@Barmar: The argument to do script needs to be in double quotes.
Yes; however, the way you’ve done it is still unsafe.
If the path itself contains backslashes or double quotes, AS will throw a syntax error as the munged AS code string fails to compile. (One might even construct a malicious file path to execute arbitrary AS.) While these are not characters that frequently appear in file paths, best safe than sorry. Quoting string literals correctly is always a nightmare; correctly quoting them all the way through shell and AppleScript quadratically so.
Fortunately, there is an easy way to do it:
currentDirectory="$(pwd)"
osascript - "${currentDirectory}" <<EOF
on run {currentDirectory}
tell application "Terminal"
do script "cd " & (quoted form of currentDirectory) & " && npm run start"
end tell
end run
EOF
Pass the currentDirectory path as an additional argument to osascript (the - separates any options flags from extra args) and osascript will pass the extra argument strings as parameters to the AppleScript’s run handler. To single-quote that AppleScript string to pass back to shell, simply get its quoted form property.
Bonus: scripts written this way are cleaner and easier to read too, so less chance of overlooking any quoting bugs you have in your shell code.
cd $(pwd) &&from your code.$(pwd)is the current directory, it's changing to where it already is.cd Documents && osascript -e 'tell application "Terminal" to do script "ls"'and you will see thelsoutput from the~directory$(pwd)is being expanded in the context of the oroginal shell script, it's needed to get the AppleScript into the same directory.