Harden command execution in init wizard beyond string-based validation

cli/src/lib/init/local-ops.ts を読み、まず validateCommand() と runSingleCommand() から、既存の検証、シェルの使用、タイムアウト、出力制限を理解してください。issue に記載されている Linux と macOS の sandboxing オプションを比較し、どのコマンドパスに OS 固有の処理が必要かを判断してください。既存のチェックを削除せずに選択した hardening アプローチが実装され、そのセキュリティ境界が検証されていれば完了です。

Summary

cli/src/lib/init/local-ops.ts executes commands from the API server using shell: true. The current protections are string-based and could be bypassed by a sufficiently creative payload. Before sentry init exits experimental mode, we should add OS-level sandboxing.

Current protections

validateCommand() (line 140) — three layers of string validation:

1. Shell metacharacter blocking — rejects commands containing ;, &&, ||, |, `, $(, $, quotes, redirects (>, <), braces, globs, newlines, backslashes
2. Env var injection blocking — rejects commands where the first token contains =
3. Dangerous executable blocklist — rejects 40+ executables (rm, curl, sudo, ssh, bash, eval, etc.) but only checks the first token — e.g. npm exec -- rm -rf / would pass because npm is the primary executable

safePath() / path validation — prevents path traversal and symlink escapes outside the project root.

runSingleCommand() (line 426) — spawns via spawn(command, [], { shell: true, cwd, ... }) with a timeout and output truncation (64KB cap).

Gap

All protections are string-based pattern matching. The command still runs under shell: true with full user privileges. Potential bypasses:

• Package manager subcommands that execute arbitrary code (e.g. npm exec, lifecycle scripts)
• Unicode/encoding tricks that survive validation but are interpreted differently by the shell
• Future commands the server might send that don't match current patterns

Suggested hardening (Linux)

These are additive layers — the string validation remains as a fast first pass.

macOS considerations

macOS lacks namespaces/Landlock. Options are more limited:

• sandbox-exec (deprecated but functional) with a restrictive profile
• Avoid shell: true where possible by splitting commands into argv arrays

Priority

Low — the current string validation is a reasonable defense for an experimental feature where commands originate from our own API server. This becomes more important if/when the command surface expands or the feature exits experimental.