@dreamlake/dreamlake-cli 0.15.0 → 0.16.0

package/bin/dreamlake.js

@@ -29,13 +29,63 @@ try {
   process.exit(1);
 }
 
-let r = spawnSync(binPath, process.argv.slice(2), { stdio: "inherit" });
+// Only explicitly selected enrollment password descriptors cross this spawn.
+// Never enumerate inherited descriptors; gaps are closed in the native child.
+function passwordStdio(args) {
+  const stdio = ['inherit', 'inherit', 'inherit'];
+  let offset = 0;
+  while (args[offset] === '-p' || args[offset] === '--prefix' || args[offset]?.startsWith('--prefix=')) offset += args[offset].includes('=') ? 1 : 2;
+  if (args[offset] !== 'hosts' || args[offset + 1] !== 'enroll') return stdio;
+  const rest = args.slice(offset + 2);
+  if (rest.some(arg => ['--dry-run','--help','-h','--no-save-credentials'].includes(arg))) return stdio;
+  const selected = new Set(), descriptors = new Map();
+  const values = new Set(['-n','--name','-p','--prefix','--ssh','--config','--wait-seconds','--request-id','--lakeshore-id','--nymph-version','--target-key','--jump-key']);
+  const validName = name => typeof name === 'string' && name.length <= 512 && /^[A-Za-z0-9_-]+(?:\/[A-Za-z0-9_-]+)*$/.test(name);
+  for (let i = 0; i < rest.length; i++) {
+    if (rest[i] === '--') break;
+    const equal = rest[i].indexOf('=');
+    const flag = equal < 0 ? rest[i] : rest[i].slice(0, equal);
+    if (!['--target-password','--jump-password','--password-fd'].includes(flag)) {
+      if (values.has(flag) && equal < 0) i++;
+      continue;
+    }
+    const value = equal < 0 ? rest[++i] : rest[i].slice(equal + 1);
+    if (typeof value !== 'string') throw Error();
+    if (flag === '--password-fd') {
+      const match = /^(.+)=([0-9]+)$/.exec(value);
+      if (!match || !validName(match[1]) || descriptors.has(match[1])) throw Error();
+      const fd = Number(match[2]);
+      if (!Number.isSafeInteger(fd) || fd < 0 || fd > 1024) throw Error();
+      descriptors.set(match[1], fd);
+    } else {
+      const at = value.indexOf('=');
+      const name = flag === '--target-password' ? value : at > 0 ? value.slice(at + 1) : '';
+      if (!validName(name) || selected.has(name) || flag === '--jump-password' && !/^[A-Za-z0-9_.@:\[\]-]{1,255}$/.test(value.slice(0,at))) throw Error();
+      selected.add(name);
+    }
+  }
+  if (selected.size > 32) throw Error();
+  const { fstatSync } = require('node:fs');
+  for (const [name, fd] of descriptors) {
+    if (!selected.has(name) || process.platform === 'win32') throw Error();
+    const info = fstatSync(fd);
+    if (!info.isFIFO() && !(info.isFile() && !(info.mode & 0o077) && info.uid === process.getuid())) throw Error();
+    while (stdio.length <= fd) stdio.push('ignore');
+    if (fd > 2) stdio[fd] = fd;
+  }
+  return stdio;
+}
+let stdio;
+try { stdio = passwordStdio(process.argv.slice(2)); }
+catch { process.stderr.write('dreamlake: invalid selected password descriptor configuration\n'); process.exit(1); }
+
+let r = spawnSync(binPath, process.argv.slice(2), { stdio });
 if (r.error && r.error.code === "EACCES") {
   // Belt and braces: if a tarball ever ships the binary without the exec
   // bit again, repair it once and retry rather than stranding the user.
   try {
     require("node:fs").chmodSync(binPath, 0o755);
-    r = spawnSync(binPath, process.argv.slice(2), { stdio: "inherit" });
+    r = spawnSync(binPath, process.argv.slice(2), { stdio });
   } catch {}
 }
 if (r.error) {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@dreamlake/dreamlake-cli",
-  "version": "0.15.0",
+  "version": "0.16.0",
   "repository": {
     "type": "git",
     "url": "git+https://github.com/dreamlake-ai/dreamlake-cli.git"
@@ -17,13 +17,13 @@
     "node": ">=18"
   },
   "optionalDependencies": {
-    "@dreamlake/dreamlake-cli-darwin-arm64": "0.15.0",
-    "@dreamlake/dreamlake-cli-darwin-x64": "0.15.0",
-    "@dreamlake/dreamlake-cli-linux-x64": "0.15.0",
-    "@dreamlake/dreamlake-cli-linux-arm64": "0.15.0",
-    "@dreamlake/dreamlake-cli-linux-x64-musl": "0.15.0",
-    "@dreamlake/dreamlake-cli-linux-arm64-musl": "0.15.0",
-    "@dreamlake/dreamlake-cli-win32-x64": "0.15.0",
-    "@dreamlake/dreamlake-cli-win32-arm64": "0.15.0"
+    "@dreamlake/dreamlake-cli-darwin-arm64": "0.16.0",
+    "@dreamlake/dreamlake-cli-darwin-x64": "0.16.0",
+    "@dreamlake/dreamlake-cli-linux-x64": "0.16.0",
+    "@dreamlake/dreamlake-cli-linux-arm64": "0.16.0",
+    "@dreamlake/dreamlake-cli-linux-x64-musl": "0.16.0",
+    "@dreamlake/dreamlake-cli-linux-arm64-musl": "0.16.0",
+    "@dreamlake/dreamlake-cli-win32-x64": "0.16.0",
+    "@dreamlake/dreamlake-cli-win32-arm64": "0.16.0"
   }
 }