Bash expands a here-document body unless part of its delimiter is quoted, and runs the $(...) and backquoted substitutions in it, with quotes as plain text. Leaving the whole body out of the segments hid those commands, so npm --version <<EOF with '$(npm run dev)' in the body was allowed. The commands of these substitutions are now segments of their own. An escaped substitution, or a body whose delimiter is quoted (<<'EOF', <<\EOF), stays data.
A body attached to the segment of its command was still searched by the dev-server check. For npm --version <<EOF && cat, the body line npm run dev made the npm segment look like a dev server. A body is data, so it is no longer part of any segment. An empty delimiter (<<'') is a valid opener again, and its body ends at the first empty line.
The opener pattern read only an identifier, so <<EOF/END stored EOF, <<E"OF" stored E and <<123 was no opener at all. In each case the body was split into segments, or the line after it was swallowed. The delimiter is now read as a shell word with its quotes and backslashes removed, as Bash does. A body that follows an operator at the end of its line (cat <<EOF &&) was split off as a segment of its own. It now goes with the command that opened it.
splitShellSegments() split at &&, ||, ; and & but not at a newline, so a multi-line command such as "cd app\nnpm run dev" was one segment led by cd, and the dev-server block let the dev server through. A newline now ends a segment. The body of a here-document (<<EOF, <<-EOF, <<'EOF') stays in the segment of the command that reads it, so a README written with cat <<EOF that mentions npm run dev is not blocked; a here-string (<<<) or a shift such as $((x << 2)) is not read as one.
`DEV_PATTERN`'s trailing `\b` treats a hyphen as a word boundary, so
`dev\b` matched the `dev` prefix of distinct npm scripts like
`dev-setup` / `dev-docs` / `dev-build` and blocked them with exit 2.
Replace the trailing `\b` with `(?![\w-])` so the dev server still
matches (`dev`, `dev;`, `dev:ssr`) but `dev-<suffix>` scripts pass.
Adds regression tests for dev-setup/dev-docs/dev-build (allowed) and
dev:ssr (still blocked).
Co-authored-by: bymle <229636660+bymle@users.noreply.github.com>
L4XB