tool-call-rules

Enforce single-line shell tool calls to prevent permission matching from splitting embedded newlines into separate bash commands, ensuring deterministic execution and avoiding heredocs or line continuations.

Multi-line shell commands trigger permission errors because security systems often split embedded newlines into separate commands. Using single-line bash commands avoids this by ensuring the entire command is evaluated as one deterministic execution block.

To write single-line bash commands for strict permission environments, avoid heredocs, line continuations, and cross-line wildcards. Split complex tasks into multiple separate single-line tool calls instead of using multi-line scripts.

Yes, heredocs and line continuations break bash tool call determinism by introducing embedded newlines that risk splitting commands during permission checks. Single-line execution guarantees deterministic command processing.

The best way to handle complex shell tasks under strict permission rules is splitting them into multiple single-line tool calls. This approach avoids multi-line commands and cross-line wildcards while maintaining deterministic execution.