From 2eee66a6c177dcff302f50772fa5a9000dbd6fb5 Mon Sep 17 00:00:00 2001
From: L4XB <lukas.buck@e-mail.de>
Date: Fri, 23 Oct 2026 01:45:20 +0200
Subject: [PATCH] fix(hooks): split shell segments at newlines, keeping
 here-document bodies whole

splitShellSegments() split at &&, ||, ; and & but not at a newline, so a multi-line command such as "cd app\nnpm run dev" was one segment led by cd, and the dev-server block let the dev server through. A newline now ends a segment. The body of a here-document (<<EOF, <<-EOF, <<'EOF') stays in the segment of the command that reads it, so a README written with cat <<EOF that mentions npm run dev is not blocked; a here-string (<<<) or a shift such as $((x << 2)) is not read as one.
---
 scripts/lib/shell-split.js                    | 54 +++++++++++++++++--
 tests/hooks/pre-bash-dev-server-block.test.js | 14 +++++
 tests/lib/shell-split.test.js                 | 26 +++++++++
 3 files changed, 91 insertions(+), 3 deletions(-)

diff --git a/scripts/lib/shell-split.js b/scripts/lib/shell-split.js
index 0d0962376..7be4deeab 100644
--- a/scripts/lib/shell-split.js
+++ b/scripts/lib/shell-split.js
@@ -1,14 +1,43 @@
 'use strict';
 
+// `<<WORD`, `<<-WORD`, `<<'WORD'` or `<<"WORD"`. A delimiter starts with a letter or an
+// underscore, so a shift such as `$((x << 2))` is not read as a here-document.
+const HEREDOC_RE = /^<<(-?)[ \t]*(?:'([^'\n]*)'|"([^"\n]*)"|\\?([A-Za-z_][\w.-]*))/;
+
+// A here-document opener at `index`, but not a here-string (<<<).
+function heredocAt(command, index) {
+  if (command[index - 1] === '<' || command[index + 2] === '<') return null;
+  const match = HEREDOC_RE.exec(command.slice(index));
+  return match && { text: match[0], delimiter: match[2] ?? match[3] ?? match[4], stripTabs: match[1] === '-' };
+}
+
+// The end of the here-document bodies that start at `start`, one after the other.
+function endOfHeredocBodies(command, start, heredocs) {
+  let end = start;
+  for (const { delimiter, stripTabs } of heredocs) {
+    while (end < command.length) {
+      const newline = command.indexOf('\n', end);
+      const lineEnd = newline === -1 ? command.length : newline;
+      const line = command.slice(end, lineEnd);
+      end = lineEnd + 1;
+      if ((stripTabs ? line.replace(/^\t+/, '') : line) === delimiter) break;
+    }
+  }
+  return Math.min(end, command.length);
+}
+
 /**
- * Split a shell command into segments by operators (&&, ||, ;, &)
- * while respecting quoting (single/double) and escaped characters.
- * Redirection operators (&>, >&, 2>&1) are NOT treated as separators.
+ * Split a shell command into segments by operators (&&, ||, ;, &) and by
+ * newlines, while respecting quoting (single/double) and escaped characters.
+ * Redirection operators (&>, >&, 2>&1) are NOT treated as separators, and the
+ * body of a here-document stays in the segment of the command that reads it.
  */
 function splitShellSegments(command) {
   const segments = [];
   let current = '';
   let quote = null;
+  // Here-documents opened on the current line, read after its newline.
+  let heredocs = [];
 
   for (let i = 0; i < command.length; i++) {
     const ch = command[i];
@@ -42,6 +71,25 @@ function splitShellSegments(command) {
     const next = command[i + 1] || '';
     const prev = i > 0 ? command[i - 1] : '';
 
+    const heredoc = ch === '<' && next === '<' ? heredocAt(command, i) : null;
+    if (heredoc) {
+      heredocs.push(heredoc);
+      current += heredoc.text;
+      i += heredoc.text.length - 1;
+      continue;
+    }
+
+    // A newline ends a command, after the bodies of the here-documents opened on its line
+    if (ch === '\n') {
+      const end = endOfHeredocBodies(command, i + 1, heredocs);
+      current += command.slice(i, end);
+      i = end - 1;
+      heredocs = [];
+      if (current.trim()) segments.push(current.trim());
+      current = '';
+      continue;
+    }
+
     // && operator
     if (ch === '&' && next === '&') {
       if (current.trim()) segments.push(current.trim());
diff --git a/tests/hooks/pre-bash-dev-server-block.test.js b/tests/hooks/pre-bash-dev-server-block.test.js
index 89524b1e0..35414ad19 100644
--- a/tests/hooks/pre-bash-dev-server-block.test.js
+++ b/tests/hooks/pre-bash-dev-server-block.test.js
@@ -215,6 +215,20 @@ function runTests() {
     }) ? passed++ : failed++);
   }
 
+  // --- Newlines ---
+
+  if (!isWindows) {
+    (test('blocks a dev server started on a later line of a multi-line command', () => {
+      const result = runScript('cd app\nnpm run dev');
+      assert.strictEqual(result.code, 2, `Expected exit code 2, got ${result.code}`);
+    }) ? passed++ : failed++);
+  }
+
+  (test('allows a here-document that only mentions a dev server', () => {
+    const result = runScript('cat <<EOF > README.md\nStart it with:\nnpm run dev\nEOF');
+    assert.strictEqual(result.code, 0, `Expected exit code 0, got ${result.code}`);
+  }) ? passed++ : failed++);
+
   // --- Edge cases ---
 
   (test('empty/invalid input passes through (exit code 0)', () => {
diff --git a/tests/lib/shell-split.test.js b/tests/lib/shell-split.test.js
index 1ec1cdb2b..964ef54e8 100644
--- a/tests/lib/shell-split.test.js
+++ b/tests/lib/shell-split.test.js
@@ -110,5 +110,31 @@ test('single command no operators', () => {
   assert.deepStrictEqual(splitShellSegments('npm run dev'), ['npm run dev']);
 });
 
+// Newlines and here-documents
+console.log('\nNewlines and here-documents:');
+test('a newline splits into two segments', () => {
+  assert.deepStrictEqual(splitShellSegments('cd app\nnpm run dev'), ['cd app', 'npm run dev']);
+  assert.deepStrictEqual(splitShellSegments('a && b\n\nc'), ['a', 'b', 'c']);
+});
+test('an escaped or quoted newline does not split', () => {
+  assert.deepStrictEqual(splitShellSegments('npm run \\\ndev'), ['npm run \\\ndev']);
+  assert.deepStrictEqual(splitShellSegments('echo "a\nb"'), ['echo "a\nb"']);
+});
+test('a here-document body stays with its command', () => {
+  assert.deepStrictEqual(
+    splitShellSegments('cat <<EOF > notes.md\na && b\nnpm run dev\nEOF\nls'),
+    ['cat <<EOF > notes.md\na && b\nnpm run dev\nEOF', 'ls']
+  );
+  assert.deepStrictEqual(
+    splitShellSegments("cat <<-'END'\n\tnpm run dev\n\tEND\nls"),
+    ["cat <<-'END'\n\tnpm run dev\n\tEND", 'ls']
+  );
+  assert.deepStrictEqual(splitShellSegments('cat <<A <<B\na\nA\nb\nB\nnext'), ['cat <<A <<B\na\nA\nb\nB', 'next']);
+});
+test('a here-string or a shift is not a here-document', () => {
+  assert.deepStrictEqual(splitShellSegments('cat <<< x && y'), ['cat <<< x', 'y']);
+  assert.deepStrictEqual(splitShellSegments('echo $((x << 2))\nnext'), ['echo $((x << 2))', 'next']);
+});
+
 console.log(`\n=== Results: ${passed} passed, ${failed} failed ===`);
 if (failed > 0) process.exit(1);