A << in a comment (echo ok # <<EOF) or an identifier shift ($((x << n))) was read as a here-document opener, so the following lines, npm run dev included, were swallowed into its body. A comment now runs to the end of its line and an arithmetic expression is copied whole, so neither opens a here-document nor splits at an operator. A delimiter line ending in \r (CRLF) now ends the body too.
splitShellSegments() split at &&, ||, ; and & but not at a newline, so a multi-line command such as "cd app\nnpm run dev" was one segment led by cd, and the dev-server block let the dev server through. A newline now ends a segment. The body of a here-document (<<EOF, <<-EOF, <<'EOF') stays in the segment of the command that reads it, so a README written with cat <<EOF that mentions npm run dev is not blocked; a here-string (<<<) or a shift such as $((x << 2)) is not read as one.