fix(commands): add heredoc and locale-quote support to command parser; fix pattern extractor

- parseCommand: mask heredocs (<<, <<-, all delimiter quoting styles) as single
  atomic tokens before newline splitting; unterminated heredocs returned as opaque token
- parseCommand: add locale-quote ($"...") support alongside existing ANSI-C ($'...')
- findUnterminatedQuote: extend QuoteType with "locale" and "heredoc" variants
- extractPatternsFromCommand (webview): pre-split via parseCommand before shell-quote
  tokenization, preventing spurious EOF/body-line/operator tokens in allow/deny selector
- Update changeset to cover all three fix areas

Author: awschmeder

.changeset/fix-multiline-quoted-command-parsing.md

@@ -2,6 +2,16 @@
 "zoo-code": patch
 ---
 
-Fix command auto-approval for a single command that wraps a multi-line script in a quoted argument (e.g. `sh -c '...'`). The parser previously split on every newline before handling quotes, so newlines inside a quoted argument were treated as separate commands, which defeated allowlist auto-approval and produced a noisy command-pattern breakdown. Single-quoted and ANSI-C (`$'...'`) strings are now masked correctly so embedded newlines and operators stay within their command. Genuine unquoted newlines still split into separate sub-commands, each of which must be allowlisted for auto-approval. Quote masking is comment-aware: a quote character inside a `#` comment is not paired with a quote on a later line, so a comment cannot hide a real newline separator and merge two distinct commands. Commands with an unterminated quote (a shell syntax error, common in LLM-generated commands with nested quotes) are detected with a quote-aware scanner and returned as a single opaque token, so a line intended to live inside the unclosed quote cannot surface as an independently auto-approvable command.
+Fix command auto-approval for multi-line shell constructs that must be treated as a single command.
+
+**Quoted multi-line arguments** (`sh -c '...'`, `sh -c $'...'`, `sh -c "..."`): the parser previously split on every newline before handling quotes, so newlines inside a quoted argument were treated as separate commands, defeating allowlist auto-approval. Single-quoted, ANSI-C (`$'...'`), and double-quoted strings are now masked before the newline split so embedded newlines and operators stay within their command.
+
+**Heredocs** (`<< EOF`, `<< 'EOF'`, `<< "EOF"`, `<<- EOF`): the entire heredoc -- opener line, body, and terminator -- is now treated as a single quoted region. Body lines are not split into independent sub-commands. All heredoc delimiter quoting styles (unquoted, single-quoted, double-quoted, backslash-escaped) are supported. An unterminated heredoc (missing terminator) is treated as malformed and returned as a single opaque token.
+
+**Locale quoting** (`$"..."`): treated as a distinct token analogous to ANSI-C quoting, preserving the `$` prefix and preventing the double-quote handler from stripping it.
+
+Quote masking is comment-aware: a quote character inside a `#` comment is not paired with a quote on a later line, so a comment cannot hide a real newline separator and merge two distinct commands. Commands with an unterminated quote are detected with a quote-aware scanner and returned as a single opaque token, preventing a line inside the unclosed quote from surfacing as an independently auto-approvable command. Genuine unquoted newlines still split into separate sub-commands, each of which must be allowlisted for auto-approval.
+
+**Pattern selector (UI)**: the command pattern breakdown shown after execution now uses the same heredoc- and quote-aware parser (`parseCommand`) before extracting patterns, so an unterminated or terminated heredoc no longer produces spurious tokens like `EOF`, body-line words, or `<<` fragments in the allow/deny selector.
 
 Note: this change only prevents *auto-approval* of fragments from a malformed command; it does not reject malformed commands before execution, which will be addressed in a separate PR to keep the scope focused here.

src/shared/__tests__/parse-command.spec.ts

@@ -235,6 +235,123 @@ describe("parseCommand", () => {
 		})
 	})
 
+	describe("heredoc quoting", () => {
+		// The entire heredoc -- opener line, body, and terminator -- must be
+		// treated as a single opaque token so body lines are never split into
+		// independent sub-commands for auto-approval evaluation.
+
+		it("treats an unquoted-delimiter heredoc as one command", () => {
+			const input = "sh -c bash << EOF\necho hello\nEOF"
+			expect(parseCommand(input)).toEqual([input])
+		})
+
+		it("treats a single-quoted-delimiter heredoc as one command", () => {
+			const input = "sh -c bash << 'EOF'\necho hello\nEOF"
+			expect(parseCommand(input)).toEqual([input])
+		})
+
+		it("treats a double-quoted-delimiter heredoc as one command", () => {
+			const input = 'sh -c bash << "EOF"\necho hello\nEOF'
+			expect(parseCommand(input)).toEqual([input])
+		})
+
+		it("treats a backslash-escaped-delimiter heredoc as one command", () => {
+			const input = "sh -c bash << \\EOF\necho hello\nEOF"
+			expect(parseCommand(input)).toEqual([input])
+		})
+
+		it("treats a <<- heredoc (strip leading tabs) as one command", () => {
+			// <<- allows the terminator to be indented with tabs.
+			const input = "sh -c bash <<-EOF\n\techo hello\n\tEOF"
+			expect(parseCommand(input)).toEqual([input])
+		})
+
+		it("does not split body lines of a multi-line heredoc", () => {
+			const input = [
+				"sh -c bash << 'EOF'",
+				"echo line1",
+				"echo line2",
+				"echo line3",
+				"EOF",
+			].join("\n")
+			expect(parseCommand(input)).toEqual([input])
+		})
+
+		it("splits a command that follows the heredoc terminator", () => {
+			const input = "sh -c bash << EOF\necho hello\nEOF\necho done"
+			const result = parseCommand(input)
+			expect(result).toHaveLength(2)
+			expect(result[0]).toBe("sh -c bash << EOF\necho hello\nEOF")
+			expect(result[1]).toBe("echo done")
+		})
+
+		it("treats a heredoc with a missing terminator as one opaque token", () => {
+			// An unterminated heredoc is a syntax error; the whole input must be
+			// returned as a single token so no body line can be auto-approved alone.
+			const input = "sh -c bash << EOF\necho hello"
+			expect(parseCommand(input)).toEqual([input])
+		})
+
+		it("treats the real-world sh heredoc pattern as one command", () => {
+			const input = [
+				"sh -c bash << 'EOF'",
+				"echo line1 > /tmp/test.txt",
+				"echo line2 \\",
+				"  --flag value \\",
+				"  --other value",
+				"EOF",
+			].join("\n")
+			expect(parseCommand(input)).toEqual([input])
+		})
+		it("does not treat a # comment inside a heredoc body as a command separator", () => {
+			// A '#' inside a heredoc body is literal text, not a shell comment.
+			// The body must not be split and the comment line must be preserved.
+			const input = "sh -c bash << 'EOF'\n# this is a comment\necho hello\nEOF"
+			expect(parseCommand(input)).toEqual([input])
+		})
+
+		it("does not mistake << inside a # comment as a heredoc opener", () => {
+			// A heredoc opener that appears inside a # comment must be ignored;
+			// the following lines must still be treated as separate commands.
+			const input = "echo hi # << EOF\necho world"
+			const result = parseCommand(input)
+			expect(result).toHaveLength(2)
+			expect(result[result.length - 1]).toBe("echo world")
+		})
+	})
+
+	describe("locale quoting ($\"...\")", () => {
+		// Locale quoting $"..." behaves like double quotes for delimiter purposes
+		// but the $ prefix is part of the token and must be preserved verbatim.
+
+		it("treats a locale-quoted argument as one command", () => {
+			const input = `echo $"hello world"`
+			expect(parseCommand(input)).toEqual([input])
+		})
+
+		it("does not split on operators inside a locale-quoted string", () => {
+			const input = `echo $"hello && world"`
+			expect(parseCommand(input)).toEqual([input])
+		})
+
+		it("does not split on a newline inside a locale-quoted string", () => {
+			const input = `echo $"hello\nworld"`
+			expect(parseCommand(input)).toEqual([input])
+		})
+
+		it("preserves the $ prefix in the output without leaking placeholders", () => {
+			const input = `echo $"greeting" && echo done`
+			const result = parseCommand(input)
+			expect(result[0]).toContain('$"greeting"')
+			expect(result.join(" ")).not.toContain("__")
+		})
+
+		it("returns an unterminated locale-quoted string as one opaque token", () => {
+			const input = `echo $"hello`
+			expect(parseCommand(input)).toEqual([input])
+		})
+	})
+
 	describe("findUnterminatedQuote", () => {
 		it("returns null for balanced and quote-free input", () => {
 			expect(findUnterminatedQuote("git status")).toBeNull()