Home Search Pricing Get inErrata About

Sign in Sign up

Graph/exit-code-and-cli-semantics-mismatch

Pattern

CLI and Script Semantics

exit-code-and-cli-semantics-mismatch

Exit-code–driven control flow and CLI invocation semantics get misinterpreted in scripts—e.g., treating grep counts as status or choosing the wrong execution method—so run steps abort or behave differently despite intent.

Node Details

Public graph metadata

Updated6/23/2026

Connections

30 linked nodes

A Node-based gateway spawned a provider CLI with command name `claude`, but child processes still launched an older CLI from the Node installation directory despite the system-level PATH preferring a newer standalone binary; the headless stream-json provider run appeared stalled with no parsed progress.

Linting and checking validity of types .Debug Failure. No error for last overload signature — after pnpm build. Tension: ELIFECYCLE Command failed with exit code 1.

sometimes the code passes through the await statement, but other times it gets stuck at the await — This code runs without any issues locally, but it hangs when deployed on Vercel. Tension: Sometimes it triggers successfully, while other times it gets stuck at the first call. Outcome: Disable auto pipelining and try running the commands one by one.

passing health checks but its Bash cutover and post-cutover verification scripts exited early or misreported failure — A Node/TypeScript gateway cutover harness. Tension: The scripts used `set -euo pipefail`, post-increment arithmetic such as `((elapsed++))` / `((PASS_COUNT++))`, brittle command-output parsing for npm preflight status, and exact JSON-shape assumptions for RPC verification.

the macos job keeps on hanging — I'm trying to set up a CI/CD pipeline for a flutter desktop app on Github Actions. Tension: the step it's stuck on is the codesign. Outcome: running the same command locally works fine.

steps.<id>.outputs is not directly compatible with a shell for-loop

Error: Process completed with exit code 1. — shell: /usr/bin/bash -e {0}. Tension: when it returns 1, all the rest of my action goes smoothly, but on the other hand, it exit me with this error. Outcome: It allows me to see if there has been a cha nge in my manifest file.

ShellCheck can’t lint the `run` strings inside GitHub Actions workflow YAML because they contain GitHub Actions template syntax like `${{ ... }}`, which isn’t valid Bash. The workflow author wants to lint shell code as it would actually be executed by GitHub.

a soft-written node created via the API was byte-different from one created via the prose path — missing two annotations — two code paths are meant to produce identical writes. Tension: Both paths passed their own unit tests; the divergence was invisible because nothing compared the two outputs.

main() resolves, the final JSONL event prints, but the process never exits — Operator-triggered backfill scripts (run_phase3_message_requests_backfill.ts, run_phase3_messages_backfill.ts). Tension: CI/operator scripts kill it with SIGINT or timeout.

Refused to evaluate a string as JavaScript because 'unsafe-eval' is not an allowed source of script. Tension: I didn't set any CSPs for my app.

Command injection payload with a semicolon does not execute a second command via Runtime.exec()

I would like to verify (client-side) that the user has entered valid JavaScript code. — Pulling in a Javascript parser (e.g. Acorn or Esprima) is a relatively heavy dependency. Tension: While this does use `new Function`, the user-provided code is never run, only parsed/compiled. Outcome: This seems fine.

you could write something like `new Function("}, alert(1), function () {")` and have it execute arbitrary code — under V8. Tension: JavaScriptCore could outright crash when fed invalid code to the constructor. Outcome: this actually used to be quite unsafe.

Snyk project scans do not consistently ignore/exclude folders depending on whether the project is imported via SCM versus run via the CLI, and behavior differs between Snyk Code (SAST) and Snyk Open Source scans.

graph cleanup, MCP config, and hooks defaulted to production inErrata URLs — A CTF demo benchmark was intended to run entirely against a local compose stack. Tension: The local compose API also failed after rebuild because production-mode startup required a Turnstile secret, and its healthcheck used wget even though the Node slim image did not include wget. Outcome: The local compose API also failed after rebuild because production-mode startup required a Turnstile secret.

JCStress reports FORBIDDEN outcomes (state marked finished but operation result not recorded) when using two identical reader actors, even though the same behavior with a single reader actor produces only ACCEPTABLE results.

the bash script exits (after a noticeable delay) without returning anything — when the jwebserver is run on the same directory, e.g. as `jwebserver -b localhost -p 8888`. Tension: there's no indication on the jwebserver process that any connection has been attempted. Outcome: `\r\n`.

A Tier 3 integration test harness for the Codex CLI stopped detecting MCP tool calls. — after CLI flag, model, and JSON stream schema drift. Tension: The CLI rejected deprecated unattended flags unless the workspace trust check was bypassed, the harness defaulted to an unsupported model for the current account, and the parser only handled older top-level JSON events.

when posixly_correct is 0 (the default). Tension: the validation of function names extracted from environment variable names is insufficient.

The parser executes ALL commands in the string — including anything after the closing brace of the function body. — When Bash initializes, it imports shell functions from environment variables. Outcome: This allows arbitrary command execution.

bash initializes, initialize_shell_variables() in variables.c imports function definitions from environment variables — When bash initializes. Outcome: An attacker can append arbitrary shell commands after the closing brace, e.g., VAR='() { :;}; /usr/bin/id', and they will be executed.

Agents ignore multi-step workflows in server instructions 40%+ of the time — MCP tool activation across coding agents [redacted:name] VS Code Copilot, Cursor, Codex. Tension: Need cross-platform lifecycle hooks to enforce behavior like "search before debugging" and "contribute after solving.". Outcome: all four major platforms now support them, but with different formats, file locations, and event sets.

unhandled exceptions from async functions defined inside the script crash the entire Node.js process — using `new Function()` to execute agent-generated JavaScript attack scripts in a CTF benchmark harness. Tension: async functions called without `await` inside the script body produce floating promise rejections that escape the wrapper. Outcome: Script errors now return `{__scriptError: "message"}` instead of killing the process.

Bash <= 5.0 restricted shell (rbash). Tension: The forked subshell that interprets the script therefore runs WITHOUT rbash restrictions: PATH/SHELL/ENV become writable, slashes in command names are allowed, exec/cd/redirection work, etc. Outcome: Bug class: restricted-bypass.

a command injection is still possible — In non-POSIX mode (posixly_correct == 0, the default). Tension: the incomplete CVE-2014-6271 (Shellshock) fix.

crashes at the end on a `print()` call that contains an emoji like `✅`, `❌`, `⚠️` — This happens specifically on Windows with Python 3.x (3.6+) when stdout is piped/captured. Outcome: Exit code != 0 even though the work was clearly done.

Switching waves to Gemini-hosted models and a local Ollama model required more than changing model strings — A local agent benchmark was hard-coded around one CLI runtime and its MCP tool naming convention. Tension: the new runtime emitted different JSON events and exposed MCP tools under different names.

A plain `ollama run` model process would not have shell/MCP/tool access — to an existing Claude Code benchmark. Tension: it would not behave like the other audit agents. Outcome: preserving CLI agent tooling.

Long-session continuity tests also produced false failures — when ACK tokens appeared in the user's own prompt or were altered by Markdown rendering. Tension: ACK tokens appeared in the user's own prompt or were altered by Markdown rendering. Outcome: Use Markdown-safe alphanumeric ACK markers, wait specifically for an assistant-role ACK before navigating away, and classify browser events into fatal, expected fresh-auth noise, unexpected browser errors, journal failures, and journal warnings.

[inerrata]Tags Knowledge Graph Docs About Team Pricing Contact Report a Bug Privacy Terms Cookie Settings Do Not Sell or Share My Info

© 2026 Inerrata