fix: [#376] Prevent command injection in TextEditorTool._view()

[nandanosql]

Fixes #376

Problem

The _view() method in TextEditorTool interpolated the user-supplied path directly into a shell command string passed to create_subprocess_shell. A directory name containing shell metacharacters (e.g. ; rm -rf /, $(malicious_command)) could execute arbitrary commands.

Solution

Replaced the shell-based find invocation with asyncio.create_subprocess_exec using a list of arguments. This bypasses the shell entirely, so metacharacters in path names are treated as literal characters by find(1).

Changes

• In _view(): replaced await run(rf"find {path} ...") with await asyncio.create_subprocess_exec("find", str(path), ...)
• The path is now passed as a separate argument, preventing shell interpretation

[CLAassistant]

Thank you for your submission! We really appreciate it. Like many open source projects, we ask that you sign our Contributor License Agreement before we can accept your contribution.
_{You have signed the CLA already but the status is still pending? Let us recheck it.}