fix(tools): execute bash commands as argv with shell=False

[tripathiji1312]

Summary

run_bash_tool previously ran subprocess.run(command, shell=True), handing the command string to /bin/sh. Shell metacharacters were live, so a prompt like echo hi > /dev/sda or |sh could execute arbitrary commands — the tool was effectively a remote shell for any agent with tool access.

Changes

• Commands are parsed with shlex.split and executed as argv with shell=False: metacharacters become inert literal tokens (a redirection attempt fails to exec instead of writing to disk).
• The dangerous-command blocklist is checked both on the raw string and on the parsed token list, closing two bypasses of the old substring check:
  • r""m -rf / (quoted-concat hides the rm substring)
  • rm -r -f / (split flags evade the rm -rf substring)
• New blocklist entries: rm -r -f, rm --recursive --force, rm -rf /, chmod 777.
• Rejected commands are logged and recorded in agent short memory as Blocked (security): ...; unparseable input (unbalanced quotes, NUL bytes) is rejected without execution.

Tests

• New tests/structs/test_autonomous_loop_utils.py (20 tests): raw-string and argv-level blocklist coverage, quoted-concat and split-flag bypasses, NUL/empty argv rejection, shell-metacharacter inertness (>/dev/sda, |sh fail to exec), benign command execution, and short-memory recording of blocked commands.

[github-actions]

Hello there, thank you for opening an PR ! 🙏🏻 The team was notified and they will get back to you asap.