fix(core): read a backslash inside single quotes as literal when splitting

packages/core/src/permissions/permission-manager.test.ts

@@ -591,6 +591,60 @@ describe('splitCompoundCommand', () => {
     expect(splitCompoundCommand('echo a \\&& b')).toEqual(['echo a \\&', 'b']);
   });
 
+  // Rows starting with a plain `'c\'` are split only by bash's reading, so
+  // they pin the ANSI-C tracking.
+  it.each([
+    ["echo 'a\\' ; touch /tmp/x", ["echo 'a\\'", 'touch /tmp/x']],
+    ["echo 'a\\' && touch /tmp/x", ["echo 'a\\'", 'touch /tmp/x']],
+    ["echo 'a\\' | sh", ["echo 'a\\'", 'sh']],
+    ["echo 'a\\' & touch /tmp/x", ["echo 'a\\'", 'touch /tmp/x']],
+    ["echo 'a\\'\ntouch /tmp/x", ["echo 'a\\'", 'touch /tmp/x']],
+    ["echo $'a\\'' ; touch /tmp/x", ["echo $'a\\''", 'touch /tmp/x']],
+    [
+      "echo 'c\\' $'a\\'' ; touch /tmp/x",
+      ["echo 'c\\' $'a\\''", 'touch /tmp/x'],
+    ],
+    [
+      "echo 'c\\' \\\\$'a\\'' ; touch /tmp/x",
+      ["echo 'c\\' \\\\$'a\\''", 'touch /tmp/x'],
+    ],
+    [
+      "echo 'c\\' $\\\n'a\\'' ; touch /tmp/x",
+      ["echo 'c\\' $\\\n'a\\''", 'touch /tmp/x'],
+    ],
+    ["echo \\$'a\\' ; touch /tmp/x", ["echo \\$'a\\'", 'touch /tmp/x']],
+    ["echo $$'a\\' ; touch /tmp/x", ["echo $$'a\\'", 'touch /tmp/x']],
+    ['echo "$"\'a\\\' ; touch /tmp/x', ['echo "$"\'a\\\'', 'touch /tmp/x']],
+  ])('splits after the quoted word in %s', async (command, parts) => {
+    expect(splitCompoundCommand(command)).toEqual(parts);
+  });
+
+  it('keeps an escaped quote inside double quotes and a line continuation', async () => {
+    expect(splitCompoundCommand('echo "a\\" ; touch /tmp/x"')).toEqual([
+      'echo "a\\" ; touch /tmp/x"',
+    ]);
+    expect(splitCompoundCommand('echo a\\\nb')).toEqual(['echo a\\\nb']);
+  });
+
+  // The last row is one command to bash but stays split, as on main.
+  it.each([
+    [
+      "echo done # note 'a\\''\nrm -rf /tmp/x",
+      ["echo done # note 'a\\''", 'rm -rf /tmp/x'],
+    ],
+    [
+      "echo `echo 'a\\''` ; rm -rf /tmp/x",
+      ["echo `echo 'a\\''`", 'rm -rf /tmp/x'],
+    ],
+    [
+      "cat <<EOF\necho safe 'a\\''\nEOF\nrm -rf /tmp/x",
+      ['cat <<EOF', "echo safe 'a\\''", 'EOF', 'rm -rf /tmp/x'],
+    ],
+    ["echo 'a\\'' ; rm x'", ["echo 'a\\''", "rm x'"]],
+  ])('keeps the boundaries main found in %s', async (command, parts) => {
+    expect(splitCompoundCommand(command)).toEqual(parts);
+  });
+
   it('trims whitespace around sub-commands', async () => {
     expect(splitCompoundCommand('  git status  &&  rm -rf /  ')).toEqual([
       'git status',
@@ -2316,6 +2370,43 @@ describe('PermissionManager', () => {
       ).toBe('deny');
     });
 
+    it.each<[string, string[], string]>([
+      ["echo 'a\\' ; rm -rf /tmp/x", [], 'ask'],
+      ["echo 'a\\' ; rm -rf /tmp/x", ['Bash(rm *)'], 'deny'],
+      ["echo $'a\\'' ; rm -rf /tmp/x", [], 'ask'],
+      ["echo $'a\\'' ; rm -rf /tmp/x", ['Bash(rm *)'], 'deny'],
+      ["echo $\\\n'a\\'' ; rm -rf /tmp/x", ['Bash(rm *)'], 'deny'],
+      ["echo done # note 'a\\''\nrm -rf /tmp/x", ['Bash(rm *)'], 'deny'],
+      [
+        "cat <<EOF\necho safe 'a\\''\nEOF\nrm -rf /tmp/x",
+        ['Bash(rm *)'],
+        'deny',
+      ],
+      [
+        "echo done # note 'a\\''\necho {} > .qwen/settings.json",
+        ['Write(.qwen/settings.json)'],
+        'deny',
+      ],
+      ["echo 'a\\'' ; rm x'", ['Bash(rm *)'], 'deny'],
+    ])('%j with deny %j is %s', async (command, deny, expected) => {
+      pm = new PermissionManager(
+        makeConfig({
+          permissionsAllow: ['Bash(echo *)', 'Bash(cat *)'],
+          permissionsDeny: deny,
+          cwd: '/repo',
+          projectRoot: '/repo',
+        }),
+      );
+      pm.initialize();
+      expect(
+        await pm.evaluate({
+          toolName: 'run_shell_command',
+          command,
+          cwd: '/repo',
+        }),
+      ).toBe(expected);
+    });
+
     it('|| compound: all allowed → allow', async () => {
       pm = new PermissionManager(
         makeConfig({

packages/core/src/permissions/rule-parser.ts

@@ -883,31 +883,89 @@ export interface CompoundCommandSegment {
  *
  * See {@link splitCompoundCommand} for the string-only form and for examples;
  * this is the same split, and that function is a projection of this one.
+ *
+ * Scanned twice and split wherever either scan finds an operator: comments,
+ * backtick bodies and heredocs are not modelled, and quotes inside them can
+ * fool bash's backslash reading where the pre-fix reading still splits.
  */
 export function splitCompoundCommandSegments(
   command: string,
 ): CompoundCommandSegment[] {
+  const boundaries = [
+    ...findOperatorBoundaries(command, 'bash'),
+    ...findOperatorBoundaries(command, 'escape-everywhere'),
+  ].sort((a, b) => a.start - b.start);
+
   const segments: CompoundCommandSegment[] = [];
+  let lastSplit = 0;
+  for (const { start, end, operator } of boundaries) {
+    if (start < lastSplit) {
+      continue;
+    }
+    const segment = command.substring(lastSplit, start).trim();
+    if (segment) {
+      segments.push({ command: segment, terminator: operator });
+    }
+    lastSplit = end;
+  }
+
+  // Add the last segment
+  const lastSegment = command.substring(lastSplit).trim();
+  if (lastSegment) {
+    segments.push({ command: lastSegment, terminator: '' });
+  }
+
+  return segments;
+}
+
+interface OperatorBoundary {
+  start: number;
+  end: number;
+  operator: string;
+}
+
+type BackslashReading = 'bash' | 'escape-everywhere';
+
+function findOperatorBoundaries(
+  command: string,
+  reading: BackslashReading,
+): OperatorBoundary[] {
+  const boundaries: OperatorBoundary[] = [];
   let inSingle = false;
   let inDouble = false;
+  let inAnsiC = false;
+  let dollarPending = false;
   let escaped = false;
-  let lastSplit = 0;
   // Nesting depth of `$(( … ))` / `(( … ))`. Inside arithmetic a bare `&` is
   // bitwise AND, not the async operator, so `$(( FLAGS & MASK ))` is one word.
   let arithmeticDepth = 0;
 
   for (let i = 0; i < command.length; i++) {
     const ch = command[i]!;
+    const ansiCIntroducer: boolean = dollarPending;
+    dollarPending = false;
 
     if (escaped) {
       escaped = false;
       continue;
     }
-    if (ch === '\\') {
+    // In bash a backslash is literal inside a plain `'…'` (so `'a\'` closes)
+    // but escapes inside ANSI-C `$'…'` (so `$'a\''` closes at the third quote).
+    if (
+      ch === '\\' &&
+      (reading === 'escape-everywhere' || !(inSingle && !inAnsiC))
+    ) {
+      // `$\⏎'…'` is still ANSI-C, so the pending `$` survives a continuation.
+      if (command[i + 1] === '\n') {
+        dollarPending = ansiCIntroducer;
+        i++;
+        continue;
+      }
       escaped = true;
       continue;
     }
     if (ch === "'" && !inDouble) {
+      inAnsiC = inSingle ? false : ansiCIntroducer;
       inSingle = !inSingle;
       continue;
     }
@@ -918,6 +976,11 @@ export function splitCompoundCommandSegments(
     if (inSingle || inDouble) {
       continue;
     }
+    if (ch === '$') {
+      // The second `$` of `$$` (the PID) cannot open `$'…'`.
+      dollarPending = !ansiCIntroducer;
+      continue;
+    }
 
     if (ch === '(' && command[i + 1] === '(') {
       arithmeticDepth++;
@@ -941,23 +1004,13 @@ export function splitCompoundCommandSegments(
       if (op === '&' && (arithmeticDepth > 0 || !isAsyncOperator(command, i))) {
         continue;
       }
-      const segment = command.substring(lastSplit, i).trim();
-      if (segment) {
-        segments.push({ command: segment, terminator: op });
-      }
-      lastSplit = i + op.length;
-      i = lastSplit - 1; // -1 because the loop will i++
+      boundaries.push({ start: i, end: i + op.length, operator: op });
+      i += op.length - 1; // -1 because the loop will i++
       break;
     }
   }
 
-  // Add the last segment
-  const lastSegment = command.substring(lastSplit).trim();
-  if (lastSegment) {
-    segments.push({ command: lastSegment, terminator: '' });
-  }
-
-  return segments;
+  return boundaries;
 }
 
 /**