diff --git a/TODO.md b/TODO.md
index 22e2d13..a027714 100644
--- a/TODO.md
+++ b/TODO.md
@@ -22,7 +22,7 @@
 - [ ] Update owned MCPorter itself on `--update`. `ensure_cli()` returns whenever its ledger record exists, so a selected MCPorter package never receives the requested update. (`scripts/lib/managed-extensions.py:342`)
 - [ ] Keep terminal newlines in Bash-managed files that need substitution. Command substitution strips trailing newlines before Bash hashes and writes the content, while PowerShell retains them; switching installers causes needless file changes and backups. (`scripts/lib/manifest.sh:70`, `scripts/lib/manifest.ps1:75`)
 - [ ] Parse the Bash plugin inventory as JSON and stop when listing fails. `plugin_installed()` searches for one exact spacing pattern and suppresses CLI errors; a minified response or listing failure marks installed plugins unchecked, allowing an update to remove owned plugins. PowerShell parses JSON and fails on a CLI error. (`scripts/lib/plugins.sh:4`, `scripts/lib/plugins.ps1:36`)
-- [ ] Serialize Bash manifest entries without shell word splitting. `write_managed_manifest()` loops over command substitution; a managed filename containing spaces becomes multiple invalid entries and can no longer be reconciled correctly. (`scripts/lib/manifest.sh:47`)
+- [x] Serialize Bash manifest entries without shell word splitting. `write_managed_manifest()` loops over command substitution; a managed filename containing spaces becomes multiple invalid entries and can no longer be reconciled correctly. (`scripts/lib/manifest.sh:47`)
 - [ ] Allow uninstall to reconcile owned extensions when file manifests are missing. Both uninstall commands stop with “Not installed” based only on destination manifests, even if `extensions.json` still owns plugins, skills, or MCP servers. (`scripts/commands/uninstall.ps1:21`, `scripts/commands/uninstall.sh:34`)
 
 ## Rules, checks, and documentation
diff --git a/scripts/lib/manifest.sh b/scripts/lib/manifest.sh
index c62e525..2448391 100755
--- a/scripts/lib/manifest.sh
+++ b/scripts/lib/manifest.sh
@@ -44,9 +44,10 @@ write_managed_manifest() {
   mkdir -p "$(dirname -- "$path")"
   {
     printf 'path\tsha256\n'
-    for rel in $(printf '%s\n' "${!in_ref[@]}" | sort); do
+    while IFS= read -r rel; do
+      [ -n "$rel" ] || continue
       printf '%s\t%s\n' "$rel" "${in_ref[$rel]}"
-    done
+    done < <(printf '%s\n' "${!in_ref[@]}" | sort)
   } > "$path"
 }