fix(arg-parser): take the arguments as stdin text, and block a heredoc that closes early

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

tests/lib/arg-parser.test.mjs

@@ -1,11 +1,15 @@
 import { test } from 'node:test';
 import { strict as assert } from 'node:assert';
 import { spawnSync } from 'node:child_process';
+import { existsSync, mkdtempSync, rmSync } from 'node:fs';
+import { tmpdir } from 'node:os';
 import { dirname, join } from 'node:path';
-import { fileURLToPath } from 'node:url';
+import { fileURLToPath, pathToFileURL } from 'node:url';
 import { parseArgs } from '../../lib/parsers/arg-parser.mjs';
+import { childEnv } from '../helpers/child-env.mjs';
 
 const PARSER = join(dirname(fileURLToPath(import.meta.url)), '..', '..', 'lib', 'parsers', 'arg-parser.mjs');
+const PARSER_URL = pathToFileURL(PARSER).href;
 
 test('trekbrief — empty args', () => {
   const r = parseArgs('', 'trekbrief');
@@ -200,3 +204,88 @@ test('trekendsession — -h stays a positional (no alias resolution)', () => {
   assert.deepEqual(r.errors, []);
   assert.equal(r.flags['--help'], undefined);
 });
+
+// --- ARG / M10 (fix round 4.5b) — the arguments reach the parser as stdin
+// text, never as shell words, and the label is read whole from `tail` ---
+
+function runStdin(command, input, cwd) {
+  return spawnSync(process.execPath, [PARSER, '--command', command, '--stdin'], {
+    input, cwd, encoding: 'utf8', env: childEnv(),
+  });
+}
+
+test('[ARG] --stdin keeps ; $( ) and * as literal characters and creates no file', async () => {
+  const mod = await import(PARSER_URL);
+  assert.equal(typeof mod.parseArgs, 'function', 'arg-parser.mjs exports parseArgs');
+  const cwd = mkdtempSync(join(tmpdir(), 'arg-parser-stdin-'));
+  try {
+    const r = runStdin('trekendsession', 'brief.md ; touch PWNED $(touch PWNED2) * ~/x $HOME\n', cwd);
+    assert.equal(r.status, 0, `the parser CLI refused --stdin: ${r.stdout}${r.stderr}`);
+    const out = JSON.parse(r.stdout);
+    assert.deepEqual(out.positional,
+      ['brief.md', ';', 'touch', 'PWNED', '$(touch', 'PWNED2)', '*', '~/x', '$HOME']);
+    assert.equal(out.tail, '; touch PWNED $(touch PWNED2) * ~/x $HOME');
+    assert.equal(existsSync(join(cwd, 'PWNED')), false, 'no PWNED file was created');
+    assert.equal(existsSync(join(cwd, 'PWNED2')), false, 'no PWNED2 file was created');
+  } finally {
+    rmSync(cwd, { recursive: true, force: true });
+  }
+});
+
+test('[ARG] a balanced quote groups words', async () => {
+  const mod = await import(PARSER_URL);
+  assert.equal(typeof mod.tokenize, 'function', 'arg-parser.mjs exports tokenize');
+  assert.deepEqual(mod.tokenize(`a "b c" 'd e' f`), [
+    { value: 'a', start: 0, end: 1 },
+    { value: 'b c', start: 2, end: 7 },
+    { value: 'd e', start: 8, end: 13 },
+    { value: 'f', start: 14, end: 15 },
+  ]);
+  assert.deepEqual(mod.tokenize(`brief.md "Fix the user's login"`).map((t) => t.value),
+    ['brief.md', "Fix the user's login"]);
+});
+
+test('[ARG] an unbalanced quote stays a literal character', async () => {
+  const mod = await import(PARSER_URL);
+  assert.equal(typeof mod.tokenize, 'function', 'arg-parser.mjs exports tokenize');
+  assert.deepEqual(mod.tokenize(`Fix the user's login`).map((t) => t.value),
+    ['Fix', 'the', "user's", 'login']);
+  assert.deepEqual(mod.tokenize('say "hi there').map((t) => t.value),
+    ['say', '"hi', 'there']);
+  assert.deepEqual(mod.parseArgs(`brief.md it's`, 'trekendsession').positional,
+    ['brief.md', "it's"]);
+});
+
+test('[ARG] empty stdin gives no positional, an empty tail and exit 0', async () => {
+  const mod = await import(PARSER_URL);
+  assert.equal(typeof mod.parseArgs, 'function', 'arg-parser.mjs exports parseArgs');
+  for (const input of ['', '\n']) {
+    const r = runStdin('trekendsession', input);
+    assert.equal(r.status, 0, `the parser CLI refused empty stdin: ${r.stdout}${r.stderr}`);
+    const out = JSON.parse(r.stdout);
+    assert.deepEqual(out.positional, []);
+    assert.deepEqual(out.errors, []);
+    assert.equal(out.tail, '', `tail for ${JSON.stringify(input)}`);
+  }
+});
+
+test('[M10] tail keeps a multi-word label whole', async () => {
+  const mod = await import(PARSER_URL);
+  assert.equal(typeof mod.parseArgs, 'function', 'arg-parser.mjs exports parseArgs');
+  const r = mod.parseArgs('brief.md Session 2 of 3', 'trekendsession');
+  assert.equal(r.tail, 'Session 2 of 3');
+  assert.equal(r.positional[0], 'brief.md');
+});
+
+test('[M10] one outer quote pair around the label is removed', async () => {
+  const mod = await import(PARSER_URL);
+  assert.equal(typeof mod.parseArgs, 'function', 'arg-parser.mjs exports parseArgs');
+  assert.equal(mod.parseArgs(`brief.md 'Session 2 of 3'`, 'trekendsession').tail, 'Session 2 of 3');
+  assert.equal(mod.parseArgs(`brief.md "Session 2 of 3"`, 'trekendsession').tail, 'Session 2 of 3');
+});
+
+test('[M10] an inner apostrophe stays', async () => {
+  const mod = await import(PARSER_URL);
+  assert.equal(typeof mod.parseArgs, 'function', 'arg-parser.mjs exports parseArgs');
+  assert.equal(mod.parseArgs(`brief.md Fix the user's login`, 'trekendsession').tail, "Fix the user's login");
+});