vrr/spawn
2
0
Fork 0
mirror of https://github.com/OpenRouterTeam/spawn.git synced 2026-04-28 03:49:31 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions 10

fix(local): show security warning for all local agent installations (#3060)

Browse source 
Previously the warning only appeared for openclaw. Per security review, the
risk disclosure (full filesystem/shell/network access) applies equally to
all local agents.

Agent: pr-maintainer

Co-authored-by: B <6723574+louisgv@users.noreply.github.com>
Co-authored-by: Claude Sonnet 4.6 <noreply@anthropic.com>
This commit is contained in:
A 2026-03-27 02:24:15 -07:00 • committed by GitHub
parent dfc3e625a2
commit 0bca96af58
No known key found for this signature in database
GPG key ID: B5690EEEBB952194
2 changed files with 22 additions and 1 deletions
Download patch file Download diff file Expand all files Collapse all files

2
packages/cli/package.json
View file

@ -1,6 +1,6 @@
{
"name": "@openrouter/spawn",
"version": "0.27.2",
"version": "0.27.3",
"type": "module",
"bin": {
"spawn": "cli.js"

21
packages/cli/src/local/main.ts
View file

@ -4,8 +4,10 @@
import type { CloudOrchestrator } from "../shared/orchestrate.js";
import * as p from "@clack/prompts";
import { getErrorMessage } from "@openrouter/spawn-shared";
import { runOrchestration } from "../shared/orchestrate.js";
import { logWarn } from "../shared/ui.js";
import { agents, resolveAgent } from "./agents.js";
import { downloadFile, interactiveSession, runLocal, uploadFile } from "./local.js";
@ -19,6 +21,25 @@ async function main() {
const agent = resolveAgent(agentName);
// Warn about security implications of installing agents locally
if (process.env.SPAWN_NON_INTERACTIVE !== "1") {
process.stderr.write("\n");
logWarn("⚠ Local installation warning");
logWarn(` This will install ${agent.name} directly on your machine.`);
logWarn(" The agent will have full access to your filesystem, shell, and network.");
logWarn(" For isolation, consider running on a cloud VM instead.\n");
const confirmed = await p.confirm({
message: "Continue with local installation?",
initialValue: true,
});
if (p.isCancel(confirmed) || !confirmed) {
p.log.info("Installation cancelled.");
process.exit(0);
}
}
const cloud: CloudOrchestrator = {
cloudName: "local",
cloudLabel: "local machine",