… by the action

The foo2 action needs to print its parameters (minus the first which is the action name, instead of hard-coding "foo" if no parameters are passed (which also is broken because the $# is already expanded in the here-doc)), and the test needs to include "foo" (instead of "bar") to match the (reused) expected output.

…tion

Spaces, quotes, $, and other special shell characters need to be escaped inside the TODOTXT_DEFAULT_ACTION, and consequently eval() used to parse that back into individual arguments.

Only $TODO_ACTIONS_DIR/$action, not even the $TODO_ACTIONS_DIR/$action/$action variant.
A totally different approach is needed: Instead of parsing off the first argument and treating that as the custom action, do a recursive invocation with the default action parsed as a command-line. A new isDefaultAction flag is needed so that we only do this when the default action actually applies (otherwise, strange invocations like todo.sh "add +project here" would also be possible). The condition for non-empty $TODOTXT_DEFAULT_ACTION avoids an endless loop.