security: fix 46 vulnerabilities and stability issues across the code…

[ZAREZOV2]

Security & Stability Patch — 46 Issues Resolved

Full-stack security audit of the Electron-based CodeMotion IDE. All findings have been patched and the TypeScript build passes cleanly (tsc exit 0).

Severity Summary

Severity	Count	Key Areas
🔴 Critical	10	RCE, path traversal, SSRF, sandbox escape, plaintext JWT
🟠 High	14	Race conditions, memory leaks, IPC listener leaks, wrong file paths
🟡 Medium	12	Missing guards, CSP, MIME types, hard-coded ports
🟢 Low	10	Naming, compare stability, raw Error returns, missing Content-Type

Critical Fixes

1. Path Traversal in Extension Sandbox — Added resolveSandboxPath() in app/sandbox/tools.js to validate that every file path stays within the extension directory. Applied across all permission handlers that read files.
2. Terminal RCE — cmd is now validated (must be string, max 5000 chars, trimmed). stdin input is coerced with String(input ?? '').
3. Arbitrary Python Execution — Introduced a block-list regex in runtimeHandler.ts that rejects dangerous patterns (__import__, os, subprocess, socket, open(, exec(, eval(, etc.) before writing to a temp file.
4. Live Server Path Traversal — Resolved path is now checked against root; requests escaping the root receive 403 Forbidden.
5. Extension SSRF — fetch in extensions now blocks private IP ranges (localhost, 127.*, 10.*, 192.168.*, etc.) and non-http(s) protocols.
6. Extension Window Sandbox Escape — BrowserWindow created by extensions now enforces contextIsolation: true, nodeIntegration: false, sandbox: true. URL hostnames are validated against a strict regex.
7. Sandbox Template Injection — Replaced vm.runInContext string interpolation with vm.Script(...).runInContext(..., { timeout: 5000 }). Back-tick characters in extension code are rejected. Removed Map from the sandbox object.
8. IPC File Operations — filesWork.ts now enforces a workspace-root guard via guardPath(). read-file also validates the resolved path stays within parentPath.
9. JWT in Plaintext — saveToken/loadToken in auth.js now use Electron safeStorage to encrypt/decrypt the JWT. Legacy plaintext fallback is preserved for existing files.

High Fixes

• Notifications: Removed removeAllListeners("notification-close"); each notification registers its own closeHandler scoped to its window.
• Diagnostics Race Condition: Replaced scalar pending resolver with a Map<number, PendingEntry> queue. Worker responses include the request id.
• Debugger Listener Leak: debugger-data listener moved to module scope (registered once). debuggerWindow is now explicitly declared.
• Splash Preload: Created a dedicated minimal preload (splash-preload.js) exposing only close, setNonAccountMode, reload, and onStatusUpdate.
• Global Keyboard Listener: Added keyboardListener reference; v.removeListener() is called on window close, before-quit, and window-all-closed. Added isDestroyed() guard.
• getPython Race: Added resolved flag to ignore duplicate exec callbacks.
• Debugger runExtension Exposure: Removed runExtension from debuggerWindow/preload.js entirely.
• Extension Quit: window.close now shows a confirmation dialog before calling app.quit().
• open-in-browser Validation: Restricted to http: and https: schemes only.
• Atomic local.json Writes: set-non-account-mode now writes to a temp file and renames atomically.

Medium & Low Fixes

• MIME Types: Live Server now serves files with proper Content-Type headers.
• Dynamic Ports: Live Server attempts ports 3000–3010 instead of hard-coding 3000/3001.
• CSP: Added Content-Security-Policy meta tag to notification.html.
• Notification Image Sanitization: img.src now only accepts URLs starting with http:/https:.
• Extension Event Scoping: onFileOpened listeners are now tracked per-extension in a Map.
• Deep Freeze: Sandbox API object is now recursively frozen.
• Stack Trace Sanitization: evalmachine.<anonymous> lines are filtered from extension error output.
• Misc Cleanups: getAppIcon async removed, isPackaged misleading variable removed, organizations.ts catches now stringify errors, api.ts returns safe error messages, py?.kill() used instead of py!.kill(), sort comparator stabilized with || 0 fallback, notification script moved inside <body>.

Files Changed

42 files changed, 1354 insertions(+), 214 deletions(-)

Checklist

• npm run build passes (tsc exit code 0)
• No new dependencies introduced
• Legacy data formats remain compatible (JWT plaintext fallback, worker message format)

[cdmtn-dev]

Please update your branch with the latest changes from main and resolve the merge conflicts.

[ZAREZOV2]

Merge conflicts resolved. Branch rebased on latest main. Ready for review.

[cdmtn-dev]

A quick review of the PR revealed the following:

• The splash screen isn't behaving as it should in the original: the splash screen content is empty, with only “CodeMotion” at the top

Also, due to the large amount of code and new AI features, the PR will take a very long time to review, and it's not certain that it will be accepted. In any case, thanks for your work!