From af668b459bcaeb7fafae113a6f18e7df05e8ed4b Mon Sep 17 00:00:00 2001
From: Bryan Helmkamp <bryan@brynary.com>
Date: Mon, 9 Mar 2026 10:01:18 -0400
Subject: [PATCH] Shell-quote vm_name in exe.dev cleanup command

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
---
 crates/arc-exe/src/lib.rs | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/crates/arc-exe/src/lib.rs b/crates/arc-exe/src/lib.rs
index 28df58118..18451bd83 100644
--- a/crates/arc-exe/src/lib.rs
+++ b/crates/arc-exe/src/lib.rs
@@ -388,7 +388,7 @@ impl Sandbox for ExeSandbox {
         let start = Instant::now();
 
         if let Some(vm_name) = self.vm_name.get() {
-            let cmd = format!("rm {vm_name}");
+            let cmd = format!("rm {}", shell_quote(vm_name));
             if let Err(e) = self.mgmt_ssh.run_command(&cmd).await {
                 let err = format!("Failed to destroy exe.dev VM: {e}");
                 self.emit(SandboxEvent::CleanupFailed {