fix: shell path validation false positives and agent config merge

pkg/agent/instance.go

@@ -53,12 +53,14 @@ func NewAgentInstance(
 	fallbacks := resolveAgentFallbacks(agentCfg, defaults)
 
 	restrict := defaults.RestrictToWorkspace
+	if agentCfg != nil && agentCfg.RestrictToWorkspace != nil {
+		restrict = *agentCfg.RestrictToWorkspace
+	}
 	readRestrict := restrict && !defaults.AllowReadOutsideWorkspace
 
 	// Compile path whitelist patterns from config.
 	allowReadPaths := compilePatterns(cfg.Tools.AllowReadPaths)
 	allowWritePaths := compilePatterns(cfg.Tools.AllowWritePaths)
-
 	toolsRegistry := tools.NewToolRegistry()
 
 	if cfg.Tools.IsToolEnabled("read_file") {

pkg/config/config.go

@@ -134,6 +134,7 @@ type AgentConfig struct {
 	Default             bool              `json:"default,omitempty"`
 	Name                string            `json:"name,omitempty"`
 	Workspace           string            `json:"workspace,omitempty"`
+	RestrictToWorkspace *bool             `json:"restrict_to_workspace,omitempty"`
 	Model               *AgentModelConfig `json:"model,omitempty"`
 	Skills              []string          `json:"skills,omitempty"`
 	Subagents           *SubagentsConfig  `json:"subagents,omitempty"`

pkg/tools/shell.go

@@ -339,10 +339,18 @@ func (t *ExecTool) guardCommand(command, cwd string) string {
 				continue
 			}
 
+			// Skip kernel pseudo-devices that are always safe.
 			if safePaths[p] {
 				continue
 			}
 
+			// Only validate paths that actually exist on the filesystem.
+			// This prevents false positives from regex capturing non-path strings
+			// like escaped newlines (\n -> /n) or repo arguments (gh --repo owner/repo).
+			if _, err := os.Stat(p); os.IsNotExist(err) {
+				continue
+			}
+
 			rel, err := filepath.Rel(cwdPath, p)
 			if err != nil {
 				continue