Harden the terminal tool's permission system to reject commands containing shell substitutions and interpolations ($VAR, ${VAR}, $(…), backticks, $((…)), <(…), >(…)) before they reach terminal creation.

Changes

Shell command parser (shell_command_parser)

• Added structured terminal command-prefix extraction with env-var prefix support
• Added parser-backed validation that classifies commands as Safe/Unsafe/Unknown
• Extended normalized command extraction to include scalar env-var assignments in order
• Preserved quoted assignment values when they contain whitespace or special characters

Pattern extraction (agent/pattern_extraction)

• Updated terminal pattern extraction to use structured parser output
• Included env-var prefixes in generated allow patterns
• Normalized regex token boundaries to \s+ while preserving display whitespace

Tool permissions (agent/tool_permissions)

• Added invalid-terminal-command rejection for forbidden substitutions/interpolations
• Added unconditional allow-all bypass (global default Allow, or terminal-specific Allow with empty patterns)
• Preserved hardcoded denial precedence over allow-all

Terminal tool (agent/tools/terminal_tool)

• Updated tool description and input schema to explicitly prohibit shell substitutions
• Added comprehensive SEC-264 regression test suite (20 new tests) covering:
  • All forbidden constructs (${HOME}, $1, $?, $$, $@, $(whoami), backticks, $((1+1)), <(ls), >(cat), env-prefix variants, multiline, nested)
  • Allow-all exception paths (global and terminal-specific)
  • Hardcoded-denial precedence
  • Env-prefix permission flow (matching, value mismatch rejection, multiple assignments, quoted whitespace)

Closes SEC-264

Release Notes:

• Terminal tool permissions regexes can now match environment variables (e.g. FOO=bar cmd arg1 arg2)
• If terminal tool permissions have active permissions regexes running on them, then bare interpolations like $FOO are disallowed for security, since regexes wouldn't be able to match on them.