fix: prevent heredoc command injection in _check_bash_command

[shunfeng8421]

Summary

Fix command injection vulnerability in _check_bash_command() via heredoc delimiter bypass.

Vulnerability

The function used shell=True with a heredoc to pass bash commands to bash -n. The heredoc delimiter SOUNIQUEEOF was hardcoded. An attacker controlling the command string could inject this delimiter to break out of the heredoc and execute arbitrary shell commands via shell=True.

Fix

Replace subprocess.run(cmd, shell=True) with subprocess.run(["bash", "-n"], input=command), which passes the command via stdin pipe instead of heredoc. Eliminates shell=True and prevents delimiter injection.