@tdk-landscape/tdk-cli-core 1.3.126 → 1.3.127

package/CHANGELOG.md

@@ -4,6 +4,10 @@ Notable changes to the `tdk` CLI. Versions match [npm](https://www.npmjs.com/pac
 
 ## Unreleased
 
+## 1.3.127 (2026-10-08)
+
+- Security hardening flagged by Socket (#826). The npm package no longer includes `ext/ide-components/code_executor/server.py`, a browser terminal that ran client-supplied commands through a shell. `tdk` and the Tilt engine never started it. The other IDE components are unchanged. `tdk doctor` now single-quotes the registry URL and container name it passes to `curl` and `docker logs`, so a value such as `$(...)` can no longer run a command.
+
 ## 1.3.126 (2026-10-08)
 
 - Security: fixes [GHSA-phgf-pww4-7jxc](https://github.com/tdk-landscape/tdk-cli-core/security/advisories/GHSA-phgf-pww4-7jxc) (all earlier versions). A line break in a `service.json` value was written into the generated Docker Compose file and could add keys such as `privileged: true` to a service when you ran `tdk up` or `tilt up` on a repository you did not write. `tdk` and the Tilt engine now refuse any `service.json` string key or value that contains a line break (including U+0085, U+2028 and U+2029) or another control character, and `healthCheckPath`, `traefik.host`, `traefik.pathPrefix`, `traefik.healthCheck`, `nats.queueGroup`, `databaseName`, `stack` and `image` must also match a pattern. `smoke` is exempt. `tdk up` and `tdk config regenerate` stop with an error that names the field and does not print the value, and `tilt up` stops the same way. Upgrade, and check `service.json` files from repositories you did not write.

package/README.md

@@ -7,6 +7,8 @@
 [![Quickstart E2E](https://github.com/tdk-landscape/tdk-cli-core/actions/workflows/quickstart-e2e.yml/badge.svg)](https://github.com/tdk-landscape/tdk-cli-core/actions/workflows/quickstart-e2e.yml)
 [![ERP fixture scale E2E](https://github.com/tdk-landscape/tdk-cli-core/actions/workflows/erp-scale-e2e.yml/badge.svg)](https://github.com/tdk-landscape/tdk-cli-core/actions/workflows/erp-scale-e2e.yml)
 [![Example apps E2E](https://github.com/tdk-landscape/tdk-cli-core/actions/workflows/examples-e2e.yml/badge.svg?branch=main)](https://github.com/tdk-landscape/tdk-cli-core/actions/workflows/examples-e2e.yml)
+[![CodeQL](https://github.com/tdk-landscape/tdk-cli-core/actions/workflows/codeql.yml/badge.svg?branch=main)](https://github.com/tdk-landscape/tdk-cli-core/security/code-scanning)
+[![OpenSSF Scorecard](https://api.securityscorecards.dev/projects/github.com/tdk-landscape/tdk-cli-core/badge)](https://scorecard.dev/viewer/?uri=github.com/tdk-landscape/tdk-cli-core)
 [![Known Vulnerabilities](https://snyk.io/test/github/tdk-landscape/tdk-cli-core/badge.svg)](https://snyk.io/test/github/tdk-landscape/tdk-cli-core)
 [![Socket Badge](https://badge.socket.dev/npm/package/@tdk-landscape/tdk-cli-core/latest)](https://socket.dev/npm/package/@tdk-landscape/tdk-cli-core/overview)
 [![License: MIT](https://img.shields.io/badge/License-MIT-yellow.svg)](LICENSE)

package/cli/dist/utils/doctor-runtime.js

@@ -17,6 +17,13 @@ export const HOST_PORT_FIXES = {
     port80: "Stop the process bound to port 80, or stop local nginx/caddy. Then: tdk doctor",
     port5432: "Stop local Postgres or change the host port. Then: tdk doctor",
 };
+/**
+ * Quote a value for a POSIX shell command line. JSON.stringify is not enough:
+ * inside double quotes `$(...)`, backticks and `$VAR` are still expanded.
+ */
+export function shellQuote(value) {
+    return `'${value.replace(/'/g, `'\\''`)}'`;
+}
 function runHostCommand(exec, command, args, shellCommand, options) {
     if (process.platform === "win32") {
         return execFileSync(findOnPath(command) ?? command, args, {
@@ -269,7 +276,7 @@ export function checkPrivateNpmRegistry(exec = execSync, projectRoot = findProje
                 timeout: REGISTRY_PROBE_TIMEOUT_MS + 1_000,
                 windowsHide: true,
             }).trim()
-            : exec(`curl -fsS -o /dev/null -w '%{http_code}' --max-time 2 ${JSON.stringify(registryUrl)}`, {
+            : exec(`curl -fsS -o /dev/null -w '%{http_code}' --max-time 2 ${shellQuote(registryUrl)}`, {
                 stdio: "pipe",
                 encoding: "utf-8",
                 timeout: REGISTRY_PROBE_TIMEOUT_MS + 1_000,
@@ -648,7 +655,7 @@ export function probeContainerRuntimeError(resourceName, exec = execSync) {
             names.find((name) => name.includes(resourceName));
         if (!match)
             return null;
-        const logs = runHostCommand(exec, "docker", ["logs", "--tail", "120", match], `docker logs --tail 120 ${JSON.stringify(match)} 2>&1`, {
+        const logs = runHostCommand(exec, "docker", ["logs", "--tail", "120", match], `docker logs --tail 120 ${shellQuote(match)} 2>&1`, {
             stdio: "pipe",
             encoding: "utf-8",
             timeout: EXEC_TIMEOUT_MS,

package/cli/package.json

@@ -1,7 +1,7 @@
 {
   "name": "tdk-cli-internal",
   "private": true,
-  "version": "1.3.126",
+  "version": "1.3.127",
   "description": "TDK CLI — start services on your laptop.",
   "keywords": [
     "tdk",
@@ -38,6 +38,7 @@
     "discovery",
     "specs",
     "ext",
+    "!ext/ide-components/code_executor",
     "shared-platform-engineering/docker-templates"
   ],
   "scripts": {

package/ext/ide-components/README.md

@@ -13,6 +13,8 @@ The Tilt IDE provides browser-based tools for browsing, viewing, and executing c
 | **Config Inspector** | 9767 | http://configs.localhost | http://localhost:9767 |
 | **Code Executor** | 9768 | http://terminal.localhost | http://localhost:9768 |
 
+> **Note:** `code_executor` is not shipped in the npm package or started by `tilt up` (see #826). Its source stays in the repository.
+
 ## Quick Start
 
 All components start automatically when you run `tilt up`:

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@tdk-landscape/tdk-cli-core",
-  "version": "1.3.126",
+  "version": "1.3.127",
   "description": "TDK CLI — start services on your laptop.",
   "homepage": "https://tdk-landscape.github.io/tdk-website",
   "repository": {
@@ -25,6 +25,7 @@
     "discovery",
     "specs",
     "ext",
+    "!ext/ide-components/code_executor",
     "shared-platform-engineering/docker-templates",
     "examples/tdk-example",
     "cli/bin",

package/ext/ide-components/code_executor/server.py

@@ -1,268 +0,0 @@
-#!/usr/bin/env python3
-"""
-Tilt IDE Code Executor
-Execute commands from web UI at http://localhost:9768
-"""
-
-import json
-import os
-import subprocess
-import sys
-import urllib.parse
-from pathlib import Path
-
-# Add shared modules
-sys.path.insert(0, str(Path(__file__).parent.parent / 'shared'))
-from file_utils import PROJECT_ROOT
-from http_utils import BaseIDEHandler, run_server
-
-PORT = 9768
-
-
-class CodeExecutorHandler(BaseIDEHandler):
-    """HTTP request handler for code executor"""
-    
-    # Command validation constants
-    DANGEROUS_COMMANDS = [
-        'rm -rf /', 'rm -rf /*', ':(){ :|:& };:', '> /dev/sda',
-        'mv / /dev/null', 'dd if=/dev/zero', 'mkfs.', 'chmod -R 777 /',
-        'sudo', 'su -', 'passwd', 'deluser', 'userdel'
-    ]
-    
-    ALLOWED_PREFIXES = [
-        'bun ', 'ls ', 'pwd', 'echo ', 'cat ', 'head ', 'tail ', 
-        'grep ', 'find ', 'cd ', 'mkdir ', 'touch ', 'clear', 'exit',
-        'npm ', 'yarn ', 'npx ', 'pnpm ', 'git ', 'curl ', 'wget '
-    ]
-    
-    def validate_command(self, cmd: str) -> tuple:
-        """
-        Validate command for safety.
-        Returns (is_valid, error_message)
-        """
-        # Block dangerous commands
-        for dangerous in self.DANGEROUS_COMMANDS:
-            if dangerous in cmd.lower():
-                return False, f"Command blocked for safety: {dangerous}"
-        
-        # Only allow bun commands and safe system commands
-        cmd_stripped = cmd.strip()
-        is_allowed = any(cmd_stripped.startswith(prefix) for prefix in self.ALLOWED_PREFIXES)
-        
-        if not is_allowed:
-            return False, "Only bun, npm, git, and safe system commands are allowed"
-        
-        return True, None
-    
-    def execute_command(self, cmd: str, cwd: str = None) -> dict:
-        """Execute command and return result"""
-        # Validate
-        is_valid, error = self.validate_command(cmd)
-        if not is_valid:
-            return {'success': False, 'stdout': '', 'stderr': error, 'exit_code': 1}
-        
-        # Determine working directory
-        work_dir = cwd or str(PROJECT_ROOT)
-        
-        try:
-            # Execute with timeout
-            result = subprocess.run(
-                cmd,
-                shell=True,
-                cwd=work_dir,
-                capture_output=True,
-                text=True,
-                timeout=60,  # 60 second timeout
-                env={**os.environ, 'TERM': 'xterm-color'}
-            )
-            
-            return {
-                'success': result.returncode == 0,
-                'stdout': result.stdout,
-                'stderr': result.stderr,
-                'exit_code': result.returncode
-            }
-        except subprocess.TimeoutExpired:
-            return {'success': False, 'stdout': '', 'stderr': 'Command timed out (60s limit)', 'exit_code': -1}
-        except Exception as e:
-            return {'success': False, 'stdout': '', 'stderr': str(e), 'exit_code': -1}
-    
-    def _get_template_path(self) -> Path:
-        """Override to use shared template"""
-        return Path(__file__).parent.parent / 'shared' / 'templates' / 'base.html'
-    
-    def do_GET(self):
-        """Handle GET requests"""
-        parsed = urllib.parse.urlparse(self.path)
-        path = parsed.path
-        query = urllib.parse.parse_qs(parsed.query)
-        
-        # Health check
-        if path == '/health':
-            self.handle_health_check('code-executor')
-            return
-        
-        # Static files
-        if path.startswith('/static/'):
-            static_path = Path(__file__).parent.parent / 'shared' / path[1:]
-            if static_path.exists():
-                with open(static_path, 'r') as f:
-                    content = f.read()
-                self.send_css_response(content)
-            else:
-                self.send_error_response(404, 'Not found')
-            return
-        
-        if path in ('/', '/terminal'):
-            cwd = query.get('cwd', [str(PROJECT_ROOT)])[0]
-            cwd_display = self.escape_html(cwd.replace(str(PROJECT_ROOT), '~'))
-            
-            content = f'''
-                <div class="terminal" style="height: calc(100vh - 200px);">
-                    <div class="terminal-header">
-                        <div>
-                            <span class="panel-title">💻 Terminal</span>
-                            <span class="text-muted" style="margin-left: 1rem; font-size: 0.85rem;">Working directory: {cwd_display}</span>
-                        </div>
-                        <div>
-                            <span class="text-muted" style="font-size: 0.8rem;">Supports: bun, npm, git, basic shell</span>
-                        </div>
-                    </div>
-                    <div class="terminal-content" id="terminal-output" style="white-space: pre-wrap; font-family: var(--font-mono);">
-                        <div class="text-muted">TDK Landscape Tilt IDE Terminal</div>
-                        <div class="text-muted">Type a command and press Enter to execute</div>
-                        <div class="text-muted">─────────────────────────────────────────</div>
-                    </div>
-                    <div class="terminal-input-line">
-                        <span class="terminal-prompt">$</span>
-                        <input type="text" id="terminal-input" class="terminal-input" 
-                               placeholder="Enter command (e.g., bun test, ls -la)..." 
-                               autocomplete="off" spellcheck="false">
-                    </div>
-                </div>
-                
-                <script>
-                    const terminalOutput = document.getElementById('terminal-output');
-                    const terminalInput = document.getElementById('terminal-input');
-                    const cwd = {json.dumps(cwd)};
-                    let commandHistory = [];
-                    let historyIndex = -1;
-                    
-                    terminalInput.addEventListener('keydown', async function(e) {{
-                        if (e.key === 'Enter') {{
-                            const cmd = this.value.trim();
-                            if (!cmd) return;
-                            
-                            // Add to history
-                            commandHistory.push(cmd);
-                            historyIndex = commandHistory.length;
-                            
-                            // Display command
-                            terminalOutput.innerHTML += `<div><span style="color: var(--accent-primary);">$</span> ${{self.escape_html(cmd)}}</div>`;
-                            terminalInput.value = '';
-                            
-                            // Execute
-                            try {{
-                                const response = await fetch('/execute', {{
-                                    method: 'POST',
-                                    headers: {{'Content-Type': 'application/json'}},
-                                    body: JSON.stringify({{command: cmd, cwd: cwd}})
-                                }});
-                                const result = await response.json();
-                                
-                                // Display output
-                                if (result.stdout) {{
-                                    terminalOutput.innerHTML += `<div style="color: var(--text-primary);">${{self.escape_html(result.stdout)}}</div>`;
-                                }}
-                                if (result.stderr) {{
-                                    terminalOutput.innerHTML += `<div style="color: var(--error);">${{self.escape_html(result.stderr)}}</div>`;
-                                }}
-                                
-                                // Status
-                                const statusColor = result.success ? 'var(--success)' : 'var(--error)';
-                                terminalOutput.innerHTML += `<div style="color: ${{statusColor}}; font-size: 0.8rem;">Exit code: ${{result.exit_code}}</div>`;
-                                
-                            }} catch (err) {{
-                                terminalOutput.innerHTML += `<div style="color: var(--error);">Error: ${{err.message}}</div>`;
-                            }}
-                            
-                            // Scroll to bottom
-                            terminalOutput.scrollTop = terminalOutput.scrollHeight;
-                        }}
-                        
-                        // History navigation
-                        if (e.key === 'ArrowUp') {{
-                            e.preventDefault();
-                            if (historyIndex > 0) {{
-                                historyIndex--;
-                                terminalInput.value = commandHistory[historyIndex];
-                            }}
-                        }}
-                        if (e.key === 'ArrowDown') {{
-                            e.preventDefault();
-                            if (historyIndex < commandHistory.length - 1) {{
-                                historyIndex++;
-                                terminalInput.value = commandHistory[historyIndex];
-                            }} else {{
-                                historyIndex = commandHistory.length;
-                                terminalInput.value = '';
-                            }}
-                        }}
-                    }});
-                    
-                    terminalInput.focus();
-                </script>
-            '''
-            
-            self.send_html_response(self.render_page('Terminal', content, icon='💻'))
-            return
-        
-        # 404
-        self.send_html_response(self.render_page(
-            'Not Found',
-            '<div class="empty-state"><div class="empty-state-icon">❓</div>Page not found</div>',
-            icon='❓'
-        ), 404)
-    
-    def do_POST(self):
-        """Handle POST requests"""
-        parsed = urllib.parse.urlparse(self.path)
-        
-        if parsed.path == '/execute':
-            # Read request body
-            content_length = int(self.headers.get('Content-Length', 0))
-            body = self.rfile.read(content_length).decode()
-            
-            try:
-                data = json.loads(body)
-                cmd = data.get('command', '').strip()
-                cwd = data.get('cwd', str(PROJECT_ROOT))
-                
-                if not cmd:
-                    self.send_json_response({'success': False, 'error': 'No command provided'}, 400)
-                    return
-                
-                result = self.execute_command(cmd, cwd)
-                self.send_json_response(result)
-                
-            except json.JSONDecodeError:
-                self.send_json_response({'success': False, 'error': 'Invalid JSON'}, 400)
-            except Exception as e:
-                self.send_json_response({'success': False, 'error': str(e)}, 500)
-            return
-        
-        self.send_json_response({'error': 'Not found'}, 404)
-
-
-def main():
-    """Run the code executor server"""
-    run_server(
-        CodeExecutorHandler,
-        PORT,
-        '💻 Tilt IDE Code Executor',
-        '🚀 Execute bun commands from the browser\n   ⚠️  Safety: Only bun, npm, git, and safe system commands allowed'
-    )
-
-
-if __name__ == '__main__':
-    main()