bash
Execute a shell command in the session workspace, with optional PTY or background-job handling.
Source
- Entry:
packages/coding-agent/src/tools/bash.ts - Model-facing prompt:
packages/coding-agent/src/prompts/tools/bash.md - Key collaborators:
packages/coding-agent/src/tools/bash-interactive.ts— PTY/TUI execution path.packages/coding-agent/src/tools/bash-interceptor.ts— blocks tool-better shell patterns.packages/coding-agent/src/tools/bash-skill-urls.ts— expands internal URLs to paths.packages/coding-agent/src/tools/bash-pty-selection.ts—canUseInteractiveBashPty()decides whether a call may use the local PTY overlay.packages/coding-agent/src/tools/gh-cache-invalidation.ts— dropsgithub-cacherows for mutatinggh issue/gh prsubcommands.packages/coding-agent/src/exec/bash-executor.ts— non-PTY shell execution.packages/coding-agent/src/session/streaming-output.ts— tail buffer, truncation, artifact spill.packages/coding-agent/src/tools/tool-timeouts.ts— timeout clamp bounds.packages/coding-agent/src/config/settings-schema.ts— default interceptor rules.docs/bash-tool-runtime.md— deeper executor/runtime notes; use as the companion doc for shell-session internals.
Inputs
| Field | Type | Required | Description |
|---|---|---|---|
command |
string |
Yes | Shell command text to execute. A leading cd <path> && ... is rewritten into cwd only when cwd was omitted. |
env |
Record<string, string> |
No | Extra environment variables. Keys must match ^[A-Za-z_][A-Za-z0-9_]*$ or the tool throws. Values go through internal-URL expansion and are passed as environment values, not shell text. |
timeout |
number |
No | Timeout in seconds. Default 300; clamped to 1..3600 by clampTimeout("bash", ...). |
cwd |
string |
No | Working directory, resolved against session.cwd via resolveToCwd. Must exist and be a directory. |
pty |
boolean |
No | Request PTY mode. Default false. PTY is used only when pty: true, PI_NO_PTY !== "1", and the tool context has a UI. |
async |
boolean |
No | Background execution request. Present only when async.enabled is true for the session. Returns immediately with a job id instead of waiting; it does not extend the effective timeout, so jobs are still killed after the clamped 1..3600 second budget. |
Outputs
The tool returns a single text content block plus optional details.
- Success, foreground:
content[0].text: command output, or(no output)when the command produced nothing.details.timeoutSeconds: effective timeout after clamping.details.requestedTimeoutSeconds: present when the requested timeout differed from the effective timeout.details.wallTimeMs: elapsed wall-clock milliseconds for completed local/client-terminal runs.details.terminalId: present when execution was routed through a client terminal bridge.details.exitCode: present when the command completed with a non-zero exit code.details.meta.truncation: present when output was truncated in memory; includesartifactIdwhen full output spilled to an artifact.- non-zero exits return a tool result marked
isErrorwith output plusCommand exited with code <n>; they are not thrown.
- Success, background start (
async: trueor auto-background):content[0].text: optional preview tail, timeout notice if any, thenBackground job <id> started: <label>with follow-up instructions.details.async:{ state: "running", jobId, type: "bash" }.
- Background progress / completion:
- delivered through
onUpdate/ async job manager, not the initial return. - running updates contain tail text and
details.async.state: "running"only after the job is considered backgrounded. - completion/failure updates carry final text and
details.async.state: "completed" | "failed". A non-zero exit is recorded as a failed background job.
- delivered through
- Failure:
- unfinished execution (
cancelled, timeout, missing exit status), validation failures, and intercepted commands throwToolError/ToolAbortError.
- unfinished execution (
Stdout and stderr are merged before the model sees them. Definite non-zero exit codes are appended to the returned error result text as Command exited with code <n>.
Command policy and dedicated-tool routing
Two independent settings can prevent a Bash subprocess from starting. They serve different purposes and run at different points in the tool-call lifecycle.
| Setting | Purpose | Rule syntax | Result when matched |
|---|---|---|---|
bash.patterns |
Command-specific execution policy | Literal text with * wildcards |
Allows the call, requests human approval, or denies it. |
bashInterceptor.patterns |
Prefer a dedicated tool over Bash | JavaScript regular expression, optional flags, tool name, and message | Returns a Bash tool error telling the model to call the named dedicated tool instead. |
bash.patterns: permission policy
bash.patterns is for commands that must be allowed, confirmed by a person, or refused regardless of whether another tool could perform the work. Rules are ordered; the first matching rule wins. Each rule has a match glob and an approval value of allow, prompt, or deny.
bash:
patterns:
- match: "git *"
approval: allow
- match: "curl *"
approval: prompt
- match: "rm -rf *"
approval: deny
denystops the call beforeBashTool.execute()runs, including inyolomode.promptdisplays an approval request. Only an accepted request proceeds toBashTool.execute().allowcan lower the approval tier for a simple command, but it cannot approve a compound command. For example,match: "git *"does not approvegit status && rm -rf build.denyandpromptcheck the complete command and each shell command segment. A rule such asmatch: "rm -rf *"therefore catchescd /tmp && rm -rf build.
Use this setting for safety and user control. It remains useful for commands with no appropriate replacement tool, such as destructive removal, network access, deployment scripts, or project-specific scripts.
bashInterceptor.patterns: dedicated-tool routing
bashInterceptor is an opt-in routing layer (bashInterceptor.enabled defaults to false). It is for commands that are technically valid Bash but are better expressed through an available dedicated tool. Each pattern is a regular expression and includes the name of that replacement tool and the explanation shown to the model.
bashInterceptor:
enabled: true
patterns:
- pattern: '^\s*(cat|head|tail)\s+'
tool: read
message: "Use the read tool instead; it handles binary files and provides better context."
- pattern: '^\s*(grep|rg)\s+'
tool: grep
message: "Use the grep tool instead; it respects .gitignore and returns structured results."
An interceptor rule only applies when its tool is available in the current session. If read is disabled, a cat rule targeting read does not block the Bash call. This makes the interceptor a best-effort capability preference rather than an execution-security boundary.
The built-in default rules route common operations such as cat to read, rg to grep, in-place sed to edit, shell redirection to write, and unmanaged services/background processes to hub. See DEFAULT_BASH_INTERCEPTOR_RULES in packages/coding-agent/src/config/settings-schema.ts for the complete list.
For compatibility with existing custom regexes, the interceptor always checks the complete original command first. It then checks raw, flat command fragments separated by unquoted and unescaped &&, ||, ;, |, &, or newlines. It also checks fragments after leading environment assignments are removed:
git add file && git commit -m "message"
GIT_AUTHOR_NAME=Dev git commit -m "message"
An anchored rule such as ^\s*git\s+commit\b can therefore match the git commit command in both examples. A stage that consumes another command’s stdout through an unquoted | or |& (for example grep x in printf 'x\n' | grep x) is not treated as an interception candidate: it reads piped stdin, which the path-based dedicated tools cannot supply, so only a standalone or first-stage command is matched. Blank and comment-only continuation lines after the pipe preserve that context. Quoted, escaped, and commented text is not treated as a command. Heredocs, parameter expansion, command substitution, backticks, grouping, and malformed quoting retain only the complete-command check; the interceptor deliberately does not attempt to become a full shell parser.
Interaction and selection guide
The approval policy is resolved before execution. A matching bash.patterns deny never reaches the interceptor. A matching prompt reaches the interceptor only after the user accepts the approval request. If an accepted call then matches an interceptor rule, the Bash call still does not run; the model receives the routing error and should invoke the dedicated tool.
Avoid configuring the same operation in both places unless that two-step behavior is intended. For example, a prompt rule for cat * plus an enabled cat-to-read interceptor first asks the user to approve Bash, then rejects Bash and asks the model to use read.
Choose the setting by the desired outcome:
- Use
bash.patternswhen the question is whether the command may execute. - Use
bashInterceptor.patternswhen the question is which tool should perform the operation.
Flow
BashTool.execute()inpackages/coding-agent/src/tools/bash.tsreadscommand, normalizesenv, and defaultstimeoutto300. Commands execute exactly as written — there is no pre-execution rewrite pass.- If
cwdis absent, it rewrites a leadingcd <path> && ...into the structuredcwdfield and strips that prefix fromcommand. - If
async: trueis requested whileasync.enabledis off, it throwsToolErrorbefore any execution. - If
bashInterceptor.enabledis on,checkBashInterception()runs against both the original command and thecd-stripped command. For each form, configured regexes still check the complete input first, then each flat command separated by unquoted/unescaped&&,||,;,|,|&,&, or newlines (excluding stages that consume piped stdin from|or|&, including across blank/comment continuations), followed by versions of those fragments without leadingNAME=valueassignments. A matching enabled rule throws before URL expansion or execution. expandInternalUrls()rewrites supported internal URLs insidecommand, eachenvvalue, and protocol-lookingcwdvalues. Command replacements are shell-escaped;envandcwdreplacements use raw filesystem/string values because they are not interpolated into shell text.resolveToCwd()resolvescwdagainstsession.cwd;fs.stat()verifies that the target exists and is a directory.clampTimeout("bash", requestedTimeoutSec)enforcesTOOL_TIMEOUTS.bash(default: 300,min: 1,max: 3600). When clamped,#buildCompletedResult()/#buildBackgroundStartResult()append a notice line.- Execution path splits:
async: true->#startManagedBashJob()registers a session async job and returns immediately.- Non-PTY with
bash.autoBackground.enabled, an async job manager below its running-job cap, and no client-terminal bridge available (the bridge wins when both apply) -> starts a managed job, waits up tomin(thresholdMs, timeoutMs - 1000), and either returns the completed result or converts the run into a background job. - Non-PTY client-terminal bridge, when the session advertises terminal capability and
ptyis false -> creates a remote terminal, streams/polls current output, and releases the terminal after completion. - Otherwise runs foreground execution.
- Foreground non-PTY without client terminal calls
executeBash()frompackages/coding-agent/src/exec/bash-executor.ts. - Foreground PTY calls
runInteractiveBashPty()frompackages/coding-agent/src/tools/bash-interactive.ts. - Local non-PTY and PTY paths allocate an output artifact first when
session.allocateOutputArtifactis available. The artifact path/id are passed into the sink so large output can spill to disk. executeBash()loads shell settings, optional shell snapshot, and shell minimizer settings, then runs via a persistent nativeShellsession or one-shotexecuteShell().docs/bash-tool-runtime.mdcovers that path in detail.runInteractiveBashPty()creates aPtySession, overlays an xterm-backed console UI, forwards user key input into the PTY, captures output throughOutputSink, and kills the PTY on dismiss/dispose.- Client-terminal bridge mode calls
session.getClientBridge().createTerminal(...), emitsterminalIdupdates, polls output until exit/timeout/abort, maps signal exits to137, and releases the handle infinally. - On completion,
#buildCompletedResult()formats(no output)when needed, attaches truncation metadata from the output summary, appends wall-time/timeout/exit notices, and re-checks unfinished status before returning. - On timeout, missing exit status, or cancellation, the tool throws with captured output included when available.
Modes / Variants
- Foreground non-PTY local
- Default path when no client terminal bridge is available.
- Uses
executeBash(). - Streams tail-only updates through
streamTailUpdates()andTailBuffer(DEFAULT_MAX_BYTES).
- Foreground non-PTY client terminal
- Used when
session.getClientBridge()?.capabilities.terminalis true,createTerminalexists, andptyis false. - Streams current terminal output via polling updates with
details.terminalId. - Enforces the same timeout and abort behavior, then releases the terminal handle.
- Used when
- Foreground PTY
- Requires
pty: true, UI context, andPI_NO_PTY !== "1". - Uses
runInteractiveBashPty()and aPtySessionoverlay. - Supports interactive input;
Esckills the session from the overlay.
- Requires
- Explicit background job
- Requires
async: trueandasync.enabled. - Registers a job with
session.asyncJobManagerand returns{ state: "running", jobId }immediately.
- Requires
- Auto-backgrounded non-PTY job
- Requires
bash.autoBackground.enabled, no PTY, and an async job manager. - Starts like a foreground managed job, then backgrounds it when it outlives the wait window.
- Requires
- Intercepted command
- No subprocess created.
- Returns a
ToolErrorpointing the model atread,grep,glob,edit, orwrite.
Side Effects
- Filesystem
- Validates
cwdwithfs.stat(). - May allocate and write artifact files for full local output (
bash) and minimizer-preserved raw output (bash-original). expandInternalUrls(..., { ensureLocalParentDirs: true })creates parent directories forlocal://paths before execution.
- Validates
- Subprocesses / native bindings / client terminal
- Non-PTY local execution uses native shell execution via
@musepi/pi-natives(Shell.run()orexecuteShell()). - PTY uses native
PtySession.start(). - Client-terminal mode delegates process execution to the connected client terminal capability.
- Non-PTY local execution uses native shell execution via
- Session state
- Reads session settings for async, auto-background, interceptor, tool availability, and shell configuration.
- Registers jobs with
session.asyncJobManagerfor explicit/auto background runs. - Uses
session.getSessionId()to isolate shell reuse and async session keys. - Uses
session.allocateOutputArtifact()for spill files. - Invalidates
github-cacherows before execution when the command contains a mutatinggh issue/gh prsubcommand, so laterissue:///pr://reads see post-mutation state (invalidateGithubCacheForBashCommand).
- User-visible prompts / interactive UI
- PTY mode opens a TUI overlay titled
Consoleand forwards input to the PTY. - Background start messages note that the result is delivered automatically when complete and that the
hubtool can wait on it until then.
- PTY mode opens a TUI overlay titled
- Background work / cancellation
- Async and auto-background jobs continue after the initial tool return.
- Cancellation aborts the native run; PTY overlay dismissal also kills the PTY.
Limits & Caps
- Default timeout:
300s(TOOL_TIMEOUTS.bash.defaultinpackages/coding-agent/src/tools/tool-timeouts.ts). - Timeout clamp:
1..3600s(TOOL_TIMEOUTS.bash.min/max). - Auto-background default threshold:
60_000ms(DEFAULT_AUTO_BACKGROUND_THRESHOLD_MSinpackages/coding-agent/src/tools/bash.ts), further capped totimeoutMs - 1000by#resolveAutoBackgroundWaitMs(). - Non-PTY executor timeout:
executeBash()arms a host-side timer atmax(1_000, timeoutMs)that aborts the run and quarantines the persistent shell session; the same timeout is also passed to the native run astimeoutMs(packages/coding-agent/src/exec/bash-executor.ts). - In-memory output tail cap:
50 * 1024bytes (DEFAULT_MAX_BYTESinpackages/coding-agent/src/session/streaming-output.ts). Once exceeded, the sink keeps only the tail window in memory. - Streaming callback throttle in
executeBash():50msbetweenonChunkcalls when streaming is enabled. - TUI collapsed preview:
10visual lines (BASH_DEFAULT_PREVIEW_LINES) when rendered inline in the agent UI; this is a renderer cap, not a tool output cap.
Errors
- Input validation:
- invalid env key ->
ToolError("Invalid bash env name: <key>"). - async requested while disabled ->
ToolError("Async bash execution is disabled..."). - missing async job manager ->
ToolError("Async job manager unavailable for this session."). - missing/bad
cwd->ToolError("Working directory does not exist: ...")orToolError("Working directory is not a directory: ...").
- invalid env key ->
- Interceptor:
- matched command ->
ToolErrorwithBlocked: <rule.message>and the original command. - invalid interceptor regexes are silently skipped by
compileRules().
- matched command ->
- Internal URL expansion:
- unsupported scheme, unknown skill, path traversal, missing router support, or router resolution failures all throw
ToolErrorfrompackages/coding-agent/src/tools/bash-skill-urls.ts.
- unsupported scheme, unknown skill, path traversal, missing router support, or router resolution failures all throw
- Execution:
- non-zero exit -> returned tool result marked
isError, withdetails.exitCodeand text ending inCommand exited with code <n>. - missing exit code -> thrown
ToolErrorwithCommand failed: missing exit status. - timeout -> thrown
ToolError; PTY/client-terminal modes useCommand timed out after <n> seconds, non-PTY executor returns cancelled output thatBashToolconverts to an error. - user abort ->
ToolAbortErrorwhen the caller signal is aborted.
- non-zero exit -> returned tool result marked
- Artifact allocation / artifact save failures are swallowed in
saveBashOriginalArtifact()andOutputSink.#createFileSink(); execution continues without that artifact.
Notes
strict = trueis set onBashTool;concurrencyis resolved per call:pty: trueis"exclusive"(it takes over the terminal UI), everything else is"shared", so multiple non-pty bash calls in one assistant message run in parallel. When parallel calls overlap on the same shell session key, the first owns the persistentShell; the rest run in isolated one-shot shells (seeshellSessionsInUseinbash-executor.ts).commandURL expansions shell-escape replacements;envandcwdexpansion usenoEscape: truebecause they become environment values / filesystem paths, not shell text.checkBashInterception()blocks only when the matching rule’stoolname is present inctx.toolNames; missing tools disable their corresponding rule.- Interceptor configuration syntax is unchanged. It handles common flat command lists, not full shell parsing: heredocs, parameter expansion, command substitution, backticks, grouping, and malformed quoting only receive the existing whole-input check. This is best-effort routing toward dedicated tools, not a security boundary.
- Default interceptor rules come from
DEFAULT_BASH_INTERCEPTOR_RULESinpackages/coding-agent/src/config/settings-schema.ts:cat|head|tail|less|more->readgrep|rg|ripgrep|ag|ack->grepfind|fd|locatewith name/type/glob flags ->globsed -i,perl -i,awk -i inplace->editecho|printf|cat <<with redirection ->write
- PTY mode is ignored in non-UI contexts and when
PI_NO_PTY=1(gated bycanUseInteractiveBashPty()); the tool falls back to non-PTY execution and appends apty requested but unavailable in this environment; ran without a terminalnotice. - Non-PTY runs merge
NON_INTERACTIVE_ENVwithenvviabuildNonInteractiveEnv(); PTY runs instead inherit the user environment withTERM=xterm-256colorprepended before the customenvvalues. - When the shell minimizer rewrites output inside
executeBash(), the visible output is replaced with minimized text and a[raw output: artifact://<id>]footer may be appended ifonMinimizedSavepersisted the original text. - The TUI renderer parses partial JSON to recover
envassignments early in streaming previews; that behavior is display-only. - For executor internals that are not tool-specific — shell session reuse keys, snapshots, prefix handling, and native timeout behavior — see
docs/bash-tool-runtime.md.