mirror of
https://github.com/OpenRouterTeam/spawn.git
synced 2026-05-06 08:10:48 +00:00
54ef5e451a
Koyeb's inject_env_vars used sed escaping that didn't handle single quotes,
allowing API key values containing ' to break out of the shell command string
passed to `koyeb instances exec`. Replace with file-based injection using
generate_env_config + upload_file, matching the safe pattern in shared/common.sh.
Hyperstack goose/gemini/interpreter/codex scripts embedded $OPENROUTER_API_KEY
directly in double-quoted command strings passed to run_server (SSH). Values
containing double quotes, backticks, or $() could execute arbitrary commands
on the remote VM. Replace with inject_env_vars_ssh which writes env vars to a
temp file, uploads via SCP, and appends to shell config without interpolation.
Also hardens Koyeb upload_file to reject remote paths containing shell
metacharacters (', $, `, newline).
Agent: security-auditor
Co-authored-by: A <6723574+louisgv@users.noreply.github.com>
Co-authored-by: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
49 lines
1.5 KiB
Bash
49 lines
1.5 KiB
Bash
#!/bin/bash
|
|
set -eo pipefail
|
|
|
|
SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" 2>/dev/null && pwd)"
|
|
if [[ -n "$SCRIPT_DIR" && -f "$SCRIPT_DIR/lib/common.sh" ]]; then
|
|
source "$SCRIPT_DIR/lib/common.sh"
|
|
else
|
|
eval "$(curl -fsSL https://raw.githubusercontent.com/OpenRouterTeam/spawn/main/hyperstack/lib/common.sh)"
|
|
fi
|
|
|
|
log_info "Open Interpreter on Hyperstack"
|
|
echo ""
|
|
|
|
ensure_hyperstack_api_key
|
|
ensure_ssh_key
|
|
|
|
VM_NAME=$(get_vm_name)
|
|
ENVIRONMENT=$(get_environment_name)
|
|
|
|
create_vm "$VM_NAME" "$ENVIRONMENT"
|
|
verify_server_connectivity "$HYPERSTACK_VM_IP"
|
|
|
|
log_warn "Installing Python and pip..."
|
|
run_server "$HYPERSTACK_VM_IP" "apt-get update && apt-get install -y python3 python3-pip"
|
|
|
|
log_warn "Installing Open Interpreter..."
|
|
run_server "$HYPERSTACK_VM_IP" "pip3 install open-interpreter --break-system-packages 2>/dev/null || pip3 install open-interpreter"
|
|
|
|
echo ""
|
|
if [[ -n "${OPENROUTER_API_KEY:-}" ]]; then
|
|
log_info "Using OpenRouter API key from environment"
|
|
else
|
|
OPENROUTER_API_KEY=$(get_openrouter_api_key_oauth 5180)
|
|
fi
|
|
|
|
log_warn "Setting up environment variables..."
|
|
inject_env_vars_ssh "$HYPERSTACK_VM_IP" upload_file run_server \
|
|
"OPENROUTER_API_KEY=${OPENROUTER_API_KEY}" \
|
|
"OPENAI_API_KEY=${OPENROUTER_API_KEY}" \
|
|
"OPENAI_BASE_URL=https://openrouter.ai/api/v1"
|
|
|
|
echo ""
|
|
log_info "Hyperstack VM setup completed successfully!"
|
|
echo ""
|
|
|
|
log_warn "Starting Open Interpreter..."
|
|
sleep 1
|
|
clear
|
|
interactive_session "$HYPERSTACK_VM_IP" "source ~/.zshrc && interpreter"
|