feat(toolbox): update toolbox-template scripts

- Update ToolboxStack/output/toolbox-template/Dockerfile with template container configurations
- Update ToolboxStack/output/toolbox-template/build.sh with template build process
- Update ToolboxStack/output/toolbox-template/run.sh with template runtime configuration

These changes improve the toolbox template for creating new developer environments.

ToolboxStack/output/toolbox-template/run.sh

@@ -2,6 +2,16 @@
 
 set -euo pipefail
 
+# Security: Validate input parameters to prevent command injection
+sanitized_input() {
+    local input="$1"
+    # Check for potentially dangerous characters/commands
+    if [[ "$input" =~ [;\|&\`\$] ]]; then
+        echo "Error: Invalid input detected: $input" >&2
+        exit 1
+    fi
+}
+
 # Validate dependencies
 if ! command -v docker &> /dev/null; then
     echo "Error: docker is required but not installed." >&2
@@ -16,9 +26,13 @@ fi
 SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
 COMPOSE_FILE="${SCRIPT_DIR}/docker-compose.yml"
 
+# Sanitize user input
 export LOCAL_UID="${USER_ID_OVERRIDE:-$(id -u)}"
+sanitized_input "$LOCAL_UID"
 export LOCAL_GID="${GROUP_ID_OVERRIDE:-$(id -g)}"
+sanitized_input "$LOCAL_GID"
 export LOCAL_USERNAME="${USERNAME_OVERRIDE:-toolbox}"
+sanitized_input "$LOCAL_USERNAME"
 
 if [[ ! -f "${COMPOSE_FILE}" ]]; then
     echo "Error: docker-compose.yml not found at ${COMPOSE_FILE}" >&2
@@ -26,14 +40,18 @@ if [[ ! -f "${COMPOSE_FILE}" ]]; then
 fi
 
 ACTION="${1:-up}"
+sanitized_input "$ACTION"
 shift || true
 
 if [[ "${ACTION}" == "up" ]]; then
-    # Create necessary directories for the toolbox tools
+    # Create necessary directories for the toolbox tools with proper permissions
     mkdir -p "${HOME}/.local/share/mise" "${HOME}/.cache/mise"
     mkdir -p "${HOME}/.config" "${HOME}/.local/share"
     mkdir -p "${HOME}/.cache/openai" "${HOME}/.cache/gemini" "${HOME}/.cache/qwen" "${HOME}/.cache/code" "${HOME}/.cache/opencode"
     mkdir -p "${HOME}/.config/openai" "${HOME}/.config/gemini" "${HOME}/.config/qwen" "${HOME}/.config/code" "${HOME}/.config/opencode"
+    
+    # Set proper permissions for created directories
+    chmod 700 "${HOME}/.config" "${HOME}/.local/share" "${HOME}/.cache" 2>/dev/null || true
 fi
 
 case "${ACTION}" in