Invoke-FalconRTR fails to accept spaces for mac devices

[xephora]

When you try to utilize the Invoke-FalconRTR command to run commands on a mac device particularly with the ls command, the following error occurs below (see error details):

Even though the argument value -Arguments "/Users/$username/Library/Application Support/" is encase with double quotes, the script takes it as 2 separate arguments. I made sure this was isolated to just mac, I performed multiple commands in a similar manner to multiple Windows devices and I do not receive this error. I am able to replicate this error on numerous mac devices. Just to be 100% I took that exact path /users/username/Library/Application Support/ and manually entered it into RTR
web interface and it works fine. I just started to learn about PSFalcon and Powershell so I really wanted to make sure I wasn't the culprit of this issue. If this was indeed something on my end, I apologize for wasting your time.

error details:

PS C:\users\profile> Invoke-FalconRTR -Command ls -Arguments "/Users/$username/Library/Application Support/" -HostIds $host_id.device_id
Format-Result : 40012: Max args is 1. 2 were provided
At C:\Users\profile\Documents\WindowsPowerShell\Modules\psfalcon\2.0.8\Private\Private.ps1:981 char:17
+                 Format-Result -Response $Response -Endpoint $Endpoint
+                 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
    + CategoryInfo          : NotSpecified: (StatusCode: 400...ication/json
}:HttpResponseMessage) [Format-Result], Exception
    + FullyQualifiedErrorId : 4fb09809-8406-42c8-9cba-d1349a4c318c,Format-Result

[xephora]

I found a work around which fixed my issue, I had to stack quotes.

Example:

Invoke-FalconRTR -Command ls -Arguments "'/users/profile/Library/Application Support/'" -HostIds $host_id.device_id

[bk-cs]

The 40012: Max args is 1. 2 were provided error is coming from the Real-time Response API, not PSFalcon. You found the correct solution already--when you use one set of quotes, it's effectively passing what would look like this in the Real-time Response UI:

ls /users/$username/Library/Application Support/

Real-time Response interprets that space as two separate arguments, so by using double quotes like you did, you're passing the following (proper) command instead:

ls '/users/$username/Library/Application Support/'