Summary

shell-quote (reproduced on v1.10.0) does not implement bash's ANSI-C quoting — the $'...' form. This is not an exotic construct: it is exactly what Chrome/Edge DevTools emit from Copy as cURL (bash) (e.g. --data-raw $'...'), so any consumer that uses shell-quote to parse real-world copied shell commands silently gets the wrong arguments.

Current behaviour

The scanner treats the leading $ as the start of a parameter expansion (empty name → emits a literal $), and then treats the rest of the token as a plain single-quoted string. Consequences:

1. the leading $ of the $' prefix is kept in the output (it should be dropped);
2. ANSI-C escape sequences are not decoded (\n, \t, \x41, \', …);
3. \' does not escape the quote — it terminates the string and the remainder is mis-parsed.

Reproduction

const { parse } = require('shell-quote'); // v1.10.0

const cases = [
  '$' + "'" + '{"a":"${field}"}' + "'",
  '$' + "'" + 'line1\\nline2' + "'",
  '$' + "'" + 'a\\\'b' + "'",
  '$' + "'" + 'tab\\there' + "'",
  '$' + "'" + '\\x41' + "'",
  '$' + "'" + 'cost is $5' + "'"
];

cases.forEach((c) => console.log(JSON.stringify(c), '->', JSON.stringify(parse(c)[0])));

Expected behaviour

Per the bash manual, inside $'...':

• the documented escape sequences are decoded (\n, \t, \', \", \\, \nnn, \xHH, \uHHHH, \UHHHHHHHH, \cx, \a, \b, \e, \E, \f, \r, \v, \?, …);
• no parameter expansion, command substitution or brace expansion happens — ${field} and $5 stay literal;
• the $' prefix and the surrounding quotes are removed, and the token is not word-split.

Real-world impact / related

• Import of Chrome "Copy as cURL (bash)" corrupts literal ${...} in --data-raw: "${field}" becomes "$field" (braces dropped) postmanlabs/curl-to-postman#104 — Postman's cURL importer corrupted literal ${...} in Chrome-copied cURL commands. It uses a vendored copy of shell-quote (assets/shell-quote.js), patched to decode escapes; because that patch kept the double-quote branch's variable resolution, ${field} was rendered as $field. Fix: fix: keep ${...} literal inside bash ANSI-C quoted ($'...') --data-raw payloads postmanlabs/curl-to-postman#105.
• If parse() supported $'...' natively, downstream consumers (Postman included) would not need to vendor + patch this file.
• Nice-to-have on the other side: quote() could emit $'...' for strings containing a single quote (instead of '\''), which is what bash/DevTools do and what round-trips through the above fix.

Thanks for maintaining this library!