The tilde in your PATH may not be your HOME
- ID
- 34335
- Status
- summarized
- Published
- 11 Oct 2026, 8:13 PM
- Fetched
- 12 Oct 2026, 6:40 AM
- Provider
- Hacker News
- Category
- dev-community
- Original URL
- https://disconnect3d.pl//2026/10/02/dont-put-tilde-in-your-path/
- Source URL
- https://hnrss.org/best
Summary
- Score
- 7.0
- Created
- 12 Oct 2026, 6:40 AM
- Tags
- Audience
- developersvibe_codersai_agent_users
What happened
The post shows that `export PATH="$PATH:~/.local/bin/"` leaves a literal `~` in PATH instead of expanding it to `$HOME`, so the entry points at `./~/.local/bin/` relative to the current directory. It was noticed via a nono agent sandbox warning, and the article demonstrates that a binary named `kek` compiled into `./~/.local/bin/` was found and executed. The fix is to use `$HOME` (e.g. `export PATH="$PATH:$HOME/.local/bin/"`); unquoted `$PATH:~/.local/bin` may work but is fragile. The HN thread has 195 points and 135 comments.
Why it matters
Developers who maintain Bash/Zsh dotfiles should run `echo "$PATH" | tr ':' '\n' | grep '~'` and, if it prints anything, replace `~` with `$HOME` in `.bashrc`/`.zshrc`/`.profile`. Otherwise a writable `./~/.local/bin` directory can cause the shell to execute a local binary unexpectedly, and agent sandboxes may warn about it. No direct Malaysia/SEA angle is in the text; the impact is for local builders who maintain shell configs or use agent sandboxes.
Discussion angle
Run the one-liner live and compare quoted vs unquoted tilde expansion; then debate whether sandbox tools like nono should make writable-PATH warnings more verbose by default.