diff --git a/dashboard/DEPLOYMENT.md b/dashboard/DEPLOYMENT.md
index 23549fd..d59a025 100644
--- a/dashboard/DEPLOYMENT.md
+++ b/dashboard/DEPLOYMENT.md
@@ -427,13 +427,31 @@ constructs `docker ...` shell strings directly with `execAsync`.
 
 ### Mitigation roadmap (incremental, not all at once)
 
-- [ ] **P1 (next):** Allow-list wrapper around shell-outs. Centralize
-      `docker`/`bash`/`npm` invocations behind a small `lib/shell.ts` that
-      validates the arg vector against a per-command schema (e.g.
-      `docker.restart(name)` rejects names not matching `^[a-zA-Z0-9._-]{1,128}$`).
-- [ ] **P1:** Validate `/code-quality/check`'s `projectPath` against a
-      configured set of allowed roots.
-- [ ] **P2:** Audit-log every shell-out (command + arg vector + actor + result).
+- [x] **P1:** Allow-list wrapper around shell-outs. *(`lib/shell.ts` ships with
+      `execAllowed` (no shell, just `execFile` with an explicit argv) plus
+      per-command helpers — `dockerRestart(name)` validates against
+      `[a-zA-Z0-9][a-zA-Z0-9._-]{0,127}`, `dockerPrune(kind, {all?})` validates
+      kind ∈ {container,image,volume,builder} and rejects `--all` on non-image,
+      `runBashScript(path, args, {allowedRoots})` and `runNpmScript(script,
+      {cwd, allowedRoots})` lock both the script path and cwd to a configured
+      set of roots. 17 unit tests cover the rejection paths; `vm/restartContainer`
+      and `system/dockerCleanup` migrated. Module covered by the test:coverage
+      gate (≥95% lines).)*
+- [x] **P1:** Validate `/code-quality/check`'s `projectPath` against a
+      configured set of allowed roots. *(`runCodeQualityCheck` now calls
+      `assertPathInAllowedRoots(projectPath, getAllowedRoots())` before any
+      lifecycle script runs; `getAllowedRoots()` reads
+      `CODE_QUALITY_ALLOWED_ROOTS` (colon-separated) with a default of
+      `/opt/bytelyst`. The path is also re-resolved (normalised, `..`
+      collapsed) before being passed to `runNpmScript`, which lifts it to its
+      own argv slot — no shell interpolation.)*
+- [x] **P2:** Audit-log every shell-out (command + arg vector + actor + result).
+      *(Audit schema extended with `action: 'shell-exec'` + `entityType: 'host'`.
+      `POST /docker/cleanup`, `POST /vm/cleanup`, `POST /vm/containers/:name/restart`
+      now write a Cosmos audit row including the actor (`authUserId`/`authRole`),
+      entity id (`docker-cleanup:<type>` etc.), and a sanitized details payload.
+      Audit writes are best-effort — a Cosmos hiccup logs a warn but never
+      fails the request.)*
 - [ ] **P2:** Run the backend container as a non-root user with `docker` group
       membership; rebuild the Dockerfile accordingly.
 - [ ] **P3:** Move from `docker.sock` to a thin daemon (`docker-proxy`-style)
diff --git a/dashboard/backend/src/lib/shell.test.ts b/dashboard/backend/src/lib/shell.test.ts
new file mode 100644
index 0000000..7d1688a
--- /dev/null
+++ b/dashboard/backend/src/lib/shell.test.ts
@@ -0,0 +1,165 @@
+import { describe, it, expect, beforeEach, vi } from 'vitest';
+
+const execFileMock = vi.hoisted(() => vi.fn());
+vi.mock('child_process', () => ({ execFile: execFileMock }));
+
+const {
+  assertPathInAllowedRoots,
+  dockerPrune,
+  dockerRestart,
+  execAllowed,
+  InvalidShellArgError,
+  runBashScript,
+  runNpmScript,
+} = await import('./shell.js');
+
+function setExec(handler: (cmd: string, args: string[]) => { error?: Error; stdout?: string; stderr?: string }) {
+  execFileMock.mockImplementation(
+    (
+      command: string,
+      args: string[],
+      _opts: unknown,
+      cb: (err: unknown, result?: { stdout: string; stderr: string }) => void,
+    ) => {
+      const res = handler(command, args);
+      if (res.error) cb(res.error);
+      else cb(null, { stdout: res.stdout ?? '', stderr: res.stderr ?? '' });
+    },
+  );
+}
+
+describe('execAllowed', () => {
+  beforeEach(() => vi.clearAllMocks());
+
+  it('passes argv through to execFile without a shell', async () => {
+    setExec(() => ({ stdout: 'ok' }));
+    const result = await execAllowed('docker', ['ps', '-a']);
+    expect(result.stdout).toBe('ok');
+    expect(execFileMock).toHaveBeenCalledTimes(1);
+    const [cmd, args] = execFileMock.mock.calls[0];
+    expect(cmd).toBe('docker');
+    expect(args).toEqual(['ps', '-a']);
+  });
+});
+
+describe('dockerRestart', () => {
+  beforeEach(() => vi.clearAllMocks());
+
+  it('rejects names with shell metacharacters before reaching execFile', async () => {
+    await expect(dockerRestart('foo; rm -rf /')).rejects.toBeInstanceOf(InvalidShellArgError);
+    await expect(dockerRestart('foo bar')).rejects.toBeInstanceOf(InvalidShellArgError);
+    await expect(dockerRestart('$(whoami)')).rejects.toBeInstanceOf(InvalidShellArgError);
+    await expect(dockerRestart('')).rejects.toBeInstanceOf(InvalidShellArgError);
+    expect(execFileMock).not.toHaveBeenCalled();
+  });
+
+  it('accepts valid container names and forwards them as a single argv element', async () => {
+    setExec(() => ({ stdout: 'restarted' }));
+    await dockerRestart('hermes-gateway');
+    const [, args] = execFileMock.mock.calls[0];
+    // `restart` and the name are separate argv slots — never one
+    // concatenated string that could be re-parsed by a shell.
+    expect(args).toEqual(['restart', 'hermes-gateway']);
+  });
+
+  it('non-string input throws InvalidShellArgError', async () => {
+    // @ts-expect-error — testing runtime guard
+    await expect(dockerRestart(undefined)).rejects.toBeInstanceOf(InvalidShellArgError);
+    // @ts-expect-error — testing runtime guard
+    await expect(dockerRestart(123)).rejects.toBeInstanceOf(InvalidShellArgError);
+  });
+});
+
+describe('dockerPrune', () => {
+  beforeEach(() => vi.clearAllMocks());
+
+  it('rejects unknown prune kinds', async () => {
+    // @ts-expect-error — exercising the runtime check
+    await expect(dockerPrune('everything')).rejects.toBeInstanceOf(InvalidShellArgError);
+  });
+
+  it('emits the documented argv per kind', async () => {
+    setExec(() => ({ stdout: '' }));
+    await dockerPrune('container');
+    expect(execFileMock.mock.calls.at(-1)![1]).toEqual(['container', 'prune', '-f']);
+    await dockerPrune('image', { all: true });
+    // `docker image prune -a -f` — kind first, then the verb, then -a/-f flags.
+    expect(execFileMock.mock.calls.at(-1)![1]).toEqual(['image', 'prune', '-a', '-f']);
+    await dockerPrune('volume');
+    expect(execFileMock.mock.calls.at(-1)![1]).toEqual(['volume', 'prune', '-f']);
+    await dockerPrune('builder');
+    expect(execFileMock.mock.calls.at(-1)![1]).toEqual(['builder', 'prune', '-f']);
+  });
+
+  it('rejects --all on non-image kinds', async () => {
+    await expect(dockerPrune('container', { all: true })).rejects.toBeInstanceOf(InvalidShellArgError);
+  });
+});
+
+describe('assertPathInAllowedRoots', () => {
+  it('accepts paths inside an allowed root', () => {
+    expect(assertPathInAllowedRoots('/opt/projects/foo', ['/opt/projects'])).toBe('/opt/projects/foo');
+    expect(assertPathInAllowedRoots('/opt/projects/foo/bar/baz', ['/opt/projects'])).toBe('/opt/projects/foo/bar/baz');
+    expect(assertPathInAllowedRoots('/opt/projects', ['/opt/projects'])).toBe('/opt/projects');
+  });
+
+  it('rejects relative paths', () => {
+    expect(() => assertPathInAllowedRoots('relative/path', ['/opt/projects'])).toThrow(InvalidShellArgError);
+    expect(() => assertPathInAllowedRoots('./foo', ['/opt/projects'])).toThrow(InvalidShellArgError);
+  });
+
+  it('rejects ../ escape attempts even when prefix-matching the root', () => {
+    expect(() => assertPathInAllowedRoots('/opt/projects/../etc', ['/opt/projects'])).toThrow(InvalidShellArgError);
+    expect(() => assertPathInAllowedRoots('/opt/projects/../../etc', ['/opt/projects'])).toThrow(InvalidShellArgError);
+  });
+
+  it('rejects sibling directories that share a prefix string', () => {
+    // /opt/projects-evil should NOT be accepted just because it starts with /opt/projects
+    expect(() => assertPathInAllowedRoots('/opt/projects-evil/foo', ['/opt/projects'])).toThrow(InvalidShellArgError);
+  });
+
+  it('checks every allowed root', () => {
+    expect(assertPathInAllowedRoots('/srv/app', ['/opt/projects', '/srv/app'])).toBe('/srv/app');
+  });
+});
+
+describe('runBashScript', () => {
+  beforeEach(() => vi.clearAllMocks());
+
+  it('rejects scripts outside allowed roots', async () => {
+    await expect(runBashScript('/etc/init.d/anything', [], { allowedRoots: ['/opt/projects'] }))
+      .rejects.toBeInstanceOf(InvalidShellArgError);
+  });
+
+  it('runs a script that is inside an allowed root', async () => {
+    setExec(() => ({ stdout: 'ok' }));
+    const result = await runBashScript('/opt/projects/deploy.sh', ['--prod'], { allowedRoots: ['/opt/projects'] });
+    expect(result.stdout).toBe('ok');
+    const [cmd, args] = execFileMock.mock.calls[0];
+    expect(cmd).toBe('bash');
+    expect(args).toEqual(['/opt/projects/deploy.sh', '--prod']);
+  });
+});
+
+describe('runNpmScript', () => {
+  beforeEach(() => vi.clearAllMocks());
+
+  it('rejects npm scripts not in the lifecycle allow-list', async () => {
+    // @ts-expect-error — exercising the runtime guard
+    await expect(runNpmScript('publish', { allowedRoots: ['/opt/projects'], cwd: '/opt/projects/foo' }))
+      .rejects.toBeInstanceOf(InvalidShellArgError);
+  });
+
+  it('rejects cwd outside allowed roots', async () => {
+    await expect(runNpmScript('typecheck', { allowedRoots: ['/opt/projects'], cwd: '/etc' }))
+      .rejects.toBeInstanceOf(InvalidShellArgError);
+  });
+
+  it('runs a whitelisted lifecycle script in an allowed cwd', async () => {
+    setExec(() => ({ stdout: 'ok' }));
+    await runNpmScript('typecheck', { allowedRoots: ['/opt/projects'], cwd: '/opt/projects/foo' });
+    const [cmd, args] = execFileMock.mock.calls[0];
+    expect(cmd).toBe('npm');
+    expect(args).toEqual(['run', 'typecheck']);
+  });
+});
diff --git a/dashboard/backend/src/lib/shell.ts b/dashboard/backend/src/lib/shell.ts
new file mode 100644
index 0000000..32c4991
--- /dev/null
+++ b/dashboard/backend/src/lib/shell.ts
@@ -0,0 +1,170 @@
+// Allow-list wrapper around shell-outs.
+//
+// Every privileged route in this backend ultimately runs `docker`, `bash`,
+// `npm`, etc. on the host. Historically those were issued as template-literal
+// strings passed through `child_process.exec`, which means a misvalidated
+// path param can become a shell-injection. This module fixes that by:
+//
+//   1. Always passing argv as a real array to `execFile` (no shell expansion,
+//      no string templating). `execAllowed()` is the only escape hatch and it
+//      still uses `execFile`, never `exec`.
+//   2. Exposing per-command helpers (`dockerRestart`, `dockerPrune`,
+//      `runBashScript`, `runNpmScript`) that validate their inputs against
+//      a per-command allow-list regex. Repos call these instead of building
+//      `docker ...` strings directly.
+//
+// This is the "allow-list wrapper" item from the DEPLOYMENT.md privilege-
+// surface mitigation roadmap.
+
+import { execFile } from 'child_process';
+import { isAbsolute, normalize, relative, resolve } from 'path';
+import { promisify } from 'util';
+import { childLogger } from './logger.js';
+
+const execFileAsync = promisify(execFile);
+const log = childLogger('lib/shell');
+
+export interface ShellExecOptions {
+  cwd?: string;
+  timeoutMs?: number;
+  env?: NodeJS.ProcessEnv;
+}
+
+export interface ShellResult {
+  stdout: string;
+  stderr: string;
+}
+
+/**
+ * Run a single command with an explicit `argv` array. No shell expansion,
+ * no string interpolation. Prefer the per-command helpers below; reach for
+ * this when the command isn't on the allow-list yet.
+ */
+export async function execAllowed(
+  command: string,
+  args: string[],
+  options: ShellExecOptions = {},
+): Promise<ShellResult> {
+  log.debug({ command, args, cwd: options.cwd }, 'shell exec');
+  const { stdout, stderr } = await execFileAsync(command, args, {
+    cwd: options.cwd,
+    timeout: options.timeoutMs ?? 30_000,
+    env: options.env,
+    maxBuffer: 10 * 1024 * 1024,
+  });
+  return {
+    stdout: stdout?.toString?.() ?? String(stdout ?? ''),
+    stderr: stderr?.toString?.() ?? String(stderr ?? ''),
+  };
+}
+
+// --- Docker allow-list ------------------------------------------------------
+
+// Container/volume/image names from the docker daemon. Docker's own rule is
+// `[a-zA-Z0-9][a-zA-Z0-9_.-]+` but we tighten the leading char too.
+const CONTAINER_NAME_RE = /^[a-zA-Z0-9][a-zA-Z0-9._-]{0,127}$/;
+
+export class InvalidShellArgError extends Error {
+  constructor(message: string) {
+    super(message);
+    this.name = 'InvalidShellArgError';
+  }
+}
+
+function assertContainerName(name: string): void {
+  if (typeof name !== 'string' || !CONTAINER_NAME_RE.test(name)) {
+    throw new InvalidShellArgError(`Invalid container name: ${JSON.stringify(name)}`);
+  }
+}
+
+/** `docker restart <name>` — validated. */
+export async function dockerRestart(name: string): Promise<ShellResult> {
+  assertContainerName(name);
+  return execAllowed('docker', ['restart', name], { timeoutMs: 30_000 });
+}
+
+const PRUNE_KINDS = ['container', 'image', 'volume', 'builder'] as const;
+export type PruneKind = typeof PRUNE_KINDS[number];
+
+/** `docker <kind> prune -f` (`-a` only valid for `image`). */
+export async function dockerPrune(kind: PruneKind, opts: { all?: boolean } = {}): Promise<ShellResult> {
+  if (!PRUNE_KINDS.includes(kind)) {
+    throw new InvalidShellArgError(`Invalid prune kind: ${JSON.stringify(kind)}`);
+  }
+  const args: string[] = [kind, 'prune', '-f'];
+  if (opts.all) {
+    if (kind !== 'image') throw new InvalidShellArgError('`all` is only valid for image prune');
+    args.splice(2, 0, '-a');
+  }
+  return execAllowed('docker', args, { timeoutMs: 60_000 });
+}
+
+// --- Filesystem-path allow-list --------------------------------------------
+
+/**
+ * Verify that `candidate` is an absolute path that resolves inside one of
+ * the allowed roots. Used to lock down request-supplied `cwd` values
+ * (e.g. `/code-quality/check`'s `projectPath`) so callers can't run
+ * lifecycle scripts in arbitrary directories.
+ */
+export function assertPathInAllowedRoots(candidate: string, allowedRoots: string[]): string {
+  if (typeof candidate !== 'string' || !isAbsolute(candidate)) {
+    throw new InvalidShellArgError(`Path must be absolute: ${JSON.stringify(candidate)}`);
+  }
+  const resolved = resolve(normalize(candidate));
+  for (const root of allowedRoots) {
+    const resolvedRoot = resolve(normalize(root));
+    const rel = relative(resolvedRoot, resolved);
+    // Inside the root iff the relative path doesn't escape upward
+    // (no leading `..`) and isn't an absolute path back out.
+    if (rel === '' || (!rel.startsWith('..') && !isAbsolute(rel))) {
+      return resolved;
+    }
+  }
+  throw new InvalidShellArgError(
+    `Path is not inside an allowed root: ${JSON.stringify(candidate)}`,
+  );
+}
+
+// --- bash / npm wrappers ----------------------------------------------------
+
+/**
+ * Run a `bash <script>` invocation with `cwd` constrained to allowed
+ * roots. The script path itself must also be inside an allowed root.
+ */
+export async function runBashScript(
+  scriptPath: string,
+  args: string[] = [],
+  options: ShellExecOptions & { allowedRoots: string[] } = { allowedRoots: [] },
+): Promise<ShellResult> {
+  const safeScript = assertPathInAllowedRoots(scriptPath, options.allowedRoots);
+  if (options.cwd) assertPathInAllowedRoots(options.cwd, options.allowedRoots);
+  return execAllowed('bash', [safeScript, ...args], {
+    cwd: options.cwd,
+    timeoutMs: options.timeoutMs ?? 300_000,
+    env: options.env,
+  });
+}
+
+const NPM_LIFECYCLE = ['typecheck', 'lint', 'build', 'test', 'test:run', 'start'] as const;
+export type NpmLifecycle = typeof NPM_LIFECYCLE[number];
+
+/**
+ * `npm run <script>` constrained to a known set of lifecycle scripts and
+ * run only inside an allowed project root. Used by `/code-quality/check`.
+ */
+export async function runNpmScript(
+  script: NpmLifecycle,
+  options: ShellExecOptions & { allowedRoots: string[] } = { allowedRoots: [] },
+): Promise<ShellResult> {
+  if (!NPM_LIFECYCLE.includes(script)) {
+    throw new InvalidShellArgError(`npm script not in allow-list: ${JSON.stringify(script)}`);
+  }
+  if (!options.cwd) throw new InvalidShellArgError('npm run requires a cwd');
+  assertPathInAllowedRoots(options.cwd, options.allowedRoots);
+  return execAllowed('npm', ['run', script], {
+    cwd: options.cwd,
+    timeoutMs: options.timeoutMs ?? 120_000,
+    env: options.env,
+  });
+}
diff --git a/dashboard/backend/src/modules/audit/types.ts b/dashboard/backend/src/modules/audit/types.ts
index 1f80fad..5b55d8c 100644
--- a/dashboard/backend/src/modules/audit/types.ts
+++ b/dashboard/backend/src/modules/audit/types.ts
@@ -2,8 +2,11 @@ import { z } from 'zod';
 
 export const AuditLogSchema = z.object({
   id: z.string(),
-  action: z.enum(['create', 'update', 'delete', 'deploy', 'trigger']),
-  entityType: z.enum(['service', 'deployment', 'user']),
+  // `shell-exec` covers privileged shell-outs (docker prune, container
+  // restart, code-quality npm runs) so a leaked admin token's actions are
+  // reconstructable from cosmos rather than only from container stdout.
+  action: z.enum(['create', 'update', 'delete', 'deploy', 'trigger', 'shell-exec']),
+  entityType: z.enum(['service', 'deployment', 'user', 'host']),
   entityId: z.string(),
   userId: z.string(),
   role: z.string(),
diff --git a/dashboard/backend/src/modules/code-quality/repository.ts b/dashboard/backend/src/modules/code-quality/repository.ts
index 2acf464..76c50b5 100644
--- a/dashboard/backend/src/modules/code-quality/repository.ts
+++ b/dashboard/backend/src/modules/code-quality/repository.ts
@@ -2,12 +2,61 @@ import { exec } from 'child_process';
 import { promisify } from 'util';
 import { readFile } from 'fs/promises';
 import { join } from 'path';
+import { assertPathInAllowedRoots, InvalidShellArgError, runNpmScript, type NpmLifecycle } from '../../lib/shell.js';
 import type { CodeQualityReport, CodeQualityCheckParams, CodeQualityIssue } from './types.js';
 
 const execAsync = promisify(exec);
 
+// Allow-listed roots inside which `/code-quality/check` may run
+// `npm run typecheck/lint/build/test:run`. Anything outside these roots is
+// rejected before a subprocess is spawned. Configure via
+// `CODE_QUALITY_ALLOWED_ROOTS` (colon-separated) for non-default deployments.
+const DEFAULT_ALLOWED_ROOTS = ['/opt/bytelyst'];
+function getAllowedRoots(): string[] {
+  const raw = process.env.CODE_QUALITY_ALLOWED_ROOTS?.trim();
+  if (!raw) return DEFAULT_ALLOWED_ROOTS;
+  return raw.split(':').map((s) => s.trim()).filter(Boolean);
+}
+
+// Run an `npm run <script>` invocation through the shell allow-list and
+// always resolve, even on non-zero exit (the parsers downstream want to
+// inspect stdout+stderr regardless of exit code).
+async function runScriptCapturingOutput(
+  script: NpmLifecycle,
+  cwd: string,
+  timeoutMs: number,
+): Promise<{ output: string; ok: boolean }> {
+  try {
+    const { stdout, stderr } = await runNpmScript(script, {
+      allowedRoots: getAllowedRoots(),
+      cwd,
+      timeoutMs,
+    });
+    return { output: `${stdout}${stderr}`, ok: true };
+  } catch (error) {
+    if (error instanceof InvalidShellArgError) throw error;
+    const e = error as { stdout?: string; stderr?: string; message?: string };
+    return { output: `${e.stdout ?? ''}${e.stderr ?? ''}` || (e.message ?? ''), ok: false };
+  }
+}
+
 export async function runCodeQualityCheck(params: CodeQualityCheckParams): Promise<CodeQualityReport> {
   const { projectId, projectPath, checks } = params;
+
+  // Reject paths outside the allow-list before spawning anything.
+  // `assertPathInAllowedRoots` returns the resolved absolute form so we
+  // pass that into the npm wrapper rather than the raw input.
+  let resolvedPath: string;
+  try {
+    resolvedPath = assertPathInAllowedRoots(projectPath, getAllowedRoots());
+  } catch (error) {
+    if (error instanceof InvalidShellArgError) {
+      throw new Error(
+        `projectPath is not inside an allowed root (${getAllowedRoots().join(', ')}); refusing to run lifecycle scripts there.`,
+      );
+    }
+    throw error;
+  }
   const issues: CodeQualityIssue[] = [];
   const summary = {
     totalIssues: 0,
@@ -27,66 +76,35 @@ export async function runCodeQualityCheck(params: CodeQualityCheckParams): Promi
   // TypeScript check
   if (checks.includes('typescript')) {
     const tsStart = Date.now();
-    try {
-      const { stdout, stderr } = await execAsync('npm run typecheck', {
-        cwd: projectPath,
-        timeout: 60000,
-      });
-      const output = stdout + stderr;
-      const tsIssues = parseTypeScriptOutput(output, projectPath);
-      issues.push(...tsIssues);
-      categories.typescript.duration = Date.now() - tsStart;
-      categories.typescript.errors = tsIssues.filter(i => i.type === 'error').length;
-      categories.typescript.warnings = tsIssues.filter(i => i.type === 'warning').length;
-    } catch (error: any) {
-      categories.typescript.duration = Date.now() - tsStart;
-      const output = error.stdout + error.stderr || error.message;
-      const tsIssues = parseTypeScriptOutput(output, projectPath);
-      issues.push(...tsIssues);
-      categories.typescript.errors = tsIssues.filter(i => i.type === 'error').length;
-      categories.typescript.warnings = tsIssues.filter(i => i.type === 'warning').length;
-    }
+    const { output } = await runScriptCapturingOutput('typecheck', resolvedPath, 60000);
+    const tsIssues = parseTypeScriptOutput(output, resolvedPath);
+    issues.push(...tsIssues);
+    categories.typescript.duration = Date.now() - tsStart;
+    categories.typescript.errors = tsIssues.filter(i => i.type === 'error').length;
+    categories.typescript.warnings = tsIssues.filter(i => i.type === 'warning').length;
   }
 
   // ESLint check
   if (checks.includes('eslint')) {
     const eslintStart = Date.now();
-    try {
-      const { stdout, stderr } = await execAsync('npm run lint', {
-        cwd: projectPath,
-        timeout: 60000,
-      });
-      const output = stdout + stderr;
-      const eslintIssues = parseEslintOutput(output, projectPath);
-      issues.push(...eslintIssues);
-      categories.eslint.duration = Date.now() - eslintStart;
-      categories.eslint.errors = eslintIssues.filter(i => i.type === 'error').length;
-      categories.eslint.warnings = eslintIssues.filter(i => i.type === 'warning').length;
-    } catch (error: any) {
-      categories.eslint.duration = Date.now() - eslintStart;
-      const output = error.stdout + error.stderr || error.message;
-      const eslintIssues = parseEslintOutput(output, projectPath);
-      issues.push(...eslintIssues);
-      categories.eslint.errors = eslintIssues.filter(i => i.type === 'error').length;
-      categories.eslint.warnings = eslintIssues.filter(i => i.type === 'warning').length;
-    }
+    const { output } = await runScriptCapturingOutput('lint', resolvedPath, 60000);
+    const eslintIssues = parseEslintOutput(output, resolvedPath);
+    issues.push(...eslintIssues);
+    categories.eslint.duration = Date.now() - eslintStart;
+    categories.eslint.errors = eslintIssues.filter(i => i.type === 'error').length;
+    categories.eslint.warnings = eslintIssues.filter(i => i.type === 'warning').length;
   }
 
   // Build check
   if (checks.includes('build')) {
     const buildStart = Date.now();
-    try {
-      const { stdout, stderr } = await execAsync('npm run build', {
-        cwd: projectPath,
-        timeout: 120000,
-      });
+    const { output, ok } = await runScriptCapturingOutput('build', resolvedPath, 120000);
+    categories.build.duration = Date.now() - buildStart;
+    if (ok) {
       categories.build.success = true;
-      categories.build.duration = Date.now() - buildStart;
-    } catch (error: any) {
+    } else {
       categories.build.success = false;
-      categories.build.duration = Date.now() - buildStart;
-      const output = error.stdout + error.stderr || error.message;
-      const buildIssues = parseBuildOutput(output, projectPath);
+      const buildIssues = parseBuildOutput(output, resolvedPath);
       issues.push(...buildIssues);
       categories.build.errors = buildIssues.length;
     }
@@ -95,25 +113,16 @@ export async function runCodeQualityCheck(params: CodeQualityCheckParams): Promi
   // Test check
   if (checks.includes('test')) {
     const testStart = Date.now();
-    try {
-      const { stdout, stderr } = await execAsync('npm run test:run', {
-        cwd: projectPath,
-        timeout: 120000,
-      });
-      const output = stdout + stderr;
-      const testResults = parseTestOutput(output);
+    const { output, ok } = await runScriptCapturingOutput('test:run', resolvedPath, 120000);
+    const testResults = parseTestOutput(output);
+    categories.test.duration = Date.now() - testStart;
+    categories.test.passed = testResults.passed;
+    categories.test.failed = testResults.failed;
+    if (ok) {
       categories.test.success = testResults.failed === 0;
-      categories.test.passed = testResults.passed;
-      categories.test.failed = testResults.failed;
-      categories.test.duration = Date.now() - testStart;
-    } catch (error: any) {
+    } else {
       categories.test.success = false;
-      categories.test.duration = Date.now() - testStart;
-      const output = error.stdout + error.stderr || error.message;
-      const testResults = parseTestOutput(output);
-      categories.test.passed = testResults.passed;
-      categories.test.failed = testResults.failed;
-      const testIssues = parseTestOutputErrors(output, projectPath);
+      const testIssues = parseTestOutputErrors(output, resolvedPath);
       issues.push(...testIssues);
     }
   }
@@ -124,13 +133,13 @@ export async function runCodeQualityCheck(params: CodeQualityCheckParams): Promi
   summary.warnings = issues.filter(i => i.type === 'warning').length;
   summary.infos = issues.filter(i => i.type === 'info').length;
 
-  const projectName = projectPath.split('/').pop() || projectPath;
+  const projectName = resolvedPath.split('/').pop() || resolvedPath;
 
   return {
     id: `cq-${Date.now()}-${Math.random().toString(36).substring(2, 9)}`,
     projectId,
     projectName,
-    projectPath,
+    projectPath: resolvedPath,
     timestamp: new Date().toISOString(),
     summary,
     categories,
diff --git a/dashboard/backend/src/modules/system/repository.ts b/dashboard/backend/src/modules/system/repository.ts
index ebe90a0..8bfa825 100644
--- a/dashboard/backend/src/modules/system/repository.ts
+++ b/dashboard/backend/src/modules/system/repository.ts
@@ -135,59 +135,60 @@ export async function getDockerStats() {
 }
 
 export async function dockerCleanup(type: string, force: boolean = false): Promise<{ message: string; freedSpace: number }> {
+  // Use the allow-list wrapper. Each cleanup type maps to a fixed sequence
+  // of `docker <kind> prune -f` invocations whose argv is built by
+  // `dockerPrune` — there is no template-literal shell command at any point.
+  const { dockerPrune, execAllowed } = await import('../../lib/shell.js');
+  type PrunePlan = Parameters<typeof dockerPrune>;
+
   let freedSpace = 0;
-  let commands: string[] = [];
+  let plans: PrunePlan[] = [];
 
   switch (type) {
     case 'images':
-      commands = force
-        ? ['docker image prune -a -f']
-        : ['docker image prune -f'];
+      plans = [['image', { all: force }]];
       break;
     case 'containers':
-      commands = ['docker container prune -f'];
+      plans = [['container', {}]];
       break;
     case 'volumes':
-      commands = force
-        ? ['docker volume prune -f']
-        : ['docker volume prune -f'];
+      plans = [['volume', {}]];
       break;
     case 'all':
-      commands = [
-        'docker container prune -f',
-        'docker image prune -a -f',
-        'docker volume prune -f',
-        'docker builder prune -f',
+      plans = [
+        ['container', {}],
+        ['image', { all: true }],
+        ['volume', {}],
+        ['builder', {}],
       ];
       break;
     default:
       throw new Error(`Unknown cleanup type: ${type}`);
   }
 
-  for (const command of commands) {
-    try {
-      await execAsync(command);
-    } catch (error) {
-      log.error({ err: error, command }, 'docker cleanup command failed');
-    }
-  }
-
-  // Calculate freed space by running docker system df before and after
-  try {
-    const { stdout: beforeOutput } = await execAsync('docker system df --format "{{.Size}}"');
-    const beforeSpace = parseSize(beforeOutput.split('\n')[1] || '0');
-
-    // Run cleanup again to measure actual space
-    for (const command of commands) {
+  const runPlans = async () => {
+    for (const [kind, opts] of plans) {
       try {
-        await execAsync(command);
+        await dockerPrune(kind, opts);
       } catch (error) {
-        // Ignore
+        log.error({ err: error, kind, opts }, 'docker cleanup command failed');
       }
     }
+  };
 
-    const { stdout: afterOutput } = await execAsync('docker system df --format "{{.Size}}"');
-    const afterSpace = parseSize(afterOutput.split('\n')[1] || '0');
+  await runPlans();
+
+  // Calculate freed space by running docker system df before and after.
+  // `execAllowed` is the no-shell variant of execFile, so the format
+  // template is passed as its own argv slot rather than expanded by sh.
+  try {
+    const before = await execAllowed('docker', ['system', 'df', '--format', '{{.Size}}']);
+    const beforeSpace = parseSize(before.stdout.split('\n')[1] || '0');
+
+    await runPlans();
+
+    const after = await execAllowed('docker', ['system', 'df', '--format', '{{.Size}}']);
+    const afterSpace = parseSize(after.stdout.split('\n')[1] || '0');
 
     freedSpace = beforeSpace - afterSpace;
   } catch (error) {
diff --git a/dashboard/backend/src/modules/system/routes.ts b/dashboard/backend/src/modules/system/routes.ts
index 94e3f52..1606999 100644
--- a/dashboard/backend/src/modules/system/routes.ts
+++ b/dashboard/backend/src/modules/system/routes.ts
@@ -2,6 +2,8 @@ import type { FastifyInstance } from 'fastify';
 import { getSystemMetrics, getDockerStats, dockerCleanup } from './repository.js';
 import { DockerCleanupParamsSchema } from './types.js';
 import { requireAdmin } from '../../lib/auth.js';
+import { createAuditLog } from '../audit/repository.js';
+import { productId } from '../../lib/config.js';
 
 export async function systemRoutes(fastify: FastifyInstance) {
   // Get system metrics (admin only)
@@ -30,13 +32,29 @@ export async function systemRoutes(fastify: FastifyInstance) {
     }
   });
 
-  // Docker cleanup (admin only)
+  // Docker cleanup (admin only). Privileged shell-out → audit-logged.
   fastify.post('/docker/cleanup', {
     preHandler: async (req) => requireAdmin(req),
   }, async (req, reply) => {
     try {
       const params = DockerCleanupParamsSchema.parse(req.body);
       const result = await dockerCleanup(params.type, params.force);
+
+      // Phase 5 P2 mitigation: every privileged shell-out lands in the audit
+      // log so a leaked admin token's actions are reconstructable from
+      // Cosmos, not only from container stdout. Best-effort — don't fail
+      // the request if audit write breaks.
+      const authReq = req as unknown as { authUserId?: string; authRole?: string };
+      await createAuditLog({
+        action: 'shell-exec',
+        entityType: 'host',
+        entityId: `docker-cleanup:${params.type}`,
+        userId: authReq.authUserId ?? 'unknown',
+        role: authReq.authRole ?? 'unknown',
+        productId,
+        details: { type: params.type, force: params.force, freedSpace: result.freedSpace },
+      }).catch((err) => fastify.log.warn({ err }, 'audit log write failed'));
+
       return reply.send(result);
     } catch (error: any) {
       fastify.log.error(error, 'Docker cleanup failed');
diff --git a/dashboard/backend/src/modules/vm/repository.ts b/dashboard/backend/src/modules/vm/repository.ts
index 95932ac..5deeba5 100644
--- a/dashboard/backend/src/modules/vm/repository.ts
+++ b/dashboard/backend/src/modules/vm/repository.ts
@@ -272,15 +272,20 @@ export async function getUnhealthyContainers(): Promise<UnhealthyContainer[]> {
 }
 
 export async function restartContainer(name: string): Promise<{ success: boolean; message: string }> {
-  // Validate name — only allow alphanumeric, dash, underscore
-  if (!/^[\w-]+$/.test(name)) {
-    return { success: false, message: 'Invalid container name' };
-  }
+  // Use the allow-list wrapper. `dockerRestart` validates `name` against
+  // `[a-zA-Z0-9][a-zA-Z0-9._-]{0,127}` and never builds a shell string —
+  // the name lands in its own argv slot, never re-parseable by a shell.
+  // See `dashboard/DEPLOYMENT.md` Privilege Surface (allow-list wrapper).
+  const { dockerRestart, InvalidShellArgError } = await import('../../lib/shell.js');
   try {
-    await execAsync(`docker restart "${name}"`, { timeout: 30_000 });
+    await dockerRestart(name);
     return { success: true, message: `${name} restarted` };
-  } catch (error: any) {
-    return { success: false, message: String(error.stderr || error.message || error) };
+  } catch (error: unknown) {
+    if (error instanceof InvalidShellArgError) {
+      return { success: false, message: 'Invalid container name' };
+    }
+    const e = error as NodeJS.ErrnoException & { stderr?: string };
+    return { success: false, message: String(e.stderr || e.message || error) };
   }
 }
 
diff --git a/dashboard/backend/src/modules/vm/routes.ts b/dashboard/backend/src/modules/vm/routes.ts
index 6375231..a3888cd 100644
--- a/dashboard/backend/src/modules/vm/routes.ts
+++ b/dashboard/backend/src/modules/vm/routes.ts
@@ -1,5 +1,7 @@
 import type { FastifyInstance } from 'fastify';
 import { requireAdmin } from '../../lib/auth.js';
+import { createAuditLog } from '../audit/repository.js';
+import { productId } from '../../lib/config.js';
 import {
   runVmHealthCheck,
   getCleanupLog,
@@ -21,6 +23,27 @@ import {
 } from './prometheus.js';
 import { VmCleanupParamsSchema, VmContainerRestartParamsSchema } from './types.js';
 
+// Best-effort audit-log helper for privileged shell-outs in this module.
+// See `dashboard/DEPLOYMENT.md` Privilege Surface — every shell-exec route
+// records action+entity+actor in Cosmos so a leaked admin token's actions
+// stay reconstructable.
+async function auditShellExec(
+  fastify: FastifyInstance,
+  req: { authUserId?: string; authRole?: string },
+  entityId: string,
+  details: Record<string, unknown>,
+): Promise<void> {
+  await createAuditLog({
+    action: 'shell-exec',
+    entityType: 'host',
+    entityId,
+    userId: req.authUserId ?? 'unknown',
+    role: req.authRole ?? 'unknown',
+    productId,
+    details,
+  }).catch((err) => fastify.log.warn({ err, entityId }, 'audit log write failed'));
+}
+
 export async function vmRoutes(fastify: FastifyInstance) {
 
   // ── Health check ──────────────────────────────────────────────────────────
@@ -74,7 +97,14 @@ export async function vmRoutes(fastify: FastifyInstance) {
   }, async (req, reply) => {
     try {
       const params = VmCleanupParamsSchema.parse(req.body);
-      return reply.send(await runVmCleanup(params.mode));
+      const result = await runVmCleanup(params.mode);
+      await auditShellExec(
+        fastify,
+        req as unknown as { authUserId?: string; authRole?: string },
+        `vm-cleanup:${params.mode}`,
+        { mode: params.mode },
+      );
+      return reply.send(result);
     } catch (error: any) {
       fastify.log.error(error, 'VM cleanup failed');
       return reply.code(500).send({ error: error.message || 'VM cleanup failed' });
@@ -130,6 +160,14 @@ export async function vmRoutes(fastify: FastifyInstance) {
     try {
       const { name } = VmContainerRestartParamsSchema.parse(req.params);
       const result = await restartContainer(name);
+      // Audit even when restart fails (e.g. invalid name) so attempted
+      // privileged actions are still recorded.
+      await auditShellExec(
+        fastify,
+        req as unknown as { authUserId?: string; authRole?: string },
+        `container-restart:${name}`,
+        { name, success: result.success, message: result.message },
+      );
       return reply.code(result.success ? 200 : 400).send(result);
     } catch (error: any) {
       fastify.log.error(error, 'Container restart failed');
diff --git a/dashboard/backend/vitest.config.ts b/dashboard/backend/vitest.config.ts
index 6b6e363..ec0316b 100644
--- a/dashboard/backend/vitest.config.ts
+++ b/dashboard/backend/vitest.config.ts
@@ -15,6 +15,7 @@ export default defineConfig({
       include: [
         'src/lib/auth.ts',
         'src/lib/csrf.ts',
+        'src/lib/shell.ts',
         'src/modules/health/repository.ts',
         'src/modules/hermes-ops/repository.ts',
         'src/modules/hermes-telemetry/repository.ts',