Summary
When a multi-line command block is passed to the agent's bash tool, a line not terminated by ;, && or | has its newline replaced by a space, so the following line's tokens are appended as extra arguments to the preceding command instead of being executed as a new command. The block is executed as a token stream, not as bash -c over the text.
Reproduction
Minimal:
echo AAA
cd /tmp && echo BBB
Observed: executed as echo AAA cd /tmp then echo BBB — cd and /tmp become arguments to echo, so the first line prints AAA cd /tmp.
Expected: two independent commands (echo AAA, then cd /tmp && echo BBB).
Terminator table
| Line ending |
Behaviour |
| bare newline |
collapsed to a space — merges into the previous command as extra arguments |
; terminated |
preserved correctly |
&& terminated |
preserved correctly |
Impact
The corruption is invisible until a merged argument happens to be dangerous. A=1 / B=2 / echo x still behaves acceptably when collapsed, so it can run unnoticed for a whole session. In our case the leading command was rm -rf <tmpdir> and the merged token was an absolute project path, so rm -rf received multiple operands and deleted the project working tree. Other commands that take multiple path operands (mv, cp, rsync, find … -delete) are equally exposed.
Workaround
Terminate every line with ; or &&; never rely on a bare newline as a command boundary inside a single bash tool call.
Environment
- pi
0.83.0
- macOS (Darwin arm64)
Happy to follow whatever format you prefer; can reproduce deterministically on a fresh session.
Summary
When a multi-line command block is passed to the agent's
bashtool, a line not terminated by;,&&or|has its newline replaced by a space, so the following line's tokens are appended as extra arguments to the preceding command instead of being executed as a new command. The block is executed as a token stream, not asbash -cover the text.Reproduction
Minimal:
Observed: executed as
echo AAA cd /tmpthenecho BBB—cdand/tmpbecome arguments toecho, so the first line printsAAA cd /tmp.Expected: two independent commands (
echo AAA, thencd /tmp && echo BBB).Terminator table
;terminated&&terminatedImpact
The corruption is invisible until a merged argument happens to be dangerous.
A=1/B=2/echo xstill behaves acceptably when collapsed, so it can run unnoticed for a whole session. In our case the leading command wasrm -rf <tmpdir>and the merged token was an absolute project path, sorm -rfreceived multiple operands and deleted the project working tree. Other commands that take multiple path operands (mv,cp,rsync,find … -delete) are equally exposed.Workaround
Terminate every line with
;or&&; never rely on a bare newline as a command boundary inside a singlebashtool call.Environment
0.83.0Happy to follow whatever format you prefer; can reproduce deterministically on a fresh session.