Native Git completion inserts filenames containing spaces as multiple arguments

Finding

Severity: medium. Confidence: 10/10.
Reviewed snapshot: 5c38677469756c69f86678c0b907d82e15d0a539.

A native completer's CompletionText is inserted into the command line literally; PowerShell does not automatically re-quote the returned value.

Tab-completing a common filename such as 'two words.txt' into git add produces two file operands. The command then fails or can operate on other matching files rather than the intended literal path. Other file/ref completions use the same insertion path.

Source

• modules/Shmuelie.Git/GitTabCompletion.ps1 lines 161-177
• modules/Shmuelie.Git/GitTabCompletion.ps1 lines 453-455

Get-GitStatusPorcelainPath strips surrounding quotes and the final CompletionResult uses the raw value as CompletionText without PowerShell literal quoting.

Safe reproduction

1. Create an isolated repository and an untracked file named 'two words.txt'.
2. Import the source module and invoke CommandCompletion.CompleteInput for 'git add two'.
3. Inspect CompletionText and parse the accepted line using PowerShell's parser; do not execute it.

Observed:

{
  "completionText": "two words.txt",
  "acceptedLine": "git add two words.txt",
  "parsedCommandElements": [
    "git",
    "add",
    "two",
    "words.txt"
  ]
}

Expected: The inserted completion represents exactly one literal filename argument, for example 'two words.txt' quoted for PowerShell.

The reviewer and parent independently replayed the controlled reproduction.
Only owned fixtures, isolated event subscribers or parser-only suggestions were
used; no user repository was updated or real command suggestion executed.

Acceptance criteria

• Quote/escape inserted literal filenames and ref values using PowerShell argument syntax.
• Round-trip actual CommandCompletion results for spaces, apostrophes, dollar signs, and other legal shell-sensitive filename/ref characters as one unchanged argument.
• Preserve normal parameter/option completions and human-readable ListItemText.
• Keep completion read-only and avoid evaluating values during completion or validation.

Start with modules/Shmuelie.Git/GitTabCompletion.ps1, especially lines 161-177 and 453-455, and reproduce the issue with CommandCompletion.CompleteInput for a filename containing spaces. Trace how Get-GitStatusPorcelainPath and CompletionResult produce CompletionText. Done means literal filenames and refs with spaces, apostrophes, dollar signs, and other shell-sensitive characters parse as one unchanged argument while options remain readable and completion stays read-only.