From 91201720e2fbb3130d228543152279eb389b8003 Mon Sep 17 00:00:00 2001
From: Slobodan Ilic <slobodan@icloud.com>
Date: Mon, 27 Apr 2026 14:39:39 +0000
Subject: [PATCH] fix: sandbox deny patterns - use (\s|$) instead of \b for
 find / and ls /

---
 pkg/tools/shell.go | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkg/tools/shell.go b/pkg/tools/shell.go
index 5f4103dcf..83bbdbb3c 100644
--- a/pkg/tools/shell.go
+++ b/pkg/tools/shell.go
@@ -95,8 +95,8 @@ var (
 		regexp.MustCompile(`\bssh\b.*@`),
 		regexp.MustCompile(`\beval\b`),
 		regexp.MustCompile(`\bsource\s+.*\.sh\b`),
-		regexp.MustCompile(`\bfind\s+/\b`),       // find / - traverse entire filesystem
-		regexp.MustCompile(`\bls\s+/\b`),         // ls / - list root directory
+		regexp.MustCompile(`\bfind\s+/(\s|$)`),   // find / - traverse entire filesystem
+		regexp.MustCompile(`\bls\s+/(\s|$)`),     // ls / - list root directory
 	}
 
 	// absolutePathPattern matches absolute file paths in commands (Unix and Windows).