[Bug] SessionStart hooks: unquoted env vars break Bash on world paths with spaces

[MarkvandenBroek]

Description

The SessionStart hooks write env vars to $CLAUDE_ENV_FILE without quoting their
values. When the world path contains a space (common on macOS iCloud/Obsidian:
~/Library/Mobile Documents/iCloud~md~obsidian/...), this breaks every Bash tool call.

Affected lines:

• hooks/scripts/alive-session-new.sh (~lines 132-135): ALIVE_SESSION_ID, ALIVE_WORLD_ROOT, ALIVE_PLUGIN_ROOT
• hooks/scripts/alive-session-resume.sh (~line 31): ALIVE_WORLD_ROOT

Example:
echo "ALIVE_WORLD_ROOT=$WORLD_ROOT" >> "$CLAUDE_ENV_FILE"

Claude Code splices these lines into each tool command as shell. zsh parses
ALIVE_WORLD_ROOT=/Users/.../Library/Mobile as an env-assignment prefix and then
tries to execute Documents/iCloud~md~obsidian/Documents/AliveWorld as a command,
producing on EVERY Bash call:

  zsh:2: no such file or directory: Documents/iCloud~md~obsidian/Documents/AliveWorld

Cosmetic (the actual command still runs), but it prepends noise to every command's
output, which is very disruptive in an interactive session.

Expected Behaviour

No spurious error. The env var should be set to the full path and commands should
run with clean output, regardless of spaces in the world path.

Fix: quote the values, e.g.
echo "ALIVE_WORLD_ROOT="$WORLD_ROOT"" >> "$CLAUDE_ENV_FILE"
(same for ALIVE_SESSION_ID and ALIVE_PLUGIN_ROOT).

System

• Plugin: 3.2.0
• Engine: claude-opus-4-8
• OS: Darwin
• Context: ~82%

---

Sent via /alive:feedback

[simonlpaige]

The quoting issue with $CLAUDE_ENV_FILE is a classic shell injection vector—unquoted expansions in echo statements. The fix you proposed is correct for the immediate bug, but I'd suggest wrapping the values in single quotes rather than double quotes to prevent any unintended variable expansion or special character interpretation in the path values:

echo "ALIVE_WORLD_ROOT='$WORLD_ROOT'" >> "$CLAUDE_ENV_FILE"

However, there's a secondary issue: if the path itself contains a single quote (unlikely but possible on macOS with certain iCloud paths), this will also break. The safest approach would be to use printf with %q:

printf "ALIVE_WORLD_ROOT=%q\n" "$WORLD_ROOT" >> "$CLAUDE_ENV_FILE"

This handles spaces, quotes, and any other special characters properly.

For alive-session-new.sh lines 132-135, the same pattern applies to ALIVE_SESSION_ID and ALIVE_PLUGIN_ROOT. While session IDs are unlikely to contain spaces, using printf %q consistently across all three variables would be cleaner and prevent future edge cases.

I'd also recommend checking alive-session-resume.sh line 50-55 area—there may be other echo statements writing to $CLAUDE_ENV_FILE that were missed in the initial report.