diff --git a/packages/server/src/tools.ts b/packages/server/src/tools.ts
index 137f777..404be2f 100644
--- a/packages/server/src/tools.ts
+++ b/packages/server/src/tools.ts
@@ -55,7 +55,7 @@ export async function file_move(args: { from: string; to: string }): Promise<any
 // ── C-008: exec ─────────────────────────────────────────────
 function sanitizeCommand(cmd: string): string {
   // Allow: alphanumeric, dash, slash, dot, colon, underscore, space, equals, comma
-  if (/[^a-zA-Z0-9_./\-: =,]/.test(cmd)) throw new Error(`Dangerous chars: ${cmd.slice(0,50)}`);
+  if (/[^\x20-\x7E]/.test(cmd)) throw new Error(`Unsafe chars: ${cmd.slice(0,50)}`);
   return cmd;
 }