Security Hardening: Remove Unsafe Shell Patterns and Temporary File Usage

[vibhu-dixit]

Summary

Several scripts rely on shell patterns and temporary file APIs that are fragile or unsafe. While these issues do not currently appear to cause widespread failures, they introduce correctness problems and increase the project's attack surface.

Issues

1. Unsafe use of eval when restoring configuration

Files

• bin/tess
• bin/worktree.sh
• bin/wt

Configuration values are restored using:

eval "$_k=\$_v"

Why this is a problem

• Values containing spaces or shell metacharacters may be parsed incorrectly.
• Unexpected shell syntax inside configuration values could be executed.
• Makes configuration loading brittle and difficult to reason about.

Suggested fix

Replace the eval-based assignment with a safer mechanism, such as validated environment variable assignment or another implementation that avoids shell evaluation entirely.

---

2. Voice input is passed without quoting

File

• bin/tess

Current implementation:

python3 "$TESS_BIN/_tess-ask.py" $line

Why this is a problem

Because $line is unquoted:

• whitespace is split into multiple arguments
• wildcard characters (*, ?, etc.) may expand
• dictated text can be modified before reaching the Python process

Suggested fix

Quote the argument as well so that we remove that entire area of error.

3. Insecure temporary file creation

Files

• bin/_tess-chat.py
• bin/_tess-music.py

Current implementation uses:

tempfile.mktemp(...)

Why this is a problem

tempfile.mktemp() is deprecated because it is vulnerable to race conditions. Another process may create the file before it is used.

Suggested fix

Replace it with one of better functions.

[vibhu-dixit]

so the changes arent made in the codebase yet?