Missing required security_risk parameter for execute_bash with DeepSeek Reasoner

[maxpetrusenkoagent]

Bug description

The OpenHands/OpenHands issue OpenHands/OpenHands#14129 reports CLI failure with DeepSeek Reasoner:

Missing required parameters for function 'execute_bash': {'security_risk'}

A maintainer on that issue asked the reporter to file CLI bugs in this repository. I could not find an existing OpenHands-CLI issue or PR for execute_bash security_risk.

Evidence / current behavior

• Installation method in the original report: CLI (uv tool install)
• Model in the original report: deepseek-reasoner
• OpenHands/OpenHands does not implement the CLI execute_bash tool contract directly. In that repo, execute_bash/security_risk mostly appears in frontend V1 event rendering/types/tests, while the Python package pins openhands-agent-server, openhands-sdk, and openhands-tools.
• OpenHands-CLI code search shows execute_bash and security_risk usage in CLI tests/trajectories, so the CLI/tool-call conversion path is the likely owner.

Expected behavior

The CLI should not fail a model tool call solely because security_risk is absent from the execute_bash arguments. Either:

1. the execute_bash tool schema should not require security_risk from the model, or
2. the CLI/tool-call adapter should inject a safe default such as UNKNOWN before validation/confirmation handling.

Implementation notes

A focused fix should likely add a regression test around the CLI tool-call validation/conversion path for an execute_bash call that includes a command but omits security_risk, then default or relax the field at the boundary that currently raises the missing-required-parameter error.

This should preserve existing confirmation-mode behavior for high-risk commands. The key compatibility case is models/providers that do not emit OpenHands-specific auxiliary fields like security_risk.