Cline's tool-call JSON repair silently executed truncated write_file and terminal arguments as valid

1. Instruction given

   None specific to this bug — the defect lives in Cline's tool-call streaming pipeline itself and can trigger during any task where the model's tool-call arguments get cut off mid-value, most commonly by hitting a max_tokens limit while still writing a long string argument (file contents, a terminal command, a commit message).

2. Expected behavior

   When a streamed tool call's arguments are truncated mid-value, Cline should surface the truncation as a recoverable error so the model can retry with the full argument, rather than treating the incomplete data as a successfully parsed tool call and executing it.

3. Actual behavior

   Cline's experimental_repairToolCall path falls back to the jsonrepair library when standard JSON parsing of a streamed tool call fails. jsonrepair closes unterminated strings as-is instead of rejecting them, so a tool call cut off mid-argument comes out as syntactically valid but semantically corrupted JSON — and Cline executed it without any warning that truncation had occurred. Because the affected code path is generic (ai-sdk.ts's registration of experimental_repairToolCall, and json.ts's use of jsonrepair), it applies to any tool accepting a free-form string argument, including write_file (file contents) and terminal/shell command execution. The reporter's minimal repro fed a truncated write_file call — `{"path":"config/database.yml","content":"production:\n host: db.prod.internal\n password: correct-horse-battery-sta` — into the parsing path and got back a valid-looking object with the cut-off password string, no error raised.

4. Damage

   No named production incident was reported alongside this issue — it was filed as a code-level defect with a reproduction, not a user recounting data loss. The risk it describes is real regardless: any write_file or terminal argument truncated mid-string by a max_tokens limit would be silently written or executed with corrupted content (e.g. a cut-off password or config value landing on disk, or a partial shell command running) with no diagnostic signal to the model or the user. Cline's maintainers treated the report as credible — it was assigned to a maintainer and fixed in PR #13015, merged six days later on 2026-08-12, which adds truncation detection that rejects unterminated strings instead of repairing them.

Classification

Agent

Cline

Failure mode

Logic Error

Root cause

Other

Domain

Infra

Source

Github Issue