shlexing happens _after_ substitution causing space paths to be multiple arguments

[asottile]

[tox]
skipsdist = true

[testenv]
commands =
    python -c 'import sys; print(sys.argv[1:])' -- {toxinidir}

In /private/tmp/t t:

$ tox -e py37 -qq
['--', '/private/tmp/t', 't']

Expected:

$ tox -e py37 -qq
['--', '/private/tmp/t t']

If I quote {toxinidir} it works though:

[tox]
skipsdist = true

[testenv]
commands =
    python -c 'import sys; print(sys.argv[1:])' -- '{toxinidir}'

$ tox -e py37 -qq
['--', '/private/tmp/t t']

Intuitively, I think {toxinidir} should probably be considered a specific argument, though if people are already depending on this behaviour it would potentially break their configuration.

Related, if we treat it as an indivisible argument, there would have to probably be some special handling for things like {toxinidir}/.coveragerc 🤔

[asottile]

CC @eirnym (originally reported https://github.com/tox-dev/tox/issues/121#issuecomment-407531282)

[jayvdb]

Confirmed it is still a problem, and is the same underlying problem as #763 . i.e. using {envpython} with a path containing space fails in the same way. While using # in path does fail in more confusing ways, the manual quoting workaround used in this issue, like putting '{toxinidir}' in the .ini file, also fixes the problem with #.

[jayvdb]

There is one difference to #763 that makes spaces 'harder', the word splitter in config/__init__.py:CommandParser.words adds another level of whitespace handling in addition to the shlex'ing.

[masenf]

Requiring users to quote substitutions is essentially how shell scripting has handled this problem: https://www.shellcheck.net/wiki/SC2086

Not saying shell scripting is the epitome of style and safety, but keeping the substitution expansion separate from any sort quoting or splitting makes the configuration language more flexible and composable (albeit adding some footguns to watch for)