[jihtsan]

Quote each --jobs and --load-average option passed through the shell by source builds, so semicolons, command substitution and backticks reach make as literal arguments. Preserve --make / config make as an existing shell command line: arguments, wrapper commands, tilde expansion and environment expansion continue to work. A make path containing spaces needs quotes inside the value, e.g. --make '"/opt/my tools/make"'.

The real configure/make stubs record argv, checking the configure --prefix with spaces as well as build/install arguments. Expected option lists are literal test cases, including default/empty/omitted values and injection strings. Separate cases preserve command-line compatibility. Removed the obsolete Python-2 lookup patch; Node 22.11.0 does not use that lookup after #429. Added the #430 unreleased CHANGES entry. Merged current upstream master (0c67226) without rewriting published commits.

Validation on macOS:

• New command compatibility tests against the merged prior implementation: 5 failed, 6 option quoting cases passed. The corrected implementation passes all 11 cases.
• Python 3.10.21: python -m pytest -m 'not integration' tests -q — 408 passed, 11 skipped, 5 deselected, 2 existing expected failures.
• Python 3.13.12: same command — 409 passed, 10 skipped, 5 deselected, 2 existing expected failures.
• flake8 --extend-ignore=E127 nodeenv.py tests setup.py and git diff --check passed.

Actual Node compilation/download integration, other Python versions and Windows runtime were not run locally. Hosted CI for the new head is not yet verified. AI assistance: OpenAI Codex inspected the Issue/review, implemented the correction, ran these checks and reviewed Standards/Spec.

Closes #430.

[ekalinin]

Thanks for the fix. Quoting --jobs and --load-average closes the injection part of #430, but quoting --make breaks setups that work today. One change is needed before merge, plus a few in the test and CHANGES.

• Please keep --make unquoted - nodeenv.py:1111

  --make and make = in the config are a command line today: the shell splits and expands them, so -m 'gmake -s', -m 'nice make', make = ~/bin/gmake or make = $HOME/bin/gmake work on master. With _quote(args.make_path) the shell looks for an executable literally named gmake -s or ~/bin/gmake, and all of these fail:

  OSError: Command "'make -s'" --jobs=2 failed with error code 127
  

  Please go back to make_cmd = args.make_path and keep the quoting of make_opts. A make path with spaces then works when the value carries its own quotes, -m '"/opt/my tools/make"' or make = "/opt/my tools/make". I checked this variant: make -s, nice make, ~/..., $VAR and the quoted path with spaces all work, and the ;, $(...) and backtick values for --jobs / --load-average reach make as plain arguments.

• Test changes - tests/test_source_build.py

  • Drop the make_name parametrization and add a case that pins the current behavior instead, e.g. make_path=str(make) + ' -s' expecting ['-s', '--jobs=2'] and ['-s', 'install'].
  • The shutil.which monkeypatch and its comment can go: since #429, build_node_from_src doesn't call shutil.which for node 22.11.0.
  • Please write expected as literal lists per case (e.g. ['--load-average=3', '--jobs=2']) rather than with the same format rule as the code, and add the default case jobs='2', load_average=None.
  • The configure stub ignores its arguments, so the env with spaces prefix is never checked. Recording its argv the same way as for make would cover --prefix.

• Please add an [unreleased] entry for #430 to CHANGES, and mention there that a --make path with spaces needs quotes inside the value.