The guard checks the command text before the Bash tool's shell expands it, and the session can create files with any name in its working directory. So `ui wait x S*`, with a file named `SECONDS[$(…)]` beside it, passed the guard, and the iOS and desktop helpers put the expanded name into `$((SECONDS + …))`, where bash runs the subscript's command substitution, in a process whose ancestors' environment holds the Claude token. Android's helper already checked the number.
Now the desktop helper checks `wait` and `click-text` seconds as Android's does, the iOS helper checks them in `wait_for`, and both guards refuse `*?[]{}~` outside quotes (the plans quote all text, and inside quotes these don't expand).
xdotool key reads a later argument that names one of its commands, exec among them, as that command, and mousemove takes a single word, so "ui key Return exec <program>" or "ui click restore exec ..." ran a program on the runner. The Claude session on the runner is limited to ui commands, and a program could read its token. Key names and numbers are now checked, and keys are pressed one per call.
Review: R1-D1, R1-D2
spacedandy-agents-simplex