cpath: use safer quoting