fix: use subprocess instead of os.system in sync.py

[anupamme]

Summary

Fix critical severity security issue in sync.py.

Vulnerability

Field	Value
ID	V-001
Severity	CRITICAL
Scanner	multi_agent_ai
Rule	V-001
File	sync.py:30
Assessment	Likely exploitable

Description: The sync.py script constructs shell commands using string formatting with user-controlled file paths and passes them to os.system() without proper escaping or quoting. An attacker who can control the directory structure or file names can inject arbitrary shell commands.

Evidence

Exploitation scenario: An attacker creates a directory or file with a name containing shell metacharacters (e.g., 'test; rm -rf /' or 'test$(whoami)').

Scanner confirmation: multi_agent_ai rule V-001 flagged this pattern.

Production code: This file is in the production codebase, not test-only code.

Threat Model Context

This is a Node.js library - vulnerabilities affect downstream consumers who use this package.

Changes

• sync.py

Behavior Preservation

The change is scoped to 1 file on the vulnerable path, and the project's existing tests still pass, so intended behavior is unchanged.

Verification

• Build passes
• Scanner re-scan confirms fix
• LLM code review passed

---

Automated security fix by OrbisAI Security