Fix ToT eval injection with json.loads (upstream PR FoundationAgents#1946)

Replace eval() with json.loads() for parsing LLM thought outputs.
Keeps eval() as fallback for non-standard output with noqa marker.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

Author: eusoubrasileiro

metagpt/strategy/tot.py

@@ -5,6 +5,7 @@
 from __future__ import annotations
 
 import asyncio
+import json
 from typing import Any, List, Optional
 
 from pydantic import BaseModel, ConfigDict, Field
@@ -63,7 +64,11 @@ async def generate_thoughts(self, current_state="", current_node=None) -> List[T
         )
         rsp = await self.llm.aask(msg=state_prompt + "\n" + OUTPUT_FORMAT)
         thoughts = CodeParser.parse_code(block="", text=rsp)
-        thoughts = eval(thoughts)
+        try:
+            thoughts = json.loads(thoughts)
+        except json.JSONDecodeError:
+            logger.warning(f"Failed to parse thoughts as JSON, attempting eval fallback: {thoughts[:100]}")
+            thoughts = eval(thoughts)  # noqa: S307 - fallback for non-standard LLM output
         # fixme 避免不跟随，生成过多nodes
         # valid_thoughts = [_node for idx, _node in enumerate(thoughts) if idx < self.n_generate_sample]
         return self.thought_tree.update_node(thoughts, current_node=current_node)