stash eql install --drizzle: --name reaches execSync unvalidated (shell injection) + --out never passed

[tobyhede]

generateDrizzleMigration (the v2 Drizzle path, packages/cli/src/commands/db/install.ts) is a hand-copy of the v3 generator in commands/eql/migration.ts that never received two fixes the v3 side already has.

1. Shell injection

install.ts builds a shell command string interpolating migrationName — which comes straight from --name, unvalidated (main.ts → values.name) — and runs it through execSync:

stash eql install --drizzle --eql-version 2 --name 'x; rm -rf ~'

executes the injected command. The v3 generator guards the identical value with SAFE_MIGRATION_NAME = /^[\w-]+$/ and invokes via spawnSync(command, argv) with no shell.

2. --out computed but not passed

install.ts computes outDir and searches it for the generated file, but omits --out from the drizzle-kit command. A project whose drizzle.config.ts writes elsewhere has drizzle-kit write there while the search looks in drizzle/, and the run dies with a bare exit. The v3 generator passes --out=${outDir}.

Fix

Both fixes are applied in PR #703, mirroring the v3 generator: shared SAFE_MIGRATION_NAME guard, argv-based spawnSync, --out passed through. Also converts the function's five process.exit(1) sites to throw new CliExit(1) (untestable/untelemetered otherwise), which is why the path had no coverage before.

Note

This code is deleted by the EQL v2 removal (#707) — generateDrizzleMigration is the v2 install path. The fix is still worth landing now: the injection is shipping and exploitable, and the removal is not imminent.