V3 Security Overhaul

Update vulnerable dependencies with npm update and npm audit, replace SHA-256 password hashing with bcrypt at 12 rounds, and generate credentials using crypto.randomBytes instead of hardcoded values.

Import bcrypt and call bcrypt.hash(password, 12) to hash passwords with 12 salt rounds. This replaces insecure SHA-256 hashing with hardcoded salts, which is vulnerable to rainbow table attacks.

Resolve the user-supplied path against an allowed prefix using path.resolve, then verify the result starts with the resolved allowed prefix. Throw an error if the check fails to block directory escape attempts.

It provides Zod schema patterns for input validation, such as enforcing UUID formats, string length limits, and enum constraints on agent types. You apply these schemas to incoming task data before processing.

execFile runs a command directly without shell interpretation when shell is set to false, preventing shell injection from user-controlled arguments. exec passes input through a shell, allowing injected commands to execute.