Agno 3.0.2 fixes a sandbox escape where CodeMode(allow_shell=False) still ran %%bash on IPython 9.17

GitHub·high signalXBlueskyLinkedInCopy link

IPython 9.17 registers script magics lazily and recreates them on lookup, so Agno's method of removing bash from the cell-magic table stopped disabling it — a kernel explicitly configured to forbid shell access still executed %%bash. The fix materializes the script-magic provider first and drops bash from both the lazy table and the live registry, so loading a sibling magic like %%sh cannot re-register it. Any Agno deployment relying on allow_shell=False as a containment boundary on IPython 9.17 was not actually contained.