Path traversal + shell injection in LLM tool sandbox

[consigcody94]

Found via code audit. core/tools.py:226-242. LLM-controlled path joined to workspace with no traversal check. Also shell=True subprocess on line 188 with bypassable blocklist (rm -r -f /).

[Xiangyue-Zhang]

Found via code audit. core/tools.py:226-242. LLM-controlled path joined to workspace with no traversal check. Also shell=True subprocess on line 188 with bypassable blocklist (rm -r -f /).

The issue has been fixed and verified locally: the tool path is now restricted to the workspace, command execution no longer uses shell interpretation, and regression testing has been added.