Bash tool: unquoted env preamble breaks every command when an env var value contains newlines

Version: 2.1.222
OS: macOS 25.5.0 (darwin). Shell: zsh.
Related: #83243, #83871.

Description

The Bash tool adds a preamble to each command. The preamble holds the environment variables. The tool writes each variable as an unquoted NAME=value line. The user command is on the last line.

The tool does not quote the values. Therefore a value that holds a newline becomes shell source text. If that value also holds braces, the shell cannot parse the script. Then every Bash tool call in the session fails. echo 0 also fails.

The shell gives this error for every command:

zsh:57: parse error near `}'

Evidence

I recorded $ZSH_EXECUTION_STRING from ~/.zshenv to get the generated script. I removed the secret values.

export TMPPREFIX=/tmp/claude/zsh
PROJECT_DIR=/path/to/project
...
JWT_JWKS_STATIC={
  "keys": [
    {
      "use": "sig",
      "kty": "RSA"
    }
  ]
}
...
: && setopt NO_EXTENDED_GLOB NO_BARE_GLOB_QUAL 2>/dev/null || true && ... && eval 'echo 0' < /dev/null && pwd -P >| /tmp/claude-<uid>/cwd-<pid>

The shell reads JWT_JWKS_STATIC={ as the start of a command group. The shell then fails at the closing brace on line 57. The user command is on line 70. The shell does not run it.

direnv set this variable from a project .envrc file. A PEM key in the environment corrupts the preamble in the same way. A PEM key holds no braces, thus the shell gives command not found messages instead of a parse error.

How to repeat the fault

1. Set an environment variable that holds a newline and braces:

``sh
export FOO=$'a{\nb\n}'
``

1. Start Claude Code.
2. Run any Bash tool call. The call fails.

You can also put these lines in a project .envrc file:

export JWT_JWKS_STATIC='{
  "keys": []
}'

Expected behavior

Bash tool calls run correctly for all environment variable values.

Effect

• The shell shows a parse error on every shell call. No command runs.
• The shell does not get the full environment. The assignments do not run.
• The shell runs the additional lines of a multi-line value as commands. This is a command injection.

Suggested correction

Escape each environment variable value for the target shell. Do this before you pass the environment to the shell.