Android's AI-written device_shell blocklist only checked literal substrings, so permuted destructive commands like `rm -fr` bypassed it and reached the device.

+//! app management, and device control. Includes text escaping for+//! shell metacharacters and coordinate sanitization.++use crate::error::{Result, ZeptoError};++use super::adb::AdbExecutor;++/// Escape text for ADB shell `input text` command.

+            ' ' => escaped.push_str("%s"),+            '\\' | '"' | '\'' | '`' | '$' | '!' | '?' | '&' | '|' | ';' | '(' | ')' | '[' | ']'+            | '{' | '}' | '<' | '>' => {+                escaped.push('\\');+                escaped.push(ch);+            }+            _ => escaped.push(ch),+        }+    }+    escaped+}++/// Parse and sanitize coordinates from various input formats.+///+/// Supports:

+) -> Result<(i32, i32)> {+    // Try explicit x, y first+    if let (Some(x), Some(y)) = (x_val, y_val) {+        let x = value_to_i32(x)?;+        let y = value_to_i32(y)?;+        return validate_coords(x, y);+    }++    // Try coords as string "x, y" or "x y"+    if let Some(coords) = coords_val.and_then(|v| v.as_str()) {+        let parts: Vec<&str> = coords.split([',', ' ']).filter(|s| !s.is_empty()).collect();+        if parts.len() == 2 {+            let x = parts[0]+                .trim()+                .parse::<i32>()+                .map_err(|_| ZeptoError::Tool("Invalid x coordinate".into()))?;+            let y = parts[1]+                .trim()+                .parse::<i32>()+                .map_err(|_| ZeptoError::Tool("Invalid y coordinate".into()))?;+            return validate_coords(x, y);+        }+    }++    // Try coords as array [x, y]+    if let Some(arr) = coords_val.and_then(|v| v.as_array()) {+        if arr.len() == 2 {+            let x = value_to_i32(&arr[0])?;+            let y = value_to_i32(&arr[1])?;+            return validate_coords(x, y);+        }+    }++    // Try concatenated number (e.g., 8282017)+    if let Some(n) = coords_val.and_then(|v| v.as_i64()) {+        let s = n.to_string();+        if s.len() >= 4 && s.len() <= 9 {+            // Try splits at positions 2, 3, 4+            for split_pos in 2..=4.min(s.len() - 1) {+                if let (Ok(x), Ok(y)) =+                    (s[..split_pos].parse::<i32>(), s[split_pos..].parse::<i32>())+                {+                    if (0..=10000).contains(&x) && (0..=10000).contains(&y) {+                        return Ok((x, y));+                    }+                }+            }+        }+    }

+/// Returns the argument slice for an `rm` invocation, supporting:

++    None+}+

+    let mut has_f = false;+    for &tok in rm_args {+        if tok.starts_with("--") {+            match tok {+                "--recursive" => has_r = true,+                "--force" => has_f = true,+                _ => {}+            }+        } else if tok.starts_with('-') && !tok.starts_with("--") {+            // Short flags: `-rf`, `-r`, `-f`, `-fr`, `-r -f`, etc.+            let flags = &tok[1..];+            if flags.contains('r') {+                has_r = true;+            }+            if flags.contains('f') {+                has_f = true;+            }+        }+    }+    has_r && has_f+}+ /// Run an arbitrary shell command on the device. pub async fn device_shell(adb: &AdbExecutor, cmd: &str) -> Result<String> {+    // Block shell metacharacters that enable command chaining.+    // Check this FIRST — before normalization — to prevent bypass via+    // metacharacters that the tokenizer would otherwise split on.+    let dangerous_chars = [';', '|', '`', '$', '&', '\n'];+    for ch in &dangerous_chars {+        if cmd.contains(*ch) {+            return Err(ZeptoError::Tool(format!(+                "Blocked shell metacharacter '{}' in command. Use specific actions instead of raw shell.",+                ch+            )));+        }+    }+     // Normalize whitespace for blocklist check-    let normalized: String = cmd.split_whitespace().collect::<Vec<_>>().join(" ");+    let tokens: Vec<&str> = cmd.split_whitespace().collect();+    let normalized = tokens.join(" ");     let lower = normalized.to_lowercase(); -    let blocked = [-        "rm -rf",