vrr/spawn
2
0
Fork 0
mirror of https://github.com/OpenRouterTeam/spawn.git synced 2026-05-10 12:20:07 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions 8
spawn/sprite
History
A 7227083a61
feat: convert sprite/ cloud provider from Bash to TypeScript (#1692) 
* feat: convert sprite/ cloud provider from Bash to TypeScript

Makes Sprite CLI orchestration (retry, org detection, file upload) cleaner.
Converts 381-line lib/common.sh and 6 agent scripts to TS/Bun.

Fixes #1680

Agent: complexity-hunter
Co-Authored-By: Claude Sonnet 4.5 <noreply@anthropic.com>

* fix: add path traversal check, fix regex injection, update test assertions

- Add '..' path traversal rejection in uploadFileSprite
- Replace RegExp constructor with string comparison in createSprite
  to prevent regex injection
- Add base64 output validation in main.ts
- Update TS_CLOUDS sets and test count assertions for sprite conversion

Agent: security-auditor
Co-Authored-By: Claude Sonnet 4.5 <noreply@anthropic.com>

* fix: update test assertions for TS-converted cloud providers

Lowered cloud lib/common.sh count from >= 7 to >= 5 and SSH-based
upload_file count from >= 4 to >= 3 to reflect sprite and digitalocean
being converted from Bash to TypeScript.

Agent: pr-maintainer
Co-Authored-By: Claude Sonnet 4.5 <noreply@anthropic.com>

* fix: add temp file path validation in sprite uploadConfigFile

Add path validation to ensure the temp file path stays within the
expected tmpdir() directory, preventing potential path manipulation.

The other three security review findings (path traversal, regex
injection, base64 validation) were already addressed in the previous
commit on this branch.

Agent: code-health
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

* fix: update test count assertions after sprite TS migration

Both upload-file-security and cloud-lib-source-chain had '>= 5' floor
assertions that assumed sprite had bash lib/common.sh. Now that sprite
is TS-based (no bash lib), the bash-cloud count is 4, not 5.

Agent: team-lead
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

---------

Co-authored-by: B <6723574+louisgv@users.noreply.github.com>
Co-authored-by: Claude Sonnet 4.5 <noreply@anthropic.com>
2026-02-22 05:04:04 -08:00
..
.claude/rules Sprite setup scripts for Claude Code and OpenClaw 2026-02-05 13:25:30 -06:00
claude.sh feat: convert sprite/ cloud provider from Bash to TypeScript (#1692) 2026-02-22 05:04:04 -08:00
codex.sh feat: convert sprite/ cloud provider from Bash to TypeScript (#1692) 2026-02-22 05:04:04 -08:00
kilocode.sh feat: convert sprite/ cloud provider from Bash to TypeScript (#1692) 2026-02-22 05:04:04 -08:00
openclaw.sh feat: convert sprite/ cloud provider from Bash to TypeScript (#1692) 2026-02-22 05:04:04 -08:00
opencode.sh feat: convert sprite/ cloud provider from Bash to TypeScript (#1692) 2026-02-22 05:04:04 -08:00
README.md fix: sync cloud READMEs with current agent list (#1486) 2026-02-19 17:47:57 -05:00
zeroclaw.sh feat: convert sprite/ cloud provider from Bash to TypeScript (#1692) 2026-02-22 05:04:04 -08:00

README.md

Sprite

Sprites.dev managed VMs with CLI. Sprite

Agents

Claude Code

bash <(curl -fsSL https://openrouter.ai/labs/spawn/sprite/claude.sh)

OpenClaw

bash <(curl -fsSL https://openrouter.ai/labs/spawn/sprite/openclaw.sh)

ZeroClaw

bash <(curl -fsSL https://openrouter.ai/labs/spawn/sprite/zeroclaw.sh)

Codex CLI

bash <(curl -fsSL https://openrouter.ai/labs/spawn/sprite/codex.sh)

OpenCode

bash <(curl -fsSL https://openrouter.ai/labs/spawn/sprite/opencode.sh)

Kilo Code

bash <(curl -fsSL https://openrouter.ai/labs/spawn/sprite/kilocode.sh)

Non-Interactive Mode

SPRITE_NAME=dev-mk1 \
OPENROUTER_API_KEY=sk-or-v1-xxxxx \
  bash <(curl -fsSL https://openrouter.ai/labs/spawn/sprite/claude.sh)