diff --git a/digitalocean/aider.sh b/digitalocean/aider.sh
index 1ecc6688..b72dabdb 100755
--- a/digitalocean/aider.sh
+++ b/digitalocean/aider.sh
@@ -45,6 +45,7 @@ log_warn "Browse models at: https://openrouter.ai/models"
 log_warn "Which model would you like to use with Aider?"
 MODEL_ID=$(safe_read "Enter model ID [openrouter/auto]: ") || MODEL_ID=""
 MODEL_ID="${MODEL_ID:-openrouter/auto}"
+if ! validate_model_id "$MODEL_ID"; then log_error "Exiting due to invalid model ID"; exit 1; fi
 
 # 8. Inject environment variables into ~/.zshrc
 log_warn "Setting up environment variables..."
diff --git a/digitalocean/lib/common.sh b/digitalocean/lib/common.sh
index 94b925fa..04926077 100755
--- a/digitalocean/lib/common.sh
+++ b/digitalocean/lib/common.sh
@@ -1,15 +1,18 @@
 #!/bin/bash
 # Common bash functions for DigitalOcean spawn scripts
 
+# Bash safety flags
+set -euo pipefail
+
 # ============================================================
 # Provider-agnostic functions (shared with sprite/lib/common.sh)
 # ============================================================
 
 # Colors for output
-RED='\033[0;31m'
-GREEN='\033[0;32m'
-YELLOW='\033[1;33m'
-NC='\033[0m' # No Color
+readonly RED='\033[0;31m'
+readonly GREEN='\033[0;32m'
+readonly YELLOW='\033[1;33m'
+readonly NC='\033[0m' # No Color
 
 # Print colored message (to stderr so they don't pollute command substitution output)
 log_info() {
@@ -136,7 +139,7 @@ try_oauth_flow() {
             local nc_status=$?
             rm -f "$response_file"
 
-            if [[ $nc_status -ne 0 ]]; then
+            if [[ "$nc_status" -ne 0 ]]; then
                 break
             fi
 
@@ -151,7 +154,7 @@ try_oauth_flow() {
 
     sleep 1
 
-    if ! kill -0 $server_pid 2>/dev/null; then
+    if ! kill -0 "$server_pid" 2>/dev/null; then
         log_warn "Failed to start OAuth server (port may be in use)"
         rm -rf "$oauth_dir"
         return 1
@@ -162,13 +165,13 @@ try_oauth_flow() {
 
     local timeout=120
     local elapsed=0
-    while [[ ! -f "$code_file" ]] && [[ $elapsed -lt $timeout ]]; do
+    while [[ ! -f "$code_file" ]] && [[ "$elapsed" -lt "$timeout" ]]; do
         sleep 1
         ((elapsed++))
     done
 
-    kill $server_pid 2>/dev/null || true
-    wait $server_pid 2>/dev/null || true
+    kill "$server_pid" 2>/dev/null || true
+    wait "$server_pid" 2>/dev/null || true
 
     if [[ ! -f "$code_file" ]]; then
         log_warn "OAuth timeout - no response received"
@@ -230,8 +233,8 @@ get_openrouter_api_key_oauth() {
 # DigitalOcean specific functions
 # ============================================================
 
-DO_API_BASE="https://api.digitalocean.com/v2"
-SSH_OPTS="-o StrictHostKeyChecking=no -o UserKnownHostsFile=/dev/null -o LogLevel=ERROR -i $HOME/.ssh/id_ed25519"
+readonly DO_API_BASE="https://api.digitalocean.com/v2"
+readonly SSH_OPTS="-o StrictHostKeyChecking=no -o UserKnownHostsFile=/dev/null -o LogLevel=ERROR -i $HOME/.ssh/id_ed25519"
 
 # Centralized curl wrapper for DigitalOcean API
 do_api() {
@@ -478,7 +481,7 @@ verify_server_connectivity() {
     local attempt=1
 
     log_warn "Waiting for SSH connectivity to $ip..."
-    while [[ $attempt -le $max_attempts ]]; do
+    while [[ "$attempt" -le "$max_attempts" ]]; do
         if ssh $SSH_OPTS -o ConnectTimeout=5 "root@$ip" "echo ok" >/dev/null 2>&1; then
             log_info "SSH connection established"
             return 0
diff --git a/digitalocean/openclaw.sh b/digitalocean/openclaw.sh
index 7df509b9..2bb42078 100755
--- a/digitalocean/openclaw.sh
+++ b/digitalocean/openclaw.sh
@@ -45,6 +45,7 @@ log_warn "Browse models at: https://openrouter.ai/models"
 log_warn "Which model would you like to use?"
 MODEL_ID=$(safe_read "Enter model ID [openrouter/auto]: ") || MODEL_ID=""
 MODEL_ID="${MODEL_ID:-openrouter/auto}"
+if ! validate_model_id "$MODEL_ID"; then log_error "Exiting due to invalid model ID"; exit 1; fi
 
 # 8. Inject environment variables into ~/.zshrc
 log_warn "Setting up environment variables..."
diff --git a/hetzner/aider.sh b/hetzner/aider.sh
index d9e826fb..64175f72 100755
--- a/hetzner/aider.sh
+++ b/hetzner/aider.sh
@@ -45,6 +45,7 @@ log_warn "Browse models at: https://openrouter.ai/models"
 log_warn "Which model would you like to use with Aider?"
 MODEL_ID=$(safe_read "Enter model ID [openrouter/auto]: ") || MODEL_ID=""
 MODEL_ID="${MODEL_ID:-openrouter/auto}"
+if ! validate_model_id "$MODEL_ID"; then log_error "Exiting due to invalid model ID"; exit 1; fi
 
 # 8. Inject environment variables into ~/.zshrc
 log_warn "Setting up environment variables..."
diff --git a/hetzner/openclaw.sh b/hetzner/openclaw.sh
index 7b7d0027..f8e22929 100755
--- a/hetzner/openclaw.sh
+++ b/hetzner/openclaw.sh
@@ -45,6 +45,7 @@ log_warn "Browse models at: https://openrouter.ai/models"
 log_warn "Which model would you like to use?"
 MODEL_ID=$(safe_read "Enter model ID [openrouter/auto]: ") || MODEL_ID=""
 MODEL_ID="${MODEL_ID:-openrouter/auto}"
+if ! validate_model_id "$MODEL_ID"; then log_error "Exiting due to invalid model ID"; exit 1; fi
 
 # 8. Inject environment variables into ~/.zshrc
 log_warn "Setting up environment variables..."
diff --git a/linode/aider.sh b/linode/aider.sh
index 1c63607d..a57113ea 100755
--- a/linode/aider.sh
+++ b/linode/aider.sh
@@ -21,6 +21,7 @@ echo ""
 log_warn "Browse models at: https://openrouter.ai/models"
 MODEL_ID=$(safe_read "Enter model ID [openrouter/auto]: ") || MODEL_ID=""
 MODEL_ID="${MODEL_ID:-openrouter/auto}"
+if ! validate_model_id "$MODEL_ID"; then log_error "Exiting due to invalid model ID"; exit 1; fi
 log_warn "Setting up environment variables..."
 ENV_TEMP=$(mktemp)
 cat > "$ENV_TEMP" << EOF
diff --git a/linode/lib/common.sh b/linode/lib/common.sh
index ee06ebcf..84592fd7 100644
--- a/linode/lib/common.sh
+++ b/linode/lib/common.sh
@@ -37,6 +37,17 @@ open_browser() {
     else log_warn "Please open: ${url}"; fi
 }
 
+validate_model_id() {
+    local model_id="$1"
+    if [[ -z "$model_id" ]]; then return 0; fi
+    if [[ ! "$model_id" =~ ^[a-zA-Z0-9/_:.-]+$ ]]; then
+        log_error "Invalid model ID: contains unsafe characters"
+        log_error "Model IDs should only contain: letters, numbers, /, -, _, :, ."
+        return 1
+    fi
+    return 0
+}
+
 get_openrouter_api_key_manual() {
     echo ""; log_warn "Manual API Key Entry"
     echo -e "${YELLOW}Get your API key from: https://openrouter.ai/settings/keys${NC}"; echo ""
diff --git a/linode/openclaw.sh b/linode/openclaw.sh
index 31cf7888..99693ba9 100755
--- a/linode/openclaw.sh
+++ b/linode/openclaw.sh
@@ -21,6 +21,7 @@ echo ""
 log_warn "Browse models at: https://openrouter.ai/models"
 MODEL_ID=$(safe_read "Enter model ID [openrouter/auto]: ") || MODEL_ID=""
 MODEL_ID="${MODEL_ID:-openrouter/auto}"
+if ! validate_model_id "$MODEL_ID"; then log_error "Exiting due to invalid model ID"; exit 1; fi
 log_warn "Setting up environment variables..."
 ENV_TEMP=$(mktemp)
 cat > "$ENV_TEMP" << EOF
diff --git a/shared/common.sh b/shared/common.sh
new file mode 100644
index 00000000..11699caa
--- /dev/null
+++ b/shared/common.sh
@@ -0,0 +1,262 @@
+#!/bin/bash
+# Shared bash functions used across all spawn scripts
+# Provider-agnostic utilities for logging, input, OAuth, etc.
+#
+# This file is meant to be sourced by cloud provider-specific common.sh files.
+# It does not set bash flags (like set -euo pipefail) as those should be set
+# by the scripts that source this file.
+
+# ============================================================
+# Color definitions and logging
+# ============================================================
+
+# Use non-readonly vars to avoid errors if sourced multiple times
+RED='\033[0;31m'
+GREEN='\033[0;32m'
+YELLOW='\033[1;33m'
+NC='\033[0m' # No Color
+
+# Print colored messages (to stderr so they don't pollute command substitution output)
+log_info() {
+    echo -e "${GREEN}$1${NC}" >&2
+}
+
+log_warn() {
+    echo -e "${YELLOW}$1${NC}" >&2
+}
+
+log_error() {
+    echo -e "${RED}$1${NC}" >&2
+}
+
+# ============================================================
+# Input handling
+# ============================================================
+
+# Safe read function that works in both interactive and non-interactive modes
+safe_read() {
+    local prompt="$1"
+    local result=""
+
+    if [[ -t 0 ]]; then
+        # stdin is a terminal - read directly
+        read -p "$prompt" result
+    elif echo -n "" > /dev/tty 2>/dev/null; then
+        # /dev/tty is functional - use it
+        read -p "$prompt" result < /dev/tty
+    else
+        # No interactive input available
+        log_error "Cannot read input: no TTY available"
+        return 1
+    fi
+
+    echo "$result"
+}
+
+# ============================================================
+# Network utilities
+# ============================================================
+
+# Listen on a port with netcat (handles busybox/Termux nc requiring -p flag)
+nc_listen() {
+    local port=$1
+    shift
+    # Detect if nc requires -p flag (busybox nc on Termux)
+    if nc --help 2>&1 | grep -q "BusyBox\|busybox" || nc --help 2>&1 | grep -q "\-p "; then
+        nc -l -p "$port" "$@"
+    else
+        nc -l "$port" "$@"
+    fi
+}
+
+# Open browser to URL (supports macOS, Linux, Termux)
+open_browser() {
+    local url=$1
+    if command -v termux-open-url &> /dev/null; then
+        termux-open-url "$url" </dev/null
+    elif command -v open &> /dev/null; then
+        open "$url" </dev/null
+    elif command -v xdg-open &> /dev/null; then
+        xdg-open "$url" </dev/null
+    else
+        log_warn "Please open: ${url}"
+    fi
+}
+
+# Validate model ID to prevent command injection
+validate_model_id() {
+    local model_id="$1"
+    if [[ -z "$model_id" ]]; then return 0; fi
+    if [[ ! "$model_id" =~ ^[a-zA-Z0-9/_:.-]+$ ]]; then
+        log_error "Invalid model ID: contains unsafe characters"
+        log_error "Model IDs should only contain: letters, numbers, /, -, _, :, ."
+        return 1
+    fi
+    return 0
+}
+
+# ============================================================
+# OpenRouter authentication
+# ============================================================
+
+# Manually prompt for API key
+get_openrouter_api_key_manual() {
+    echo ""
+    log_warn "Manual API Key Entry"
+    echo -e "${YELLOW}Get your API key from: https://openrouter.ai/settings/keys${NC}"
+    echo ""
+
+    local api_key=""
+    while [[ -z "$api_key" ]]; do
+        api_key=$(safe_read "Enter your OpenRouter API key: ") || return 1
+
+        # Basic validation - OpenRouter keys typically start with "sk-or-"
+        if [[ -z "$api_key" ]]; then
+            log_error "API key cannot be empty"
+        elif [[ ! "$api_key" =~ ^sk-or-v1-[a-f0-9]{64}$ ]]; then
+            log_warn "Warning: API key format doesn't match expected pattern (sk-or-v1-...)"
+            local confirm=$(safe_read "Use this key anyway? (y/N): ") || return 1
+            if [[ "$confirm" =~ ^[Yy]$ ]]; then
+                break
+            else
+                api_key=""
+            fi
+        fi
+    done
+
+    log_info "API key accepted!"
+    echo "$api_key"
+}
+
+# Try OAuth flow, fallback to manual entry if it fails
+try_oauth_flow() {
+    local callback_port=${1:-5180}
+
+    log_warn "Attempting OAuth authentication..."
+
+    # Check if nc is available
+    if ! command -v nc &> /dev/null; then
+        log_warn "netcat (nc) not found - OAuth server unavailable"
+        return 1
+    fi
+
+    local callback_url="http://localhost:${callback_port}/callback"
+    local auth_url="https://openrouter.ai/auth?callback_url=${callback_url}"
+
+    # Create a temporary directory for the OAuth flow
+    local oauth_dir=$(mktemp -d)
+    local code_file="$oauth_dir/code"
+
+    log_warn "Starting local OAuth server on port ${callback_port}..."
+
+    # Use a simpler nc approach - pipe response while capturing request
+    (
+        local success_response='HTTP/1.1 200 OK\r\nContent-Type: text/html\r\nConnection: close\r\n\r\n<html><head><style>@keyframes checkmark{0%{transform:scale(0) rotate(-45deg);opacity:0}60%{transform:scale(1.2) rotate(-45deg);opacity:1}100%{transform:scale(1) rotate(-45deg);opacity:1}}@keyframes fadein{from{opacity:0;transform:translateY(10px)}to{opacity:1;transform:translateY(0)}}body{font-family:system-ui,-apple-system,sans-serif;display:flex;justify-content:center;align-items:center;height:100vh;margin:0;background:#1a1a2e}.card{text-align:center;color:#fff}.check{width:80px;height:80px;border-radius:50%;background:#00d4aa22;display:flex;align-items:center;justify-content:center;margin:0 auto 24px}.check::after{content:"";display:block;width:28px;height:14px;border-left:4px solid #00d4aa;border-bottom:4px solid #00d4aa;animation:checkmark .5s ease forwards}h1{color:#00d4aa;margin:0 0 8px;font-size:1.6rem}p{margin:0 0 6px;color:#ffffffcc;font-size:1rem}.sub{color:#ffffff66;font-size:.85rem;animation:fadein .5s ease .5s both}</style></head><body><div class="card"><div class="check"></div><h1>Authentication Successful!</h1><p>Redirecting back to terminal...</p><p class="sub">This tab will close automatically</p></div><script>setTimeout(function(){try{window.close()}catch(e){}setTimeout(function(){document.querySelector(".sub").textContent="You can safely close this tab"},500)},3000)</script></body></html>'
+
+        while true; do
+            # Listen and capture just the first line of the request, then respond
+            local response_file=$(mktemp)
+            echo -e "$success_response" > "$response_file"
+
+            local request=$(nc_listen "$callback_port" < "$response_file" 2>/dev/null | head -1)
+            local nc_status=$?
+            rm -f "$response_file"
+
+            # If nc failed, exit the loop
+            if [[ $nc_status -ne 0 ]]; then
+                break
+            fi
+
+            if [[ "$request" == *"/callback?code="* ]]; then
+                local code=$(echo "$request" | sed -n 's/.*code=\([^ &]*\).*/\1/p')
+                echo "$code" > "$code_file"
+                break
+            fi
+        done
+    ) </dev/null &
+    local server_pid=$!
+
+    # Give the server a moment to start and check if it's running
+    sleep 1
+
+    # Check if the background process is still running
+    if ! kill -0 $server_pid 2>/dev/null; then
+        log_warn "Failed to start OAuth server (port may be in use)"
+        rm -rf "$oauth_dir"
+        return 1
+    fi
+
+    # Open browser
+    log_warn "Opening browser to authenticate with OpenRouter..."
+    open_browser "$auth_url"
+
+    # Wait for the code file to be created (timeout after 2 minutes)
+    local timeout=120
+    local elapsed=0
+    while [[ ! -f "$code_file" ]] && [[ $elapsed -lt $timeout ]]; do
+        sleep 1
+        ((elapsed++))
+    done
+
+    # Kill the background server process
+    kill $server_pid 2>/dev/null || true
+    wait $server_pid 2>/dev/null || true
+
+    if [[ ! -f "$code_file" ]]; then
+        log_warn "OAuth timeout - no response received"
+        rm -rf "$oauth_dir"
+        return 1
+    fi
+
+    local oauth_code=$(cat "$code_file")
+    rm -rf "$oauth_dir"
+
+    # Exchange the code for an API key
+    log_warn "Exchanging OAuth code for API key..."
+    local key_response=$(curl -s -X POST "https://openrouter.ai/api/v1/auth/keys" \
+        -H "Content-Type: application/json" \
+        -d "{\"code\": \"$oauth_code\"}")
+
+    local api_key=$(echo "$key_response" | grep -o '"key":"[^"]*"' | sed 's/"key":"//;s/"$//')
+
+    if [[ -z "$api_key" ]]; then
+        log_error "Failed to exchange OAuth code: ${key_response}"
+        return 1
+    fi
+
+    log_info "Successfully obtained OpenRouter API key via OAuth!"
+    echo "$api_key"
+}
+
+# Main function: Try OAuth, fallback to manual entry
+get_openrouter_api_key_oauth() {
+    local callback_port=${1:-5180}
+
+    # Try OAuth flow first
+    local api_key=$(try_oauth_flow "$callback_port")
+
+    if [[ -n "$api_key" ]]; then
+        echo "$api_key"
+        return 0
+    fi
+
+    # OAuth failed, offer manual entry
+    echo ""
+    log_warn "OAuth authentication failed or unavailable"
+    log_warn "You can enter your API key manually instead"
+    echo ""
+    local manual_choice=$(safe_read "Would you like to enter your API key manually? (Y/n): ") || {
+        log_error "Cannot prompt for manual entry in non-interactive mode"
+        log_warn "Set OPENROUTER_API_KEY environment variable for non-interactive usage"
+        return 1
+    }
+
+    if [[ ! "$manual_choice" =~ ^[Nn]$ ]]; then
+        api_key=$(get_openrouter_api_key_manual)
+        echo "$api_key"
+        return 0
+    else
+        log_error "Authentication cancelled by user"
+        return 1
+    fi
+}
diff --git a/sprite/aider.sh b/sprite/aider.sh
index 8aca9e42..42eecee3 100755
--- a/sprite/aider.sh
+++ b/sprite/aider.sh
@@ -44,6 +44,12 @@ log_warn "Which model would you like to use with Aider?"
 MODEL_ID=$(safe_read "Enter model ID [openrouter/auto]: ") || MODEL_ID=""
 MODEL_ID="${MODEL_ID:-openrouter/auto}"
 
+# Validate model ID for security
+if ! validate_model_id "$MODEL_ID"; then
+    log_error "Exiting due to invalid model ID"
+    exit 1
+fi
+
 # Inject environment variables
 log_warn "Setting up environment variables..."
 
diff --git a/sprite/lib/common.sh b/sprite/lib/common.sh
index 5f0072d5..eb167464 100644
--- a/sprite/lib/common.sh
+++ b/sprite/lib/common.sh
@@ -117,190 +117,24 @@ EOF
     rm "$bash_temp"
 }
 
-# Listen on a port with netcat (handles busybox/Termux nc requiring -p flag)
-nc_listen() {
-    local port=$1
-    shift
-    # Detect if nc requires -p flag (busybox nc on Termux)
-    if nc --help 2>&1 | grep -q "BusyBox\|busybox" || nc --help 2>&1 | grep -q "\-p "; then
-        nc -l -p "$port" "$@"
-    else
-        nc -l "$port" "$@"
-    fi
-}
+# Note: Provider-agnostic functions (nc_listen, open_browser, OAuth helpers) are now in shared/common.sh
 
-# Manually prompt for API key
-get_openrouter_api_key_manual() {
-    echo ""
-    log_warn "Manual API Key Entry"
-    echo -e "${YELLOW}Get your API key from: https://openrouter.ai/settings/keys${NC}"
-    echo ""
+# Validate model ID to prevent command injection
+# Model IDs should only contain alphanumeric, slash, dash, underscore, colon, dot
+validate_model_id() {
+    local model_id="$1"
 
-    local api_key=""
-    while [[ -z "$api_key" ]]; do
-        api_key=$(safe_read "Enter your OpenRouter API key: ") || return 1
-
-        # Basic validation - OpenRouter keys typically start with "sk-or-"
-        if [[ -z "$api_key" ]]; then
-            log_error "API key cannot be empty"
-        elif [[ ! "$api_key" =~ ^sk-or-v1-[a-f0-9]{64}$ ]]; then
-            log_warn "Warning: API key format doesn't match expected pattern (sk-or-v1-...)"
-            local confirm=$(safe_read "Use this key anyway? (y/N): ") || return 1
-            if [[ "$confirm" =~ ^[Yy]$ ]]; then
-                break
-            else
-                api_key=""
-            fi
-        fi
-    done
-
-    log_info "API key accepted!"
-    echo "$api_key"
-}
-
-# Try OAuth flow, fallback to manual entry if it fails
-try_oauth_flow() {
-    local callback_port=${1:-5180}
-
-    log_warn "Attempting OAuth authentication..."
-
-    # Check if nc is available
-    if ! command -v nc &> /dev/null; then
-        log_warn "netcat (nc) not found - OAuth server unavailable"
-        return 1
-    fi
-
-    local callback_url="http://localhost:${callback_port}/callback"
-    local auth_url="https://openrouter.ai/auth?callback_url=${callback_url}"
-
-    # Create a temporary directory for the OAuth flow
-    local oauth_dir=$(mktemp -d)
-    local code_file="$oauth_dir/code"
-
-    log_warn "Starting local OAuth server on port ${callback_port}..."
-
-    # Use a simpler nc approach - pipe response while capturing request
-    (
-        local success_response='HTTP/1.1 200 OK\r\nContent-Type: text/html\r\nConnection: close\r\n\r\n<html><head><style>@keyframes checkmark{0%{transform:scale(0) rotate(-45deg);opacity:0}60%{transform:scale(1.2) rotate(-45deg);opacity:1}100%{transform:scale(1) rotate(-45deg);opacity:1}}@keyframes fadein{from{opacity:0;transform:translateY(10px)}to{opacity:1;transform:translateY(0)}}body{font-family:system-ui,-apple-system,sans-serif;display:flex;justify-content:center;align-items:center;height:100vh;margin:0;background:#1a1a2e}.card{text-align:center;color:#fff}.check{width:80px;height:80px;border-radius:50%;background:#00d4aa22;display:flex;align-items:center;justify-content:center;margin:0 auto 24px}.check::after{content:"";display:block;width:28px;height:14px;border-left:4px solid #00d4aa;border-bottom:4px solid #00d4aa;animation:checkmark .5s ease forwards}h1{color:#00d4aa;margin:0 0 8px;font-size:1.6rem}p{margin:0 0 6px;color:#ffffffcc;font-size:1rem}.sub{color:#ffffff66;font-size:.85rem;animation:fadein .5s ease .5s both}</style></head><body><div class="card"><div class="check"></div><h1>Authentication Successful!</h1><p>Redirecting back to terminal...</p><p class="sub">This tab will close automatically</p></div><script>setTimeout(function(){try{window.close()}catch(e){}setTimeout(function(){document.querySelector(".sub").textContent="You can safely close this tab"},500)},3000)</script></body></html>'
-
-        while true; do
-            # Listen and capture just the first line of the request, then respond
-            local response_file=$(mktemp)
-            echo -e "$success_response" > "$response_file"
-
-            local request=$(nc_listen "$callback_port" < "$response_file" 2>/dev/null | head -1)
-            local nc_status=$?
-            rm -f "$response_file"
-
-            # If nc failed, exit the loop
-            if [[ "$nc_status" -ne 0 ]]; then
-                break
-            fi
-
-            if [[ "$request" == *"/callback?code="* ]]; then
-                local code=$(echo "$request" | sed -n 's/.*code=\([^ &]*\).*/\1/p')
-                echo "$code" > "$code_file"
-                break
-            fi
-        done
-    ) </dev/null &
-    local server_pid=$!
-
-    # Give the server a moment to start and check if it's running
-    sleep 1
-
-    # Check if the background process is still running
-    if ! kill -0 "$server_pid" 2>/dev/null; then
-        log_warn "Failed to start OAuth server (port may be in use)"
-        rm -rf "$oauth_dir"
-        return 1
-    fi
-
-    # Open browser
-    log_warn "Opening browser to authenticate with OpenRouter..."
-    open_browser "$auth_url"
-
-    # Wait for the code file to be created (timeout after 2 minutes)
-    local timeout=120
-    local elapsed=0
-    while [[ ! -f "$code_file" ]] && [[ "$elapsed" -lt "$timeout" ]]; do
-        sleep 1
-        ((elapsed++))
-    done
-
-    # Kill the background server process
-    kill "$server_pid" 2>/dev/null || true
-    wait "$server_pid" 2>/dev/null || true
-
-    if [[ ! -f "$code_file" ]]; then
-        log_warn "OAuth timeout - no response received"
-        rm -rf "$oauth_dir"
-        return 1
-    fi
-
-    local oauth_code=$(cat "$code_file")
-    rm -rf "$oauth_dir"
-
-    # Exchange the code for an API key
-    log_warn "Exchanging OAuth code for API key..."
-    local key_response=$(curl -s -X POST "https://openrouter.ai/api/v1/auth/keys" \
-        -H "Content-Type: application/json" \
-        -d "{\"code\": \"$oauth_code\"}")
-
-    local api_key=$(echo "$key_response" | grep -o '"key":"[^"]*"' | sed 's/"key":"//;s/"$//')
-
-    if [[ -z "$api_key" ]]; then
-        log_error "Failed to exchange OAuth code: ${key_response}"
-        return 1
-    fi
-
-    log_info "Successfully obtained OpenRouter API key via OAuth!"
-    echo "$api_key"
-}
-
-# Main function: Try OAuth, fallback to manual entry
-get_openrouter_api_key_oauth() {
-    local callback_port=${1:-5180}
-
-    # Try OAuth flow first
-    local api_key=$(try_oauth_flow "$callback_port")
-
-    if [[ -n "$api_key" ]]; then
-        echo "$api_key"
+    # Allow empty (will use default)
+    if [[ -z "$model_id" ]]; then
         return 0
     fi
 
-    # OAuth failed, offer manual entry
-    echo ""
-    log_warn "OAuth authentication failed or unavailable"
-    log_warn "You can enter your API key manually instead"
-    echo ""
-    local manual_choice=$(safe_read "Would you like to enter your API key manually? (Y/n): ") || {
-        log_error "Cannot prompt for manual entry in non-interactive mode"
-        log_warn "Set OPENROUTER_API_KEY environment variable for non-interactive usage"
-        return 1
-    }
-
-    if [[ ! "$manual_choice" =~ ^[Nn]$ ]]; then
-        api_key=$(get_openrouter_api_key_manual)
-        echo "$api_key"
-        return 0
-    else
-        log_error "Authentication cancelled by user"
+    # Check for valid characters only: a-z A-Z 0-9 / - _ : .
+    if [[ ! "$model_id" =~ ^[a-zA-Z0-9/_:.-]+$ ]]; then
+        log_error "Invalid model ID: contains unsafe characters"
+        log_error "Model IDs should only contain: letters, numbers, /, -, _, :, ."
         return 1
     fi
-}
 
-# Open browser to URL (supports macOS, Linux, Termux)
-open_browser() {
-    local url=$1
-    if command -v termux-open-url &> /dev/null; then
-        termux-open-url "$url" </dev/null
-    elif command -v open &> /dev/null; then
-        open "$url" </dev/null
-    elif command -v xdg-open &> /dev/null; then
-        xdg-open "$url" </dev/null
-    else
-        log_warn "Please open: ${url}"
-    fi
+    return 0
 }
diff --git a/sprite/openclaw.sh b/sprite/openclaw.sh
index 60820b1c..37460262 100755
--- a/sprite/openclaw.sh
+++ b/sprite/openclaw.sh
@@ -39,6 +39,12 @@ log_warn "Which model would you like to use?"
 MODEL_ID=$(safe_read "Enter model ID [openrouter/auto]: ") || MODEL_ID=""
 MODEL_ID="${MODEL_ID:-openrouter/auto}"
 
+# Validate model ID for security
+if ! validate_model_id "$MODEL_ID"; then
+    log_error "Exiting due to invalid model ID"
+    exit 1
+fi
+
 # Inject environment variables
 log_warn "Setting up environment variables..."
 
diff --git a/vultr/aider.sh b/vultr/aider.sh
index 372489e0..f945faae 100755
--- a/vultr/aider.sh
+++ b/vultr/aider.sh
@@ -34,6 +34,7 @@ echo ""
 log_warn "Browse models at: https://openrouter.ai/models"
 MODEL_ID=$(safe_read "Enter model ID [openrouter/auto]: ") || MODEL_ID=""
 MODEL_ID="${MODEL_ID:-openrouter/auto}"
+if ! validate_model_id "$MODEL_ID"; then log_error "Exiting due to invalid model ID"; exit 1; fi
 
 log_warn "Setting up environment variables..."
 ENV_TEMP=$(mktemp)
diff --git a/vultr/lib/common.sh b/vultr/lib/common.sh
index 5d592234..686d4f2e 100755
--- a/vultr/lib/common.sh
+++ b/vultr/lib/common.sh
@@ -45,6 +45,17 @@ open_browser() {
     else log_warn "Please open: ${url}"; fi
 }
 
+validate_model_id() {
+    local model_id="$1"
+    if [[ -z "$model_id" ]]; then return 0; fi
+    if [[ ! "$model_id" =~ ^[a-zA-Z0-9/_:.-]+$ ]]; then
+        log_error "Invalid model ID: contains unsafe characters"
+        log_error "Model IDs should only contain: letters, numbers, /, -, _, :, ."
+        return 1
+    fi
+    return 0
+}
+
 get_openrouter_api_key_manual() {
     echo ""
     log_warn "Manual API Key Entry"
diff --git a/vultr/openclaw.sh b/vultr/openclaw.sh
index 1c103d7c..799f72db 100755
--- a/vultr/openclaw.sh
+++ b/vultr/openclaw.sh
@@ -34,6 +34,7 @@ echo ""
 log_warn "Browse models at: https://openrouter.ai/models"
 MODEL_ID=$(safe_read "Enter model ID [openrouter/auto]: ") || MODEL_ID=""
 MODEL_ID="${MODEL_ID:-openrouter/auto}"
+if ! validate_model_id "$MODEL_ID"; then log_error "Exiting due to invalid model ID"; exit 1; fi
 
 log_warn "Setting up environment variables..."
 ENV_TEMP=$(mktemp)