The closing-quote detection only checked the immediately preceding
character for a backslash, which mis-parsed sequences like "\\\\"
where even backslashes escape each other. Count consecutive
backslashes (odd = escaped, even = real closing quote) instead.
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
shell-quote doesn't support $'...' (ANSI-C quoting), which is a bash
extension used by browsers when copying requests as cURL. It misinterprets
the $ as variable expansion, mangling JSON bodies and escape sequences
like \n, \uXXXX, \r, etc.
Switches to shlex which handles $'...' natively. Adds splitCommands()
to handle command separation (;, newlines) that shell-quote used to do,
and a tokenize() wrapper with fallback for malformed input.
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
