- Add --max-time 30 to OAuth key exchange curl to prevent indefinite hangs
- Remove unused DIM variable from cli/install.sh
- Remove unused BLUE variable from cli/spawn.sh
Co-Authored-By: Claude Sonnet 4.5 <noreply@anthropic.com>
Changed trap commands from double quotes to single quotes so variables
expand at trap execution time instead of definition time. This prevents
security issues where variables could be tampered with between trap
definition and execution.
Fixed 3 instances:
- cli/install.sh (2 instances): trap 'rm -rf "$tmpdir"' EXIT
- test/run.sh (1 instance): trap 'cleanup' EXIT
Co-Authored-By: Claude Sonnet 4.5 <noreply@anthropic.com>
Changed set -uo pipefail to set -eo pipefail to align with commit #27
which removed nounset from all other scripts due to incompatibility
with optional env var checks (SPRITE_NAME, OPENROUTER_API_KEY, etc.).
This file was missed in the original nounset removal sweep.
Co-Authored-By: Claude Sonnet 4.5 <noreply@anthropic.com>
Added comprehensive test suite for cli/ TypeScript code:
- 37 tests covering manifest.ts, commands.ts, and integration scenarios
- Tests for manifest loading, caching, network fallback, and validation
- Tests for all CLI commands (list, agents, clouds, run, help, etc.)
- Integration tests for end-to-end workflows
- ~900 lines of test code covering ~635 lines of source
Test infrastructure:
- Added vitest as test runner for fast execution
- Created isolated test environment with mocked cache directories
- Mocked network calls to avoid external dependencies
- Test coverage for critical paths: caching, offline mode, error handling
All tests passing with proper isolation and cleanup.
Co-Authored-By: Claude Sonnet 4.5 <noreply@anthropic.com>
- Replace empty catch blocks with proper error logging
- Add input validation for agent and cloud names in cmdRun and cmdAgentInfo
- Add detailed error messages for network failures and manifest validation
- Improve error context in execScript, cmdImprove, and cmdUpdate
- All errors now log helpful context instead of failing silently
Co-Authored-By: Claude Sonnet 4.5 <noreply@anthropic.com>
The autonomous refactoring added `set -euo pipefail` but the scripts
check optional env vars with `[[ -n "$VAR" ]]` which is a fatal error
under nounset when the var isn't set (e.g. SPRITE_NAME, OPENROUTER_API_KEY).
Fix: downgrade to `set -eo pipefail` across all 42 affected files.
Co-authored-by: Sprite <noreply@sprite.dev>
Co-authored-by: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
Three issues broke the OAuth callback server on macOS:
1. echo -e doesn't work in bash 3.x — \r\n appears as literal text
in the HTTP response, browser gets malformed headers.
Fix: pre-write response with printf to a file before the subshell.
2. local variables inside ( ... ) & subshell — undefined behavior in
bash 3.x since subshells aren't function scope.
Fix: use plain variables in subshells.
3. ((elapsed++)) when elapsed=0 evaluates to falsy — set -e kills
the script on the first iteration of the timeout loop.
Fix: use elapsed=$((elapsed + 1)) instead.
Also simplified nc_listen detection to only check for BusyBox
(the -p flag check could misfire on macOS nc).
Applied to all 10 lib/common.sh files.
Co-authored-by: Sprite <noreply@sprite.dev>
Co-authored-by: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
