Environment
- Installed client:
jst 0.3.0 on macOS / zsh
- Production server tested on 2026-07-23
- Production model order during verification: Gemma 4 26B primary, Phi-4 fallback
Current behavior
The deployed server now translates the literal-metacharacter request safely, but the client rejects the returned command.
$ jst --dry print exactly '$(whoami) `date` ; ampersand & pipe | greater >'
jst: generated command contains unsafe terminal characters
Calling the production translation endpoint directly with the same request returned:
printf '%s\n' '$(whoami) `date` ; ampersand & pipe | greater >'
This command correctly keeps the shell metacharacters inside a single-quoted literal. The response also reported no reads, writes, network use, privilege use, or other side effects.
The rejection reproduced consistently through the installed client. Simpler literal text such as $(whoami) is displayed correctly.
Desired outcome
Allow safely quoted literal shell syntax to be displayed and reviewed while retaining protection against actual control characters and terminal escape sequences.
Potential direction:
- Identify exactly which character or pattern triggers the current guard.
- Distinguish printable shell metacharacters from terminal control/escape characters.
- Add tests for safe quoted backticks, substitutions, semicolons, pipes, ampersands, redirects, and
printf '%s\n'.
- Keep the guard fail-closed for genuine terminal-control output.
This is now a client output-validation issue rather than a model translation issue.
Environment
jst 0.3.0on macOS / zshCurrent behavior
The deployed server now translates the literal-metacharacter request safely, but the client rejects the returned command.
Calling the production translation endpoint directly with the same request returned:
This command correctly keeps the shell metacharacters inside a single-quoted literal. The response also reported no reads, writes, network use, privilege use, or other side effects.
The rejection reproduced consistently through the installed client. Simpler literal text such as
$(whoami)is displayed correctly.Desired outcome
Allow safely quoted literal shell syntax to be displayed and reviewed while retaining protection against actual control characters and terminal escape sequences.
Potential direction:
printf '%s\n'.This is now a client output-validation issue rather than a model translation issue.