cosmicstack-labs mercury-agent bg agent.ts Agent.handleBgCommand authorization (CVE-2026-18997) | HOL Guard CVE