fix(shell): preserve heredoc contexts and reject arithmetic placeholders by waleedlatif1 · Pull Request #8342 · simstudioai/sim

waleedlatif1 · 2026-09-26T21:27:43Z

Summary

Preserve shell quote state across heredocs and track direct environment reads inside expanding bodies without treating literal bodies or delimiters as reads.
Reject placeholders in Bash arithmetic syntax ($((...)), $[...], ((...)), array subscripts, numeric [[ ... ]] comparisons, and statically named let arguments), including nested substitutions, before Bash can re-evaluate their values.
Share arithmetic context ancestry so nested placeholders do not duplicate scanner stacks.
Preserve array-shaped command arguments while rejecting actual array assignments, including those following comments. Keep redirection paths outside builtin arithmetic argument contexts.

Type of Change

Bug fix

Testing

Compiler and scanner suites: 185 passed, 3 existing skips; Bash runtime regressions cover literal arguments and direct environment reads.
Verified regressions fail on the original compiler and independently disabled each fix to confirm its tests fail.
Application type-check, lint, all 51 audits, block registry audit, and docs manifest check passed.
Regenerated agent stream docs, docs manifest, and skill links; no generated changes.

Checklist

Code follows project style guidelines
Self-reviewed my changes
Tests added/updated and passing (new tests pass the test-audit authoring gate)
No new warnings introduced
I confirm that I have read and agree to the terms outlined in the Contributor License Agreement (CLA)

vercel · 2026-09-26T21:27:48Z

The latest updates on your projects. Learn more about Vercel for GitHub.

1 Skipped Deployment

Project	Deployment	Actions	Updated
docs	Skipped		Sep 26, 2026 10:28pm UTC

cubic-dev-ai

No issues found across 2 files

Confidence score: 5/5

Automated review surfaced no issues in the provided summaries.
No files require special attention.

_{Re-trigger cubic}

greptile-apps · 2026-09-26T21:34:53Z

Confidence Score: 5/5

[Medium risk] Adds validation to reject placeholders in shell arithmetic contexts.

The PR appears safe to merge; no outstanding previous finding or actionable new issue remains.

Summary

The PR updates the shell placeholder scanner to preserve context across heredocs, recognize arithmetic positions, and distinguish array assignments from literal arguments. It adds compiler and runtime regressions for those cases.

Diagram

%%{init: {'theme': 'neutral'}}%%
flowchart LR
  Source[Shell source] --> Scan[Scan quote, command, and heredoc contexts]
  Scan --> Classify{Placeholder context}
  Classify -->|Arithmetic| Reject[Reject bound placeholder]
  Classify -->|Supported shell text| Compile[Compile binding]
  Classify -->|Literal heredoc or delimiter| Preserve[Preserve literal text]

_{Reviews (7) · Last reviewed commit: "fix(shell): preserve placeholders in let..."}

waleedlatif1 · 2026-09-26T21:45:57Z

@greptile

waleedlatif1 · 2026-09-26T21:45:59Z

@cubic-dev-ai review this PR

cubic-dev-ai · 2026-09-26T21:46:04Z

@cubic-dev-ai review this PR

@waleedlatif1 I have started the AI code review. It will take a few minutes to complete.

waleedlatif1 · 2026-09-26T21:50:32Z

@greptile

waleedlatif1 · 2026-09-26T21:50:33Z

@cubic-dev-ai review this PR

cubic-dev-ai · 2026-09-26T21:50:39Z

@cubic-dev-ai review this PR

@waleedlatif1 I have started the AI code review. It will take a few minutes to complete.

cubic-dev-ai

All reported issues were addressed across 2 files

_{Reply with feedback, questions, or to request a fix.

Fix all with cubic | Re-trigger cubic}

waleedlatif1 · 2026-09-26T22:04:33Z

@greptile

waleedlatif1 · 2026-09-26T22:04:34Z

@cubic-dev-ai review this PR

cubic-dev-ai · 2026-09-26T22:04:39Z

@cubic-dev-ai review this PR

@waleedlatif1 I have started the AI code review. It will take a few minutes to complete.

cubic-dev-ai

All reported issues were addressed across 2 files

_{Reply with feedback, questions, or to request a fix.

Fix all with cubic | Re-trigger cubic}

waleedlatif1 · 2026-09-26T22:15:38Z

@greptile

waleedlatif1 · 2026-09-26T22:15:39Z

@cubic-dev-ai review this PR

cubic-dev-ai · 2026-09-26T22:15:44Z

@cubic-dev-ai review this PR

@waleedlatif1 I have started the AI code review. It will take a few minutes to complete.

waleedlatif1 · 2026-09-26T22:22:31Z

@greptile

waleedlatif1 · 2026-09-26T22:22:32Z

@cubic-dev-ai review this PR

cubic-dev-ai · 2026-09-26T22:22:37Z

@cubic-dev-ai review this PR

@waleedlatif1 I have started the AI code review. It will take a few minutes to complete.

cubic-dev-ai

No issues found across 2 files

Confidence score: 5/5

Automated review surfaced no issues in the provided summaries.
No files require special attention.

_{Re-trigger cubic}

waleedlatif1 · 2026-09-26T22:28:32Z

@greptile

waleedlatif1 · 2026-09-26T22:28:33Z

@cubic-dev-ai review this PR

cubic-dev-ai · 2026-09-26T22:28:39Z

@cubic-dev-ai review this PR

@waleedlatif1 I have started the AI code review. It will take a few minutes to complete.

cubic-dev-ai

No issues found across 2 files

Confidence score: 5/5

Automated review surfaced no issues in the provided summaries.
No files require special attention.

_{Re-trigger cubic}

cubic-dev-ai Bot reviewed Sep 26, 2026

View reviewed changes

greptile-apps Bot reviewed Sep 26, 2026

View reviewed changes

Comment thread apps/sim/lib/execution/code-placeholders/shell.ts

vercel Bot temporarily deployed to Preview September 26, 2026 21:45 Inactive

greptile-apps Bot reviewed Sep 26, 2026

View reviewed changes

Comment thread apps/sim/lib/execution/code-placeholders/shell.ts

vercel Bot temporarily deployed to Preview September 26, 2026 21:50 Inactive

cubic-dev-ai Bot reviewed Sep 26, 2026

View reviewed changes

Comment thread apps/sim/lib/execution/code-placeholders/shell.ts

Comment thread apps/sim/lib/execution/code-placeholders/shell.ts

waleedlatif1 force-pushed the codex/shell-placeholder-context-safety branch from 934b442 to b9b0e8c Compare September 26, 2026 22:04

vercel Bot temporarily deployed to Preview September 26, 2026 22:04 Inactive

cubic-dev-ai Bot reviewed Sep 26, 2026

View reviewed changes

Comment thread apps/sim/lib/execution/code-placeholders/shell.ts Outdated

vercel Bot temporarily deployed to Preview September 26, 2026 22:15 Inactive

greptile-apps Bot reviewed Sep 26, 2026

View reviewed changes

Comment thread apps/sim/lib/execution/code-placeholders/shell.ts

vercel Bot temporarily deployed to Preview September 26, 2026 22:22 Inactive

cubic-dev-ai Bot reviewed Sep 26, 2026

View reviewed changes

greptile-apps Bot reviewed Sep 26, 2026

View reviewed changes

Comment thread apps/sim/lib/execution/code-placeholders/shell.ts

waleedlatif1 added 7 commits September 26, 2026 15:27

fix(shell): preserve heredoc contexts and reject arithmetic placeholders

b7c2635

fix(shell): reject arithmetic array subscript placeholders

d213168

fix(shell): share nested arithmetic context ancestry

c4deb37

fix(shell): distinguish array assignments from command arguments

449d127

fix(shell): reject placeholders in numeric conditional operands

a9c27d8

fix(shell): reject arithmetic placeholders passed to let

bc172c0

fix(shell): preserve placeholders in let redirection paths

29d9576

waleedlatif1 force-pushed the codex/shell-placeholder-context-safety branch from d19f0ad to 29d9576 Compare September 26, 2026 22:28

vercel Bot temporarily deployed to Preview September 26, 2026 22:28 Inactive

cubic-dev-ai Bot reviewed Sep 26, 2026

View reviewed changes

Conversation

waleedlatif1 commented Sep 26, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Summary

Type of Change

Testing

Checklist

Uh oh!

vercel Bot commented Sep 26, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

cubic-dev-ai Bot left a comment

Choose a reason for hiding this comment

Uh oh!

greptile-apps Bot commented Sep 26, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Confidence Score: 5/5

Summary

Uh oh!

Uh oh!

waleedlatif1 commented Sep 26, 2026

Uh oh!

waleedlatif1 commented Sep 26, 2026

Uh oh!

cubic-dev-ai Bot commented Sep 26, 2026

Uh oh!

Uh oh!

waleedlatif1 commented Sep 26, 2026

Uh oh!

waleedlatif1 commented Sep 26, 2026

Uh oh!

cubic-dev-ai Bot commented Sep 26, 2026

Uh oh!

cubic-dev-ai Bot left a comment • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

waleedlatif1 commented Sep 26, 2026

Uh oh!

waleedlatif1 commented Sep 26, 2026

Uh oh!

cubic-dev-ai Bot commented Sep 26, 2026

Uh oh!

cubic-dev-ai Bot left a comment • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Uh oh!

waleedlatif1 commented Sep 26, 2026

Uh oh!

waleedlatif1 commented Sep 26, 2026

Uh oh!

cubic-dev-ai Bot commented Sep 26, 2026

Uh oh!

Uh oh!

waleedlatif1 commented Sep 26, 2026

Uh oh!

waleedlatif1 commented Sep 26, 2026

Uh oh!

cubic-dev-ai Bot commented Sep 26, 2026

Uh oh!

cubic-dev-ai Bot left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

waleedlatif1 commented Sep 26, 2026

Uh oh!

waleedlatif1 commented Sep 26, 2026

Uh oh!

cubic-dev-ai Bot commented Sep 26, 2026

Uh oh!

cubic-dev-ai Bot left a comment

Choose a reason for hiding this comment

Uh oh!

This branch was previously deployed

Reviewers

Assignees

Labels

waleedlatif1 commented Sep 26, 2026 •

edited

Loading

vercel Bot commented Sep 26, 2026 •

edited

Loading

greptile-apps Bot commented Sep 26, 2026 •

edited

Loading

cubic-dev-ai Bot left a comment •

edited

Loading

cubic-dev-ai Bot left a comment •

edited

Loading