codemesh

The project relies on `vm2@3.9.19` for sandboxed TypeScript code execution. The `pnpm-lock.yaml` explicitly marks this dependency as "deprecated: The library contains critical security issues and should not be used for production! The maintenance of the project has been discontinued. Consider migrating your code to isolated-vm." This poses a significant security risk, as a malicious agent or crafted input could exploit these vulnerabilities to break out of the sandbox. While `eval: false` and `wasm: false` are configured, these do not mitigate the underlying `vm2` security issues. Environment variable handling for sub-servers correctly uses substitution to prevent hardcoding secrets.