2 commits

Author	SHA1	Message	Date
A	d785571026	fix: use safe inject_env_vars helpers instead of raw shell interpolation (#932) ... Replace unsafe heredoc/echo patterns with inject_env_vars_ssh (Atlantic.Net) and inject_env_vars_local (CodeSandbox) for API key injection. The previous patterns embedded OPENROUTER_API_KEY values directly into shell command strings without escaping, allowing potential command injection if the API key contained shell metacharacters (quotes, backticks, dollar signs). Affected scripts (11 total): - atlanticnet: codex, continue, gemini, gptme, kilocode, opencode - codesandbox: amazonq, gemini, goose, opencode, plandex The safe helpers (generate_env_config) properly single-quote all values and escape embedded single quotes, preventing shell interpretation of special chars. Agent: security-auditor Co-authored-by: A <6723574+louisgv@users.noreply.github.com> Co-authored-by: Claude Opus 4.6 (1M context) <noreply@anthropic.com>	2026-02-13 05:57:06 -08:00
A	dea0b9a09e	feat: Add opencode on CodeSandbox (#905) ... Agent: gap-filler Co-authored-by: B (Discovery Team) <6723574+louisgv@users.noreply.github.com>	2026-02-13 05:09:44 -08:00