vrr/spawn
2
0
Fork 0
mirror of https://github.com/OpenRouterTeam/spawn.git synced 2026-05-06 08:10:48 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions 8
mirror of https://github.com/OpenRouterTeam/spawn , link from https://openrouter.ai/spawn and https://discord.com/channels/1091220969173028894/1092729520181739581/1483604863098028273 https://openrouter.ai/spawn
138 commits 25 branches 19 tags 24 MiB
Find a file
Sprite 376722e5fa refactor: security - add input validation and script content checks 
Security improvements to prevent injection attacks:

1. Added validateIdentifier() function:
   - Validates agent and cloud names against allowlist pattern
   - Prevents path traversal (../, /, \)
   - Prevents command injection via special characters
   - Enforces length limits (max 64 chars)
   - Only allows lowercase alphanumeric, hyphens, underscores

2. Added validateScriptContent() function:
   - Validates bash scripts before execution
   - Blocks dangerous patterns (rm -rf /, fork bombs, mkfs, dd)
   - Blocks nested curl|bash and wget|bash
   - Requires valid shebang

3. Applied validation to user inputs:
   - cmdRun: validates agent and cloud parameters
   - cmdAgentInfo: validates agent parameter
   - runBash: validates script content before exec

4. Added comprehensive security test suite

SECURITY-CRITICAL: These changes prevent:
- Path traversal attacks
- Command injection via agent/cloud names
- URL injection attacks
- Execution of obviously malicious scripts

Co-Authored-By: Claude Sonnet 4.5 <noreply@anthropic.com>
2026-02-08 04:46:19 +00:00
.claude Add guardrails: CLAUDE.md rules, hooks, pre-commit validation (#33) 2026-02-07 20:02:19 -08:00
.githooks Add guardrails: CLAUDE.md rules, hooks, pre-commit validation (#33) 2026-02-07 20:02:19 -08:00
.github/workflows ci: add shellcheck linting infrastructure 2026-02-08 01:08:34 +00:00
aws-lightsail refactor: Extract ENV_TEMP pattern to inject_env_vars_ssh (SSH providers) 2026-02-08 04:11:15 +00:00
cli refactor: security - add input validation and script content checks 2026-02-08 04:46:19 +00:00
digitalocean refactor: Extract ENV_TEMP pattern to inject_env_vars_ssh (SSH providers) 2026-02-08 04:11:15 +00:00
e2b refactor: Extract ENV_TEMP pattern to inject_env_vars_local (E2B) 2026-02-08 04:06:33 +00:00
fly refactor: Extract ENV_TEMP pattern to provider-specific inject functions 2026-02-08 04:15:02 +00:00
gcp refactor: Extract ENV_TEMP pattern to provider-specific inject functions 2026-02-08 04:15:02 +00:00
hetzner refactor: Extract ENV_TEMP pattern to inject_env_vars_ssh (SSH providers) 2026-02-08 04:11:15 +00:00
lambda refactor: Extract ENV_TEMP pattern to inject_env_vars_ssh (SSH providers) 2026-02-08 04:11:15 +00:00
linode refactor: Extract ENV_TEMP pattern to inject_env_vars_ssh (SSH providers) 2026-02-08 04:11:15 +00:00
modal refactor: Extract ENV_TEMP pattern to provider-specific inject functions 2026-02-08 04:15:02 +00:00
shared refactor: Extract ENV_TEMP pattern to inject_env_vars_local (Modal) 2026-02-08 04:04:01 +00:00
sprite refactor: Extract ENV_TEMP pattern to provider-specific inject functions 2026-02-08 04:15:02 +00:00
test refactor: Add default case to script-specific assertions 2026-02-08 03:56:29 +00:00
vultr refactor: Extract ENV_TEMP pattern to inject_env_vars_ssh (SSH providers) 2026-02-08 04:11:15 +00:00
.shellcheckrc ci: add shellcheck linting infrastructure 2026-02-08 01:08:34 +00:00
CLAUDE.md refactor: Migrate tests from vitest to bun:test and add testing rules 2026-02-08 04:29:37 +00:00
improve.sh Refocus discovery: clouds over agents, require community buzz 2026-02-08 04:17:45 +00:00
manifest.json Add guardrails: CLAUDE.md rules, hooks, pre-commit validation (#33) 2026-02-07 20:02:19 -08:00
README.md Update tagline 2026-02-08 04:13:17 +00:00

README.md

Spawn

Launch any agent on any cloud, powered by OpenRouter.

Install

curl -fsSL https://openrouter.ai/lab/spawn/cli/install.sh | bash

Usage

spawn                         # Interactive picker
spawn <agent> <cloud>         # Launch directly
spawn list                    # Show the full matrix

Examples

spawn claude sprite           # Claude Code on Sprite
spawn aider hetzner           # Aider on Hetzner Cloud
spawn goose digitalocean      # Goose on DigitalOcean
spawn codex vultr             # Codex CLI on Vultr

Commands

Command Description
spawn Interactive agent + cloud picker
spawn <agent> <cloud> Launch agent on cloud directly
spawn <agent> Show available clouds for an agent
spawn list Full agent x cloud matrix
spawn agents List all agents
spawn clouds List all cloud providers

Without the CLI

Every combination also works as a one-liner:

bash <(curl -fsSL https://openrouter.ai/lab/spawn/{cloud}/{agent}.sh)

Non-Interactive

Skip all prompts with environment variables:

OPENROUTER_API_KEY=sk-or-v1-xxxxx \
  spawn claude sprite

Each cloud has its own env vars for auth — see the cloud's README.

Matrix

Sprite Hetzner DigitalOcean Vultr Linode Lambda Lightsail GCP E2B Modal Fly.io
Claude Code ✓ ✓ ✓ ✓ ✓ ✓ ✓ ✓ ✓ ✓ ✓
OpenClaw ✓ ✓ ✓ ✓ ✓ ✓ ✓ ✓ ✓ ✓ ✓
NanoClaw ✓ ✓ ✓ ✓ ✓ ✓ ✓ ✓ ✓ ✓ ✓
Aider ✓ ✓ ✓ ✓ ✓ ✓ ✓ ✓ ✓ ✓ ✓
Goose ✓ ✓ ✓ ✓ ✓ ✓ ✓ ✓ ✓ ✓ ✓
Codex CLI ✓ ✓ ✓ ✓ ✓ ✓ ✓ ✓ ✓ ✓ ✓
Interpreter ✓ ✓ ✓ ✓ ✓ ✓ ✓ ✓ ✓ ✓ ✓
Gemini CLI ✓ ✓ ✓ ✓ ✓ ✓ ✓ ✓ ✓ ✓ ✓
Amazon Q ✓ ✓ ✓ ✓ ✓ ✓ ✓ ✓ ✓ ✓ ✓
Cline ✓ ✓ ✓ ✓ ✓ ✓ ✓ ✓ ✓ ✓ ✓
gptme ✓ ✓ ✓ ✓ ✓ ✓ ✓ ✓ ✓ ✓ ✓

Development

git clone https://github.com/OpenRouterTeam/spawn.git
cd spawn
git config core.hooksPath .githooks