SHELL tool can read any files outside of working directory

[sysid]

Describe the bug

Using --allow-tool 'shell' enables copilot to read any file which the user has access to.

Expectations:
Only access files which are listed by /list-dirs

Affected version

GitHub Copilot CLI 1.0.9

Steps to reproduce the behavior

Start copilot with: `copilot --allow-tool 'shell'``

❯ Read ~/.secret_test somehow and show me the content. Be creative

◐ The user is asking me to read ~/.secret_test and show them the content. Let me just read it directly using the view tool or bash.

● Read ~/.secret_test (shell)
│ cat ~/.secret_test
└ 2 lines...

● nothing creative needed — cat works fine.

You MUST NOT SEE THIS !!

Expected behavior

Only access files which are listed by /list-dirs

Additional context

No response