vrr/spawn
2
0
Fork 0
mirror of https://github.com/OpenRouterTeam/spawn.git synced 2026-05-04 23:00:20 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions 9
spawn/codesandbox
History
A a0f6b335a4
fix: harden upload_file path validation with strict allowlist regex across 10 clouds (#993) 
Replace fragile blocklist validation and printf '%q' escaping in upload_file()
with strict allowlist regex [a-zA-Z0-9/_.~-]+ across all non-SSH cloud providers.
For codesandbox, additionally migrate from shell command interpolation to SDK
filesystem API via environment variables, eliminating the injection surface entirely.

Affected clouds: codesandbox, daytona, e2b, fly, koyeb, modal, northflank,
railway, render, sprite

Fixes #989

Agent: security-auditor

Co-authored-by: A <6723574+louisgv@users.noreply.github.com>
Co-authored-by: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
2026-02-13 12:20:40 -08:00
..
lib fix: harden upload_file path validation with strict allowlist regex across 10 clouds (#993) 2026-02-13 12:20:40 -08:00
aider.sh feat: add CodeSandbox cloud provider (#857) 2026-02-13 02:09:31 -08:00
amazonq.sh fix: use safe inject_env_vars helpers instead of raw shell interpolation (#932) 2026-02-13 05:57:06 -08:00
claude.sh feat: add CodeSandbox cloud provider (#857) 2026-02-13 02:09:31 -08:00
cline.sh fix: use safe inject_env_vars helpers in 3 missed scripts (#937) 2026-02-13 06:42:13 -08:00
codex.sh fix: use safe inject_env_vars helpers in 4 missed scripts (#941) 2026-02-13 07:00:26 -08:00
continue.sh feat: Add codesandbox/continue (#878) 2026-02-13 05:47:24 -08:00
gemini.sh fix: use safe inject_env_vars helpers instead of raw shell interpolation (#932) 2026-02-13 05:57:06 -08:00
goose.sh fix: use safe inject_env_vars helpers instead of raw shell interpolation (#932) 2026-02-13 05:57:06 -08:00
gptme.sh fix: add actionable guidance to agent installation failures across 126 scripts (#966) 2026-02-13 10:14:03 -08:00
interpreter.sh fix: use safe inject_env_vars helpers in 4 missed scripts (#941) 2026-02-13 07:00:26 -08:00
kilocode.sh feat: Add codesandbox/kilocode (#874) 2026-02-13 06:23:50 -08:00
nanoclaw.sh feat: implement codesandbox/nanoclaw (#915) 2026-02-13 05:08:04 -08:00
openclaw.sh feat: add CodeSandbox cloud provider (#857) 2026-02-13 02:09:31 -08:00
opencode.sh fix: use safe inject_env_vars helpers instead of raw shell interpolation (#932) 2026-02-13 05:57:06 -08:00
plandex.sh fix: use safe inject_env_vars helpers instead of raw shell interpolation (#932) 2026-02-13 05:57:06 -08:00
README.md feat: Add codex on CodeSandbox (#889) 2026-02-13 06:11:54 -08:00

README.md

CodeSandbox

CodeSandbox Firecracker microVMs via SDK/CLI. CodeSandbox

No SSH — uses CodeSandbox SDK/CLI for exec. Firecracker microVMs with ~2s start. Free tier: 40 hrs/mo on Build plan. Requires npm install -g @codesandbox/sdk.

Agents

Claude Code

bash <(curl -fsSL https://openrouter.ai/labs/spawn/codesandbox/claude.sh)

OpenClaw

bash <(curl -fsSL https://openrouter.ai/labs/spawn/codesandbox/openclaw.sh)

Aider

bash <(curl -fsSL https://openrouter.ai/labs/spawn/codesandbox/aider.sh)

NanoClaw

bash <(curl -fsSL https://openrouter.ai/labs/spawn/codesandbox/nanoclaw.sh)

Goose

bash <(curl -fsSL https://openrouter.ai/labs/spawn/codesandbox/goose.sh)

OpenCode

bash <(curl -fsSL https://openrouter.ai/labs/spawn/codesandbox/opencode.sh)

Plandex

bash <(curl -fsSL https://openrouter.ai/labs/spawn/codesandbox/plandex.sh)

Gemini CLI

bash <(curl -fsSL https://openrouter.ai/labs/spawn/codesandbox/gemini.sh)

Amazon Q CLI

bash <(curl -fsSL https://openrouter.ai/labs/spawn/codesandbox/amazonq.sh)

Cline

bash <(curl -fsSL https://openrouter.ai/labs/spawn/codesandbox/cline.sh)

Open Interpreter

bash <(curl -fsSL https://openrouter.ai/labs/spawn/codesandbox/interpreter.sh)

Codex CLI

bash <(curl -fsSL https://openrouter.ai/labs/spawn/codesandbox/codex.sh)

Non-Interactive Mode

CODESANDBOX_SANDBOX_NAME=dev-mk1 \
CSB_API_KEY=csb_xxxxx \
OPENROUTER_API_KEY=sk-or-v1-xxxxx \
  bash <(curl -fsSL https://openrouter.ai/labs/spawn/codesandbox/claude.sh)

Authentication

Get your CodeSandbox API key at: https://codesandbox.io/t/api

Enable all scopes when creating the key and export it as:

export CSB_API_KEY=your-key-here