feat: enhance project name sanitization and improve Docker image naming

- Added a `sanitizeProjectName` function to ensure project names are safe for shell commands and Docker image names by converting them to lowercase and removing non-alphanumeric characters.
- Updated `dev.mjs` and `start.mjs` to utilize the new sanitization function when determining Docker image names, enhancing security and consistency.
- Refactored the Docker entrypoint script to ensure proper permissions for the Cursor CLI config directory, improving setup reliability.
- Clarified documentation regarding the storage location of OAuth tokens for the Cursor CLI on Linux.

These changes improve the robustness of the Docker setup and enhance the overall development workflow.

dev.mjs

@@ -47,6 +47,14 @@ const processes = {
   docker: null,
 };
 
+/**
+ * Sanitize a project name to be safe for use in shell commands and Docker image names.
+ * Converts to lowercase and removes any characters that aren't alphanumeric.
+ */
+function sanitizeProjectName(name) {
+  return name.toLowerCase().replace(/[^a-z0-9]/g, '');
+}
+
 /**
  * Check if Docker images need to be rebuilt based on Dockerfile or package.json changes
  */
@@ -60,35 +68,27 @@ function shouldRebuildDockerImages() {
     const packageJsonMtime = statSync(packageJsonPath).mtimeMs;
     const latestSourceMtime = Math.max(dockerfileMtime, packageJsonMtime);
 
-    // Get image names from docker-compose config
-    let serverImageName, uiImageName;
+    // Get project name from docker-compose config, falling back to directory name
+    let projectName;
     try {
       const composeConfig = execSync('docker compose config --format json', {
         encoding: 'utf-8',
         cwd: __dirname,
       });
       const config = JSON.parse(composeConfig);
-
-      // Docker Compose generates image names as <project>_<service>
-      // Get project name from config or default to directory name
-      const projectName =
-        config.name ||
-        path
-          .basename(__dirname)
-          .toLowerCase()
-          .replace(/[^a-z0-9]/g, '');
-      serverImageName = `${projectName}_server`;
-      uiImageName = `${projectName}_ui`;
+      projectName = config.name;
     } catch (error) {
-      // Fallback to default naming convention
-      const projectName = path
-        .basename(__dirname)
-        .toLowerCase()
-        .replace(/[^a-z0-9]/g, '');
-      serverImageName = `${projectName}_server`;
-      uiImageName = `${projectName}_ui`;
+      // Fallback handled below
     }
 
+    // Sanitize project name (whether from config or fallback)
+    // This prevents command injection and ensures valid Docker image names
+    const sanitizedProjectName = sanitizeProjectName(
+      projectName || path.basename(__dirname)
+    );
+    const serverImageName = `${sanitizedProjectName}_server`;
+    const uiImageName = `${sanitizedProjectName}_ui`;
+
     // Check if images exist and get their creation times
     let needsRebuild = false;