vrr/spawn
2
0
Fork 0
mirror of https://github.com/OpenRouterTeam/spawn.git synced 2026-05-19 16:39:50 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions 8

fix(security): add --proto '=https' to all curl executable downloads (#2160)

Browse source 
42 curl calls downloading JS bundles, CLI binaries, and gh CLI tarballs
were missing --proto '=https', allowing protocol downgrade attacks on
hostile networks. PR #2138 fixed bun installer calls; this closes the
remaining gap for executable downloads.

Fixes applied:
- sh/{sprite,aws,gcp,hetzner,daytona,local}/{claude,codex,openclaw,opencode,kilocode,hermes,zeroclaw}.sh (42 files)
- sh/cli/install.sh (cli.js download)
- sh/shared/github-auth.sh (keyring, API, tarball downloads)

Agent: security-auditor

Co-authored-by: B <6723574+louisgv@users.noreply.github.com>
Co-authored-by: Claude Sonnet 4.6 <noreply@anthropic.com>
This commit is contained in:
A 2026-03-03 20:38:03 -08:00 • committed by GitHub
parent 251ddf2967
commit 1097f055c3
No known key found for this signature in database
GPG key ID: B5690EEEBB952194
45 changed files with 47 additions and 47 deletions
Download patch file Download diff file Expand all files Collapse all files

2
packages/cli/package.json
View file

@ -1,6 +1,6 @@
{
"name": "@openrouter/spawn",
"version": "0.12.12",
"version": "0.12.13",
"type": "module",
"bin": {
"spawn": "cli.js"

2
sh/aws/claude.sh
View file

@ -28,6 +28,6 @@ fi
# Remote — download and run compiled TypeScript bundle
AWS_JS=$(mktemp)
trap 'rm -f "$AWS_JS"' EXIT
curl -fsSL "https://github.com/OpenRouterTeam/spawn/releases/download/aws-latest/aws.js" -o "$AWS_JS" \
curl -fsSL --proto '=https' "https://github.com/OpenRouterTeam/spawn/releases/download/aws-latest/aws.js" -o "$AWS_JS" \
|| { printf '\033[0;31mFailed to download aws.js\033[0m\n' >&2; exit 1; }
exec bun run "$AWS_JS" claude "$@"

2
sh/aws/codex.sh
View file

@ -28,6 +28,6 @@ fi
# Remote — download and run compiled TypeScript bundle
AWS_JS=$(mktemp)
trap 'rm -f "$AWS_JS"' EXIT
curl -fsSL "https://github.com/OpenRouterTeam/spawn/releases/download/aws-latest/aws.js" -o "$AWS_JS" \
curl -fsSL --proto '=https' "https://github.com/OpenRouterTeam/spawn/releases/download/aws-latest/aws.js" -o "$AWS_JS" \
|| { printf '\033[0;31mFailed to download aws.js\033[0m\n' >&2; exit 1; }
exec bun run "$AWS_JS" codex "$@"

2
sh/aws/hermes.sh
View file

@ -28,6 +28,6 @@ fi
# Remote — download and run compiled TypeScript bundle
AWS_JS=$(mktemp)
trap 'rm -f "$AWS_JS"' EXIT
curl -fsSL "https://github.com/OpenRouterTeam/spawn/releases/download/aws-latest/aws.js" -o "$AWS_JS" \
curl -fsSL --proto '=https' "https://github.com/OpenRouterTeam/spawn/releases/download/aws-latest/aws.js" -o "$AWS_JS" \
|| { printf '\033[0;31mFailed to download aws.js\033[0m\n' >&2; exit 1; }
exec bun run "$AWS_JS" hermes "$@"

2
sh/aws/kilocode.sh
View file

@ -28,6 +28,6 @@ fi
# Remote — download and run compiled TypeScript bundle
AWS_JS=$(mktemp)
trap 'rm -f "$AWS_JS"' EXIT
curl -fsSL "https://github.com/OpenRouterTeam/spawn/releases/download/aws-latest/aws.js" -o "$AWS_JS" \
curl -fsSL --proto '=https' "https://github.com/OpenRouterTeam/spawn/releases/download/aws-latest/aws.js" -o "$AWS_JS" \
|| { printf '\033[0;31mFailed to download aws.js\033[0m\n' >&2; exit 1; }
exec bun run "$AWS_JS" kilocode "$@"

2
sh/aws/openclaw.sh
View file

@ -28,6 +28,6 @@ fi
# Remote — download and run compiled TypeScript bundle
AWS_JS=$(mktemp)
trap 'rm -f "$AWS_JS"' EXIT
curl -fsSL "https://github.com/OpenRouterTeam/spawn/releases/download/aws-latest/aws.js" -o "$AWS_JS" \
curl -fsSL --proto '=https' "https://github.com/OpenRouterTeam/spawn/releases/download/aws-latest/aws.js" -o "$AWS_JS" \
|| { printf '\033[0;31mFailed to download aws.js\033[0m\n' >&2; exit 1; }
exec bun run "$AWS_JS" openclaw "$@"

2
sh/aws/opencode.sh
View file

@ -28,6 +28,6 @@ fi
# Remote — download and run compiled TypeScript bundle
AWS_JS=$(mktemp)
trap 'rm -f "$AWS_JS"' EXIT
curl -fsSL "https://github.com/OpenRouterTeam/spawn/releases/download/aws-latest/aws.js" -o "$AWS_JS" \
curl -fsSL --proto '=https' "https://github.com/OpenRouterTeam/spawn/releases/download/aws-latest/aws.js" -o "$AWS_JS" \
|| { printf '\033[0;31mFailed to download aws.js\033[0m\n' >&2; exit 1; }
exec bun run "$AWS_JS" opencode "$@"

2
sh/aws/zeroclaw.sh
View file

@ -28,6 +28,6 @@ fi
# Remote — download and run compiled TypeScript bundle
AWS_JS=$(mktemp)
trap 'rm -f "$AWS_JS"' EXIT
curl -fsSL "https://github.com/OpenRouterTeam/spawn/releases/download/aws-latest/aws.js" -o "$AWS_JS" \
curl -fsSL --proto '=https' "https://github.com/OpenRouterTeam/spawn/releases/download/aws-latest/aws.js" -o "$AWS_JS" \
|| { printf '\033[0;31mFailed to download aws.js\033[0m\n' >&2; exit 1; }
exec bun run "$AWS_JS" zeroclaw "$@"

2
sh/cli/install.sh
View file

@ -198,7 +198,7 @@ build_and_install() {
trap 'rm -rf "${tmpdir}"' EXIT
log_step "Downloading pre-built CLI binary..."
curl -fsSL "https://github.com/${SPAWN_REPO}/releases/download/cli-latest/cli.js" -o "${tmpdir}/cli.js"
curl -fsSL --proto '=https' "https://github.com/${SPAWN_REPO}/releases/download/cli-latest/cli.js" -o "${tmpdir}/cli.js"
if [ ! -s "${tmpdir}/cli.js" ]; then
log_error "Failed to download pre-built binary"
exit 1

2
sh/daytona/claude.sh
View file

@ -28,7 +28,7 @@ fi
# Remote — download bundled daytona.js from GitHub release
DAYTONA_JS=$(mktemp)
trap 'rm -f "$DAYTONA_JS"' EXIT
curl -fsSL "https://github.com/OpenRouterTeam/spawn/releases/download/daytona-latest/daytona.js" -o "$DAYTONA_JS" \
curl -fsSL --proto '=https' "https://github.com/OpenRouterTeam/spawn/releases/download/daytona-latest/daytona.js" -o "$DAYTONA_JS" \
|| { printf '\033[0;31mFailed to download daytona.js\033[0m\n' >&2; exit 1; }
exec bun run "$DAYTONA_JS" claude "$@"

2
sh/daytona/codex.sh
View file

@ -28,7 +28,7 @@ fi
# Remote — download bundled daytona.js from GitHub release
DAYTONA_JS=$(mktemp)
trap 'rm -f "$DAYTONA_JS"' EXIT
curl -fsSL "https://github.com/OpenRouterTeam/spawn/releases/download/daytona-latest/daytona.js" -o "$DAYTONA_JS" \
curl -fsSL --proto '=https' "https://github.com/OpenRouterTeam/spawn/releases/download/daytona-latest/daytona.js" -o "$DAYTONA_JS" \
|| { printf '\033[0;31mFailed to download daytona.js\033[0m\n' >&2; exit 1; }
exec bun run "$DAYTONA_JS" codex "$@"

2
sh/daytona/hermes.sh
View file

@ -28,7 +28,7 @@ fi
# Remote — download bundled daytona.js from GitHub release
DAYTONA_JS=$(mktemp)
trap 'rm -f "$DAYTONA_JS"' EXIT
curl -fsSL "https://github.com/OpenRouterTeam/spawn/releases/download/daytona-latest/daytona.js" -o "$DAYTONA_JS" \
curl -fsSL --proto '=https' "https://github.com/OpenRouterTeam/spawn/releases/download/daytona-latest/daytona.js" -o "$DAYTONA_JS" \
|| { printf '\033[0;31mFailed to download daytona.js\033[0m\n' >&2; exit 1; }
exec bun run "$DAYTONA_JS" hermes "$@"

2
sh/daytona/kilocode.sh
View file

@ -28,7 +28,7 @@ fi
# Remote — download bundled daytona.js from GitHub release
DAYTONA_JS=$(mktemp)
trap 'rm -f "$DAYTONA_JS"' EXIT
curl -fsSL "https://github.com/OpenRouterTeam/spawn/releases/download/daytona-latest/daytona.js" -o "$DAYTONA_JS" \
curl -fsSL --proto '=https' "https://github.com/OpenRouterTeam/spawn/releases/download/daytona-latest/daytona.js" -o "$DAYTONA_JS" \
|| { printf '\033[0;31mFailed to download daytona.js\033[0m\n' >&2; exit 1; }
exec bun run "$DAYTONA_JS" kilocode "$@"

2
sh/daytona/openclaw.sh
View file

@ -28,7 +28,7 @@ fi
# Remote — download bundled daytona.js from GitHub release
DAYTONA_JS=$(mktemp)
trap 'rm -f "$DAYTONA_JS"' EXIT
curl -fsSL "https://github.com/OpenRouterTeam/spawn/releases/download/daytona-latest/daytona.js" -o "$DAYTONA_JS" \
curl -fsSL --proto '=https' "https://github.com/OpenRouterTeam/spawn/releases/download/daytona-latest/daytona.js" -o "$DAYTONA_JS" \
|| { printf '\033[0;31mFailed to download daytona.js\033[0m\n' >&2; exit 1; }
exec bun run "$DAYTONA_JS" openclaw "$@"

2
sh/daytona/opencode.sh
View file

@ -28,7 +28,7 @@ fi
# Remote — download bundled daytona.js from GitHub release
DAYTONA_JS=$(mktemp)
trap 'rm -f "$DAYTONA_JS"' EXIT
curl -fsSL "https://github.com/OpenRouterTeam/spawn/releases/download/daytona-latest/daytona.js" -o "$DAYTONA_JS" \
curl -fsSL --proto '=https' "https://github.com/OpenRouterTeam/spawn/releases/download/daytona-latest/daytona.js" -o "$DAYTONA_JS" \
|| { printf '\033[0;31mFailed to download daytona.js\033[0m\n' >&2; exit 1; }
exec bun run "$DAYTONA_JS" opencode "$@"

2
sh/daytona/zeroclaw.sh
View file

@ -28,7 +28,7 @@ fi
# Remote — download bundled daytona.js from GitHub release
DAYTONA_JS=$(mktemp)
trap 'rm -f "$DAYTONA_JS"' EXIT
curl -fsSL "https://github.com/OpenRouterTeam/spawn/releases/download/daytona-latest/daytona.js" -o "$DAYTONA_JS" \
curl -fsSL --proto '=https' "https://github.com/OpenRouterTeam/spawn/releases/download/daytona-latest/daytona.js" -o "$DAYTONA_JS" \
|| { printf '\033[0;31mFailed to download daytona.js\033[0m\n' >&2; exit 1; }
exec bun run "$DAYTONA_JS" zeroclaw "$@"

2
sh/gcp/claude.sh
View file

@ -28,7 +28,7 @@ fi
# Remote — download bundled gcp.js from GitHub release
GCP_JS=$(mktemp)
trap 'rm -f "$GCP_JS"' EXIT
curl -fsSL "https://github.com/OpenRouterTeam/spawn/releases/download/gcp-latest/gcp.js" -o "$GCP_JS" \
curl -fsSL --proto '=https' "https://github.com/OpenRouterTeam/spawn/releases/download/gcp-latest/gcp.js" -o "$GCP_JS" \
|| { printf '\033[0;31mFailed to download gcp.js\033[0m\n' >&2; exit 1; }
exec bun run "$GCP_JS" claude "$@"

2
sh/gcp/codex.sh
View file

@ -28,7 +28,7 @@ fi
# Remote — download bundled gcp.js from GitHub release
GCP_JS=$(mktemp)
trap 'rm -f "$GCP_JS"' EXIT
curl -fsSL "https://github.com/OpenRouterTeam/spawn/releases/download/gcp-latest/gcp.js" -o "$GCP_JS" \
curl -fsSL --proto '=https' "https://github.com/OpenRouterTeam/spawn/releases/download/gcp-latest/gcp.js" -o "$GCP_JS" \
|| { printf '\033[0;31mFailed to download gcp.js\033[0m\n' >&2; exit 1; }
exec bun run "$GCP_JS" codex "$@"

2
sh/gcp/hermes.sh
View file

@ -28,7 +28,7 @@ fi
# Remote — download bundled gcp.js from GitHub release
GCP_JS=$(mktemp)
trap 'rm -f "$GCP_JS"' EXIT
curl -fsSL "https://github.com/OpenRouterTeam/spawn/releases/download/gcp-latest/gcp.js" -o "$GCP_JS" \
curl -fsSL --proto '=https' "https://github.com/OpenRouterTeam/spawn/releases/download/gcp-latest/gcp.js" -o "$GCP_JS" \
|| { printf '\033[0;31mFailed to download gcp.js\033[0m\n' >&2; exit 1; }
exec bun run "$GCP_JS" hermes "$@"

2
sh/gcp/kilocode.sh
View file

@ -28,7 +28,7 @@ fi
# Remote — download bundled gcp.js from GitHub release
GCP_JS=$(mktemp)
trap 'rm -f "$GCP_JS"' EXIT
curl -fsSL "https://github.com/OpenRouterTeam/spawn/releases/download/gcp-latest/gcp.js" -o "$GCP_JS" \
curl -fsSL --proto '=https' "https://github.com/OpenRouterTeam/spawn/releases/download/gcp-latest/gcp.js" -o "$GCP_JS" \
|| { printf '\033[0;31mFailed to download gcp.js\033[0m\n' >&2; exit 1; }
exec bun run "$GCP_JS" kilocode "$@"

2
sh/gcp/openclaw.sh
View file

@ -28,7 +28,7 @@ fi
# Remote — download bundled gcp.js from GitHub release
GCP_JS=$(mktemp)
trap 'rm -f "$GCP_JS"' EXIT
curl -fsSL "https://github.com/OpenRouterTeam/spawn/releases/download/gcp-latest/gcp.js" -o "$GCP_JS" \
curl -fsSL --proto '=https' "https://github.com/OpenRouterTeam/spawn/releases/download/gcp-latest/gcp.js" -o "$GCP_JS" \
|| { printf '\033[0;31mFailed to download gcp.js\033[0m\n' >&2; exit 1; }
exec bun run "$GCP_JS" openclaw "$@"

2
sh/gcp/opencode.sh
View file

@ -28,7 +28,7 @@ fi
# Remote — download bundled gcp.js from GitHub release
GCP_JS=$(mktemp)
trap 'rm -f "$GCP_JS"' EXIT
curl -fsSL "https://github.com/OpenRouterTeam/spawn/releases/download/gcp-latest/gcp.js" -o "$GCP_JS" \
curl -fsSL --proto '=https' "https://github.com/OpenRouterTeam/spawn/releases/download/gcp-latest/gcp.js" -o "$GCP_JS" \
|| { printf '\033[0;31mFailed to download gcp.js\033[0m\n' >&2; exit 1; }
exec bun run "$GCP_JS" opencode "$@"

2
sh/gcp/zeroclaw.sh
View file

@ -28,7 +28,7 @@ fi
# Remote — download bundled gcp.js from GitHub release
GCP_JS=$(mktemp)
trap 'rm -f "$GCP_JS"' EXIT
curl -fsSL "https://github.com/OpenRouterTeam/spawn/releases/download/gcp-latest/gcp.js" -o "$GCP_JS" \
curl -fsSL --proto '=https' "https://github.com/OpenRouterTeam/spawn/releases/download/gcp-latest/gcp.js" -o "$GCP_JS" \
|| { printf '\033[0;31mFailed to download gcp.js\033[0m\n' >&2; exit 1; }
exec bun run "$GCP_JS" zeroclaw "$@"

2
sh/hetzner/claude.sh
View file

@ -23,6 +23,6 @@ fi
HETZNER_JS=$(mktemp)
trap 'rm -f "$HETZNER_JS"' EXIT
curl -fsSL "https://github.com/OpenRouterTeam/spawn/releases/download/hetzner-latest/hetzner.js" -o "$HETZNER_JS" \
curl -fsSL --proto '=https' "https://github.com/OpenRouterTeam/spawn/releases/download/hetzner-latest/hetzner.js" -o "$HETZNER_JS" \
|| { printf '\033[0;31mFailed to download hetzner.js\033[0m\n' >&2; exit 1; }
exec bun run "$HETZNER_JS" claude "$@"

2
sh/hetzner/codex.sh
View file

@ -23,6 +23,6 @@ fi
HETZNER_JS=$(mktemp)
trap 'rm -f "$HETZNER_JS"' EXIT
curl -fsSL "https://github.com/OpenRouterTeam/spawn/releases/download/hetzner-latest/hetzner.js" -o "$HETZNER_JS" \
curl -fsSL --proto '=https' "https://github.com/OpenRouterTeam/spawn/releases/download/hetzner-latest/hetzner.js" -o "$HETZNER_JS" \
|| { printf '\033[0;31mFailed to download hetzner.js\033[0m\n' >&2; exit 1; }
exec bun run "$HETZNER_JS" codex "$@"

2
sh/hetzner/hermes.sh
View file

@ -28,6 +28,6 @@ fi
# Remote — download and run compiled TypeScript bundle
HETZNER_JS=$(mktemp)
trap 'rm -f "$HETZNER_JS"' EXIT
curl -fsSL "https://github.com/OpenRouterTeam/spawn/releases/download/hetzner-latest/hetzner.js" -o "$HETZNER_JS" \
curl -fsSL --proto '=https' "https://github.com/OpenRouterTeam/spawn/releases/download/hetzner-latest/hetzner.js" -o "$HETZNER_JS" \
|| { printf '\033[0;31mFailed to download hetzner.js\033[0m\n' >&2; exit 1; }
exec bun run "$HETZNER_JS" hermes "$@"

2
sh/hetzner/kilocode.sh
View file

@ -23,6 +23,6 @@ fi
HETZNER_JS=$(mktemp)
trap 'rm -f "$HETZNER_JS"' EXIT
curl -fsSL "https://github.com/OpenRouterTeam/spawn/releases/download/hetzner-latest/hetzner.js" -o "$HETZNER_JS" \
curl -fsSL --proto '=https' "https://github.com/OpenRouterTeam/spawn/releases/download/hetzner-latest/hetzner.js" -o "$HETZNER_JS" \
|| { printf '\033[0;31mFailed to download hetzner.js\033[0m\n' >&2; exit 1; }
exec bun run "$HETZNER_JS" kilocode "$@"

2
sh/hetzner/openclaw.sh
View file

@ -23,6 +23,6 @@ fi
HETZNER_JS=$(mktemp)
trap 'rm -f "$HETZNER_JS"' EXIT
curl -fsSL "https://github.com/OpenRouterTeam/spawn/releases/download/hetzner-latest/hetzner.js" -o "$HETZNER_JS" \
curl -fsSL --proto '=https' "https://github.com/OpenRouterTeam/spawn/releases/download/hetzner-latest/hetzner.js" -o "$HETZNER_JS" \
|| { printf '\033[0;31mFailed to download hetzner.js\033[0m\n' >&2; exit 1; }
exec bun run "$HETZNER_JS" openclaw "$@"

2
sh/hetzner/opencode.sh
View file

@ -23,6 +23,6 @@ fi
HETZNER_JS=$(mktemp)
trap 'rm -f "$HETZNER_JS"' EXIT
curl -fsSL "https://github.com/OpenRouterTeam/spawn/releases/download/hetzner-latest/hetzner.js" -o "$HETZNER_JS" \
curl -fsSL --proto '=https' "https://github.com/OpenRouterTeam/spawn/releases/download/hetzner-latest/hetzner.js" -o "$HETZNER_JS" \
|| { printf '\033[0;31mFailed to download hetzner.js\033[0m\n' >&2; exit 1; }
exec bun run "$HETZNER_JS" opencode "$@"

2
sh/hetzner/zeroclaw.sh
View file

@ -23,6 +23,6 @@ fi
HETZNER_JS=$(mktemp)
trap 'rm -f "$HETZNER_JS"' EXIT
curl -fsSL "https://github.com/OpenRouterTeam/spawn/releases/download/hetzner-latest/hetzner.js" -o "$HETZNER_JS" \
curl -fsSL --proto '=https' "https://github.com/OpenRouterTeam/spawn/releases/download/hetzner-latest/hetzner.js" -o "$HETZNER_JS" \
|| { printf '\033[0;31mFailed to download hetzner.js\033[0m\n' >&2; exit 1; }
exec bun run "$HETZNER_JS" zeroclaw "$@"

2
sh/local/claude.sh
View file

@ -23,7 +23,7 @@ fi
# Remote — download bundled local.js from GitHub release
LOCAL_JS=$(mktemp)
trap 'rm -f "$LOCAL_JS"' EXIT
curl -fsSL "https://github.com/OpenRouterTeam/spawn/releases/download/local-latest/local.js" -o "$LOCAL_JS" \
curl -fsSL --proto '=https' "https://github.com/OpenRouterTeam/spawn/releases/download/local-latest/local.js" -o "$LOCAL_JS" \
|| { printf '\033[0;31mFailed to download local.js\033[0m\n' >&2; exit 1; }
exec bun run "$LOCAL_JS" claude "$@"

2
sh/local/codex.sh
View file

@ -23,7 +23,7 @@ fi
# Remote — download bundled local.js from GitHub release
LOCAL_JS=$(mktemp)
trap 'rm -f "$LOCAL_JS"' EXIT
curl -fsSL "https://github.com/OpenRouterTeam/spawn/releases/download/local-latest/local.js" -o "$LOCAL_JS" \
curl -fsSL --proto '=https' "https://github.com/OpenRouterTeam/spawn/releases/download/local-latest/local.js" -o "$LOCAL_JS" \
|| { printf '\033[0;31mFailed to download local.js\033[0m\n' >&2; exit 1; }
exec bun run "$LOCAL_JS" codex "$@"

2
sh/local/hermes.sh
View file

@ -23,7 +23,7 @@ fi
# Remote — download bundled local.js from GitHub release
LOCAL_JS=$(mktemp)
trap 'rm -f "$LOCAL_JS"' EXIT
curl -fsSL "https://github.com/OpenRouterTeam/spawn/releases/download/local-latest/local.js" -o "$LOCAL_JS" \
curl -fsSL --proto '=https' "https://github.com/OpenRouterTeam/spawn/releases/download/local-latest/local.js" -o "$LOCAL_JS" \
|| { printf '\033[0;31mFailed to download local.js\033[0m\n' >&2; exit 1; }
exec bun run "$LOCAL_JS" hermes "$@"

2
sh/local/kilocode.sh
View file

@ -23,7 +23,7 @@ fi
# Remote — download bundled local.js from GitHub release
LOCAL_JS=$(mktemp)
trap 'rm -f "$LOCAL_JS"' EXIT
curl -fsSL "https://github.com/OpenRouterTeam/spawn/releases/download/local-latest/local.js" -o "$LOCAL_JS" \
curl -fsSL --proto '=https' "https://github.com/OpenRouterTeam/spawn/releases/download/local-latest/local.js" -o "$LOCAL_JS" \
|| { printf '\033[0;31mFailed to download local.js\033[0m\n' >&2; exit 1; }
exec bun run "$LOCAL_JS" kilocode "$@"

2
sh/local/openclaw.sh
View file

@ -23,7 +23,7 @@ fi
# Remote — download bundled local.js from GitHub release
LOCAL_JS=$(mktemp)
trap 'rm -f "$LOCAL_JS"' EXIT
curl -fsSL "https://github.com/OpenRouterTeam/spawn/releases/download/local-latest/local.js" -o "$LOCAL_JS" \
curl -fsSL --proto '=https' "https://github.com/OpenRouterTeam/spawn/releases/download/local-latest/local.js" -o "$LOCAL_JS" \
|| { printf '\033[0;31mFailed to download local.js\033[0m\n' >&2; exit 1; }
exec bun run "$LOCAL_JS" openclaw "$@"

2
sh/local/opencode.sh
View file

@ -23,7 +23,7 @@ fi
# Remote — download bundled local.js from GitHub release
LOCAL_JS=$(mktemp)
trap 'rm -f "$LOCAL_JS"' EXIT
curl -fsSL "https://github.com/OpenRouterTeam/spawn/releases/download/local-latest/local.js" -o "$LOCAL_JS" \
curl -fsSL --proto '=https' "https://github.com/OpenRouterTeam/spawn/releases/download/local-latest/local.js" -o "$LOCAL_JS" \
|| { printf '\033[0;31mFailed to download local.js\033[0m\n' >&2; exit 1; }
exec bun run "$LOCAL_JS" opencode "$@"

2
sh/local/zeroclaw.sh
View file

@ -23,7 +23,7 @@ fi
# Remote — download bundled local.js from GitHub release
LOCAL_JS=$(mktemp)
trap 'rm -f "$LOCAL_JS"' EXIT
curl -fsSL "https://github.com/OpenRouterTeam/spawn/releases/download/local-latest/local.js" -o "$LOCAL_JS" \
curl -fsSL --proto '=https' "https://github.com/OpenRouterTeam/spawn/releases/download/local-latest/local.js" -o "$LOCAL_JS" \
|| { printf '\033[0;31mFailed to download local.js\033[0m\n' >&2; exit 1; }
exec bun run "$LOCAL_JS" zeroclaw "$@"

6
sh/shared/github-auth.sh
View file

@ -42,7 +42,7 @@ _install_gh_apt() {
if [[ "$(id -u)" -ne 0 ]]; then SUDO="sudo"; fi
log_info "Adding GitHub CLI APT repository..."
curl -fsSL https://cli.github.com/packages/githubcli-archive-keyring.gpg \
curl -fsSL --proto '=https' https://cli.github.com/packages/githubcli-archive-keyring.gpg \
| ${SUDO} dd of=/usr/share/keyrings/githubcli-archive-keyring.gpg 2>/dev/null
${SUDO} chmod go+r /usr/share/keyrings/githubcli-archive-keyring.gpg
printf 'deb [arch=%s signed-by=/usr/share/keyrings/githubcli-archive-keyring.gpg] https://cli.github.com/packages stable main\n' \
@ -130,7 +130,7 @@ _detect_gh_platform() {
# Fetch the latest gh release version string from GitHub API
_fetch_gh_latest_version() {
local latest_version
latest_version=$(curl -fsSL "https://api.github.com/repos/cli/cli/releases/latest" \
latest_version=$(curl -fsSL --proto '=https' "https://api.github.com/repos/cli/cli/releases/latest" \
| grep '"tag_name"' | sed 's/.*"v\([^"]*\)".*/\1/') || {
log_error "Failed to fetch latest gh release version"
return 1
@ -156,7 +156,7 @@ _download_and_install_gh() {
local tmpdir
tmpdir=$(mktemp -d)
curl -fsSL "${url}" -o "${tmpdir}/${tarball}" || {
curl -fsSL --proto '=https' "${url}" -o "${tmpdir}/${tarball}" || {
log_error "Failed to download ${url}"
rm -rf "${tmpdir}"
return 1

2
sh/sprite/claude.sh
View file

@ -28,7 +28,7 @@ fi
# Remote — download bundled sprite.js from GitHub release
SPRITE_JS=$(mktemp)
trap 'rm -f "$SPRITE_JS"' EXIT
curl -fsSL "https://github.com/OpenRouterTeam/spawn/releases/download/sprite-latest/sprite.js" -o "$SPRITE_JS" \
curl -fsSL --proto '=https' "https://github.com/OpenRouterTeam/spawn/releases/download/sprite-latest/sprite.js" -o "$SPRITE_JS" \
|| { printf '\033[0;31mFailed to download sprite.js\033[0m\n' >&2; exit 1; }
exec bun run "$SPRITE_JS" claude "$@"

2
sh/sprite/codex.sh
View file

@ -28,7 +28,7 @@ fi
# Remote — download bundled sprite.js from GitHub release
SPRITE_JS=$(mktemp)
trap 'rm -f "$SPRITE_JS"' EXIT
curl -fsSL "https://github.com/OpenRouterTeam/spawn/releases/download/sprite-latest/sprite.js" -o "$SPRITE_JS" \
curl -fsSL --proto '=https' "https://github.com/OpenRouterTeam/spawn/releases/download/sprite-latest/sprite.js" -o "$SPRITE_JS" \
|| { printf '\033[0;31mFailed to download sprite.js\033[0m\n' >&2; exit 1; }
exec bun run "$SPRITE_JS" codex "$@"

2
sh/sprite/hermes.sh
View file

@ -28,7 +28,7 @@ fi
# Remote — download bundled sprite.js from GitHub release
SPRITE_JS=$(mktemp)
trap 'rm -f "$SPRITE_JS"' EXIT
curl -fsSL "https://github.com/OpenRouterTeam/spawn/releases/download/sprite-latest/sprite.js" -o "$SPRITE_JS" \
curl -fsSL --proto '=https' "https://github.com/OpenRouterTeam/spawn/releases/download/sprite-latest/sprite.js" -o "$SPRITE_JS" \
|| { printf '\033[0;31mFailed to download sprite.js\033[0m\n' >&2; exit 1; }
exec bun run "$SPRITE_JS" hermes "$@"

2
sh/sprite/kilocode.sh
View file

@ -28,7 +28,7 @@ fi
# Remote — download bundled sprite.js from GitHub release
SPRITE_JS=$(mktemp)
trap 'rm -f "$SPRITE_JS"' EXIT
curl -fsSL "https://github.com/OpenRouterTeam/spawn/releases/download/sprite-latest/sprite.js" -o "$SPRITE_JS" \
curl -fsSL --proto '=https' "https://github.com/OpenRouterTeam/spawn/releases/download/sprite-latest/sprite.js" -o "$SPRITE_JS" \
|| { printf '\033[0;31mFailed to download sprite.js\033[0m\n' >&2; exit 1; }
exec bun run "$SPRITE_JS" kilocode "$@"

2
sh/sprite/openclaw.sh
View file

@ -28,7 +28,7 @@ fi
# Remote — download bundled sprite.js from GitHub release
SPRITE_JS=$(mktemp)
trap 'rm -f "$SPRITE_JS"' EXIT
curl -fsSL "https://github.com/OpenRouterTeam/spawn/releases/download/sprite-latest/sprite.js" -o "$SPRITE_JS" \
curl -fsSL --proto '=https' "https://github.com/OpenRouterTeam/spawn/releases/download/sprite-latest/sprite.js" -o "$SPRITE_JS" \
|| { printf '\033[0;31mFailed to download sprite.js\033[0m\n' >&2; exit 1; }
exec bun run "$SPRITE_JS" openclaw "$@"

2
sh/sprite/opencode.sh
View file

@ -28,7 +28,7 @@ fi
# Remote — download bundled sprite.js from GitHub release
SPRITE_JS=$(mktemp)
trap 'rm -f "$SPRITE_JS"' EXIT
curl -fsSL "https://github.com/OpenRouterTeam/spawn/releases/download/sprite-latest/sprite.js" -o "$SPRITE_JS" \
curl -fsSL --proto '=https' "https://github.com/OpenRouterTeam/spawn/releases/download/sprite-latest/sprite.js" -o "$SPRITE_JS" \
|| { printf '\033[0;31mFailed to download sprite.js\033[0m\n' >&2; exit 1; }
exec bun run "$SPRITE_JS" opencode "$@"

2
sh/sprite/zeroclaw.sh
View file

@ -28,7 +28,7 @@ fi
# Remote — download bundled sprite.js from GitHub release
SPRITE_JS=$(mktemp)
trap 'rm -f "$SPRITE_JS"' EXIT
curl -fsSL "https://github.com/OpenRouterTeam/spawn/releases/download/sprite-latest/sprite.js" -o "$SPRITE_JS" \
curl -fsSL --proto '=https' "https://github.com/OpenRouterTeam/spawn/releases/download/sprite-latest/sprite.js" -o "$SPRITE_JS" \
|| { printf '\033[0;31mFailed to download sprite.js\033[0m\n' >&2; exit 1; }
exec bun run "$SPRITE_JS" zeroclaw "$@"