fix: address security vulnerabilities and code quality weaknesses

- Fix path traversal in _glob_search by validating resolved paths stay within workspace root
- Fix ReDoS vulnerability in _grep_search by adding regex compilation error handling
- Replace 6 assert statements with explicit validation (assertions are disabled with -O flag)
- Replace bare except Exception with specific exception types (OSError, KeyError, ValueError)
- Block file:// scheme in web_fetch to prevent SSRF attacks
- Filter sensitive environment variables from subprocess execution
- Update test to verify file:// scheme rejection

Agent-Logs-Url: https://github.com/HarnessLab/claw-code-agent/sessions/94dfb41f-57dd-48ea-ab0d-d2f2249ef950

Co-authored-by: abdoelsayed2016 <27821589+abdoelsayed2016@users.noreply.github.com>

tests/test_extended_tools.py

@@ -9,7 +9,8 @@ from src.agent_types import AgentRuntimeConfig
 
 
 class ExtendedToolTests(unittest.TestCase):
-    def test_web_fetch_reads_text_from_file_url(self) -> None:
+    def test_web_fetch_rejects_file_url(self) -> None:
+        """Verify that file:// URLs are blocked to prevent SSRF attacks."""
         with tempfile.TemporaryDirectory() as tmp_dir:
             workspace = Path(tmp_dir)
             target = workspace / 'page.txt'
@@ -25,9 +26,8 @@ class ExtendedToolTests(unittest.TestCase):
                 context,
             )
 
-        self.assertTrue(result.ok)
-        self.assertIn('hello from web fetch', result.content)
-        self.assertEqual(result.metadata.get('action'), 'web_fetch')
+        self.assertFalse(result.ok)
+        self.assertIn('http or https', result.content)
 
     def test_tool_search_lists_matching_tools(self) -> None:
         registry = default_tool_registry()