mirror of
https://github.com/OpenRouterTeam/spawn.git
synced 2026-04-28 03:49:31 +00:00
d5461adc16
* feat: SPAWN_CLI_DIR env var to force local source in e2e and shell scripts When SPAWN_CLI_DIR is set, the entire toolchain uses local TypeScript source instead of downloading pre-bundled scripts from GitHub releases: - e2e.sh: auto-sets SPAWN_CLI_DIR to repo root when running locally - provision.sh: exports SPAWN_CLI_DIR into the headless subshell - commands.ts: reads local shell scripts instead of fetching from CDN - All 36 cloud/agent shell scripts: exec local main.ts when set This enables e2e tests to validate local changes before they're released. Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com> * fix(security): add path traversal defense to SPAWN_CLI_DIR script loading Canonicalize the path via realpathSync and verify it stays inside the resolved CLI directory before reading. Prevents SPAWN_CLI_DIR from being used to read arbitrary files via ../ traversal. Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com> * fix(security): harden SPAWN_CLI_DIR path traversal defense - Validate cloud/agent names don't contain '..', '/' or '\' before constructing file paths - Fix root-directory edge case in prefix check by handling trailing separator correctly Agent: pr-maintainer Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com> --------- Co-authored-by: Claude Opus 4.6 <noreply@anthropic.com> Co-authored-by: B <6723574+louisgv@users.noreply.github.com>
34 lines
1.4 KiB
Bash
34 lines
1.4 KiB
Bash
#!/bin/bash
|
|
set -eo pipefail
|
|
|
|
# Thin shim: ensures bun is available, runs bundled daytona TypeScript (local or from GitHub release)
|
|
|
|
_ensure_bun() {
|
|
if command -v bun &>/dev/null; then return 0; fi
|
|
printf '\033[0;36mInstalling bun...\033[0m\n' >&2
|
|
curl -fsSL --show-error https://bun.sh/install | bash >/dev/null || { printf '\033[0;31mFailed to install bun\033[0m\n' >&2; exit 1; }
|
|
export PATH="$HOME/.bun/bin:$PATH"
|
|
command -v bun &>/dev/null || { printf '\033[0;31mbun not found after install\033[0m\n' >&2; exit 1; }
|
|
}
|
|
|
|
_ensure_bun
|
|
|
|
SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" 2>/dev/null && pwd)"
|
|
|
|
# SPAWN_CLI_DIR override — force local source (used by e2e tests)
|
|
if [[ -n "${SPAWN_CLI_DIR:-}" && -f "$SPAWN_CLI_DIR/packages/cli/src/daytona/main.ts" ]]; then
|
|
exec bun run "$SPAWN_CLI_DIR/packages/cli/src/daytona/main.ts" codex "$@"
|
|
fi
|
|
|
|
# Local checkout — run from source
|
|
if [[ -n "$SCRIPT_DIR" && -f "$SCRIPT_DIR/../../packages/cli/src/daytona/main.ts" ]]; then
|
|
exec bun run "$SCRIPT_DIR/../../packages/cli/src/daytona/main.ts" codex "$@"
|
|
fi
|
|
|
|
# Remote — download bundled daytona.js from GitHub release
|
|
DAYTONA_JS=$(mktemp)
|
|
trap 'rm -f "$DAYTONA_JS"' EXIT
|
|
curl -fsSL "https://github.com/OpenRouterTeam/spawn/releases/download/daytona-latest/daytona.js" -o "$DAYTONA_JS" \
|
|
|| { printf '\033[0;31mFailed to download daytona.js\033[0m\n' >&2; exit 1; }
|
|
|
|
exec bun run "$DAYTONA_JS" codex "$@"
|