mirror of
https://github.com/OpenRouterTeam/spawn.git
synced 2026-04-28 03:49:31 +00:00
cfa1ae7a08
* fix(security): add --proto '=https' to all curl bun installer calls Fixes #2134 All _ensure_bun() functions across aws, hetzner, gcp, local, daytona, and sprite scripts now enforce HTTPS-only downloads via --proto '=https'. This prevents MITM attacks during bun installation on remote VMs. DigitalOcean scripts were already correct and are not changed. Agent: security-auditor Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com> * fix(security): add --proto '=https' to bun installer in TS files Address security reviewer feedback: the same MITM vulnerability existed in 5 TypeScript programmatic provisioning files. Agent: pr-maintainer Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com> * fix(security): quote --proto '=https' in su -c curl calls The aws.ts and gcp.ts files had --proto =https without quotes inside su -c '...' blocks. Uses double quotes ("=https") to properly nest inside the single-quoted su -c argument while maintaining protocol restriction. Agent: security-auditor Co-Authored-By: Claude Sonnet 4.5 <noreply@anthropic.com> --------- Co-authored-by: B <6723574+louisgv@users.noreply.github.com> Co-authored-by: Claude Sonnet 4.6 <noreply@anthropic.com>
33 lines
1.4 KiB
Bash
Executable file
33 lines
1.4 KiB
Bash
Executable file
#!/bin/bash
|
|
set -eo pipefail
|
|
|
|
# Thin shim: ensures bun is available, runs bundled aws.js (local or from GitHub release)
|
|
|
|
_ensure_bun() {
|
|
if command -v bun &>/dev/null; then return 0; fi
|
|
printf '\033[0;36mInstalling bun...\033[0m\n' >&2
|
|
curl -fsSL --proto '=https' --show-error https://bun.sh/install | bash >/dev/null || { printf '\033[0;31mFailed to install bun\033[0m\n' >&2; exit 1; }
|
|
export PATH="$HOME/.bun/bin:$PATH"
|
|
command -v bun &>/dev/null || { printf '\033[0;31mbun not found after install\033[0m\n' >&2; exit 1; }
|
|
}
|
|
|
|
_ensure_bun
|
|
|
|
SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" 2>/dev/null && pwd)"
|
|
|
|
# SPAWN_CLI_DIR override — force local source (used by e2e tests)
|
|
if [[ -n "${SPAWN_CLI_DIR:-}" && -f "$SPAWN_CLI_DIR/packages/cli/src/aws/main.ts" ]]; then
|
|
exec bun run "$SPAWN_CLI_DIR/packages/cli/src/aws/main.ts" kilocode "$@"
|
|
fi
|
|
|
|
# Local checkout — run from source
|
|
if [[ -n "$SCRIPT_DIR" && -f "$SCRIPT_DIR/../../packages/cli/src/aws/main.ts" ]]; then
|
|
exec bun run "$SCRIPT_DIR/../../packages/cli/src/aws/main.ts" kilocode "$@"
|
|
fi
|
|
|
|
# Remote — download and run compiled TypeScript bundle
|
|
AWS_JS=$(mktemp)
|
|
trap 'rm -f "$AWS_JS"' EXIT
|
|
curl -fsSL "https://github.com/OpenRouterTeam/spawn/releases/download/aws-latest/aws.js" -o "$AWS_JS" \
|
|
|| { printf '\033[0;31mFailed to download aws.js\033[0m\n' >&2; exit 1; }
|
|
exec bun run "$AWS_JS" kilocode "$@"
|