🛡️ Sentinel: [MEDIUM] Replace os.system with subprocess.run

[haseeb-heaven]

🚨 Severity: MEDIUM
💡 Vulnerability: The upgrade_pip_packages function in libs/utils.py used os.system with hardcoded strings to execute shell commands. While not immediately exploitable with user input in its current state, os.system is universally flagged as a security risk because it invokes a shell and is vulnerable to command injection if arguments are ever parameterized. Additionally, os.system does not raise exceptions on command failure, making the try/except block ineffective.
🎯 Impact: If arguments were ever introduced dynamically, an attacker could execute arbitrary shell commands on the server. Furthermore, failed package installations were silently ignored because os.system does not raise exceptions.
🔧 Fix: Replaced os.system with subprocess.run passing arguments as a list and using check=True. This entirely avoids invoking the shell, preventing any future risk of command injection, and properly raises a CalledProcessError if the command fails, allowing the try/except block to correctly catch and report errors. Added an entry to the .jules/sentinel.md journal.
✅ Verification: Ran python3 -m py_compile libs/utils.py to ensure syntax is correct. Checked that the changes are isolated to replacing os.system with the safer alternative.

---

PR created automatically by Jules for task 16770307918619061751 started by @haseeb-heaven

[google-labs-jules]

👋 Jules, reporting for duty! I'm here to lend a hand with this pull request.

When you start a review, I'll add a 👀 emoji to each comment to let you know I've read it. I'll focus on feedback directed at me and will do my best to stay out of conversations between you and other bots or reviewers to keep the noise down.

I'll push a commit with your requested changes shortly after. Please note there might be a delay between these steps, but rest assured I'm on the job!

For more direct control, you can switch me to Reactive Mode. When this mode is on, I will only act on comments where you specifically mention me with @jules. You can find this option in the Pull Request section of your global Jules UI settings. You can always switch back!

New to Jules? Learn more at jules.google/docs.

---

For security, I will only act on instructions from the user who triggered this task.

[chatgpt-codex-connector]

You have reached your Codex usage limits for code reviews. You can see your limits in the Codex usage dashboard.
To continue using code reviews, you can upgrade your account or add credits to your account and enable them for code reviews in your settings.

[greptile-apps]

Your trial has ended. Reactivate Greptile to resume code reviews.