rocketdoo 3.2.0__tar.gz → 3.2.1__tar.gz

{rocketdoo-3.2.0 → rocketdoo-3.2.1}/LICENSE

@@ -57,7 +57,7 @@ If the Library as you received it specifies that a proxy can decide whether futu
 <div RKD as ROCKETDOO V3=""></div>
 
 Licencia: LGPL-3.0+
-Versión: "3.2.0"
+Versión: "3.2.1"
 Autor: Horacio Montaño
-Fecha: 29/08/2026
+Fecha: 13/09/2026
 Descripción: Framework to development Odoo

{rocketdoo-3.2.0/rocketdoo.egg-info → rocketdoo-3.2.1}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: rocketdoo
-Version: 3.2.0
+Version: 3.2.1
 Summary: Framework for creating Odoo development environments with Docker and custom templates.
 Author-email: Horacio Montaño <horaciomontano@hdmsoft.com.ar>
 License: GNU LESSER GENERAL PUBLIC LICENSE
@@ -62,9 +62,9 @@ License: GNU LESSER GENERAL PUBLIC LICENSE
         <div RKD as ROCKETDOO V3=""></div>
         
         Licencia: LGPL-3.0+
-        Versión: "3.2.0"
+        Versión: "3.2.1"
         Autor: Horacio Montaño
-        Fecha: 29/08/2026
+        Fecha: 13/09/2026
         Descripción: Framework to development Odoo
 Requires-Python: >=3.10
 Description-Content-Type: text/markdown
@@ -97,7 +97,7 @@ Odoo Development Framework
    - "Horacio Montaño"
 
 ## Version: 
-   - "3.2.0"
+   - "3.2.1"
 
 ----------------------------------------------------------------------------------------------------------------------------------------------------------
 
@@ -517,7 +517,7 @@ rkd instance status                  # Show configured environments
 - Stage: 2 workers, `log_level = info`, 1.5 GB memory limit
 - Production: 4 workers, `log_level = warn`, 2.5 GB memory limit, `proxy_mode = True`, `list_db = False`
 
-> **Note:** Docker deployment requires a running SSH agent with the relevant keys loaded (`ssh-add -l`). Password authentication requires `sshpass` installed on your local machine.
+> **Note:** Docker deployment requires a running SSH agent with the relevant keys loaded (`ssh-add -l`). Password authentication requires `sshpass` installed on your local machine; the password itself travels through the `SSHPASS` environment variable (`sshpass -e`), never as a command-line argument visible to other processes on the same host.
 
 ------------------------------------------------------------------------------------------------------------------------------------------------------
 

{rocketdoo-3.2.0 → rocketdoo-3.2.1}/README.md

@@ -15,7 +15,7 @@ Odoo Development Framework
    - "Horacio Montaño"
 
 ## Version: 
-   - "3.2.0"
+   - "3.2.1"
 
 ----------------------------------------------------------------------------------------------------------------------------------------------------------
 
@@ -435,7 +435,7 @@ rkd instance status                  # Show configured environments
 - Stage: 2 workers, `log_level = info`, 1.5 GB memory limit
 - Production: 4 workers, `log_level = warn`, 2.5 GB memory limit, `proxy_mode = True`, `list_db = False`
 
-> **Note:** Docker deployment requires a running SSH agent with the relevant keys loaded (`ssh-add -l`). Password authentication requires `sshpass` installed on your local machine.
+> **Note:** Docker deployment requires a running SSH agent with the relevant keys loaded (`ssh-add -l`). Password authentication requires `sshpass` installed on your local machine; the password itself travels through the `SSHPASS` environment variable (`sshpass -e`), never as a command-line argument visible to other processes on the same host.
 
 ------------------------------------------------------------------------------------------------------------------------------------------------------
 

{rocketdoo-3.2.0 → rocketdoo-3.2.1}/pyproject.toml

@@ -1,6 +1,6 @@
 [project]
 name = "rocketdoo"
-version = "3.2.0"
+version = "3.2.1"
 description = "Framework for creating Odoo development environments with Docker and custom templates."
 authors = [
     { name = "Horacio Montaño", email = "horaciomontano@hdmsoft.com.ar" }

{rocketdoo-3.2.0 → rocketdoo-3.2.1}/rocketdoo/core/deploy/vps.py

@@ -13,7 +13,7 @@ from typing import Dict, List
 from rich.console import Console
 from rich.progress import BarColumn, Progress, SpinnerColumn, TaskProgressColumn, TextColumn
 
-from rocketdoo.core.ssh_manager import check_sshpass, env_ref_name, resolve_env_ref
+from rocketdoo.core.ssh_manager import check_sshpass, env_ref_name, resolve_env_ref, sshpass_wrap
 
 from .base import BaseDeployer, DeploymentResult
 from .module_packager import ModulePackager
@@ -110,6 +110,11 @@ class VPSDeployer(BaseDeployer):
 
             console.print(f"[green]✔ Password stored securely at {secret_file}[/green]")
 
+    @property
+    def _sshpass_password(self) -> str | None:
+        """The password to feed sshpass, or None when authenticating with a key."""
+        return self.password if self.auth_method == "password" else None
+
     def validate_config(self) -> List[str]:
         """
         Validate VPS configuration
@@ -388,11 +393,23 @@ class VPSDeployer(BaseDeployer):
         Returns:
             CompletedProcess with result
         """
-        # Handle sudo with password authentication
+        # Handle sudo with password authentication. The password never touches
+        # the command string: it travels through the stdin of subprocess.run,
+        # which ssh forwards over the encrypted channel to the remote sudo -S.
+        # This keeps the password out of `ps aux` on both ends and, unlike the
+        # old `echo '{password}' | sudo -S` interpolation, means the password's
+        # content can never alter the structure of the remote command.
+        # The password goes to sudo's stdin, so a remote command that reads
+        # stdin itself cannot be run with use_sudo=True: it would consume the
+        # password line. Today none of the callers do (the only two are
+        # `mkdir` and `systemctl restart`).
+        sudo_input = None
         if use_sudo:
             if self.auth_method == "password" and self.password:
-                # Use echo password | sudo -S for password-based sudo
-                command = f"echo '{self.password}' | sudo -S {command}"
+                command = f"sudo -S -p '' {command}"
+                # Only the first line reaches sudo; a multi-line password would
+                # leave the rest in the remote command's stdin.
+                sudo_input = self.password.splitlines()[0] + "\n" if self.password else None
             else:
                 # Try passwordless sudo or rely on SSH key having sudo access
                 command = f"sudo {command}"
@@ -406,9 +423,6 @@ class VPSDeployer(BaseDeployer):
         if self.auth_method == "ssh_key" and self.ssh_key:
             key_path = os.path.expanduser(self.ssh_key)
             ssh_cmd.extend(["-i", key_path])
-        elif self.auth_method == "password" and self.password:
-            # Use sshpass for password authentication
-            ssh_cmd = ["sshpass", "-p", self.password] + ssh_cmd
 
         # Add user@host
         ssh_cmd.append(f"{self.user}@{self.host}")
@@ -416,9 +430,11 @@ class VPSDeployer(BaseDeployer):
         # Add command
         ssh_cmd.append(command)
 
+        ssh_cmd, env = sshpass_wrap(self._sshpass_password, ssh_cmd)
+
         # Execute
         try:
-            result = subprocess.run(ssh_cmd, capture_output=True, text=True, timeout=timeout)
+            result = subprocess.run(ssh_cmd, capture_output=True, text=True, timeout=timeout, env=env, input=sudo_input)
             return result
         except FileNotFoundError as e:
             if "sshpass" in str(e):
@@ -447,9 +463,6 @@ class VPSDeployer(BaseDeployer):
             if self.auth_method == "ssh_key" and self.ssh_key:
                 key_path = os.path.expanduser(self.ssh_key)
                 ssh_opts += f" -i {key_path}"
-            elif self.auth_method == "password" and self.password:
-                # Use sshpass for rsync with password
-                rsync_cmd = ["sshpass", "-p", self.password] + rsync_cmd
 
             rsync_cmd.extend(["-e", f"ssh {ssh_opts}"])
 
@@ -457,8 +470,10 @@ class VPSDeployer(BaseDeployer):
             rsync_cmd.append(f"{local_path}/")
             rsync_cmd.append(f"{self.user}@{self.host}:{remote_path}/")
 
+            rsync_cmd, env = sshpass_wrap(self._sshpass_password, rsync_cmd)
+
             # Execute rsync
-            result = subprocess.run(rsync_cmd, capture_output=True, text=True, timeout=600)
+            result = subprocess.run(rsync_cmd, capture_output=True, text=True, timeout=600, env=env)
 
             if result.returncode != 0:
                 self.log(f"rsync failed: {result.stderr}", "error")
@@ -500,16 +515,15 @@ class VPSDeployer(BaseDeployer):
             if self.auth_method == "ssh_key" and self.ssh_key:
                 key_path = os.path.expanduser(self.ssh_key)
                 scp_cmd.extend(["-i", key_path])
-            elif self.auth_method == "password" and self.password:
-                # Use sshpass for password authentication
-                scp_cmd = ["sshpass", "-p", self.password] + scp_cmd
 
             # Add source and destination
             scp_cmd.append(str(local_path))
             scp_cmd.append(f"{self.user}@{self.host}:{remote_path}")
 
+            scp_cmd, env = sshpass_wrap(self._sshpass_password, scp_cmd)
+
             # Execute
-            result = subprocess.run(scp_cmd, capture_output=True, text=True, timeout=300)
+            result = subprocess.run(scp_cmd, capture_output=True, text=True, timeout=300, env=env)
 
             return result.returncode == 0
 

{rocketdoo-3.2.0 → rocketdoo-3.2.1}/rocketdoo/core/instance/deployer_docker.py

@@ -140,7 +140,7 @@ class DockerInstanceDeployer:
     def _read_remote_pg_pass(self) -> str | None:
         """Return odoo_pg_pass from a previous deploy, or None if unavailable."""
         remote_file = f"{self.remote_path}/{self.env}/odoo_pg_pass"
-        cmd = build_ssh_cmd(
+        cmd, env = build_ssh_cmd(
             self.auth,
             self.port,
             self.user,
@@ -148,7 +148,7 @@ class DockerInstanceDeployer:
             f"cat {remote_file} 2>/dev/null",
         )
         try:
-            result = subprocess.run(cmd, capture_output=True, text=True, timeout=60)
+            result = subprocess.run(cmd, capture_output=True, text=True, timeout=60, env=env)
         except (subprocess.SubprocessError, OSError):
             return None
         return result.stdout.strip() or None
@@ -228,12 +228,12 @@ class DockerInstanceDeployer:
     # ─── SSH / transfer helpers ───────────────────────────────────────────────
 
     def _ssh(self, command: str, agent_forward: bool = False, timeout: int = 600) -> bool:
-        cmd = build_ssh_cmd(self.auth, self.port, self.user, self.host, command, agent_forward=agent_forward)
-        return subprocess.run(cmd, timeout=timeout).returncode == 0
+        cmd, env = build_ssh_cmd(self.auth, self.port, self.user, self.host, command, agent_forward=agent_forward)
+        return subprocess.run(cmd, timeout=timeout, env=env).returncode == 0
 
     def _rsync(self, local: str, remote: str, extra_opts: list[str] | None = None) -> bool:
-        cmd = build_rsync_cmd(self.auth, self.port, self.user, self.host, local, remote, extra_opts)
-        return subprocess.run(cmd).returncode == 0
+        cmd, env = build_rsync_cmd(self.auth, self.port, self.user, self.host, local, remote, extra_opts)
+        return subprocess.run(cmd, env=env).returncode == 0
 
     # ─── deployment steps ────────────────────────────────────────────────────
 

{rocketdoo-3.2.0 → rocketdoo-3.2.1}/rocketdoo/core/instance/deployer_native.py

@@ -160,9 +160,11 @@ class NativeInstanceDeployer:
             "list_db = False\n"
         )
 
-        # Write conf via heredoc on remote. The heredoc delimiter is quoted
-        # (<< \'ENDCONF\'), so the shell performs no expansion on the body.
-        return self._ssh(f"sudo bash -c 'cat > {self.odoo_conf_path} << \\'ENDCONF\\'\n{conf}\nENDCONF'")
+        # The conf body (including admin_passwd) travels through stdin rather
+        # than being embedded in the command string: it never touches argv,
+        # so it cannot appear in `ps aux` and cannot be affected by shell
+        # quoting rules regardless of what a value contains.
+        return self._ssh(f"sudo tee {self.odoo_conf_path} > /dev/null", input=conf)
 
     def _sync_addons(self) -> bool:
         addons_dir = self.project_path / "addons"
@@ -171,8 +173,8 @@ class NativeInstanceDeployer:
             return True
 
         self._ssh(f"sudo mkdir -p {self.remote_addons} && sudo chown {self.user} {self.remote_addons}")
-        cmd = build_rsync_cmd(self.auth, self.port, self.user, self.host, f"{addons_dir}/", f"{self.remote_addons}/")
-        result = subprocess.run(cmd)
+        cmd, env = build_rsync_cmd(self.auth, self.port, self.user, self.host, f"{addons_dir}/", f"{self.remote_addons}/")
+        result = subprocess.run(cmd, env=env)
         return result.returncode == 0
 
     def _enable_service(self) -> bool:
@@ -180,9 +182,9 @@ class NativeInstanceDeployer:
 
     # ─── helpers ─────────────────────────────────────────────────────────────
 
-    def _ssh(self, command: str, timeout: int = 300) -> bool:
-        cmd = build_ssh_cmd(self.auth, self.port, self.user, self.host, command)
-        return subprocess.run(cmd, timeout=timeout).returncode == 0
+    def _ssh(self, command: str, timeout: int = 300, input: str | None = None) -> bool:
+        cmd, env = build_ssh_cmd(self.auth, self.port, self.user, self.host, command)
+        return subprocess.run(cmd, timeout=timeout, env=env, input=input, text=True).returncode == 0
 
     def _show_plan(self):
         console.print("\n[bold]DRY-RUN — Steps that would be executed:[/bold]")

{rocketdoo-3.2.0 → rocketdoo-3.2.1}/rocketdoo/core/instance/ssh_utils.py

@@ -4,7 +4,7 @@ Shared by DockerInstanceDeployer and NativeInstanceDeployer.
 
 Mirrors the auth pattern from core/deploy/vps.py:
   - ssh_key  → -i key_path
-  - password → sshpass -p <pass>  (requires sshpass installed)
+  - password → sshpass -e     (password read from the SSHPASS env var, requires sshpass installed)
 """
 
 import os
@@ -14,7 +14,7 @@ from pathlib import Path
 
 from rich.console import Console
 
-from rocketdoo.core.ssh_manager import check_sshpass, env_ref_name, resolve_env_ref
+from rocketdoo.core.ssh_manager import check_sshpass, env_ref_name, resolve_env_ref, sshpass_wrap
 
 console = Console()
 
@@ -75,24 +75,8 @@ def resolve_auth(vps_cfg: dict, env: str, project_path: Path) -> dict:
     return {"method": "password", "key_path": None, "password": password}
 
 
-def ssh_prefix(auth: dict) -> list[str]:
-    """
-    Return the command prefix for SSH/rsync based on auth method.
-
-    ssh_key  → []                          (key added via ssh_opts)
-    password → ['sshpass', '-p', '<pass>']
-    """
-    if auth["method"] == "password":
-        return ["sshpass", "-p", auth["password"]]
-    return []
-
-
 def ssh_opts(auth: dict, port: int, agent_forward: bool = False) -> list[str]:
-    """
-    Return SSH -o/-i/-A options (without the leading 'ssh').
-
-    Combine with ssh_prefix() for password auth.
-    """
+    """Return SSH -o/-i/-A options (without the leading 'ssh')."""
     opts = [
         "-p",
         str(port),
@@ -108,24 +92,28 @@ def ssh_opts(auth: dict, port: int, agent_forward: bool = False) -> list[str]:
     return opts
 
 
-def build_ssh_cmd(auth: dict, port: int, user: str, host: str, command: str, agent_forward: bool = False) -> list[str]:
-    """Full SSH command list ready for subprocess.run()."""
-    return [
-        *ssh_prefix(auth),
+def build_ssh_cmd(
+    auth: dict, port: int, user: str, host: str, command: str, agent_forward: bool = False
+) -> tuple[list[str], dict | None]:
+    """Full (cmd, env) pair ready for subprocess.run()."""
+    argv = [
         "ssh",
         *ssh_opts(auth, port, agent_forward),
         f"{user}@{host}",
         command,
     ]
+    # Keyed on the method, as ssh_prefix() was: a dict built by hand without
+    # a "password" key should not silently fall through to key auth.
+    password = auth["password"] if auth["method"] == "password" else None
+    return sshpass_wrap(password, argv)
 
 
 def build_rsync_cmd(
     auth: dict, port: int, user: str, host: str, local: str, remote: str, extra_opts: list[str] | None = None
-) -> list[str]:
-    """rsync command list ready for subprocess.run()."""
+) -> tuple[list[str], dict | None]:
+    """rsync (cmd, env) pair ready for subprocess.run()."""
     ssh_e = "ssh " + " ".join(ssh_opts(auth, port))
-    return [
-        *ssh_prefix(auth),
+    argv = [
         "rsync",
         "-avz",
         "--delete",
@@ -135,3 +123,7 @@ def build_rsync_cmd(
         local,
         f"{user}@{host}:{remote}",
     ]
+    # Keyed on the method, as ssh_prefix() was: a dict built by hand without
+    # a "password" key should not silently fall through to key auth.
+    password = auth["password"] if auth["method"] == "password" else None
+    return sshpass_wrap(password, argv)

rocketdoo-3.2.1/rocketdoo/core/odoo_db.py

@@ -0,0 +1,118 @@
+"""Read-only access to the project's PostgreSQL container.
+
+The `pg_database` query and the container lookup used to live only in
+`pack_environment`; the GUI module-update feature needs the same data, so
+this consolidates them into a single place (like `core/compose.py` did for
+`docker compose` in #137) instead of growing a third copy.
+"""
+
+import subprocess
+
+from rocketdoo.project_info import read_docker_compose
+
+PSQL_USER = "root"  # POSTGRES_USER set by the docker-compose template
+
+
+def db_container(compose_data: dict | None = None) -> str | None:
+    """Return the `db` service's container name, or None if it can't be read."""
+    if compose_data is None:
+        compose_data = read_docker_compose()
+    try:
+        return compose_data["services"]["db"]["container_name"]
+    except (KeyError, TypeError):
+        return None
+
+
+def databases_result(compose_data: dict | None = None) -> tuple[list[str], str]:
+    """List of user databases plus the reason it came back empty, if any.
+
+    Excludes `postgres` and the templates, matching what `rkd pack` already
+    queried. Any failure to reach the container yields an empty list.
+    """
+    container = db_container(compose_data)
+    if not container:
+        return [], "no database container configured"
+
+    try:
+        result = subprocess.run(
+            [
+                "docker",
+                "exec",
+                container,
+                "psql",
+                "-U",
+                PSQL_USER,
+                "-d",
+                "postgres",
+                "-t",
+                "-c",
+                "SELECT datname FROM pg_database WHERE datistemplate = false AND datname != 'postgres';",
+            ],
+            capture_output=True,
+            text=True,
+            timeout=15,
+        )
+    except FileNotFoundError:
+        return [], "docker not found"
+    except (OSError, subprocess.SubprocessError) as exc:
+        return [], str(exc)
+
+    if result.returncode != 0:
+        return [], result.stderr.strip()
+
+    return [line.strip() for line in result.stdout.splitlines() if line.strip()], ""
+
+
+def list_databases(compose_data: dict | None = None) -> list[str]:
+    """List of user databases. Use `databases_result` when the reason matters."""
+    return databases_result(compose_data)[0]
+
+
+def module_states(db: str) -> tuple[dict[str, str], str]:
+    """Map `{module_name: state}` read from `ir_module_module` in `db`.
+
+    `db` is not validated here: that is the trust boundary's job (the GUI
+    layer), and keeping it in one place avoids the validation being
+    duplicated with different criteria. If `db` isn't an Odoo database,
+    psql fails and ({}, stderr) is returned.
+    """
+    container = db_container()
+    if not container:
+        return {}, "no database container configured"
+
+    try:
+        result = subprocess.run(
+            [
+                "docker",
+                "exec",
+                container,
+                "psql",
+                "-U",
+                PSQL_USER,
+                "-d",
+                db,
+                "-t",
+                "-A",
+                "-F",
+                "\t",
+                "-c",
+                "SELECT name, state FROM ir_module_module;",
+            ],
+            capture_output=True,
+            text=True,
+            timeout=15,
+        )
+    except FileNotFoundError:
+        return {}, "docker not found"
+    except (OSError, subprocess.SubprocessError) as exc:
+        return {}, str(exc)
+
+    if result.returncode != 0:
+        return {}, result.stderr.strip()
+
+    states = {}
+    for line in result.stdout.splitlines():
+        name, _, state = line.strip().partition("\t")
+        if name and state:
+            states[name] = state
+    return states, ""

{rocketdoo-3.2.0 → rocketdoo-3.2.1}/rocketdoo/core/ssh_manager.py

@@ -58,3 +58,16 @@ def resolve_env_ref(value: str) -> str:
     if name is None:
         return value
     return os.environ.get(name, "")
+
+
+def sshpass_wrap(password: str | None, argv: list[str]) -> tuple[list[str], dict | None]:
+    """Return (argv, env) for a command that may need password authentication.
+
+    The password travels in the SSHPASS environment variable of the child
+    process, never as an argv element readable through `ps`. Without a
+    password the command is returned untouched and env is None, which makes
+    subprocess inherit the parent environment exactly as before.
+    """
+    if not password:
+        return argv, None
+    return ["sshpass", "-e", *argv], {**os.environ, "SSHPASS": password}

{rocketdoo-3.2.0 → rocketdoo-3.2.1}/rocketdoo/gui/api/__init__.py

@@ -6,6 +6,7 @@ from .gitman import router as gitman_router
 from .instances import router as instances_router
 from .mail import router as mail_router
 from .modules import router as modules_router
+from .odoo import router as odoo_router
 from .pack_ops import router as pack_router
 from .project import router as project_router
 from .setup import router as setup_router
@@ -17,6 +18,7 @@ router.include_router(workspace_router, prefix="/workspace", tags=["workspace"])
 router.include_router(project_router, prefix="/project", tags=["project"])
 router.include_router(docker_router, prefix="/docker", tags=["docker"])
 router.include_router(modules_router, prefix="/modules", tags=["modules"])
+router.include_router(odoo_router, prefix="/odoo", tags=["odoo"])
 router.include_router(gitman_router, prefix="/gitman", tags=["gitman"])
 router.include_router(mail_router, prefix="/mail", tags=["mail"])
 router.include_router(traefik_router, prefix="/traefik", tags=["traefik"])

rocketdoo-3.2.1/rocketdoo/gui/api/odoo.py

@@ -0,0 +1,80 @@
+"""Odoo database and module-state endpoints for the GUI.
+
+Backs the Modules view's per-database Update button: lists the databases in
+the project's PostgreSQL container, the install state of each module in one
+of them, and builds the `docker compose exec` command that runs the update.
+"""
+
+from pathlib import Path
+
+from fastapi import APIRouter
+
+from rocketdoo.core.module_scanner import ModuleScanner
+from rocketdoo.core.odoo_db import databases_result, list_databases, module_states
+
+router = APIRouter()
+
+ODOO_SERVICE = "web"  # service name from the docker-compose template
+
+
+# Not `async def`: these call subprocess.run, which would block the event
+# loop. Starlette runs sync handlers in a threadpool instead.
+@router.get("/databases")
+def get_databases():
+    databases, error = databases_result()
+    if error:
+        return {"databases": databases, "error": error}
+    return {"databases": databases}
+
+
+@router.get("/module-states")
+def get_module_states(db: str):
+    if db not in list_databases():
+        return {"states": {}, "error": "unknown database"}
+    states, error = module_states(db)
+    if error:
+        return {"states": states, "error": error}
+    return {"states": states}
+
+
+def _known_modules() -> set[str]:
+    """Every module name found under addons/.
+
+    Same scanner and addons_path as GET /api/modules, but without its
+    `installable` filter: whether a module can be updated is decided by its
+    state in ir_module_module, not by its manifest.
+    """
+    scanner = ModuleScanner(addons_path=Path.cwd() / "addons")
+    return {m.name for m in scanner.scan(force_rescan=True)}
+
+
+def build_update_command(module: str, db: str) -> tuple[list[str] | None, str]:
+    """Build the `docker compose exec` argv for updating `module` in `db`.
+
+    Validates both by membership in the real lists, never by regex or
+    escaping: this is the only barrier between the browser and the Odoo CLI.
+    """
+    # A directory literally named "--load-language=es" would otherwise pass
+    # the membership check below and reach the Odoo CLI as a flag. Membership
+    # is still the real barrier; this only closes the one case where an
+    # attacker also controls addons/.
+    if module.startswith("-") or db.startswith("-"):
+        return None, "invalid name"
+    if db not in list_databases():
+        return None, "unknown database"
+    if module not in _known_modules():
+        return None, "unknown module"
+    return [
+        "docker",
+        "compose",
+        "exec",
+        "-T",
+        ODOO_SERVICE,
+        "odoo",
+        "-d",
+        db,
+        "-u",
+        module,
+        "--stop-after-init",
+        "--log-level=info",
+    ], ""