fix(plugins): quote path env vars in service commands so spaces in project dir work

[mikeland73]

Summary

Fixes #2631.

Several builtin plugins reference an absolute project path in their process-compose service command without wrapping it in double quotes:

Plugin	command (before)
apache	apachectl start -f $HTTPD_CONFDIR/httpd.conf ..., tail -f $HTTPD_ERROR_LOG_FILE, tail -f $HTTPD_ACCESS_LOG_FILE
caddy	caddy run --config=$CADDY_CONFIG
php	php-fpm -y {{ .DevboxDir }}/php-fpm.conf --nodaemonize
redis	redis-server $REDIS_CONF --port $REDIS_PORT
valkey	valkey-server $VALKEY_CONF --port $VALKEY_PORT

Each of these variables/templates expands to the project's absolute path (for example $CADDY_CONFIG → {{ .DevboxDir }}/Caddyfile, $REDIS_CONF → {{ .DevboxDir }}/redis.conf). An unquoted reference is word-split by the shell whenever the project directory contains a space, so the service fails to start. This is the same class of bug as the init_hook fix in #2876 — now applied to the plugin service commands that run under devbox services.

Fix

Wrap each path reference in double quotes, matching the pattern the postgresql plugin already uses (pg_isready -p "${PGPORT:-5432}" and -k "$PGHOST"). Ports and other non-path values are left unquoted. After the fix, e.g.:

command: "caddy run --config=\"$CADDY_CONFIG\""
command: "php-fpm -y \"{{ .DevboxDir }}/php-fpm.conf\" --nodaemonize"

The affected plugins' version fields are bumped, consistent with how prior plugin behavior changes are versioned.

The mariadb, mysql, and nginx plugins have the same unquoted-path pattern in their service commands, but they currently have other in-flight PRs touching those exact files (#2906, #2911, #2909). They were intentionally left out of this PR to avoid conflicts and can be quoted in those PRs or a small follow-up.

How was it tested?

• Added plugins/service_command_quoting_test.go, which scans every builtin plugin's process-compose.yaml and asserts that templated paths ({{ ... }}) and known path-bearing env vars in service commands are quoted. It reuses the shell-quoting model from the existing init_hook_quoting_test.go. Verified it fails on the old (unquoted) content and passes on the fix.
• go test ./plugins/ ./internal/plugin/, go vet ./plugins/, and gofmt are clean.

cc @arent-groebner — thanks for the report.

Community Contribution License

All community contributions in this pull request are licensed to the project
maintainers under the terms of the
Apache 2 License.

By creating this pull request, I represent that I have the right to license the
contributions to the project maintainers under the Apache 2 License as stated in
the
Community Contribution License.

---

Generated by Claude Code

[Copilot]

Copilot was unable to review this pull request because the user who requested the review has reached their quota limit.