Harden command execution in init wizard beyond string-based validation

Read cli/src/lib/init/local-ops.ts, starting with validateCommand() and runSingleCommand() to understand the existing validation, shell usage, timeout, and output limits. Compare the Linux and macOS sandboxing options listed in the issue and determine which command paths need OS-specific handling. Done means the chosen hardening approach is implemented without removing the existing checks and its security boundaries are verified.

Summary

cli/src/lib/init/local-ops.ts executes commands from the API server using shell: true. The current protections are string-based and could be bypassed by a sufficiently creative payload. Before sentry init exits experimental mode, we should add OS-level sandboxing.

Current protections

validateCommand() (line 140) — three layers of string validation:

1. Shell metacharacter blocking — rejects commands containing ;, &&, ||, |, `, $(, $, quotes, redirects (>, <), braces, globs, newlines, backslashes
2. Env var injection blocking — rejects commands where the first token contains =
3. Dangerous executable blocklist — rejects 40+ executables (rm, curl, sudo, ssh, bash, eval, etc.) but only checks the first token — e.g. npm exec -- rm -rf / would pass because npm is the primary executable

safePath() / path validation — prevents path traversal and symlink escapes outside the project root.

runSingleCommand() (line 426) — spawns via spawn(command, [], { shell: true, cwd, ... }) with a timeout and output truncation (64KB cap).

Gap

All protections are string-based pattern matching. The command still runs under shell: true with full user privileges. Potential bypasses:

• Package manager subcommands that execute arbitrary code (e.g. npm exec, lifecycle scripts)
• Unicode/encoding tricks that survive validation but are interpreted differently by the shell
• Future commands the server might send that don't match current patterns

Suggested hardening (Linux)

These are additive layers — the string validation remains as a fast first pass.

macOS considerations

macOS lacks namespaces/Landlock. Options are more limited:

• sandbox-exec (deprecated but functional) with a restrictive profile
• Avoid shell: true where possible by splitting commands into argv arrays

Priority

Low — the current string validation is a reasonable defense for an experimental feature where commands originate from our own API server. This becomes more important if/when the command surface expands or the feature exits experimental.