fix: monitor-agent.py parse board-config.sh safely

Replace exec() on shell scripts with regex line parsing to avoid
shell injection and only extract PORT from board-config.sh

scripts/monitor-agent.py

@@ -8,11 +8,22 @@ import time
 import threading
 import serial
 import select
+import re
 
 BOARD = sys.argv[1] if len(sys.argv) > 1 else "esp32-32e-4"
 
-# Load board config
-exec(open(f"./boards/{BOARD}/board-config.sh").read().replace("export ", ""))
+# Load board config - parse shell script format
+board_config_path = f"./boards/{BOARD}/board-config.sh"
+PORT = "/dev/ttyACM0"  # Default
+try:
+    with open(board_config_path, 'r') as f:
+        for line in f:
+            line = line.strip()
+            if line.startswith('PORT='):
+                PORT = line.split('=', 1)[1].strip()
+                break
+except FileNotFoundError:
+    print(f"Warning: Board config not found: {board_config_path}")
 
 SERIAL_PORT = os.environ.get("PORT", PORT)
 LOGFILE = f"/tmp/doorbell-{BOARD}.jsonl"