[BUG] npm doesn't quote the path used when running Git to clone a repository during package install

[IncPlusPlus]

Current Behavior:

Running npm install on a project with a dependency (or transitive dependency) on a GitHub repo (an example of which can be found here) will lead to an error caused by Git during the cloning process.

Click to see the CLI output demonstrating the error

C:\Users\Ryan Cloherty\Downloads\npm-git-spaces-issue>npm i
npm WARN ERESOLVE overriding peer dependency
npm WARN Found: register-scheme@undefined
npm WARN node_modules/register-scheme
npm WARN
npm WARN Could not resolve dependency:
npm WARN peer register-scheme@"github:devsnek/node-register-scheme" from [email protected]
npm WARN node_modules/discord-rpc
npm WARN   dev discord-rpc@"^3.1.1" from the root project
npm ERR! code 129
npm ERR! command failed
npm ERR! command git clone ssh://[email protected]/devsnek/node-register-scheme.git C:\Users\Ryan Cloherty\AppData\Local\npm-cache\_cacache\tmp\git-clone-c66c9a05 --recurse-submodules --depth=1 --config core.longpaths=true
npm ERR! fatal: Too many arguments.
npm ERR!
npm ERR! usage: git clone [<options>] [--] <repo> [<dir>]
npm ERR!
npm ERR!     -v, --verbose         be more verbose
npm ERR!     -q, --quiet           be more quiet
npm ERR!     --progress            force progress reporting
npm ERR!     -n, --no-checkout     don't create a checkout
npm ERR!     --bare                create a bare repository
npm ERR!     --mirror              create a mirror repository (implies bare)
npm ERR!     -l, --local           to clone from a local repository
npm ERR!     --no-hardlinks        don't use local hardlinks, always copy
npm ERR!     -s, --shared          setup as shared repository
npm ERR!     --recurse-submodules[=<pathspec>]
npm ERR!                           initialize submodules in the clone
npm ERR!     --recursive ...       alias of --recurse-submodules
npm ERR!     -j, --jobs <n>        number of submodules cloned in parallel
npm ERR!     --template <template-directory>
npm ERR!                           directory from which templates will be used
npm ERR!     --reference <repo>    reference repository
npm ERR!     --reference-if-able <repo>
npm ERR!                           reference repository
npm ERR!     --dissociate          use --reference only while cloning
npm ERR!     -o, --origin <name>   use <name> instead of 'origin' to track upstream
npm ERR!     -b, --branch <branch>
npm ERR!                           checkout <branch> instead of the remote's HEAD
npm ERR!     -u, --upload-pack <path>
npm ERR!                           path to git-upload-pack on the remote
npm ERR!     --depth <depth>       create a shallow clone of that depth
npm ERR!     --shallow-since <time>
npm ERR!                           create a shallow clone since a specific time
npm ERR!     --shallow-exclude <revision>
npm ERR!                           deepen history of shallow clone, excluding rev
npm ERR!     --single-branch       clone only one branch, HEAD or --branch
npm ERR!     --no-tags             don't clone any tags, and make later fetches not to follow them
npm ERR!     --shallow-submodules  any cloned submodules will be shallow
npm ERR!     --separate-git-dir <gitdir>
npm ERR!                           separate git dir from working tree
npm ERR!     -c, --config <key=value>
npm ERR!                           set config inside the new repository
npm ERR!     --server-option <server-specific>
npm ERR!                           option to transmit
npm ERR!     -4, --ipv4            use IPv4 addresses only
npm ERR!     -6, --ipv6            use IPv6 addresses only
npm ERR!     --filter <args>       object filtering
npm ERR!     --remote-submodules   any cloned submodules will use their remote-tracking branch
npm ERR!     --sparse              initialize sparse-checkout file to include only files at root

npm ERR! A complete log of this run can be found in:
npm ERR!     C:\Users\Ryan Cloherty\AppData\Local\npm-cache\_logs\2020-12-25T22_21_14_399Z-debug.log

C:\Users\Ryan Cloherty\Downloads\npm-git-spaces-issue>

Expected Behavior:

Running npm install on a project with a dependency (or transitive dependency) on a GitHub repo should successfully install the dependencies and exit without error.

Explanation:

The error from Git happens because the path that the repository will be cloned into contains spaces. In my case, because Windows configured my home directory to be C:\Users\Ryan Cloherty, Git can't clone into this folder and fails when it gets told to do so by npm.

The command that npm runs (in my case, given that I want to use the package "discord-rpc") is git clone ssh://[email protected]/devsnek/node-register-scheme.git C:\Users\Ryan Cloherty\AppData\Local\npm-cache\_cacache\tmp\git-clone-c66c9a05 --recurse-submodules --depth=1 --config core.longpaths=true. Running this same command in Git Bash yields the same "too many arguments" error. However, quoting the path like so git clone ssh://[email protected]/devsnek/node-register-scheme.git "C:\Users\Ryan Cloherty\AppData\Local\npm-cache\_cacache\tmp\git-clone-c66c9a05" --recurse-submodules --depth=1 --config core.longpaths=true will clone the repo successfully.

Steps To Reproduce:

1. Roughly replicate the environment detailed below (being off by a couple minor released for some stuff likely won't matter). The home directory having a space in it is the most important part.
2. Make a new node project that depends on a GitHub repository or depends transitively on one. I've made a ]repository that does this](https://github.com/IncPlusPlus/npm-git-spaces-issue) for demonstration purposes. You can clone it to replicate the issue faster.
3. With your current working directory in the project you just made (or cloned), run npm install.
4. The installation should fail because of a Git error.

Workaround:

To work around this issue, you can change the directory that "npm-cache" will be kept to some other path without spaces. I chose to just dump the "npm-cache" folder at the root of my C drive. You can edit the various directories that npm uses via npm config edit much like what was seen in another path-related issue. Uncomment the "cache" line and change the directory to some folder without spaces. I chose to use cache=C:\npm-cache. Save and close the config file and try running npm install again. It should work just fine.

Side note: The package I was trying to install is discord-rpc. If you don't have Visual Studio C++ related stuff installed, the install will fail. However, that particular error is unrelated to the Git error and if you've gotten to the Visual Studio-related error, you've passed the point at which the Git error should have occurred.

Environment:

• OS: Windows 10 Pro version 20H2 (build 19042.685)
• Node: 15.4.0
• npm: 7.3.0
• Git: 2.29.2.windows.3
• A home folder (%USERPROFILE%) with one or more spaces in it