### Summary For an alias that is not a shell alias, `ExpandAlias` pastes each argument into the alias text with `strings.ReplaceAll` and then splits the result with `shlex`, so every argument is parsed a second time: - Quotes inside an argument are removed, and an argument with an unmatched quote can make the alias fail with `EOF found when expecting closing quote`. - Backslashes inside an argument are removed: with the placeholder written as `"$1"`, as in the `glab alias set` help, `C:\tools\vim.exe` reaches the command as `C:toolsvim.exe`. - An argument filled into an unquoted placeholder (`$1` rather than `"$1"`) is split on its spaces. - An argument starting with `#` in an unquoted placeholder is read as the start of a comment, so it is dropped together with the rest of the alias text: `issue view $1 --comments` called with `#123` runs `issue view`. - `$N` text inside an argument is treated as a placeholder: it is filled with another argument, or the alias fails with `not enough arguments for alias`. - While any `$` is left in the text, the arguments after the placeholders are not appended, so extra flags are dropped without a warning. A `glab api graphql` alias whose query declares a variable such as `$fullPath` therefore never receives the `-f fullPath=...` that sets it. - `$10` is filled with the first argument followed by a literal `0`, so an alias that uses `$10` never reports a missing tenth argument. ### Environment - OS: Linux x86_64 - SHELL: /bin/bash - TERM: dumb (the commands ran without a terminal) - GLAB: built from `main` at 1d1012f32e225df2e3a047eb0516fb2c36157dc0. The code is the same in v1.123.0 (2026-10-13), and `internal/commands/alias/expand/alias_expand.go` has not changed on `main` since 2026-09-14. ### Steps to reproduce I ran these in an empty directory used as both the configuration directory and `HOME`, with no token and with telemetry and update checks off. The `cs` and `cu` aliases only store a configuration value, and `GLAB_DEBUG` prints what an alias expands to before the command runs (what the command does after that is beside the point, since there is no repository and no token). ```shell d=$(mktemp -d) && cd "$d" export GLAB_CONFIG_DIR=$d HOME=$d GITLAB_TOKEN= GITLAB_HOST= GLAB_SEND_TELEMETRY=false GLAB_CHECK_UPDATE=false glab alias set cs 'config set editor "$1"' glab alias set cu 'config set editor $1' glab alias set createissue 'issue create --title "$1"' glab alias set iv 'issue view $1 --comments' glab alias set pname 'api graphql -f query='\''query($fullPath: ID!) { project(fullPath: $fullPath) { name } }'\''' glab cs 'my "ed" here' --global; glab config get editor --global glab cs 'an "odd quote' --global glab cs 'C:\tools\vim.exe' --global; glab config get editor --global glab cs 'costs $5 now' --global glab cs '$2' --global glab cu 'my editor' --global GLAB_DEBUG=true glab createissue 'Fix "login" page' GLAB_DEBUG=true glab createissue 'Price in $' --description x GLAB_DEBUG=true glab iv '#123' GLAB_DEBUG=true glab pname -f fullPath=gitlab-org/cli ``` ### What is the current _bug_ behavior? ```plaintext glab cs 'my "ed" here' --global stores the editor as: my ed here glab cs 'an "odd quote' --global Failed to process alias: EOF found when expecting closing quote (exit status 2) glab cs 'C:\tools\vim.exe' --global stores the editor as: C:toolsvim.exe glab cs 'costs $5 now' --global Failed to process alias: not enough arguments for alias: config set editor "costs $5 now" (exit status 2) glab cs '$2' --global Accepts 2 arg(s), received 1. (exit status 1: the $2 in the argument was filled with --global) glab cu 'my editor' --global Accepts 2 arg(s), received 3. (exit status 1) ``` `GLAB_DEBUG` prints the arguments before and after the expansion (the rest of the output left out): ```plaintext [createissue Fix "login" page] -> [issue create --title Fix login page] [createissue Price in $ --description x] -> [issue create --title Price in $] [iv #123] -> [issue view] [pname -f fullPath=gitlab-org/cli] -> [api graphql -f query=query($fullPath: ID!) { project(fullPath: $fullPath) { name } }] ``` The quotes are gone from the title in the first one, `--description x` is dropped in the second, `#123` and `--comments` are dropped in the third, and the `-f fullPath=gitlab-org/cli` that sets the query variable is dropped in the fourth. ### What is the expected _correct_ behavior? Each argument reaches the command unchanged and as one argument, and the arguments after the placeholders are appended: the editor is stored as `my "ed" here`, `an "odd quote`, `C:\tools\vim.exe`, `costs $5 now`, `$2` and `my editor`, the title keeps its quotes, `--description x` reaches `issue create`, `iv` runs `issue view #123 --comments`, and `-f fullPath=gitlab-org/cli` reaches `api graphql`. ### Relevant logs and/or screenshots The output above, from glab built from `main` and run in an empty configuration directory. ### Possible fixes In `ExpandAlias` ([alias_expand.go#L59-79](https://gitlab.com/gitlab-org/cli/-/blob/1d1012f32e225df2e3a047eb0516fb2c36157dc0/internal/commands/alias/expand/alias_expand.go#L59-79)), split the alias text with `shlex` first, then fill `$N` inside each resulting word, and append the arguments after the highest placeholder. The `not enough arguments for alias` error and its message can stay as they are. This also changes three things on purpose: an alias with a `$` but no placeholder keeps the arguments after it, an argument in an unquoted placeholder stays one argument, and `$0` is literal text instead of making the alias fail. A `$` followed by several digits becomes one placeholder, so `$11` is the eleventh argument rather than `$1` followed by `1`. I have a merge request ready for it.