fix: shell-escape package names in npm install commands (CWE-78)

src/__tests__/tools-security.test.ts

@@ -654,7 +654,7 @@ describe("package install inline validation", () => {
     const tool = tools.find((t) => t.name === "install_npm_package")!;
     await tool.execute({ package: "axios" }, ctx);
     expect(conway.execCalls.length).toBe(1);
-    expect(conway.execCalls[0].command).toBe("npm install -g axios");
+    expect(conway.execCalls[0].command).toBe("npm install -g 'axios'");
   });
 
   it("install_npm_package allows scoped packages", async () => {

src/agent/tools.ts

@@ -559,7 +559,7 @@ export function createBuiltinTools(sandboxId: string): AutomatonTool[] {
         if (!/^[@a-zA-Z0-9._\/-]+$/.test(pkg)) {
           return `Blocked: invalid package name "${pkg}"`;
         }
-        const result = await ctx.conway.exec(`npm install -g ${pkg}`, 60000);
+        const result = await ctx.conway.exec(`npm install -g ${escapeShellArg(pkg)}`, 60000);
 
         const { ulid } = await import("ulid");
         ctx.db.insertModification({
@@ -955,7 +955,7 @@ Model: ${ctx.inference.getDefaultModel()}
         if (!/^[@a-zA-Z0-9._\/-]+$/.test(pkg)) {
           return `Blocked: invalid package name "${pkg}"`;
         }
-        const result = await ctx.conway.exec(`npm install -g ${pkg}`, 60000);
+        const result = await ctx.conway.exec(`npm install -g ${escapeShellArg(pkg)}`, 60000);
 
         if (result.exitCode !== 0) {
           return `Failed to install MCP server: ${result.stderr}`;

src/self-mod/tools-manager.ts

@@ -9,6 +9,7 @@ import type {
   AutomatonDatabase,
   InstalledTool,
 } from "../types.js";
+import { escapeShellArg } from "../shell-escape.js";
 import { logModification } from "./audit-log.js";
 import { ulid } from "ulid";
 
@@ -29,7 +30,7 @@ export async function installNpmPackage(
   }
 
   const result = await conway.exec(
-    `npm install -g ${packageName}`,
+    `npm install -g ${escapeShellArg(packageName)}`,
     120000,
   );
 

src/shell-escape.ts

@@ -0,0 +1,7 @@
+/**
+ * Escape a string for safe interpolation into a shell command.
+ * Wraps in single quotes and escapes any embedded single quotes.
+ */
+export function escapeShellArg(arg: string): string {
+  return `'${arg.replace(/'/g, "'\\''")}'`;
+}