vrr/spawn
2
0
Fork 0
mirror of https://github.com/OpenRouterTeam/spawn.git synced 2026-04-29 20:39:29 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions 9
spawn/sh/daytona
History
Ahmed Abushagur d5461adc16
feat: SPAWN_CLI_DIR env var to force local source in e2e (#2015) 
* feat: SPAWN_CLI_DIR env var to force local source in e2e and shell scripts

When SPAWN_CLI_DIR is set, the entire toolchain uses local TypeScript
source instead of downloading pre-bundled scripts from GitHub releases:

- e2e.sh: auto-sets SPAWN_CLI_DIR to repo root when running locally
- provision.sh: exports SPAWN_CLI_DIR into the headless subshell
- commands.ts: reads local shell scripts instead of fetching from CDN
- All 36 cloud/agent shell scripts: exec local main.ts when set

This enables e2e tests to validate local changes before they're released.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

* fix(security): add path traversal defense to SPAWN_CLI_DIR script loading

Canonicalize the path via realpathSync and verify it stays inside the
resolved CLI directory before reading. Prevents SPAWN_CLI_DIR from
being used to read arbitrary files via ../ traversal.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

* fix(security): harden SPAWN_CLI_DIR path traversal defense

- Validate cloud/agent names don't contain '..', '/' or '\' before
  constructing file paths
- Fix root-directory edge case in prefix check by handling trailing
  separator correctly

Agent: pr-maintainer
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

---------

Co-authored-by: Claude Opus 4.6 <noreply@anthropic.com>
Co-authored-by: B <6723574+louisgv@users.noreply.github.com>
2026-02-28 04:14:36 -05:00
..
claude.sh feat: SPAWN_CLI_DIR env var to force local source in e2e (#2015) 2026-02-28 04:14:36 -05:00
codex.sh feat: SPAWN_CLI_DIR env var to force local source in e2e (#2015) 2026-02-28 04:14:36 -05:00
kilocode.sh feat: SPAWN_CLI_DIR env var to force local source in e2e (#2015) 2026-02-28 04:14:36 -05:00
openclaw.sh feat: SPAWN_CLI_DIR env var to force local source in e2e (#2015) 2026-02-28 04:14:36 -05:00
opencode.sh feat: SPAWN_CLI_DIR env var to force local source in e2e (#2015) 2026-02-28 04:14:36 -05:00
README.md refactor: move all shell scripts to /sh directory (#1843) 2026-02-23 21:14:54 -08:00
zeroclaw.sh feat: SPAWN_CLI_DIR env var to force local source in e2e (#2015) 2026-02-28 04:14:36 -05:00

README.md

Daytona

Daytona sandboxed environments for AI code execution. Daytona

Sub-90ms sandbox creation. True SSH support via daytona ssh. Requires DAYTONA_API_KEY from https://app.daytona.io.

Agents

Claude Code

bash <(curl -fsSL https://openrouter.ai/labs/spawn/daytona/claude.sh)

OpenClaw

bash <(curl -fsSL https://openrouter.ai/labs/spawn/daytona/openclaw.sh)

ZeroClaw

bash <(curl -fsSL https://openrouter.ai/labs/spawn/daytona/zeroclaw.sh)

Codex CLI

bash <(curl -fsSL https://openrouter.ai/labs/spawn/daytona/codex.sh)

OpenCode

bash <(curl -fsSL https://openrouter.ai/labs/spawn/daytona/opencode.sh)

Kilo Code

bash <(curl -fsSL https://openrouter.ai/labs/spawn/daytona/kilocode.sh)

Non-Interactive Mode

DAYTONA_SANDBOX_NAME=dev-mk1 \
DAYTONA_API_KEY=your-api-key \
OPENROUTER_API_KEY=sk-or-v1-xxxxx \
  bash <(curl -fsSL https://openrouter.ai/labs/spawn/daytona/claude.sh)

Environment Variables

Variable Description Default
DAYTONA_API_KEY Daytona API key (prompted)
DAYTONA_SANDBOX_NAME Sandbox name (prompted)
DAYTONA_CLASS Sandbox class (e.g. small, medium, large) small
DAYTONA_CPU Number of vCPUs (overrides --class) (unset)
DAYTONA_MEMORY Memory in MB (overrides --class) (unset)
DAYTONA_DISK Disk size in GB (overrides --class) (unset)
OPENROUTER_API_KEY OpenRouter API key (OAuth or prompted)

Note: Daytona rejects explicit --cpu/--memory/--disk flags when using snapshots. Use DAYTONA_CLASS instead. If explicit resource flags fail due to snapshot conflict, spawn automatically retries with --class small.