Fix: remediate agent executing TypeScript identifiers as bash commands #88

New issue

david · 2026-07-31T10:13:14Z

david commented

2026-07-31 10:13:14 +00:00

Problem

The remediate agent (Stage 3) has bash in its tool allowlist and is executing TypeScript identifiers as shell commands:

/bin/sh: line 1: MrResultAutoMerge: command not found
/bin/sh: line 1: autoMerge: command not found

This is systematic - the remediate skill says to re-run the projects build/test/lint commands but does not specify which commands. The agent sees TypeScript identifiers in the code and hallucinates them as shell commands.

Root Cause

REMEDIATE_SKILL_BODY (step 4) says: Re-run the gates. Run the projects build/test/lint commands
No guidance on which commands to run
Agent sees TypeScript identifiers (MrResultAutoMerge, autoMerge) and tries to execute them

Fix

File 1: src/skills/remediateSkill.ts

Replace step 4 with two new steps adding project detection:

package.json scripts section
pyproject.toml project.scripts or tool sections
Cargo.toml cargo test, cargo build, cargo clippy
Makefile make build, make test, make lint, make check
AGENTS.md Commands section if present

File 2: src/remediate/helpers/buildRemediateWrapper.ts

Add guardrail language: Detect commands from project files before running. Only execute commands you found in project files.

Files Changed

src/skills/remediateSkill.ts
src/remediate/helpers/buildRemediateWrapper.ts

Validation

Run batch mode on TypeScript project
Verify remediate agent runs npm run build/test/lint instead of hallucinated commands
Verify fix works for Python/Rust projects too

## Problem The remediate agent (Stage 3) has bash in its tool allowlist and is executing TypeScript identifiers as shell commands: ``` /bin/sh: line 1: MrResultAutoMerge: command not found /bin/sh: line 1: autoMerge: command not found ``` This is systematic - the remediate skill says to re-run the projects build/test/lint commands but does not specify which commands. The agent sees TypeScript identifiers in the code and hallucinates them as shell commands. ## Root Cause - REMEDIATE_SKILL_BODY (step 4) says: Re-run the gates. Run the projects build/test/lint commands - No guidance on which commands to run - Agent sees TypeScript identifiers (MrResultAutoMerge, autoMerge) and tries to execute them ## Fix ### File 1: src/skills/remediateSkill.ts Replace step 4 with two new steps adding project detection: - package.json scripts section - pyproject.toml project.scripts or tool sections - Cargo.toml cargo test, cargo build, cargo clippy - Makefile make build, make test, make lint, make check - AGENTS.md Commands section if present ### File 2: src/remediate/helpers/buildRemediateWrapper.ts Add guardrail language: Detect commands from project files before running. Only execute commands you found in project files. ## Files Changed - src/skills/remediateSkill.ts - src/remediate/helpers/buildRemediateWrapper.ts ## Validation - Run batch mode on TypeScript project - Verify remediate agent runs npm run build/test/lint instead of hallucinated commands - Verify fix works for Python/Rust projects too

david commented

2026-07-31 10:14:52 +00:00

Fix Applied

Both files updated and all 1064 tests pass:

src/skills/remediateSkill.ts — added project detection step before re-running gates
src/remediate/helpers/buildRemediateWrapper.ts — added guardrail language

Changes:

Step 4 now tells the agent to detect build commands from project files first
Step 5 tells the agent to only run commands found in project files
Step 6 (was step 5) — carry forward what you cannot fix

Validation:

All unit tests pass
Ready for batch mode testing on TypeScript project
Fix also covers Python, Rust, and other project types

## Fix Applied Both files updated and all 1064 tests pass: - `src/skills/remediateSkill.ts` — added project detection step before re-running gates - `src/remediate/helpers/buildRemediateWrapper.ts` — added guardrail language ### Changes: 1. **Step 4** now tells the agent to detect build commands from project files first 2. **Step 5** tells the agent to only run commands found in project files 3. **Step 6** (was step 5) — carry forward what you cannot fix ### Validation: - All unit tests pass - Ready for batch mode testing on TypeScript project - Fix also covers Python, Rust, and other project types

Sign in to join this conversation.