unslothai/unsloth · warning · ValueError

Cell uses shell metacharacters / interpolation but --no-allo

Error message

Cell uses shell metacharacters / interpolation but --no-allow-shell was set; refusing to emit shell=True

What it means

Thrown by parseMaxOutputTokens (chat-providers-dialog.tsx:493-509) when the Max Tokens field is non-empty but fails /^\d+$/ — i.e. it contains anything other than plain digits. Only an empty field returns null (no override); any other content must be a non-negative integer in decimal digits, so signs, decimals, thousands separators, and exponent notation are all rejected.

Source

Thrown at scripts/notebook_to_python.py:105

def _emit_shell_command(indent: str, full_cmd: str, *, allow_shell: bool) -> list[str]:
    """Render a `!cmd` notebook line as Python statements.

    f-string interpolation, shell metacharacters, or multiline force
    shell=True (shlex.split would drop operators), flagged with a
    WARNING comment. Otherwise emit shell=False argv form. allow_shell
    False makes shell=True emission a hard error.
    """
    needs_f = needs_fstring(full_cmd)
    has_meta = bool(_SHELL_METACHARS_RE.search(full_cmd))
    multiline = "\n" in full_cmd

    must_use_shell = needs_f or has_meta or multiline

    if must_use_shell:
        if not allow_shell:
            raise ValueError(
                "Cell uses shell metacharacters / interpolation but "
                "--no-allow-shell was set; refusing to emit shell=True"
            )
        warn = f"{indent}# WARNING: shell=True; reviewed for hostile input"
        f_prefix = "f" if needs_f else ""
        if multiline:
            escaped_cmd = full_cmd.replace('"""', r"\"\"\"")
            if escaped_cmd.rstrip().endswith('"'):
                escaped_cmd = escaped_cmd.rstrip() + " "
            stmt = f'{indent}subprocess.run({f_prefix}"""{escaped_cmd}""", shell=True)'
        else:
            stmt = f"{indent}subprocess.run({f_prefix}{full_cmd!r}, shell=True)"
        return [warn, stmt]

    return [f"{indent}subprocess.run(shlex.split({full_cmd!r}), shell=False)"]


def convert_cell_to_python(source: str, *, allow_shell: bool = True) -> str:

View on GitHub (pinned to 203007d190)

Solutions

1. Enter plain digits only, e.g. '4096'.
2. Remove commas, decimals, units, and whitespace.
3. Leave the field empty entirely if you don't want a per-provider token override — empty is valid.

Example fix

// before
1,024

// after
1024

function isDigitsOnly(input: string): boolean {
  const t = input.trim();
  return t === '' || /^\d+$/.test(t);
}

When it happens

Trigger: Typing '1,024' (comma), '4.5', '-1', '1e5', '4096 ', or 'max' into the Max Tokens limit field of the custom provider dialog and submitting. The regex test at chat-providers-dialog.tsx:496 is the sole trigger.

Common situations: Users formatting numbers with locale separators; pasting values from docs that include units ('4096 tokens'); negative or float experiments; autocomplete inserting stray characters.

Related errors

• load error: {backend.load_progress()}
• load timed out
• model load did not reach ready
• unknown family '{name}'
• Refused notebook fetch from {host!r}: not in allowlist {sort

AI-assisted analysis of unslothai/unsloth@203007d190 (2026-08-15). Data as JSON: /api/errors/10c3bad8eee9752c. Report an issue: GitHub.