appium-mac2-driver 4.5.0 → 4.5.1

package/node_modules/axios/lib/helpers/formDataToJSON.js

@@ -65,6 +65,29 @@ function arrayToObject(arr) {
   return obj;
 }
 
+function normalizeArray(value) {
+  if (!utils.isArray(value)) return value;
+
+  const keys = Object.keys(value);
+  return keys.length !== value.length || keys.some((key, index) => key !== String(index))
+    ? arrayToObject(value)
+    : value;
+}
+
+function normalizeArrays(obj) {
+  const pending = [obj];
+  while (pending.length) {
+    const target = pending.pop();
+    Object.keys(target).forEach((key) => {
+      const value = (target[key] = normalizeArray(target[key]));
+      if (utils.isArray(value) || utils.isPlainObject(value)) {
+        pending.push(value);
+      }
+    });
+  }
+  return obj;
+}
+
 /**
  * It takes a FormData object and returns a JavaScript object
  *
@@ -86,6 +109,7 @@ function formDataToJSON(formData) {
 
     if (isLast) {
       if (utils.hasOwnProp(target, name)) {
+        target[name] = normalizeArray(target[name]);
         target[name] = utils.isArray(target[name])
           ? target[name].concat(value)
           : [target[name], value];
@@ -116,7 +140,7 @@ function formDataToJSON(formData) {
       buildPath(parsePropPath(name), value, obj, 0);
     });
 
-    return obj;
+    return normalizeArrays(obj);
   }
 
   return null;

package/node_modules/axios/lib/helpers/fromDataURI.js

@@ -6,7 +6,10 @@ import platform from '../platform/index.js';
 
 // RFC 2397: data:[<mediatype>][;base64],<data>
 // mediatype = type/subtype followed by optional ;name=value parameters
-const DATA_URL_PATTERN = /^([^,;/]+\/[^,;/]+)?((?:;[^,;=]+=[^,;]+)*)(;base64)?,([\s\S]*)$/;
+// The `i` flag makes the `;base64` token case-insensitive, matching the WHATWG
+// URL/Fetch data URL processor (and therefore the fetch adapter and browsers).
+// The remaining character classes do not depend on letter case.
+const DATA_URL_PATTERN = /^([^,;/]+\/[^,;/]+)?((?:;[^,;=]+=[^,;]+)*)(;base64)?,([\s\S]*)$/i;
 
 /**
  * Parse data uri to a Buffer or Blob
@@ -51,7 +54,10 @@ export default function fromDataURI(uri, asBlob, options) {
 
     const buffer =
       encoding === 'base64'
-        ? Buffer.from(body, 'base64')
+        ? Buffer.from(
+            body.replace(/%([\da-f]{2})/gi, (_, hex) => String.fromCharCode(parseInt(hex, 16))),
+            'base64'
+          )
         : Buffer.from(decodeURIComponent(body), encoding);
 
     if (asBlob) {

package/node_modules/axios/lib/helpers/isURLSameOrigin.js

@@ -1,16 +1,11 @@
 import platform from '../platform/index.js';
 
 export default platform.hasStandardBrowserEnv
-  ? ((origin, isMSIE) => (url) => {
-      url = new URL(url, platform.origin);
+  ? ((origin) => (url) => {
+      url = new URL(url, document.baseURI || platform.origin);
 
       return (
-        origin.protocol === url.protocol &&
-        origin.host === url.host &&
-        (isMSIE || origin.port === url.port)
+        origin.protocol === url.protocol && origin.host === url.host && origin.port === url.port
       );
-    })(
-      new URL(platform.origin),
-      platform.navigator && /(msie|trident)/i.test(platform.navigator.userAgent)
-    )
+    })(new URL(platform.origin))
   : () => true;

package/node_modules/axios/lib/helpers/parseHeaders.js

@@ -39,7 +39,8 @@ const ignoreDuplicateOf = utils.toObjectSet([
  * @returns {Object} Headers parsed into an object
  */
 export default (rawHeaders) => {
-  const parsed = {};
+  // Header names are data, including __proto__; avoid inherited setters.
+  const parsed = Object.create(null);
   let key;
   let val;
   let i;

package/node_modules/axios/lib/helpers/parseProtocol.js

@@ -2,5 +2,5 @@
 
 export default function parseProtocol(url) {
   const match = /^([-+\w]{1,25}):(?:\/\/)?/.exec(url);
-  return (match && match[1]) || '';
+  return (match && match[1].toLowerCase()) || '';
 }

package/node_modules/axios/lib/helpers/resolveConfig.js

@@ -22,7 +22,9 @@ const encodeUTF8 = (str) =>
     String.fromCharCode(parseInt(hex, 16))
   );
 
-function resolveConfig(config) {
+const readCookie = (name) => cookies.read(name);
+
+function resolveConfig(config, readXsrfCookie = readCookie) {
   const newConfig = mergeConfig({}, config);
 
   // Read only own properties to prevent prototype pollution gadgets
@@ -51,11 +53,22 @@ function resolveConfig(config) {
   if (auth) {
     const username = utils.getSafeProp(auth, 'username') || '';
     const password = utils.getSafeProp(auth, 'password') || '';
+    const transitional = own('transitional');
+    const encodeUsername =
+      transitional &&
+      utils.hasOwnProp(transitional, 'encodeBasicAuthUsername') &&
+      transitional.encodeBasicAuthUsername === true;
 
     try {
       headers.set(
         'Authorization',
-        'Basic ' + btoa(username + ':' + (password ? encodeUTF8(password) : ''))
+        // Preserve legacy username bytes unless the caller opts in to UTF-8.
+        'Basic ' +
+          btoa(
+            (encodeUsername ? encodeUTF8(username) : username) +
+              ':' +
+              (password ? encodeUTF8(password) : '')
+          )
       );
     } catch (e) {
       throw AxiosError.from(e, AxiosError.ERR_BAD_OPTION_VALUE, config);
@@ -93,7 +106,7 @@ function resolveConfig(config) {
       withXSRFToken === true || (withXSRFToken == null && isURLSameOrigin(newConfig.url));
 
     if (shouldSendXSRF) {
-      const xsrfValue = xsrfHeaderName && xsrfCookieName && cookies.read(xsrfCookieName);
+      const xsrfValue = xsrfHeaderName && xsrfCookieName && readXsrfCookie(xsrfCookieName);
 
       if (xsrfValue) {
         headers.set(xsrfHeaderName, xsrfValue);

package/node_modules/axios/lib/helpers/shouldBypassProxy.js

@@ -1,3 +1,5 @@
+import { domainToASCII } from 'url';
+
 const LOOPBACK_HOSTNAMES = new Set(['localhost', '0.0.0.0']);
 
 const trimTrailingDots = (value) => {
@@ -319,7 +321,20 @@ const normalizeNoProxyHost = (hostname) => {
     hostname = hostname.slice(1, -1);
   }
 
-  const trimmed = trimTrailingDots(hostname);
+  let trimmed = trimTrailingDots(hostname);
+  if (trimmed.indexOf(':') !== -1) {
+    try {
+      trimmed = new URL('http://[' + trimmed + ']/').hostname.slice(1, -1);
+    } catch (_err) {
+      return trimmed;
+    }
+  } else if (/[\u0080-\uffff]/.test(trimmed)) {
+    const prefix = /^[*.]+/.exec(trimmed);
+    const start = prefix ? prefix[0] : '';
+    const ascii = domainToASCII(trimmed.slice(start.length));
+    if (!ascii) return '';
+    trimmed = start + trimTrailingDots(ascii);
+  }
 
   // IPv4 shorthand/octal/hex → dotted-decimal; helper is a no-op for inputs
   // containing ':' (IPv6 and IPv4-mapped IPv6) so we fall through to unmap.

package/node_modules/axios/lib/utils.js

@@ -313,11 +313,17 @@ const isPlainObject = (val) => {
   const prototype = getPrototypeOf(val);
   return (
     (prototype === null || prototype === Object.prototype || getPrototypeOf(prototype) === null) &&
-    // Treat safe own/inherited Symbol.toStringTag or Symbol.iterator members as
-    // evidence the value is tagged/iterable, while ignoring members reachable
-    // only through shared or terminal prototype boundaries.
-    !hasOwnInPrototypeChain(val, toStringTag) &&
-    !hasOwnInPrototypeChain(val, iterator)
+    // Treat own Symbol.toStringTag or Symbol.iterator members as evidence the
+    // value is tagged/iterable, ignoring members reachable only through shared
+    // or terminal prototype boundaries. This is exactly what
+    // hasOwnInPrototypeChain(val, prop) computes here: every prototype admitted
+    // above (null, Object.prototype, or a terminal null-prototype template) is
+    // a boundary, so the walk never inspects anything but `val`'s own members,
+    // and stops before even those when `val` is itself the boundary
+    // Object.prototype. Checking that inline avoids allocating the walker's
+    // `seen` list twice per call on the mergeConfig / merge hot path.
+    (isPrototypeBoundary(val, prototype, true) ||
+      (!hasOwnProperty(val, toStringTag) && !hasOwnProperty(val, iterator)))
   );
 };
 
@@ -581,15 +587,30 @@ const isContextDefined = (context) => !isUndefined(context) && context !== _glob
 function merge(...objs) {
   const { caseless, skipUndefined } = (isContextDefined(this) && this) || {};
   const result = {};
+  // Caseless lookup only applies to string keys — symbol keys are
+  // identity-matched. Every string key that reaches `result` passes through
+  // this index first, so it can never hold two case variants of one key and a
+  // lowercase -> key map is exactly what findKey(result, key) would rescan
+  // Object.keys(result) for on each assignment.
+  const lowerCaseKeys = caseless ? Object.create(null) : null;
   const assignValue = (val, key) => {
     // Skip dangerous property names to prevent prototype pollution
     if (key === '__proto__' || key === 'constructor' || key === 'prototype') {
       return;
     }
 
-    // findKey lowercases the key, so caseless lookup only applies to strings —
-    // symbol keys are identity-matched.
-    const targetKey = (caseless && typeof key === 'string' && findKey(result, key)) || key;
+    let targetKey = key;
+    if (lowerCaseKeys && typeof key === 'string') {
+      const lowerKey = key.toLowerCase();
+      const knownKey = lowerCaseKeys[lowerKey];
+      // A key recorded but absent from `result` was skipped by skipUndefined;
+      // the later spelling wins then, as it does for findKey.
+      if (knownKey !== undefined && hasOwnProperty(result, knownKey)) {
+        targetKey = knownKey;
+      } else {
+        lowerCaseKeys[lowerKey] = key;
+      }
+    }
     // Read via own-prop only — a bare `result[targetKey]` walks the prototype
     // chain, so a polluted Object.prototype value could surface here and get
     // copied into the merged result.
@@ -613,7 +634,7 @@ function merge(...objs) {
 
     forEach(source, assignValue);
 
-    if (typeof source !== 'object' || isArray(source)) {
+    if (typeof source !== 'object' || isArray(source) || !Object.getOwnPropertySymbols) {
       continue;
     }
 
@@ -772,7 +793,37 @@ const toArray = (thing) => {
   if (!thing) return null;
   if (isArray(thing)) return thing;
   let i = thing.length;
-  if (!isNumber(i)) return null;
+  if (!Number.isSafeInteger(i) || i < 0 || i > 0xffffffff) return null;
+
+  // Bound the copy by actual indexed properties, including hidden and inherited
+  // members of array-like collections, rather than by the declared length alone.
+  const indexes = new Set();
+  const seen = new Set();
+  let source = thing;
+
+  while (source != null && indexes.size < i) {
+    if (seen.has(source)) return null;
+    seen.add(source);
+
+    const prototype = getPrototypeOf(source);
+    if (isPrototypeBoundary(source, prototype, source === thing)) break;
+
+    Object.getOwnPropertyNames(source).forEach((key) => {
+      const index = +key;
+      if (
+        Number.isInteger(index) &&
+        index >= 0 &&
+        index < i &&
+        String(index) === key &&
+        hasOwnProperty(source, key)
+      ) {
+        indexes.add(index);
+      }
+    });
+    source = prototype;
+  }
+
+  if (indexes.size !== i) return null;
   const arr = new Array(i);
   while (i-- > 0) {
     arr[i] = thing[i];

package/node_modules/axios/package.json

@@ -1,6 +1,6 @@
 {
   "name": "axios",
-  "version": "1.20.0",
+  "version": "1.21.0",
   "description": "Promise based HTTP client for the browser and node.js",
   "main": "./dist/node/axios.cjs",
   "module": "./index.js",
@@ -161,7 +161,6 @@
     "abortcontroller-polyfill": "^1.7.8",
     "acorn": "^8.17.0",
     "body-parser": "^2.3.0",
-    "chalk": "^5.6.2",
     "cross-env": "^10.1.0",
     "dev-null": "^0.1.1",
     "eslint": "^10.6.0",

package/node_modules/follow-redirects/README.md

@@ -1,4 +1,30 @@
-## Follow Redirects
+## _Follow Redirects_ is in need of funding
+
+> [!IMPORTANT]
+> **Maintenance paused until funding found.**
+>
+> follow-redirects is downloaded over 400 million times per month,
+> It has been maintained for over ten years by one volunteer,
+> who has no funds to provide update and security guarantees.
+>
+> **What this means for you:**
+> the package stays published and keeps working as it does today,
+> but there are no guarantees of bug fixes, security fixes,
+> or replies to issues and pull requests.
+> Security reports are handled best-effort only; see [SECURITY.md](SECURITY.md).
+>
+> **What can restart maintenance:**
+> Even if only 0.1% of downloads paid $0.01, we'd be fully funded
+> with $4000 per month.
+> That's not the case, and that's okay,
+> but unfortunately also insufficient to continue.
+> We need to cover security triage, CVE handling, fixes, and releases.
+> Progress toward that goal will be posted here.
+>
+> **If your company depends on follow-redirects,**
+> directly or another library,
+> please [sponsor on GitHub](https://github.com/sponsors/RubenVerborgh)
+> or email us for invoice-based funding or a security support agreement.
 
 Drop-in replacement for Node's `http` and `https` modules that automatically follows redirects.
 

package/node_modules/follow-redirects/index.js

@@ -311,7 +311,7 @@ RedirectableRequest.prototype._sanitizeOptions = function (options) {
     }
   }
   // Ensure sensitive headers are always present
-  if (!isArray(options.sensitiveHeaders)) {
+  if (!Array.isArray(options.sensitiveHeaders)) {
     options.sensitiveHeaders = [];
   }
 
@@ -689,10 +689,6 @@ function isSubdomain(subdomain, domain) {
   return dot > 0 && subdomain[dot] === "." && subdomain.endsWith(domain);
 }
 
-function isArray(value) {
-  return value instanceof Array;
-}
-
 function isString(value) {
   return typeof value === "string" || value instanceof String;
 }

package/node_modules/follow-redirects/package.json

@@ -1,6 +1,6 @@
 {
   "name": "follow-redirects",
-  "version": "1.16.1",
+  "version": "1.16.2",
   "description": "HTTP and HTTPS modules that follow redirects.",
   "license": "MIT",
   "main": "index.js",

package/node_modules/shell-quote/README.md

@@ -39,6 +39,20 @@ output
 [ 'a', 'b c', '$def', "it's great" ]
 ```
 
+## parse with ANSI-C quoting
+
+```js
+var parse = require('shell-quote/parse');
+var xs = parse("echo $'it\\'s a \\n test'");
+console.dir(xs);
+```
+
+output
+
+```
+[ 'echo', "it's a \n test" ]
+```
+
 ## parse with an environment variable
 
 ```js
@@ -123,10 +137,13 @@ commands.
 
 Each entry of `args` may be a string, or one of the object shapes that
 `parse` emits: `{ op }` (where `op` is one of the control operators
-`||`, `&&`, `;;`, `|&`, `<(`, `<<<`, `>>`, `>&`, `<&`, `&`, `;`, `(`,
-`)`, `|`, `<`, `>`), `{ op: 'glob', pattern }`, or `{ comment }`. Any
-other object shape, an unrecognized `op`, or a `pattern`/`comment`
-containing line terminators throws a `TypeError`.
+`||`, `&&`, `;;&`, `;;`, `;&`, `|&`, `<(`, `>(`, `<<<`, `<<-`,
+`<<`, `>>`, `>&`, `>|`, `&>>`, `&>`, `<&`, `<>`, `&`, `;`, `(`,
+`)`, `|`, `<`, `>`),
+`{ op: 'glob', pattern }`, or `{ comment }`. Any
+other object shape, an unrecognized `op`, a `pattern`/`comment`
+containing line terminators, or a string containing line terminators
+anywhere after a `{ comment }` throws a `TypeError`.
 
 The output is POSIX shell (`sh`/`bash`) quoting.
 It is not valid for Windows `cmd.exe` or PowerShell,
@@ -158,6 +175,15 @@ Pass a string to use its characters as the `IFS` instead
 (for example `{ splitUnquoted: ':' }`).
 A quoted expansion (`"$VAR"`) is never split.
 
+Bash [ANSI-C quoting](https://www.gnu.org/software/bash/manual/html_node/ANSI_002dC-Quoting.html)
+(`$'...'`) is supported: escape sequences (such as `\n`, `\t`, `\\`, `\'`, `\"`,
+`\xHH`, `\uHHHH`, `\UHHHHHHHH`, `\nnn`, and `\cx`) are decoded, an unrecognized
+escape keeps its backslash, and the contents are never word-split and never
+variable-expanded, so `${VAR}` inside `$'...'` stays literal. As in bash,
+`$'...'` is not special inside double or single quotes, and a NUL ends the string.
+Since the result is a JavaScript string, `\xHH` and `\nnn` produce the character
+with that code (U+0000 to U+00FF), not a raw byte.
+
 Only simple `$VARNAME` and `${VARNAME}` interpolation is supported.
 Bash parameter expansion beyond a plain variable name is not evaluated:
 forms such as array subscripts (`${arr[i]}`), length (`${#arr[@]}`),
@@ -186,6 +212,13 @@ parses as:
 [ 'beep', { op: '||' }, 'boop', { op: '>' }, '/byte' ]
 ```
 
+The here-document operators (`<<` and `<<-`) are emitted like any other operator,
+followed by the delimiter word.
+The here-document body is not recognized:
+a newline is whitespace to `parse`,
+so the lines after the command are parsed as ordinary tokens,
+subject to quoting, comments, globs, and variable expansion.
+
 # install
 
 With [npm](http://npmjs.org) do:

package/node_modules/shell-quote/package.json

@@ -1,7 +1,7 @@
 {
 	"name": "shell-quote",
 	"description": "quote and parse shell commands",
-	"version": "1.10.0",
+	"version": "1.12.0",
 	"author": {
 		"name": "James Halliday",
 		"email": "mail@substack.net",
@@ -41,11 +41,11 @@
 	},
 	"devDependencies": {
 		"@arethetypeswrong/cli": "^0.18.5",
-		"@ljharb/eslint-config": "^22.2.3",
+		"@ljharb/eslint-config": "^22.2.5",
 		"@ljharb/tsconfig": "^0.3.2",
-		"auto-changelog": "^2.6.0",
-		"eslint": "^10.6.0",
-		"evalmd": "^0.0.20",
+		"auto-changelog": "^2.7.0",
+		"eslint": "^10.11.0",
+		"evalmd": "^0.0.22",
 		"in-publish": "^2.0.1",
 		"jiti": "^0.0.0",
 		"npmignore": "^0.3.5",
@@ -66,8 +66,12 @@
 	"publishConfig": {
 		"ignore": [
 			".github/workflows",
+			".nycrc",
+			"eslint.config.mjs",
 			"example",
-			"CHANGELOG.md"
+			"CHANGELOG.md",
+			"security.md",
+			"test"
 		]
 	},
 	"engines": {

package/node_modules/shell-quote/parse.d.ts

@@ -1,7 +1,7 @@
 declare namespace parse {
 	/** A shell control operator. */
 	export interface ControlOperator {
-		op: '||' | '&&' | ';;' | '|&' | '<(' | '<<<' | '>>' | '>&' | '<&' | '&' | ';' | '(' | ')' | '|' | '<' | '>';
+		op: '||' | '&&' | ';;&' | ';;' | ';&' | '|&' | '<(' | '>(' | '<<<' | '<<-' | '<<' | '>>' | '>&' | '>|' | '&>>' | '&>' | '<&' | '<>' | '&' | ';' | '(' | ')' | '|' | '<' | '>';
 	}
 
 	/** A glob pattern parsed from the shell command. */

package/node_modules/shell-quote/parse.js

@@ -8,24 +8,31 @@
  * 	ParseEntry,
  * } from './parse' */
 
-// '<(' is process substitution operator and
+// '<(' and '>(' are process substitution operators and
 // can be parsed the same as control operator
 var CONTROL = /** @type {const} */ ('(?:') + /** @type {const} */ ([
 	'\\|\\|',
-	'\\&\\&',
-	';;',
-	'\\|\\&',
+	'\\&(?:\\&|>>?)', // `&&`, `&>`, and `&>>`
+	';;\\&?', // `;;` and `;;&`
+	'[;|]\\&', // `;&` and `|&`
 	'\\<\\(',
 	'\\<\\<\\<',
+	'\\<\\<-',
+	'\\<\\<(?!\\()', // `<<(` stays `<` and `<(`, as zsh reads it; other shells reject it
 	'>>',
-	'>\\&',
-	'<\\&',
+	'>[&|(]', // `>&`, `>|`, and `>(`
+	'<[&>]', // `<&` and `<>`
 	'[&;()|<>]'
 ]).join(/** @type {const} */ ('|')) + /** @type {const} */ (')');
 var controlRE = new RegExp('^' + CONTROL + '$');
 var META = /** @type {const} */ ('|&;()<> \\t');
 var SINGLE_QUOTE = /** @type {const} */ ('\'([^\']*?)\'');
-var DOUBLE_QUOTE = /** @type {const} */ ('"((\\\\"|[^"])*?)"');
+// bash ANSI-C quoting, `$'...'`: a backslash escapes the next character, including `'`
+var ANSI_C_BODY = '(?:\\\\[\\s\\S]|[^\\\\\'])*?';
+var ANSI_C_QUOTE = '\\$\'' + ANSI_C_BODY + '\'';
+var ansiCAt = new RegExp('\\$\'' + ANSI_C_BODY + '(?:(\')|\\\\?$)', 'g');
+var ANSI_C_LETTERS = 'abeEfnrtv';
+var ANSI_C_CHARS = '\x07\b\x1B\x1B\f\n\r\t\v';
 var hash = /^#$/;
 
 var SQ = /** @type {const} */ ("'");
@@ -80,6 +87,46 @@ function getVar(env, pre, key) {
 	return pre + r;
 }
 
+var ansiCEscape = /\\([0-7]{1,3}|x[\dA-Fa-f]{1,2}|u[\dA-Fa-f]{1,4}|U[\dA-Fa-f]{1,8}|c(?:\\\\|[\s\S])|[abeEfnrtv\\'"?])/g;
+
+/**
+ * @param {string} m
+ * @param {string} escape
+ */
+function expandAnsiCEscape(m, escape) {
+	var kind = escape.charAt(0);
+	if (kind === 'c') {
+		var ctrl = escape.charAt(1);
+		return ctrl === '?' ? '\x7F' : String.fromCharCode(ctrl.charCodeAt(0) & 0x1F);
+	}
+	if (kind === 'x' || kind === 'u' || kind === 'U') {
+		var cp = parseInt(escape.slice(1), 16);
+		if (cp > 0x10FFFF) {
+			return m;
+		}
+		return String.fromCharCode.apply(null, cp > 0xFFFF ? [0xD7C0 + (cp >> 10), 0xDC00 + (cp & 0x3FF)] : [cp]);
+	}
+	if (kind >= '0' && kind <= '7') {
+		return String.fromCharCode(parseInt(escape, 8) & 0xFF);
+	}
+	var letter = ANSI_C_LETTERS.indexOf(escape);
+	return letter < 0 ? escape : ANSI_C_CHARS.charAt(letter);
+}
+
+/** @param {string} body */
+function expandAnsiC(body) {
+	return body.replace(ansiCEscape, expandAnsiCEscape).split('\0')[0]; // like bash, a NUL ends the string
+}
+
+/**
+ * @param {string} s
+ * @param {number} i
+ */
+function closesAnsiC(s, i) {
+	ansiCAt.lastIndex = i;
+	return !!(/** @type {RegExpExecArray} */ (ansiCAt.exec(s)))[1];
+}
+
 /**
  * @param {string} string
  * @param {Env} [env]
@@ -92,11 +139,12 @@ function parseInternal(string, env, opts) {
 	}
 	var BS = opts.escape || '\\';
 	var ifs = opts.splitUnquoted === true ? ' \t\n' : (typeof opts.splitUnquoted === 'string' ? opts.splitUnquoted : '');
-	var BAREWORD = '(\\' + BS + '[\'"' + META + ']|[^\\s\'"' + META + '])+';
+	var BAREWORD = '(\\' + BS + '[\'"$\\' + BS + META + ']|\\$\\$|\\$(?!' + ANSI_C_QUOTE.slice(2) + ')|[^\\s\'"$' + META + '])+';
+	var DOUBLE_QUOTE = '"(?:\\' + BS + '[\\s\\S]|[^"\\' + BS + '])*"';
 
 	var chunker = new RegExp([
 		'(' + CONTROL + ')', // control chars
-		'(' + BAREWORD + '|' + DOUBLE_QUOTE + '|' + SINGLE_QUOTE + ')+'
+		'(' + ANSI_C_QUOTE + '|' + BAREWORD + '|' + DOUBLE_QUOTE + '|' + SINGLE_QUOTE + ')+'
 	].join('|'), 'g');
 
 	var matches = matchAll(string, chunker);
@@ -173,9 +221,8 @@ function parseInternal(string, env, opts) {
 				varend -= 1;
 				varname = s.slice(i, varend);
 				i = varend;
-			} else if ((/[*@#?$!_-]/).test(char)) {
+			} else if ((/[*@#?$!-]/).test(char)) {
 				varname = char;
-				i += 1;
 			} else {
 				var slicedFromI = s.slice(i);
 				varend = slicedFromI.match(/[^\w\d_]/);
@@ -252,6 +299,11 @@ function parseInternal(string, env, opts) {
 				return /** @type {const} */ ([commentObj]);
 			} else if (c === BS) {
 				esc = true;
+			} else if (c === DS && s.charAt(i + 1) === SQ && closesAnsiC(s, i)) {
+				flushRun();
+				sawQuote = true;
+				out += expandAnsiC(s.slice(i + 2, ansiCAt.lastIndex - 1));
+				i = ansiCAt.lastIndex - 1;
 			} else if (c === DS) {
 				var value = parseEnvVar();
 				if (!ifs) {

package/node_modules/shell-quote/quote.d.ts

@@ -5,7 +5,8 @@ import parse = require('./parse');
  *
  * Accepts strings and the object shapes that {@link parse} emits. Throws a
  * `TypeError` for unrecognized object shapes, `op` values outside the
- * allowlist, or `pattern`/`comment` values containing line terminators.
+ * allowlist, `pattern`/`comment` values containing line terminators, or
+ * strings containing line terminators anywhere after a `comment`.
  *
  * @param args - Array of tokens to quote.
  * @returns A shell-safe quoted string.