stablyai/orca · error · Error

Windows command tokens cannot contain quotes or line breaks.

Error message

Windows command tokens cannot contain quotes or line breaks.

What it means

Thrown by quoteCmdToken when a command or argument string contains a carriage return (\r), newline (\n), or double-quote ("). This is a security guard preventing cmd.exe command injection through crafted tokens, since the quoting strategy (windowsVerbatimArguments with /s /c) cannot safely embed those characters.

Source

Thrown at src/main/claude-accounts/windows-command-invocation.ts:9

export type WindowsCommandInvocation = {
  command: string
  args: string[]
  windowsVerbatimArguments: true
}

function quoteCmdToken(value: string): string {
  if (/[\r\n"]/.test(value)) {
    throw new Error('Windows command tokens cannot contain quotes or line breaks.')
  }
  const crtEscaped = value.replace(
    /(\\*)$/,
    (_match, backslashes: string) => `${backslashes}${backslashes}`
  )
  // Percent expansion still runs inside quotes, so briefly leave the quoted span to escape it.
  return `"${crtEscaped.replace(/%/g, '"^%"')}"`
}

export function buildWindowsCommandInvocation(
  command: string,
  args: string[],
  commandInterpreter = process.env.ComSpec ?? 'cmd.exe'
): WindowsCommandInvocation {
  const commandLine = [command, ...args].map(quoteCmdToken).join(' ')
  return {
    command: commandInterpreter,
    args: ['/d', '/v:off', '/s', '/c', `"${commandLine}"`],

View on GitHub (pinned to 1136503c6a)

Solutions

Do NOT pre-quote paths — buildWindowsCommandInvocation handles quoting internally. Pass raw unquoted paths.
Strip or reject newlines/quotes from user-supplied strings before passing them as command args.
If a multiline value is needed, write it to a temp file and pass the file path instead.
Audit the caller to ensure args are sanitized before reaching buildWindowsCommandInvocation.

Example fix

// before: pre-quoted path with embedded quotes causes the guard to fire
const invocation = buildWindowsCommandInvocation('"C:\\Program Files\\app\\orca.exe"', args)
// after: pass the raw path; quoteCmdToken adds the quotes
const invocation = buildWindowsCommandInvocation('C:\\Program Files\\app\\orca.exe', args)

Defensive patterns

Strategy: validation

Validate before calling

function isSafeWindowsToken(value: string): boolean {
  return !/[\r\n"]/.test(value)
}

// Before building the invocation:
if (!isSafeWindowsToken(command) || args.some(a => !isSafeWindowsToken(a))) {
  throw new Error('Rejecting unsafe command token before Windows invocation')
}

Try / catch

try {
  buildWindowsCommandInvocation(command, args)
} catch (error) {
  if (error instanceof Error && error.message.includes('cannot contain quotes or line breaks')) {
    // Sanitize or reject the offending token
    command = command.replace(/[\r\n"]/g, '')
  } else { throw error }
}

Prevention

Never pre-quote paths before passing to buildWindowsCommandInvocation.
Sanitize user-supplied strings: strip quotes and newlines before use as command args.
Write multi-line values to temp files and pass file paths instead.

When it happens

Trigger: buildWindowsCommandInvocation is called with a command or arg containing quotes or line breaks. This happens when resolveClaudeCommand() returns a path with embedded quotes, or when an arg passed to Claude includes a newline (e.g., a multi-line prompt or config value).

Common situations: A file path with spaces was incorrectly pre-quoted by the caller (adding embedded quotes). A multi-line environment variable or argument is passed through. A user-supplied string with special characters reaches the command builder without sanitization.

Related errors

AI-assisted analysis of stablyai/orca@1136503c6a (2026-08-12). Data as JSON: /api/errors/6cd9827c198bbd17. Report an issue: GitHub.