vrr/spawn
2
0
Fork 0
mirror of https://github.com/OpenRouterTeam/spawn.git synced 2026-04-28 11:59:29 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions 10

fix: Remove curl|bash script validation that blocks spawn scripts

Browse source 
The spawn scripts themselves use curl|bash to install agents (e.g.
Claude Code). The validateScriptContent check was blocking our own
legitimate scripts. Removed curl|bash and wget|bash from the
dangerous patterns list since the scripts are already fetched from
our trusted GitHub repo.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
This commit is contained in:
Sprite 2026-02-10 09:39:51 +00:00
parent c93cb1d40c
commit 18b5aa4a32
7 changed files with 56 additions and 58 deletions
Download patch file Download diff file Expand all files Collapse all files

6
cli/src/__tests__/unicode-detect.test.ts
View file

@ -97,7 +97,7 @@ describe("unicode-detect", () => {
});
describe("LANG environment variable", () => {
it("should not modify LANG (unicode-detect only touches TERM)", () => {
it("should not modify LANG when Unicode is enabled", () => {
const script = `
import "./src/unicode-detect.ts";
console.log(process.env.LANG ?? "undefined");
@ -108,7 +108,6 @@ describe("unicode-detect", () => {
encoding: "utf-8",
timeout: 5000,
});
// unicode-detect only modifies TERM, never LANG
expect(result.trim()).toBe("undefined");
});
@ -126,7 +125,7 @@ describe("unicode-detect", () => {
expect(result.trim()).toBe("fr_FR.UTF-8");
});
it("should preserve LANG even without UTF-8 suffix", () => {
it("should preserve LANG without UTF-8 when Unicode is enabled", () => {
const script = `
import "./src/unicode-detect.ts";
console.log(process.env.LANG);
@ -137,7 +136,6 @@ describe("unicode-detect", () => {
encoding: "utf-8",
timeout: 5000,
});
// unicode-detect does not modify LANG
expect(result.trim()).toBe("C");
});
});