Use shell-quote for script argument parsing

Replace custom splitShellArgs with shell-quote's parse() for proper
shell argument tokenization in createScriptOptionsParser.

Signed-off-by: Patrik Oldsberg <poldsberg@gmail.com>

packages/cli/package.json

@@ -131,6 +131,7 @@
     "rollup-plugin-postcss": "^4.0.0",
     "rollup-pluginutils": "^2.8.2",
     "semver": "^7.5.3",
+    "shell-quote": "^1.8.1",
     "style-loader": "^3.3.1",
     "sucrase": "^3.20.2",
     "swc-loader": "^0.2.3",
@@ -177,6 +178,7 @@
     "@types/recursive-readdir": "^2.2.0",
     "@types/rollup-plugin-peer-deps-external": "^2.2.0",
     "@types/rollup-plugin-postcss": "^3.1.4",
+    "@types/shell-quote": "^1.7.5",
     "@types/svgo": "^2.6.2",
     "@types/tar": "^6.1.1",
     "@types/terser-webpack-plugin": "^5.0.4",

packages/cli/src/modules/build/lib/optionsParser.ts

@@ -14,40 +14,7 @@
  * limitations under the License.
  */
 import { parseArgs, type ParseArgsConfig } from 'node:util';
-
-// Splits a shell-like argument string, respecting single and double quotes
-function splitShellArgs(str: string): string[] {
-  const args: string[] = [];
-  let current = '';
-  let quote: string | undefined;
-
-  for (let i = 0; i < str.length; i++) {
-    const ch = str[i];
-
-    if (quote) {
-      if (ch === quote) {
-        quote = undefined;
-      } else {
-        current += ch;
-      }
-    } else if (ch === '"' || ch === "'") {
-      quote = ch;
-    } else if (/\s/.test(ch)) {
-      if (current) {
-        args.push(current);
-        current = '';
-      }
-    } else {
-      current += ch;
-    }
-  }
-
-  if (current) {
-    args.push(current);
-  }
-
-  return args;
-}
+import { parse as parseShellArgs } from 'shell-quote';
 
 export function createScriptOptionsParser(
   commandPath: string[],
@@ -61,7 +28,11 @@ export function createScriptOptionsParser(
     }
 
     const argsStr = scriptStr.slice(expectedScript.length).trim();
-    const args = argsStr ? splitShellArgs(argsStr) : [];
+    const args = argsStr
+      ? parseShellArgs(argsStr).filter(
+          (e): e is string => typeof e === 'string',
+        )
+      : [];
 
     const { values } = parseArgs({ args, strict: false, options });
     return values;

packages/cli/src/modules/lint/lib/optionsParser.ts

@@ -14,40 +14,7 @@
  * limitations under the License.
  */
 import { parseArgs, type ParseArgsConfig } from 'node:util';
-
-// Splits a shell-like argument string, respecting single and double quotes
-function splitShellArgs(str: string): string[] {
-  const args: string[] = [];
-  let current = '';
-  let quote: string | undefined;
-
-  for (let i = 0; i < str.length; i++) {
-    const ch = str[i];
-
-    if (quote) {
-      if (ch === quote) {
-        quote = undefined;
-      } else {
-        current += ch;
-      }
-    } else if (ch === '"' || ch === "'") {
-      quote = ch;
-    } else if (/\s/.test(ch)) {
-      if (current) {
-        args.push(current);
-        current = '';
-      }
-    } else {
-      current += ch;
-    }
-  }
-
-  if (current) {
-    args.push(current);
-  }
-
-  return args;
-}
+import { parse as parseShellArgs } from 'shell-quote';
 
 export function createScriptOptionsParser(
   commandPath: string[],
@@ -61,7 +28,11 @@ export function createScriptOptionsParser(
     }
 
     const argsStr = scriptStr.slice(expectedScript.length).trim();
-    const args = argsStr ? splitShellArgs(argsStr) : [];
+    const args = argsStr
+      ? parseShellArgs(argsStr).filter(
+          (e): e is string => typeof e === 'string',
+        )
+      : [];
 
     const { values } = parseArgs({ args, strict: false, options });
     return values;

yarn.lock

@@ -3341,6 +3341,7 @@ __metadata:
     "@types/recursive-readdir": "npm:^2.2.0"
     "@types/rollup-plugin-peer-deps-external": "npm:^2.2.0"
     "@types/rollup-plugin-postcss": "npm:^3.1.4"
+    "@types/shell-quote": "npm:^1.7.5"
     "@types/svgo": "npm:^2.6.2"
     "@types/tar": "npm:^6.1.1"
     "@types/terser-webpack-plugin": "npm:^5.0.4"
@@ -3411,6 +3412,7 @@ __metadata:
     rollup-plugin-postcss: "npm:^4.0.0"
     rollup-pluginutils: "npm:^2.8.2"
     semver: "npm:^7.5.3"
+    shell-quote: "npm:^1.8.1"
     style-loader: "npm:^3.3.1"
     sucrase: "npm:^3.20.2"
     swc-loader: "npm:^0.2.3"
@@ -22660,6 +22662,13 @@ __metadata:
   languageName: node
   linkType: hard
 
+"@types/shell-quote@npm:^1.7.5":
+  version: 1.7.5
+  resolution: "@types/shell-quote@npm:1.7.5"
+  checksum: 10/32b4d697c7d23dbadf40713692c47f1595f083a3b3deea76cb18e30a05d197aa9205d2b87f6d92edb60cda120b51e35d32bda96ed9b0a7e32921eed2deb4559e
+  languageName: node
+  linkType: hard
+
 "@types/sinon@npm:^17.0.3":
   version: 17.0.3
   resolution: "@types/sinon@npm:17.0.3"