fix: remove cat from allowed shell commands and fix stale display tests

Remove cat from allowed_commands to close shell redirect bypass vector
(read_file provides safer alternative). Update display tests to match
render_user_message returning Text instead of Panel, and shell test to
use head instead of cat.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

config/config.yaml

@@ -48,7 +48,6 @@ tools:
       - pytest
       - ruff
       - ls
-      - cat
       - head
       - tail
       - wc

tests/unit/test_display.py

@@ -21,10 +21,10 @@ from app.utils.display import (
 
 
 class TestRenderFunctions:
-    def test_render_user_message_returns_panel(self) -> None:
+    def test_render_user_message_returns_text(self) -> None:
         result = render_user_message("hello")
-        assert isinstance(result, Panel)
+        assert isinstance(result, Text)
-        assert result.title == "You"
+        assert "hello" in result.plain
 
     def test_render_assistant_message_returns_panel(self) -> None:
         result = render_assistant_message("response")
@@ -72,7 +72,7 @@ class TestDisplayAdapter:
         adapter.write_user_message("hello")
         mock_log.write.assert_called_once()
         arg = mock_log.write.call_args[0][0]
-        assert isinstance(arg, Panel)
+        assert isinstance(arg, Text)
 
     def test_write_tool_call(self) -> None:
         mock_log = MagicMock()

tests/unit/test_shell.py

@@ -90,6 +90,6 @@ class TestRunCommandTool:
         # Create a file in the workspace to verify cwd
         (ws / "marker.txt").write_text("found")
         tool = RunCommandTool(ws, cfg)
-        result = tool.run("tc-9", {"command": "cat marker.txt"})
+        result = tool.run("tc-9", {"command": "head marker.txt"})
         assert result.status == ToolResultStatus.SUCCESS
         assert "found" in result.output