diff --git a/.chronus/changes/add-security-warning-tsp-init-docs-2025-11-10-20-22-32.md b/.chronus/changes/add-security-warning-tsp-init-docs-2025-11-10-20-22-32.md new file mode 100644 index 00000000000..ca7b265e5b7 --- /dev/null +++ b/.chronus/changes/add-security-warning-tsp-init-docs-2025-11-10-20-22-32.md @@ -0,0 +1,7 @@ +--- +changeKind: fix +packages: + - "@typespec/compiler" +--- + +Add security warning to tsp init CLI documentation for external templates (#8916) diff --git a/packages/compiler/src/core/cli/cli.ts b/packages/compiler/src/core/cli/cli.ts index 200b37502b8..80c85892d2d 100644 --- a/packages/compiler/src/core/cli/cli.ts +++ b/packages/compiler/src/core/cli/cli.ts @@ -211,7 +211,8 @@ async function main() { (cmd) => cmd .positional("templatesUrl", { - description: "Url of the initialization template", + description: + "Url of the initialization template. WARNING: Downloading or using an untrusted template may contain malicious packages that can compromise your system and data. Proceed with caution and verify the source.", type: "string", }) .option("template", { diff --git a/website/src/content/docs/docs/extending-typespec/writing-scaffolding-template.md b/website/src/content/docs/docs/extending-typespec/writing-scaffolding-template.md index 8a5571e5cde..8b3c68fa428 100644 --- a/website/src/content/docs/docs/extending-typespec/writing-scaffolding-template.md +++ b/website/src/content/docs/docs/extending-typespec/writing-scaffolding-template.md @@ -8,6 +8,10 @@ TypeSpec offers a scaffolding feature through the `tsp init` command. tsp init ``` +:::warning +When using `tsp init` with an external template URL, be aware that downloading or using an untrusted template may contain malicious packages that can compromise your system and data. Proceed with caution and verify the source. +::: + ## Setting a minimum TypeSpec version If your template requires a feature that was introduced in a later version of TypeSpec, you can specify this in the template. This will alert the user that the template may not function as expected and ask them to confirm if they wish to proceed. diff --git a/website/src/content/docs/docs/handbook/cli.md b/website/src/content/docs/docs/handbook/cli.md index 9e49446a7af..c68a7912be9 100644 --- a/website/src/content/docs/docs/handbook/cli.md +++ b/website/src/content/docs/docs/handbook/cli.md @@ -5,6 +5,10 @@ title: Cli usage See full usage documentation by typing `tsp --help`: +:::warning +When using `tsp init` with an external template URL, be aware that downloading or using an untrusted template may contain malicious packages that can compromise your system and data. Proceed with caution and verify the source. +::: + ```bash >tsp --help TypeSpec compiler v0.36.1