Skip to content

docs+feat: prevent shell expansion of backticks in multi-line body flags #93

@flipbit03

Description

@flipbit03

Problem

The Set up your AI agent section tells agents to call lineark via their shell tool, which is correct. However, when agents pass multi-line content (issue descriptions, comment bodies) via -d or --body flags, they naturally use inline double-quoted strings — and backticks inside those strings get interpreted as shell command substitutions by the shell.

Example of what goes wrong

An agent writes:

lineark issues create "My issue" --team E -d "Use `cgr k3s health` to check pod status"

The shell executes `cgr k3s health` as a command, gets empty output (command not found), and the description is silently corrupted to "Use to check pod status".

This is especially painful in issue descriptions that reference CLI tool names in backticks — a very common pattern in technical documentation.

Suggested fixes

1. README: document the single-quoted heredoc pattern

Add a note in the Set up your AI agent section recommending the single-quoted heredoc pattern for multi-line content:

lineark issues create "My issue" --team E -d "$(cat <<'EOF'
Use `cgr k3s health` to check pod status.

Backticks and $variables are safe here.
EOF
)"

The single-quoted 'EOF' delimiter disables all shell expansion inside the heredoc, so backticks, $variables, and other shell-special characters are passed through literally.

2. Feature: stdin support (-d -) for body flags

The more robust solution is to support reading body content from stdin when - is passed as the value:

cat <<'EOF' | lineark issues create "My issue" --team E -d -
Use `cgr k3s health` to check pod status.

Backticks and $variables are safe here.
EOF

This composes naturally with shell pipes, requires no temp file, and sidesteps any sandbox or filesystem access issues that --body-file would have. It also covers --body on comments create and any other flag that accepts multi-line text.

Both fixes are complementary: the README tip is immediately actionable, and stdin support is the long-term clean solution.

Metadata

Metadata

Assignees

No one assigned

    Labels

    No labels
    No labels

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions