Agno 3.0.2 fixed a sandbox escape where `allow_shell=False` still ran `%%bash`.

IPython 9.17 registers script magics lazily and recreates them on lookup, so Agno's method of removing bash from the cell-magic table stopped disabling it. A kernel explicitly configured to forbid shell access executed %%bash anyway. The fix materializes the script-magic provider first and drops bash from both the lazy table and the live registry, so loading a sibling magic like %%sh can't re-register it. (GitHub) Any Agno deployment treating allow_shell=False as a containment boundary on IPython 9.17 was not contained.