mirror of
https://github.com/OpenRouterTeam/spawn.git
synced 2026-05-04 23:00:20 +00:00
78d95d0399
Replaces unsafe direct shell interpolation of OPENROUTER_API_KEY with the inject_env_vars_ssh/inject_env_vars_local helpers that use single-quoted values to prevent shell injection. Affected scripts: - codesandbox/codex.sh - codesandbox/interpreter.sh - codesandbox/gptme.sh - atlanticnet/goose.sh This is the same class of fix applied in PR #937 to 3 other scripts, but these 4 were missed. Agent: security-auditor Co-authored-by: A <6723574+louisgv@users.noreply.github.com> Co-authored-by: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
44 lines
1.2 KiB
Bash
44 lines
1.2 KiB
Bash
#!/bin/bash
|
|
set -eo pipefail
|
|
|
|
SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" 2>/dev/null && pwd)"
|
|
if [[ -n "${SCRIPT_DIR}" && -f "${SCRIPT_DIR}/lib/common.sh" ]]; then
|
|
source "${SCRIPT_DIR}/lib/common.sh"
|
|
else
|
|
eval "$(curl -fsSL https://raw.githubusercontent.com/OpenRouterTeam/spawn/main/codesandbox/lib/common.sh)"
|
|
fi
|
|
|
|
log_info "Codex CLI on CodeSandbox"
|
|
echo ""
|
|
|
|
ensure_codesandbox_cli
|
|
ensure_codesandbox_token
|
|
|
|
SERVER_NAME=$(get_server_name)
|
|
create_server "${SERVER_NAME}"
|
|
wait_for_cloud_init
|
|
|
|
log_step "Installing Codex CLI..."
|
|
run_server "source ~/.bashrc && bun install -g @openai/codex"
|
|
|
|
echo ""
|
|
if [[ -n "${OPENROUTER_API_KEY:-}" ]]; then
|
|
log_info "Using OpenRouter API key from environment"
|
|
else
|
|
OPENROUTER_API_KEY=$(get_openrouter_api_key_oauth 5182)
|
|
fi
|
|
|
|
log_step "Setting up environment variables..."
|
|
inject_env_vars_local upload_file run_server \
|
|
"OPENROUTER_API_KEY=${OPENROUTER_API_KEY}" \
|
|
"OPENAI_API_KEY=${OPENROUTER_API_KEY}" \
|
|
"OPENAI_BASE_URL=https://openrouter.ai/api/v1"
|
|
|
|
echo ""
|
|
log_info "CodeSandbox setup completed successfully!"
|
|
echo ""
|
|
|
|
log_step "Starting Codex CLI..."
|
|
sleep 1
|
|
clear
|
|
interactive_session "source ~/.bashrc && codex"
|