Field notes from building an agent toolkit

Array-form spawn stops shell metacharacters cold — we proved it by executing every generated command with a live payload. It does nothing about a value that starts with a dash, because the program parses its own argv.

Five loaders resolved a name to a file. Four enumerated a directory and matched; one joined the name onto a path. Only one of them had a path traversal, and it was reachable by prompt injection.

Three whitespace quantifiers sitting next to each other turned a security hook into a denial of service — and because the hook fails open, the denial of service was also a bypass. With the measurements and the fix.

Session bundles exist to be passed around. Two JSON fields in one built filesystem paths — one reached a recursive delete, the other planted an always-on rule file. The CLI printed success for both.

It caught modified files and deleted files. An added file was advisory — exit code 0 — and in a toolkit that loads every markdown file in a directory as instructions, an added file is the whole attack.

A fixed-size excerpt whose cost scaled with the file. The fix is four lines, but the interesting part is the multi-byte detail that makes a naive byte window wrong, and writing the test as a memory bound rather than a timing bound.

BM25 scores are not normalised, so a fixed minimum score is a bet on corpus size. One memory in our store was mathematically unreachable at any size, and the search returned nothing while working perfectly.

A hydration error named an innocent component. The real cause was a cache-first service worker serving dev chunks that Turbopack reuses without content hashes — and the stale bundle re-registered the worker, closing the loop.