[BichengWang]

Description

The Computer Use demo interpolates key and modifier strings into shell commands without quoting them. A semicolon is consumed as shell syntax, an apostrophe causes a parse error, and $(...) executes a substitution instead of reaching xdotool literally. This affects the older key actions and the click/scroll modifier paths inherited by the current computer toolset.

Quote these arguments with shlex.quote, matching the existing handling for typing, held keys, and toolset key presses. Add regressions that run the real shell with a local xdotool stand-in and assert the arguments it receives.

Quickstart

• Computer Use Demo
• Customer Support Agent
• Financial Data Analyst
• N/A

Type of Change

• Bug fix
• New feature
• Documentation update
• Code refactoring
• Other (please describe):

Testing

• Added/updated unit tests
• Tested manually
• Verified in development environment

On macOS with Python 3.11.17 and the demo's development dependencies:

• All 15 new regressions fail before the fix and pass after it.
• Full suite: 88 passed; unchanged upstream: 73 passed. Both emit existing un-awaited AsyncMock warnings.
• Full Ruff lint and Pyright pass.
• Formatting and all applicable pinned pre-commit hooks pass for both changed files. The full format check reports only the unchanged tests/tools/edit_test.py.

Screenshots

Not applicable.

Additional Notes

Validation ran offline. The regressions use a local executable to observe shell arguments and mock screenshots; actual X server, Docker/GUI, and live model checks were not run.