Harden CLI security boundaries and toolchain

[bmdavis419]

Summary

• require patched Go and scan every release target with the configured workflow toolchain
• prevent release-tag shell injection, multiline/non-canonical version bypasses, and cross-repository self-update traversal
• validate release metadata, asset paths, redirect hosts, and credential boundaries
• open credential files with no-follow semantics, validate the opened descriptor, preserve close errors, and self-heal repairable POSIX modes
• strictly parse loopback-only HTTP test URLs, including default port 80, and prove hostile authorities trigger no request
• bound network waits, retry arithmetic, response sizes, and streaming memory
• sanitize terminal controls and neutralize scalar/composite TSV formulas without altering negative numbers
• harden Unix and Windows installers, including unique temporary bootstrap scripts
• document the remaining unsigned-release trust boundary

Security review

The audit covers credentials, OAuth, networking, updater/archive handling, installers, release workflows, output formats, parameter boundaries, resource limits, and dependency reachability.

Release checksums protect download integrity but retain GitHub Releases as the publisher trust root. Independent signing needs a separately managed signing identity and verification policy.

Testing

• all Depot CI jobs pass
• CodeRabbit, Greptile, and Macroscope checks pass
• six release-target govulncheck matrix reports no vulnerabilities
• scoped race tests pass for config, YouTube client, updater, and output handling
• credential no-follow, pathname-replacement, FIFO, permission-healing, and close-error regressions pass
• Windows and macOS credential implementations cross-compile
• workflow lint, shell syntax, ShellCheck, PowerShell parsing, and site checks pass
• installer URL/request, default-port loopback, and multiline/non-canonical tag regressions pass
• canonical prerelease packaging succeeds for all release targets

  

Note

Harden CLI security boundaries across credential loading, update, OAuth, and installer toolchain

• Credential file loading now rejects symlinks, FIFOs, and reparse points using O_NOFOLLOW on UNIX and FILE_FLAG_OPEN_REPARSE_POINT on Windows; permissions are self-repaired to 0600 on POSIX and files are capped at 1 MiB.
• The self-update flow validates repository names, asset URLs, and release tags against strict semver/host allowlists, refuses HTTPS→HTTP redirect downgrades, and errors on oversized archives instead of truncating.
• OAuth flows and YouTube API requests now block cross-origin credential forwarding on HTTP redirects.
• TSV output sanitizes control characters from headers and neutralizes spreadsheet formula injection (e.g. leading =, +, -, @) while preserving valid JSON negative numbers.
• Install scripts (install.sh, install.ps1) enforce HTTPS-only fetches, validate semver version strings and 64-hex checksum digests, reject symlinks in extracted archives, and use atomic staging for the final binary swap.
• Live chat deduplication switches from an unbounded map to a fixed-capacity ring buffer (liveChatDedupWindow = 10000) and polling intervals are clamped to [1s, 60s].
• CI adds govulncheck across six GOOS/GOARCH targets and fuzz-tests version argument handling in the release pipeline.
• Risk: credential files with permissions looser than 0600 will be silently chmod'd on POSIX; symlinked credential paths now return an error instead of being followed.

^{Macroscope summarized 2772c20.}

Greptile Summary

This change strengthens release delivery, installation, credential handling, update behavior, and API response safety. Focused execution confirmed that the installer rejects checksum-valid archives containing symbolic links and that redirect and response-size protections behave as intended.

Confidence Score: 5/5

Safe to merge: no blocking failure remains.

No blocking failure remains after exercising the installer release boundary and focused network-safety behavior.

T-Rex Logs

What T-Rex did

• Created a local checksum-valid release fixture containing a symbolic-link archive entry and ran the installer against the merge-base and current revisions.
• The merge-base installer accepted the fixture and installed its target payload, while the current installer rejected the archive and left no binary installed.
• Ran focused race-enabled redirect and updater-size checks for updater, YouTube, and OAuth behavior, plus changed-package regressions and POSIX shell syntax checks; all completed successfully.
• Compared the HEAD installer against the merge-base baseline using the symlink release entry and confirmed that HEAD rejected the symbolic link, leaving no installed binary; all focused Go checks and shell syntax/regression tests passed.

_{Ran code and verified through T-Rex}

_{Reviews (3): Last reviewed commit: "fix: accept default-port loopback URLs" | Re-trigger Greptile}

[coderabbitai]

Note

Reviews paused

It looks like this branch is under active development. To avoid overwhelming you with review comments due to an influx of new commits, CodeRabbit has automatically paused this review. You can configure this behavior by changing the reviews.auto_review.auto_pause_after_reviewed_commits setting.

Use the following commands to manage reviews:

• @coderabbitai resume to resume automatic reviews.
• @coderabbitai review to trigger a single review.

Use the checkboxes below for quick actions:

• ▶️ Resume reviews
• 🔍 Trigger review

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro Plus

Run ID: dd91fbc4-d4e3-422d-bfbe-000ab2f7f8c7

📥 Commits

Reviewing files that changed from the base of the PR and between f763006 and a592c4d.

📒 Files selected for processing (2)

• internal/config/config.go
• internal/config/config_test.go

🚧 Files skipped from review as they are similar to previous changes (2)

• internal/config/config.go
• internal/config/config_test.go

---

📝 Walkthrough

Walkthrough

Summary

The pull request hardens release validation, installers, HTTP clients, credential loading, output rendering, analytics input, and live-chat polling. It adds vulnerability scans and regression tests for validation and resource limits.

Changes

Security and Release Hardening

Layer / File(s)	Summary
Release and distribution validation .depot/workflows/*, scripts/package.sh, site/*, README.md, docs/releasing.md, go.mod	Release tags now use strict semantic-version validation. Installers validate URLs, checksums, and archives. CI adds vulnerability and packaging checks. Documentation describes installation and checksum trust limits.
Updater validation and bounded extraction internal/update/*	The updater validates repositories, release metadata, asset URLs, redirects, and archive sizes. Tests cover invalid inputs, redirect restrictions, and oversized content.
OAuth and YouTube transport controls internal/oauth/*, internal/youtube/*	OAuth redirects are blocked. YouTube clients restrict cross-origin credential forwarding, response sizes, and retry delays.
Credential, analytics, and output validation internal/config/*, internal/cli/analytics.go, internal/output/*	Credential files require safe types, permissions, and bounded size. Analytics IDs and rendered output receive validation and sanitization.
Live-chat cache and polling bounds internal/cli/live_chat.go, internal/cli/app_test.go	Live-chat deduplication uses a fixed-size rolling cache. Polling intervals default to one second and cap at 60 seconds.

🚥 Pre-merge checks | ✅ 4 | ❌ 1

❌ Failed checks (1 warning)

Check name	Status	Explanation	Resolution
Docstring Coverage	⚠️ Warning	Docstring coverage is 1.96% which is insufficient. The required threshold is 80.00%.	Write docstrings for the functions missing them to satisfy the coverage threshold.

✅ Passed checks (4 passed)

Check name	Status	Explanation
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Title check	✅ Passed	The title clearly summarizes the PR's main focus on strengthening CLI security boundaries and the toolchain.
Description check	✅ Passed	The description directly covers the security, tooling, testing, and documentation changes in the changeset.

---

_{Comment @coderabbitai help to get the list of available commands.}