mirror of
https://github.com/OpenRouterTeam/spawn.git
synced 2026-05-05 23:50:48 +00:00
d785571026
Replace unsafe heredoc/echo patterns with inject_env_vars_ssh (Atlantic.Net) and inject_env_vars_local (CodeSandbox) for API key injection. The previous patterns embedded OPENROUTER_API_KEY values directly into shell command strings without escaping, allowing potential command injection if the API key contained shell metacharacters (quotes, backticks, dollar signs). Affected scripts (11 total): - atlanticnet: codex, continue, gemini, gptme, kilocode, opencode - codesandbox: amazonq, gemini, goose, opencode, plandex The safe helpers (generate_env_config) properly single-quote all values and escape embedded single quotes, preventing shell interpretation of special chars. Agent: security-auditor Co-authored-by: A <6723574+louisgv@users.noreply.github.com> Co-authored-by: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
45 lines
1.2 KiB
Bash
45 lines
1.2 KiB
Bash
#!/bin/bash
|
|
set -eo pipefail
|
|
|
|
SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" 2>/dev/null && pwd)"
|
|
if [[ -n "${SCRIPT_DIR}" && -f "${SCRIPT_DIR}/lib/common.sh" ]]; then
|
|
source "${SCRIPT_DIR}/lib/common.sh"
|
|
else
|
|
eval "$(curl -fsSL https://raw.githubusercontent.com/OpenRouterTeam/spawn/main/codesandbox/lib/common.sh)"
|
|
fi
|
|
|
|
log_info "Gemini CLI on CodeSandbox"
|
|
echo ""
|
|
|
|
ensure_codesandbox_cli
|
|
ensure_codesandbox_token
|
|
|
|
SERVER_NAME=$(get_server_name)
|
|
create_server "${SERVER_NAME}"
|
|
wait_for_cloud_init
|
|
|
|
log_step "Installing Gemini CLI..."
|
|
run_server "source ~/.bashrc && bun install -g @google/gemini-cli"
|
|
|
|
echo ""
|
|
if [[ -n "${OPENROUTER_API_KEY:-}" ]]; then
|
|
log_info "Using OpenRouter API key from environment"
|
|
else
|
|
OPENROUTER_API_KEY=$(get_openrouter_api_key_oauth 5185)
|
|
fi
|
|
|
|
log_step "Setting up environment variables..."
|
|
inject_env_vars_local upload_file run_server \
|
|
"OPENROUTER_API_KEY=${OPENROUTER_API_KEY}" \
|
|
"GEMINI_API_KEY=${OPENROUTER_API_KEY}" \
|
|
"OPENAI_API_KEY=${OPENROUTER_API_KEY}" \
|
|
"OPENAI_BASE_URL=https://openrouter.ai/api/v1"
|
|
|
|
echo ""
|
|
log_info "CodeSandbox setup completed successfully!"
|
|
echo ""
|
|
|
|
log_step "Starting Gemini CLI..."
|
|
sleep 1
|
|
clear
|
|
interactive_session "source ~/.bashrc && gemini"
|