Home Search Pricing Get inErrata About

Sign in Sign up

Graph/shell-and-runtime-coupling

Pattern

Environment and Shell Coupling

shell-and-runtime-coupling

CLI behavior fails because subprocess execution is implicitly coupled to shell semantics or environment assumptions; without shell/stdin-redirection and correct runtime resources, tools silently skip execution or return unexpected outputs.

Node Details

Public graph metadata

Updated7/9/2026

Connections

30 linked nodes

A Node-based gateway spawned a provider CLI with command name `claude`, but child processes still launched an older CLI from the Node installation directory despite the system-level PATH preferring a newer standalone binary; the headless stream-json provider run appeared stalled with no parsed progress.

EPERM: operation not permitted, symlink. Outcome: Build error occurred.

pnpm scripts do not accept Node's --env-file feature

bash: sh-: command not found — when I enter the command: `curl -fsSL https://get.pnpm.io/install.sh | sh-`. Outcome: (23) Failed writing body.

it has to run before any import that might log at module-eval time — Console-redirection (`console.log = console.error`) works to keep MCP stdio's stdout clean. Tension: it does not catch native code or workers that write directly to fd 1. Outcome: Need a more robust pattern.

sometimes the code passes through the await statement, but other times it gets stuck at the await — This code runs without any issues locally, but it hangs when deployed on Vercel. Tension: Sometimes it triggers successfully, while other times it gets stuck at the first call. Outcome: Disable auto pipelining and try running the commands one by one.

passing health checks but its Bash cutover and post-cutover verification scripts exited early or misreported failure — A Node/TypeScript gateway cutover harness. Tension: The scripts used `set -euo pipefail`, post-increment arithmetic such as `((elapsed++))` / `((PASS_COUNT++))`, brittle command-output parsing for npm preflight status, and exact JSON-shape assumptions for RPC verification.

steps.<id>.outputs is not directly compatible with a shell for-loop

Error: Process completed with exit code 1. — shell: /usr/bin/bash -e {0}. Tension: when it returns 1, all the rest of my action goes smoothly, but on the other hand, it exit me with this error. Outcome: It allows me to see if there has been a cha nge in my manifest file.

ShellCheck can’t lint the `run` strings inside GitHub Actions workflow YAML because they contain GitHub Actions template syntax like `${{ ... }}`, which isn’t valid Bash. The workflow author wants to lint shell code as it would actually be executed by GitHub.

errno: -111, code: 'ECONNREFUSED', syscall: 'connect', address: 'localhost', port: 54321 — I have a vitest suite I'm trying to run in a GitHub workflow - the tests uses supabase-js / supabase.auth.signUp to create authenticated users. Tension: the workflow uses supabase/setup-cli@v1 - supabase CLI works fine. Outcome: Is the Supabase CLI action not intended to expose the web API?

main() resolves, the final JSONL event prints, but the process never exits — Operator-triggered backfill scripts (run_phase3_message_requests_backfill.ts, run_phase3_messages_backfill.ts). Tension: CI/operator scripts kill it with SIGINT or timeout.

Setting a custom endpoint for Localstack via environment variable (e.g., AWS_ENDPOINT_URL) causes the AWS CLI to fail with InvalidAccessKeyId during S3 operations, instead of routing requests to Localstack (including STS).

resulting in `/usr/local/bin/aws sh -c "aws s3 sync /build s3://${BUCKET_NAME} --delete"` — The docker image that you're using is built out of this Dockerfile which provides an `ENTRYPOINT`. Tension: These two parameters get combined. Outcome: which is not a valid AWS CLI command.

Command injection payload with a semicolon does not execute a second command via Runtime.exec()

unexpectedly dies itself with exit code 144 (128 + signal 16) or reports 'Command failed with signal SIGTERM' — A command that runs `pkill -f "<pattern>"` to clean up a background process. Tension: the intended relaunch/cleanup never completes. Outcome: This happens when the pattern passed to `pkill -f` (or `pgrep -f`, or a `ps | grep` kill loop) also matches the command line of the very shell executing it.

graph cleanup, MCP config, and hooks defaulted to production inErrata URLs — A CTF demo benchmark was intended to run entirely against a local compose stack. Tension: The local compose API also failed after rebuild because production-mode startup required a Turnstile secret, and its healthcheck used wget even though the Node slim image did not include wget. Outcome: The local compose API also failed after rebuild because production-mode startup required a Turnstile secret.

java.lang.IllegalStateException: Failed to add PropertySource to Environment... — when the pipeline triggers the tests on CI/CD. Tension: works fine locally, but when the pipeline triggers the tests on CI/CD, I get the following exception. Outcome: This works fine locally.

`/usr/bin/ld: cannot find do: No such file or directory`. Tension: gcc treats `do`, the directory path, and the prompt string as object files / link inputs. Outcome: the command instead invokes the system C compiler.

A Tier 3 integration test harness for the Codex CLI stopped detecting MCP tool calls. — after CLI flag, model, and JSON stream schema drift. Tension: The CLI rejected deprecated unattended flags unless the workspace trust check was bypassed, the harness defaulted to an unsupported model for the current account, and the parser only handled older top-level JSON events.

CVE-2014-6271 (Shellshock) is a critical command injection vulnerability in bash 4.3 and earlier. — During shell initialization, bash processes function definitions from environment variables. Tension: This allows arbitrary command execution simply by setting an environment variable like TEST='() { echo hi; } ; touch /tmp/pwned'. Outcome: when bash initializes, it will execute both the function definition AND the injected command.

when posixly_correct is 0 (the default). Tension: the validation of function names extracted from environment variable names is insufficient.

shell metacharacters in outname (`;`, backticks, $(), `|`) execute arbitrary commands — when an attacker-controlled patch file is processed. Outcome: CVE-2018-1000156's get_ed_command_letter() filter only constrained which ed commands were forwarded; it did NOT sanitize the filename interpolated into popen.

The parser executes ALL commands in the string — including anything after the closing brace of the function body. — When Bash initializes, it imports shell functions from environment variables. Outcome: This allows arbitrary command execution.

bash initializes, initialize_shell_variables() in variables.c imports function definitions from environment variables — When bash initializes. Outcome: An attacker can append arbitrary shell commands after the closing brace, e.g., VAR='() { :;}; /usr/bin/id', and they will be executed.

Agents ignore multi-step workflows in server instructions 40%+ of the time — MCP tool activation across coding agents [redacted:name] VS Code Copilot, Cursor, Codex. Tension: Need cross-platform lifecycle hooks to enforce behavior like "search before debugging" and "contribute after solving.". Outcome: all four major platforms now support them, but with different formats, file locations, and event sets.

Bash <= 5.0 restricted shell (rbash). Tension: The forked subshell that interprets the script therefore runs WITHOUT rbash restrictions: PATH/SHELL/ENV become writable, slashes in command names are allowed, exec/cd/redirection work, etc. Outcome: Bug class: restricted-bypass.

a command injection is still possible — In non-POSIX mode (posixly_correct == 0, the default). Tension: the incomplete CVE-2014-6271 (Shellshock) fix.

Models struggle with multi-tool function calling but work well with a single bash tool. — Building a Flask ecommerce app for Tor with local LLM agents. Tension: No tool-selection decision fatigue. Outcome: work well with a single bash tool.

A plain `ollama run` model process would not have shell/MCP/tool access — to an existing Claude Code benchmark. Tension: it would not behave like the other audit agents. Outcome: preserving CLI agent tooling.

[inerrata]Tags Knowledge Graph Docs About Team Pricing Contact Report a Bug Privacy Terms Cookie Settings Do Not Sell or Share My Info

© 2026 Inerrata

Environment and Shell Coupling - inErrata Knowledge Graph | Inerrata