Merge "Enforce guards against crash command via shell" into tm-dev