fix: harden AST blocklist in _safe_import_check for attribute-style and dynamic dispatch dangerous calls

[nobugpal]

Summary

Harden the AST-based blocklist in python_executor.py:_safe_import_check() to cover attribute-style calls (builtins.eval(...)), getattr-based dynamic dispatch (getattr(obj, "eval")(...)), and subscript access patterns (obj.__dict__["eval"](...)), in addition to the existing direct Name call coverage.

Changes

LightAgent/builtin_tools/python_executor.py

Three defenses added:

1. Attribute calls (line 200): Added eval, exec, compile to the ast.Attribute blocklist — closes the builtins.eval(...) bypass path
2. getattr detection (lines 198-202): When getattr() is called with a constant second argument matching dangerous function names, the call is blocked — closes getattr(obj, "eval")(...) patterns
3. Subscript access (lines 207-210): Subscript access (obj[...]) with a constant key matching dangerous function names is blocked — closes obj.__dict__["eval"](...) patterns

All pattern checks are scoped to constant string arguments only, preserving legitimate dynamic access (e.g., getattr(obj, variable_name) or d[variable_key]).

tests/test_python_executor_blocklist.py (new — 20 tests)

Category	Tests	Purpose
Direct Name calls	4	eval(), exec(), compile(), import()
Import-based	3	import os, import subprocess, from builtins import eval
Attribute calls	3	builtins.eval(), builtins.exec(), builtins.compile()
getattr dispatch	3	getattr("eval"), getattr("exec"), getattr("system")
Subscript access	1	obj.dict"eval"
Safe getattr	1	getattr(obj, "normal_attribute") — still allowed
Safe subscript	1	d["normal_key"] — still allowed
Harmless code	3	sum, print, len/range — still allowed

Testing

$ python3 -m pytest tests/test_python_executor_blocklist.py -v
20 passed in 0.83s

$ python3 -m pytest tests/test_v065_core.py tests/test_v070_tracing.py \
  tests/test_memory_policy.py tests/test_python_executor_blocklist.py -q
74 passed in 1.90s

No regressions. All existing tests pass.

Security Note

Per CONTRIBUTING.md: this change affects the code execution tool path and includes a security hardening note. The fix closes defense-in-depth gaps (CWE-184: Incomplete Blocklist) in the Python code execution sandbox by ensuring consistent blocking regardless of call syntax or dispatch mechanism.

Checklist

• python -m compileall -q LightAgent passes
• Regression test suite passes (74 tests)
• New tests cover all known bypass patterns
• Safe operations (including dynamic getattr) remain functional
• Backward compatible — no API changes
• No credentials, logs, or build artifacts included