fix(copy-as): emit shell-safe arguments in the curl and gRPCurl exporters (#593)

plugins/action-copy-grpcurl/src/index.ts

@@ -129,7 +129,10 @@ export async function convert(request: Partial<GrpcRequest>, allProtoFiles: stri
 }
 
 function quote(arg: string): string {
-  const escaped = arg.replace(/'/g, "\\'");
+  // A single-quoted POSIX string takes no escapes, so `\'` does not close it:
+  // the string ends one character early and the rest of the command is left
+  // dangling. Step out of the quotes, emit an escaped quote, step back in.
+  const escaped = arg.replace(/'/g, `'\\''`);
   return `'${escaped}'`;
 }
 

plugins/action-copy-grpcurl/tests/index.test.ts

@@ -175,4 +175,21 @@ describe("exporter-curl", () => {
       ].join(" \\\n  "),
     );
   });
+
+  test("Quotes an apostrophe so the command still parses", async () => {
+    // POSIX single quotes take no escapes: `\'` ends the string one
+    // character early and leaves the rest of the command dangling.
+    const command = await convert(
+      {
+        url: "https://yaak.app",
+        service: "Service",
+        method: "Method",
+        message: `{"note":"don't stop"}`,
+        metadata: [{ name: "x-note", value: "it's fine" }],
+      },
+      [],
+    );
+    expect(command).toContain(`'{"note":"don'\\''t stop"}'`);
+    expect(command).toContain(`'x-note: it'\\''s fine'`);
+  });
 });