vrr/spawn
2
0
Fork 0
mirror of https://github.com/OpenRouterTeam/spawn.git synced 2026-04-28 11:59:29 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions 10

feat: SPAWN_CLI_DIR env var to force local source in e2e (#2015)

Browse source 
* feat: SPAWN_CLI_DIR env var to force local source in e2e and shell scripts

When SPAWN_CLI_DIR is set, the entire toolchain uses local TypeScript
source instead of downloading pre-bundled scripts from GitHub releases:

- e2e.sh: auto-sets SPAWN_CLI_DIR to repo root when running locally
- provision.sh: exports SPAWN_CLI_DIR into the headless subshell
- commands.ts: reads local shell scripts instead of fetching from CDN
- All 36 cloud/agent shell scripts: exec local main.ts when set

This enables e2e tests to validate local changes before they're released.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

* fix(security): add path traversal defense to SPAWN_CLI_DIR script loading

Canonicalize the path via realpathSync and verify it stays inside the
resolved CLI directory before reading. Prevents SPAWN_CLI_DIR from
being used to read arbitrary files via ../ traversal.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

* fix(security): harden SPAWN_CLI_DIR path traversal defense

- Validate cloud/agent names don't contain '..', '/' or '\' before
  constructing file paths
- Fix root-directory edge case in prefix check by handling trailing
  separator correctly

Agent: pr-maintainer
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

---------

Co-authored-by: Claude Opus 4.6 <noreply@anthropic.com>
Co-authored-by: B <6723574+louisgv@users.noreply.github.com>
This commit is contained in:
Ahmed Abushagur 2026-02-28 01:14:36 -08:00 • committed by GitHub
parent ee83e46d9b
commit d5461adc16
No known key found for this signature in database
GPG key ID: B5690EEEBB952194
39 changed files with 276 additions and 33 deletions
Download patch file Download diff file Expand all files Collapse all files

6
sh/hetzner/opencode.sh
View file

@ -11,6 +11,12 @@ _ensure_bun() {
_ensure_bun
SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" 2>/dev/null && pwd)"
# SPAWN_CLI_DIR override — force local source (used by e2e tests)
if [[ -n "${SPAWN_CLI_DIR:-}" && -f "$SPAWN_CLI_DIR/packages/cli/src/hetzner/main.ts" ]]; then
exec bun run "$SPAWN_CLI_DIR/packages/cli/src/hetzner/main.ts" opencode "$@"
fi
if [[ -n "$SCRIPT_DIR" && -f "$SCRIPT_DIR/../../packages/cli/src/hetzner/main.ts" ]]; then
exec bun run "$SCRIPT_DIR/../../packages/cli/src/hetzner/main.ts" opencode "$@"
fi