PIMP MY IDEBack to dispatches
October 11, 2026 / shell hygiene / command lookup

Your tilde can take the wrong exit.

A quoted ~ inside PATH can stay literal. Command lookup then follows a directory under the current working directory instead of your home.

Inspect the stored value, not the line you remember typing. Use $HOME when a path must survive quoting, shells, and future edits.

The shell reads syntax before it stores text

Disconnect3d found a warning from the nono sandbox about a writable ~/.local/bin/ entry in PATH. The configuration used export PATH="$PATH:~/.local/bin/". The quotes protected the whole value, so the tilde did not expand to the home directory.[1]

Bash documents the trigger in exact terms. Tilde expansion starts when a word begins with an unquoted tilde. Bash also checks unquoted tilde prefixes after the first equals sign and after colons in variable assignments.[2]

Quotes protect the string you wrote. They do not preserve the expansion you meant.

A literal tilde is a relative route

The stored entry ~/.local/bin does not begin with a slash. It can therefore point under the process's current working directory. Disconnect3d demonstrated the result by creating ./~/.local/bin/, placing an executable there, and running it through a literal-tilde PATH.[1]

This is more than a broken shortcut. If an untrusted project can create that relative directory and a process starts there, command lookup can reach the project's executable. The original post treats the result as a security concern, and nono surfaced it as a writable PATH entry. The exact exposure still depends on the working directory, process, permissions, and command order.

Use the expansion that works inside quotes

Write export PATH="$PATH:$HOME/.local/bin". The dollar sign keeps its parameter-expansion role inside double quotes. POSIX says double quotes preserve most characters but retain the special meaning of the dollar sign for parameter expansion.[3]

An unquoted assignment such as PATH=$PATH:~/.local/bin expands in Bash. The Bash manual supports that form.[2] It still asks a future edit to preserve shell-specific parsing. The explicit $HOME form says what should be stored and lets the quotes protect spaces in the expanded value.

Audit the value that programs inherit

Search the active value one entry at a time. The source post suggests echo "$PATH" | tr ':' '\n' | grep '~' as a quick check.[1] Use printf in scripts when you want predictable output. Then inspect the startup files that produced each match.

The customs bay below models the three assignments. It is a teaching fixture. It does not execute shell code or inspect your machine. Change the working directory to see why the literal route moves.

Interactive teaching fixture

PATH customs bay

Traditional purpose: a shell quoting explainer, path visualizer, warning, and copyable repair. This bay connects them so the selected source line visibly becomes a stored entry and a lookup route.

SourceStartup line
ShellExpansion
PATHStored entry
LookupResolved route

Choose the assignment

The radios change the same PATH entry. The working directory matters only when the stored entry remains relative.

Choose a PATH assignment

Try /tmp/build with the quoted tilde selected.

EXPLICIT HOMEABSOLUTE ROUTE

Expansion radiograph

The shell expands $HOME inside double quotes. The stored entry is absolute.

Source lineexport PATH="$PATH:$HOME/.local/bin"
Stored PATH entry/home/dev/.local/bin
Lookup candidate for tool/home/dev/.local/bin/tool
HOME ROUTE KEPTThe value is quoted and the home directory is explicit.
Copyable inspection receipt

Record the route you checked

The bay fills this template from the selected teaching state. Replace its sample values with output from your shell before treating the audit as evidence.

Sources read / October 11, 2026 UTC

Source log

Open the evidence boundary
  1. Disconnect3d, "The tilde in your PATH may not be your HOME", read October 11, 2026. This supplies the nono warning, quoted-assignment example, literal-relative-path demonstration, repair, and audit command.
  2. GNU Bash manual, "Tilde Expansion", read October 11, 2026. This supports when Bash expands an unquoted tilde and its special handling of variable assignments after equals signs and colons.
  3. POSIX.1-2024, Shell Command Language, double quotes, read October 11, 2026. This supports the statement that a dollar sign keeps its parameter-expansion role inside double quotes.
  4. Hacker News discussion, item 50042425, verified through the official item API and read October 11, 2026. We used it only as the current-interest signal.

Evidence boundary: Pimp My IDE read the named post, Bash manual, POSIX shell text, and discussion route. We did not test every shell or startup-file combination. The browser fixture uses a fixed sample home directory and performs no command lookup.