mirror of
https://github.com/OpenRouterTeam/spawn.git
synced 2026-05-10 12:20:07 +00:00
7227083a61
* feat: convert sprite/ cloud provider from Bash to TypeScript Makes Sprite CLI orchestration (retry, org detection, file upload) cleaner. Converts 381-line lib/common.sh and 6 agent scripts to TS/Bun. Fixes #1680 Agent: complexity-hunter Co-Authored-By: Claude Sonnet 4.5 <noreply@anthropic.com> * fix: add path traversal check, fix regex injection, update test assertions - Add '..' path traversal rejection in uploadFileSprite - Replace RegExp constructor with string comparison in createSprite to prevent regex injection - Add base64 output validation in main.ts - Update TS_CLOUDS sets and test count assertions for sprite conversion Agent: security-auditor Co-Authored-By: Claude Sonnet 4.5 <noreply@anthropic.com> * fix: update test assertions for TS-converted cloud providers Lowered cloud lib/common.sh count from >= 7 to >= 5 and SSH-based upload_file count from >= 4 to >= 3 to reflect sprite and digitalocean being converted from Bash to TypeScript. Agent: pr-maintainer Co-Authored-By: Claude Sonnet 4.5 <noreply@anthropic.com> * fix: add temp file path validation in sprite uploadConfigFile Add path validation to ensure the temp file path stays within the expected tmpdir() directory, preventing potential path manipulation. The other three security review findings (path traversal, regex injection, base64 validation) were already addressed in the previous commit on this branch. Agent: code-health Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com> * fix: update test count assertions after sprite TS migration Both upload-file-security and cloud-lib-source-chain had '>= 5' floor assertions that assumed sprite had bash lib/common.sh. Now that sprite is TS-based (no bash lib), the bash-cloud count is 4, not 5. Agent: team-lead Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com> --------- Co-authored-by: B <6723574+louisgv@users.noreply.github.com> Co-authored-by: Claude Sonnet 4.5 <noreply@anthropic.com>
29 lines
1.1 KiB
Bash
Executable file
29 lines
1.1 KiB
Bash
Executable file
#!/bin/bash
|
|
set -eo pipefail
|
|
|
|
# Thin shim: ensures bun is available, runs bundled sprite.js (local or from GitHub release)
|
|
|
|
_ensure_bun() {
|
|
if command -v bun &>/dev/null; then return 0; fi
|
|
printf '\033[0;36mInstalling bun...\033[0m\n' >&2
|
|
curl -fsSL https://bun.sh/install | bash >/dev/null 2>&1 || { printf '\033[0;31mFailed to install bun\033[0m\n' >&2; exit 1; }
|
|
export PATH="$HOME/.bun/bin:$PATH"
|
|
command -v bun &>/dev/null || { printf '\033[0;31mbun not found after install\033[0m\n' >&2; exit 1; }
|
|
}
|
|
|
|
_ensure_bun
|
|
|
|
SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" 2>/dev/null && pwd)"
|
|
|
|
# Local checkout — run from source
|
|
if [[ -n "$SCRIPT_DIR" && -f "$SCRIPT_DIR/../cli/src/sprite/main.ts" ]]; then
|
|
exec bun run "$SCRIPT_DIR/../cli/src/sprite/main.ts" opencode "$@"
|
|
fi
|
|
|
|
# Remote — download bundled sprite.js from GitHub release
|
|
SPRITE_JS=$(mktemp)
|
|
trap 'rm -f "$SPRITE_JS"' EXIT
|
|
curl -fsSL "https://github.com/OpenRouterTeam/spawn/releases/download/sprite-latest/sprite.js" -o "$SPRITE_JS" \
|
|
|| { printf '\033[0;31mFailed to download sprite.js\033[0m\n' >&2; exit 1; }
|
|
|
|
exec bun run "$SPRITE_JS" opencode "$@"
|