🔒 Security: replace exec() with subprocess sandbox in run_text

[shunfeng8421]

Summary

Fix arbitrary code execution vulnerability in RunCode.run_text().

Vulnerability

run_text() executes LLM-generated Python code via exec(code, namespace) directly in the MetaGPT process with zero sandboxing:

# Before (vulnerable — runs in MetaGPT process)
async def run_text(cls, code):
    namespace = {}
    exec(code, namespace)  # Attacker code runs HERE
    return namespace.get("result", ""), ""

Impact

An adversary who controls the code input — via prompt injection, a compromised LLM, or a malicious agent — gains arbitrary code execution in the MetaGPT host process, with full access to:

• File system
• Network
• Environment variables
• All in-memory data
• Any credentials loaded by MetaGPT

Fix

Write code to a temporary .py file and execute it in an isolated subprocess via subprocess.run() with a 30-second timeout:

# After (safe — subprocess isolation)
async def run_text(cls, code):
    with tempfile.NamedTemporaryFile(mode="w", suffix=".py", delete=False) as tmp:
        tmp.write(code)
        tmp_path = tmp.name
    proc = subprocess.run([sys.executable, tmp_path], capture_output=True, text=True, timeout=30)
    return proc.stdout, proc.stderr

Why this is safe

• Subprocess cannot access MetaGPT's memory space
• OS-level process isolation prevents filesystem/network escape
• 30-second timeout prevents resource exhaustion
• Aligns with existing run_script() which already uses subprocess