Cline's run_commands mangled PowerShell/cmd quoting on a temp-folder cleanup, turning it into a drive-root `rmdir /s /q` that wiped ~1.5TB of a user's photos, videos, and documents (GitHub #14864)

On October 6, 2026, a user filed cline/cline issue #14864 after a Cline session running on Cline VS Code extension 4.1.22 with the `deepseek/deepseek-v4-flash` model, operating in Act mode on Windows, was asked to clean up a temp folder on the G: drive whose target subfolder had a Cyrillic name. Cline's `run_commands` tool issued the cleanup as an inline shell command, `cmd /c "rmdir /s /q \"g:\...\<folder>\""`, wrapped through PowerShell. The nested quoting in that command broke. A `\"`-escaped quote boundary caused the path PowerShell actually handed to `cmd` to collapse down to the root of the current drive rather than the intended subfolder, turning the command into a recursive, forced delete of the entire G: drive. A different user, mahirhir, reproduced the mechanism directly: working in a sandboxed `subst` drive on Windows 11 with PowerShell 5.1, they showed that the same command written with a backslash-escaped `\"` deleted everything except the locked working directory, while an equivalent command using a backtick escape instead preserved the files — and they stated plainly that "the Cyrillic segment plays no part," isolating the quoting syntax itself as the cause rather than the non-ASCII folder name the original reporter had suspected. The deletion destroyed approximately 1.5TB of the user's personal data — photos, videos, and documents across several named folders — plus the project Cline had been editing, though that project's code was recoverable from git since it had already been pushed. Recovery of the rest of the drive largely failed because it was an SSD using TRIM, which overwrites freed blocks and defeats most undelete tools. The reporter later noted that some of what was lost turned out to be non-critical or recoverable from other locations, while a commenter observed that "family photos usually never come back." Cline maintainer dominiccooney responded that the team had "decided we can't solve the problem of deciding what's a destructive command" and that command execution in Cline is simply "on or off" rather than classified by risk, so no guard existed to catch the malformed path before it ran. The maintainer acknowledged that "cmd quoting is very fragile," recommended PowerShell 7 over cmd for this reason, and floated running agent sessions inside Hyper-V VMs and adding a `-WhatIf` dry-run step before destructive commands — but none of these had shipped as of publication, and the issue remained open.