fix(hooks): allow tmux-wrapped dev server commands (#321)

* fix(hooks): fix shell splitter redirection/escape bugs, extract shared module

- Fix single & incorrectly splitting redirection operators (&>, >&, 2>&1)
- Fix escaped quotes (\", \') not being handled inside quoted strings
- Extract splitShellSegments into shared scripts/lib/shell-split.js
  to eliminate duplication between hooks.json, before-shell-execution.js,
  and pre-bash-dev-server-block.js
- Add comprehensive tests for shell splitting edge cases

* fix(hooks): handle backslash escapes outside quotes in shell splitter

Escaped operators like \&& and \; outside quotes were still being
treated as separators. Add escape handling for unquoted context.

scripts/hooks/pre-bash-dev-server-block.js

@@ -2,40 +2,7 @@
 'use strict';
 
 const MAX_STDIN = 1024 * 1024;
-
-function splitShellSegments(command) {
-  const segments = [];
-  let current = '';
-  let quote = null;
-
-  for (let i = 0; i < command.length; i++) {
-    const ch = command[i];
-    if (quote) {
-      if (ch === quote) quote = null;
-      current += ch;
-      continue;
-    }
-
-    if (ch === '"' || ch === "'") {
-      quote = ch;
-      current += ch;
-      continue;
-    }
-
-    const next = command[i + 1] || '';
-    if (ch === ';' || (ch === '&' && next === '&') || (ch === '|' && next === '|') || (ch === '&' && next !== '&')) {
-      if (current.trim()) segments.push(current.trim());
-      current = '';
-      if ((ch === '&' && next === '&') || (ch === '|' && next === '|')) i++;
-      continue;
-    }
-
-    current += ch;
-  }
-
-  if (current.trim()) segments.push(current.trim());
-  return segments;
-}
+const { splitShellSegments } = require('../lib/shell-split');
 
 let raw = '';
 process.stdin.setEncoding('utf8');

scripts/lib/shell-split.js

@@ -0,0 +1,86 @@
+'use strict';
+
+/**
+ * Split a shell command into segments by operators (&&, ||, ;, &)
+ * while respecting quoting (single/double) and escaped characters.
+ * Redirection operators (&>, >&, 2>&1) are NOT treated as separators.
+ */
+function splitShellSegments(command) {
+  const segments = [];
+  let current = '';
+  let quote = null;
+
+  for (let i = 0; i < command.length; i++) {
+    const ch = command[i];
+
+    // Inside quotes: handle escapes and closing quote
+    if (quote) {
+      if (ch === '\\' && i + 1 < command.length) {
+        current += ch + command[i + 1];
+        i++;
+        continue;
+      }
+      if (ch === quote) quote = null;
+      current += ch;
+      continue;
+    }
+
+    // Backslash escape outside quotes
+    if (ch === '\\' && i + 1 < command.length) {
+      current += ch + command[i + 1];
+      i++;
+      continue;
+    }
+
+    // Opening quote
+    if (ch === '"' || ch === "'") {
+      quote = ch;
+      current += ch;
+      continue;
+    }
+
+    const next = command[i + 1] || '';
+    const prev = i > 0 ? command[i - 1] : '';
+
+    // && operator
+    if (ch === '&' && next === '&') {
+      if (current.trim()) segments.push(current.trim());
+      current = '';
+      i++;
+      continue;
+    }
+
+    // || operator
+    if (ch === '|' && next === '|') {
+      if (current.trim()) segments.push(current.trim());
+      current = '';
+      i++;
+      continue;
+    }
+
+    // ; separator
+    if (ch === ';') {
+      if (current.trim()) segments.push(current.trim());
+      current = '';
+      continue;
+    }
+
+    // Single & — but skip redirection patterns (&>, >&, digit>&)
+    if (ch === '&' && next !== '&') {
+      if (next === '>' || prev === '>') {
+        current += ch;
+        continue;
+      }
+      if (current.trim()) segments.push(current.trim());
+      current = '';
+      continue;
+    }
+
+    current += ch;
+  }
+
+  if (current.trim()) segments.push(current.trim());
+  return segments;
+}
+
+module.exports = { splitShellSegments };