multica-ai/multica · error

command_name must be a single executable token; put argument

Error message

command_name must be a single executable token; put arguments in fixed_args

What it means

validateRuntimeProfileCommandName rejects command_name values containing spaces, tabs, or newlines. The field must be a single executable token (argv[0]); everything else belongs in fixed_args. This prevents clients from smuggling a full command line into one field, which the backend would otherwise exec incorrectly or unsafely.

Source

Thrown at server/internal/handler/runtime_profile.go:108

		// fixed_args are launch flags inherited by every agent on the runtime;
		// blank entries are always a client mistake.
		if strings.TrimSpace(a) == "" {
			return nil, errors.New("fixed_args entries must be non-empty")
		}
		if strings.ContainsRune(a, '\x00') {
			return nil, errors.New("fixed_args entries cannot contain NUL bytes")
		}
		clean = append(clean, a)
	}
	return json.Marshal(clean)
}

func validateRuntimeProfileCommandName(commandName string) error {
	if commandName == "" {
		return errors.New("command_name is required")
	}
	if strings.ContainsAny(commandName, " \t\r\n") {
		return errors.New("command_name must be a single executable token; put arguments in fixed_args")
	}
	if strings.ContainsRune(commandName, '\x00') {
		return errors.New("command_name cannot contain NUL bytes")
	}
	return nil
}

type createRuntimeProfileRequest struct {
	DisplayName    string   `json:"display_name"`
	ProtocolFamily string   `json:"protocol_family"`
	CommandName    string   `json:"command_name"`
	Description    *string  `json:"description"`
	FixedArgs      []string `json:"fixed_args"`
	Enabled        *bool    `json:"enabled"`
}

// CreateRuntimeProfile creates a workspace runtime profile. Admin-gated by the
// router. protocol_family is validated against the agent backend whitelist.

View on GitHub (pinned to 2c0912b6ec)

Solutions

1. Split the command line: first token into command_name, the rest into fixed_args
2. Trim the input and reject embedded newlines in the client form
3. Label the form fields explicitly ('Executable' vs 'Arguments') to guide users

Example fix

// before
{ command_name: "npx -y @scope/agent" }
// after
{ command_name: "npx", fixed_args: ["-y", "@scope/agent"] }

const parts = commandLine.trim().split(/\s+/);
const commandName = parts[0];
const fixedArgs = parts.slice(1);
if (/\s/.test(commandName)) throw new Error('Executable must be a single token');

function isSingleToken(s: string): boolean {
  return s.length > 0 && !/[ \t\r\n]/.test(s);
}

When it happens

Trigger: POST/PUT a runtime profile with command_name: "node server.js", "npx -y @scope/agent", or a value with a trailing \n from a textarea. Happens when a form has one 'command' box and the developer pastes the whole command line.

Common situations: Single-input UX for 'command' instead of separate command + args fields; shell snippets copied from docs into the command field; multi-line textarea values with invisible newlines.

Related errors

• fixed_args entries must be non-empty
• fixed_args entries cannot contain NUL bytes
• command_name is required
• command_name cannot contain NUL bytes
• Invalid desktop runtime config: ${field} must use http or ht

AI-assisted analysis of multica-ai/multica@2c0912b6ec (2026-08-15). Data as JSON: /api/errors/b4c5a9dfafc8d463. Report an issue: GitHub.