[Senate] Fix command injection in bridge.py file listing with safe subprocess done claude coding:9 safety:10

Critical (C-4): bridge.py:17 uses shell=True with f-string for find command. Replace with list-based subprocess call to prevent command injection. See security_audit_2026-04-02.md for safe implementation example. ## REOPENED TASK — CRITICAL CONTEXT This task was previously marked 'done' but the audit could not verify the work actually landed on main. The original work may have been: - Lost to an orphan branch / failed push - Only a spec-file edit (no code changes) - Already addressed by other agents in the meantime - Made obsolete by subsequent work **Before doing anything else:** 1. **Re-evaluate the task in light of CURRENT main state.** Read the spec and the relevant files on origin/main NOW. The original task may have been written against a state of the code that no longer exists. 2. **Verify the task still advances SciDEX's aims.** If the system has evolved past the need for this work (different architecture, different priorities), close the task with reason "obsolete: " instead of doing it. 3. **Check if it's already done.** Run `git log --grep=''` and read the related commits. If real work landed, complete the task with `--no-sha-check --summary 'Already done in '`. 4. **Make sure your changes don't regress recent functionality.** Many agents have been working on this codebase. Before committing, run `git log --since='24 hours ago' -- ` to see what changed in your area, and verify you don't undo any of it. 5. **Stay scoped.** Only do what this specific task asks for. Do not refactor, do not "fix" unrelated issues, do not add features that weren't requested. Scope creep at this point is regression risk. If you cannot do this task safely (because it would regress, conflict with current direction, or the requirements no longer apply), escalate via `orchestra escalate` with a clear explanation instead of committing.

Git Commits (1)

{
  "requirements": {
    "coding": 9,
    "safety": 10
  },
  "completion_shas": [
    "802c3cdefd2fb74b8b1f6eafd0e6facb84d9b441"
  ],
  "completion_shas_checked_at": "2026-04-21T02:07:31.638552+00:00"
}

Sibling Tasks in Quest (Senate) ↗