Windows paths with backslashes are incorrectly parsed

[KJ7LNW]

Problem Description

When parsing Windows-style paths (e.g., C:\script.cmd), shell-quote incorrectly handles backslashes, which causes issues in applications that rely on the parsed output matching the original input structure.

Reproduction

I created a simple test script to demonstrate the issue:

import { parse } from "shell-quote";

// Test cases
const testCases = [
  "C:\\script.cmd",
  "C:\\Program Files\\app.exe",
  "cd C:\\Users && dir"
];

testCases.forEach(cmd => {
  console.log(`Original command: "${cmd}"`);
  const tokens = parse(cmd);
  console.log("Parsed tokens:");
  console.log(JSON.stringify(tokens, null, 2));
});

Results

Original command: "C:\script.cmd"
Parsed tokens:
[
  "C:script.cmd"
]

Original command: "C:\Program Files\app.exe"
Parsed tokens:
[
  "C:Program",
  "Filesapp.exe"
]

Original command: "cd C:\Users && dir"
Parsed tokens:
[
  "cd",
  "C:Users",
  {
    "op": "&&"
  },
  "dir"
]

Expected Behavior

For Windows paths, backslashes should be preserved in the parsed output, especially when they're part of a path structure rather than being used as escape characters.

For example, C:\script.cmd should be parsed as ["C:\script.cmd"] (or with appropriate escaping) rather than removing the backslash.

Impact

This behavior causes issues in applications that use shell-quote to parse commands containing Windows paths and then try to match those paths against allowed prefixes or patterns. The parsed path no longer matches the original path structure, leading to validation failures.

Environment

• shell-quote version: 1.8.2
• Node.js version: v22.15.0
• OS: Linux (but issue affects Windows path handling)

Additional Context

This issue was discovered while investigating why Windows paths were failing validation in a command approval system that uses shell-quote for parsing.

[ljharb]

I'm wondering if #20 helps with this - can you try against main?

[KJ7LNW]

I'm wondering if #20 helps with this - can you try against main?

that looks promising has this been released so I can npm install?

if so then which version ?

[ljharb]

It has not been released yet - I'm asking if you can npm install ljharb/shell-quote temporarily, to see if that fixes the issue.

[KJ7LNW]

pnpm add --filter @roo-code/vscode-webview ljharb/shell-quote

#] test-shell-quote.mjs
...
Original command: "cd C:\Users && dir"
Parsed tokens:
[
  "cd",
  "C:Users",
  {
    "op": "&&"
  },
  "dir"
]

I do not think #20 fixed the problem above.

here is the entire test script:

// Test script to investigate shell-quote behavior with Windows paths
import { parse } from 'shell-quote';

// Test cases
const testCases = [
  // Backslash Windows paths
  'C:\\script.cmd',
  'C:\\Program Files\\app.exe',
  'cd C:\\Users && dir',
];

console.log('Shell-quote parsing behavior test:');
console.log('=================================\n');

testCases.forEach(cmd => {
  console.log(`Original command: "${cmd}"`);
  
  // Parse the command
  const tokens = parse(cmd);
  
  console.log('Parsed tokens:');
  console.log(JSON.stringify(tokens, null, 2));
  
  // Reconstruct the command to see how it would be processed
  const reconstructed = tokens.map(token => {
    if (typeof token === 'object' && 'op' in token) {
      return token.op;
    }
    return token;
  }).join(' ');
  
  console.log(`Reconstructed: "${reconstructed}"`);
  console.log('=================================\n');
});

[KJ7LNW]

You might need a "win32" mode flag because:

• C:\Users -> C:Users is correct for UNIX, but
• C:\Users -> C:\Users is correct for windows.