python -m, stdin programs, and deno/bun eval or kill-named scripts could still tear down a managed graphical desktop after the shell guard tokenized the command.
Co-authored-by: Cursor Agent <cursoragent@cursor.com>
Co-authored-by: cynarAI <cynarAI@users.noreply.github.com>
The desktop-protection shell guard inspected shell syntax and nested
bash -c, but not script files passed to python, node, perl, ruby, or
php. Read small workspace scripts and reject kill-family contents, and
fall back to a kill/pkill/killall/xkill filename when the path cannot
be read.
Co-authored-by: Cursor Agent <cursoragent@cursor.com>
Co-authored-by: cynarAI <cynarAI@users.noreply.github.com>
The desktop-protection shell guard only walked nested shell -c programs,
so interpreter inline code could still invoke kill/pkill. Inspect python/
node/perl/ruby/php -c/-e/-r payloads for the same lifecycle kills.
Co-authored-by: Cursor Agent <cursoragent@cursor.com>
Co-authored-by: cynarAI <cynarAI@users.noreply.github.com>
