The isolation preamble on the first tool result has no trailing newline, so it runs into
the first line of the command's output.
First shell call of an MCP session, command: "echo hi; uname -sr; id -u":
[husk] local computer cmp_r8cqtrfad0ed on real Linux via wsl:Ubuntu. This is a guarded
working directory, NOT a sandbox: /work is jailed and destructive commands are refused,
but it shares the host kernel and network. Start Docker for real isolation.hi
Linux 6.18.33.2-microsoft-standard-WSL2
0
isolation.hi — the banner and echo hi share a line.
The banner itself is doing its job and doing it well. It is accurate for the provider that
was actually selected, it says NOT a sandbox in the one place a model will definitely
read, it names the computer id, and it correctly does not repeat on the second call. It is
the best version of that idea I have seen. It just needs one \n.
Why it is worth the one character
A model that parses the first line of stdout — head -1, a split('\n')[0], an
expectation that a command's output starts where the output starts — gets the tail of a
sentence about Docker prepended to it. On echo hi that is obvious. On a command whose
first line is the answer, and whose contract is "the first line is the answer", it is a
wrong answer that looks like a right one.
It also makes the banner harder to read, which is a shame given how carefully it is
worded.
Observed with @husk-ai/mcp 0.1.3 on the local provider via WSL2. I did not check
whether the same join happens on the container providers, but the concatenation looks like
it is in the tool-result assembly rather than anything provider-specific.
The isolation preamble on the first tool result has no trailing newline, so it runs into
the first line of the command's output.
First
shellcall of an MCP session,command: "echo hi; uname -sr; id -u":isolation.hi— the banner andecho hishare a line.The banner itself is doing its job and doing it well. It is accurate for the provider that
was actually selected, it says
NOT a sandboxin the one place a model will definitelyread, it names the computer id, and it correctly does not repeat on the second call. It is
the best version of that idea I have seen. It just needs one
\n.Why it is worth the one character
A model that parses the first line of
stdout—head -1, asplit('\n')[0], anexpectation that a command's output starts where the output starts — gets the tail of a
sentence about Docker prepended to it. On
echo hithat is obvious. On a command whosefirst line is the answer, and whose contract is "the first line is the answer", it is a
wrong answer that looks like a right one.
It also makes the banner harder to read, which is a shame given how carefully it is
worded.
Observed with
@husk-ai/mcp0.1.3 on thelocalprovider via WSL2. I did not checkwhether the same join happens on the container providers, but the concatenation looks like
it is in the tool-result assembly rather than anything provider-specific.