From 36e406d3c0f9f5990942695b99c5ecd8ec07eb93 Mon Sep 17 00:00:00 2001 From: daewoongoh Date: Tue, 4 Aug 2026 14:01:35 +0900 Subject: [PATCH 1/2] fix: stop heredoc delimiter from absorbing trailing control operators A heredoc delimiter is a single shell word, so a control operator (;, |, &&) on the opener line terminates the word and must not be absorbed into the delimiter. Previously the parser kept scanning past these operators, so the terminator line was never found and a valid command was incorrectly rejected as an unterminated heredoc. Add isHeredocDelimiterTerminator() to stop the delimiter at POSIX control operators, matching shell tokenization, and apply it to both the backslash-escaped and unquoted delimiter branches. Add regression tests covering ;, |, and && on the opener line. Signed-off-by: daewoongoh --- src/shared/__tests__/parse-command.spec.ts | 19 +++++++++++++++++ src/shared/parse-command.ts | 24 ++++++++++++++++++++-- 2 files changed, 41 insertions(+), 2 deletions(-) diff --git a/src/shared/__tests__/parse-command.spec.ts b/src/shared/__tests__/parse-command.spec.ts index fa41d31c6c..fd95d0db16 100644 --- a/src/shared/__tests__/parse-command.spec.ts +++ b/src/shared/__tests__/parse-command.spec.ts @@ -290,6 +290,25 @@ describe("parseCommand", () => { expect(result[1]).toBe("echo done") }) + it("does not absorb a control operator into the delimiter on the opener line", () => { + // A heredoc delimiter is a single shell word; a control operator + // (`;`, `|`, `&&`) on the same line terminates the word and must not + // be absorbed into the delimiter. Otherwise the terminator line is + // never found and the whole (valid) command is rejected as an + // unterminated heredoc. The whole heredoc is kept as one opaque token + // (matching the other heredoc cases), but must not produce a parse error. + const inputs = [ + "sh -c bash << EOF; echo done\necho hello\nEOF", + "sh -c bash << EOF | grep hi\necho hello\nEOF", + "sh -c bash << EOF && cat f\necho hello\nEOF", + ] + for (const input of inputs) { + const { commands: result, parseError } = parseCommand(input) + expect(parseError).toBeNull() + expect(result).toEqual([input]) + } + }) + it("treats a heredoc with a missing terminator as one opaque token", () => { // An unterminated heredoc is a syntax error; the whole input must be // returned as a single token so no body line can be auto-approved alone. diff --git a/src/shared/parse-command.ts b/src/shared/parse-command.ts index 6b2fb4d267..f7c99fc60b 100644 --- a/src/shared/parse-command.ts +++ b/src/shared/parse-command.ts @@ -142,6 +142,26 @@ interface ScanResult { * Returns the bare delimiter word (for terminator line matching) and the index * of the first character after the delimiter token. */ +// POSIX control operators that terminate a word. A heredoc delimiter is a +// single word, so it must stop at these just like the shell's tokenizer does. +// This prevents a trailing control operator (e.g. `;`, `|`, `&&`) from being +// absorbed into the delimiter (see the "match POSIX shell tokenization" rule +// in scanTopLevelQuotes). +function isHeredocDelimiterTerminator(char: string): boolean { + return ( + char === "\n" || + char === " " || + char === "\t" || + char === ";" || + char === "|" || + char === "&" || + char === ">" || + char === "<" || + char === "(" || + char === ")" + ) +} + function parseHeredocDelimiter(command: string, start: number): { delimiter: string; endIndex: number } { let i = start let delimiter = "" @@ -160,11 +180,11 @@ function parseHeredocDelimiter(command: string, start: number): { delimiter: str if (command[i] === '"') i++ // consume closing " } else if (command[i] === "\\") { i++ // skip backslash - while (i < command.length && command[i] !== "\n" && command[i] !== " " && command[i] !== "\t") { + while (i < command.length && !isHeredocDelimiterTerminator(command[i])) { delimiter += command[i++] } } else { - while (i < command.length && command[i] !== "\n" && command[i] !== " " && command[i] !== "\t") { + while (i < command.length && !isHeredocDelimiterTerminator(command[i])) { delimiter += command[i++] } } From 2ad15461b5b952ab1c8a2b01610233889ead2da4 Mon Sep 17 00:00:00 2001 From: daewoongoh Date: Tue, 4 Aug 2026 14:50:49 +0900 Subject: [PATCH 2/2] fix: treat CR as a heredoc delimiter terminator The heredoc body scanner already strips CR before comparing the terminator line, but the delimiter parser did not treat CR as a word terminator. On CRLF input the delimiter became e.g. `EOF\r`, which never matched the `EOF` terminator and caused a valid heredoc to be rejected as unterminated. Add CR to isHeredocDelimiterTerminator() so the delimiter ends at CR on CRLF line endings, and add a regression test covering a CRLF heredoc. Signed-off-by: daewoongoh --- src/shared/__tests__/parse-command.spec.ts | 14 ++++++++++++++ src/shared/parse-command.ts | 1 + 2 files changed, 15 insertions(+) diff --git a/src/shared/__tests__/parse-command.spec.ts b/src/shared/__tests__/parse-command.spec.ts index fd95d0db16..6a44ee5b6f 100644 --- a/src/shared/__tests__/parse-command.spec.ts +++ b/src/shared/__tests__/parse-command.spec.ts @@ -309,6 +309,20 @@ describe("parseCommand", () => { } }) + it("treats a CRLF heredoc as one command without an unterminated error", () => { + // With CRLF line endings the delimiter word ends at `\r` (just like + // the body scanner strips `\r` before comparing the terminator line). + // Without treating `\r` as a terminator, the delimiter would become + // `EOF\r`, never match the `EOF` terminator, and be rejected as an + // unterminated heredoc. The whole heredoc is kept as one opaque token + // (the trailing `\r\n` after the terminator is consumed, matching the + // LF case where the trailing newline is left as a separator). + const input = "sh -c bash << EOF\r\necho hello\r\nEOF\r\n" + const { commands: result, parseError } = parseCommand(input) + expect(parseError).toBeNull() + expect(result).toEqual(["sh -c bash << EOF\r\necho hello\r\nEOF"]) + }) + it("treats a heredoc with a missing terminator as one opaque token", () => { // An unterminated heredoc is a syntax error; the whole input must be // returned as a single token so no body line can be auto-approved alone. diff --git a/src/shared/parse-command.ts b/src/shared/parse-command.ts index f7c99fc60b..2ee63a8d5a 100644 --- a/src/shared/parse-command.ts +++ b/src/shared/parse-command.ts @@ -150,6 +150,7 @@ interface ScanResult { function isHeredocDelimiterTerminator(char: string): boolean { return ( char === "\n" || + char === "\r" || char === " " || char === "\t" || char === ";" ||