Refactor spawn scripts with shared library and OAuth fallback by louisgv · Pull Request #1 · OpenRouterLabs/spawn

louisgv · 2026-02-07T04:06:36Z

Summary

Major refactoring to improve code maintainability, reliability, and user experience:

🏗️ Shared Library Architecture

Created sprite/lib/common.sh with 12 reusable bash functions
openclaw.sh: 258 lines → 93 lines (-64%)
claude.sh: 272 lines → 101 lines (-63%)
Total: Eliminated ~330 lines of duplicate code

🔄 OAuth Fallback Mechanism

Automatic fallback to manual API key entry when OAuth fails
Handles missing netcat (nc) gracefully
Handles port conflicts and OAuth timeouts
API key format validation with override option
Works in headless and minimal environments

🌐 Dual Execution Mode

Local: bash sprite/openclaw.sh
Remote: curl URL | bash
Auto-detects execution context and sources library appropriately

New Shared Functions

Logging:

log_info(), log_warn(), log_error()

Sprite Setup:

ensure_sprite_installed() - Install sprite CLI if needed
ensure_sprite_authenticated() - Check/prompt for auth
ensure_sprite_exists() - Create sprite if doesn't exist
verify_sprite_connectivity() - Test sprite connection
run_sprite() - Execute commands on sprite

Environment:

setup_shell_environment() - Configure PATH and zsh

OAuth:

get_openrouter_api_key_oauth() - OAuth with fallback
try_oauth_flow() - Attempt OAuth (can fail gracefully)
get_openrouter_api_key_manual() - Manual API key entry

Utilities:

open_browser() - Cross-platform browser launch

Failure Scenarios Handled

✅ Missing netcat (nc)
✅ Port already in use
✅ OAuth server startup failure
✅ OAuth timeout (2 minute default)
✅ OAuth code exchange failure
✅ No browser available
✅ User cancellation

Documentation

REFACTORING.md - Architecture overview and benefits
OAUTH_FALLBACK.md - Fallback mechanism guide
CURL_BASH_SOLUTION.md - Execution mode details
EXAMPLES.md - Real-world usage scenarios
CHANGELOG.md - Complete change history

Test Plan

Syntax validation: All scripts pass bash -n
Local execution: Scripts work when run locally
Remote execution: Test curl | bash after merge
OAuth success: Verify OAuth flow completes
OAuth fallback: Test with missing nc
Manual entry: Test API key validation

Breaking Changes

None - scripts maintain identical functionality and command-line interface.

Benefits

Maintainability: Common logic in one place
Reliability: Graceful degradation when OAuth fails
Extensibility: Future scripts can reuse all functions
User Experience: Works in more environments
Code Quality: DRY principle, better organization

🤖 Generated with Claude Code

Major refactoring to improve code maintainability and reliability: ## Shared Library Architecture - Created sprite/lib/common.sh with reusable bash functions - Reduced openclaw.sh from 258 to 93 lines (-64%) - Reduced claude.sh from 272 to 101 lines (-63%) - Eliminated ~330 lines of duplicate code ## OAuth Fallback Mechanism - Added automatic fallback to manual API key entry - Handles missing netcat (nc) gracefully - Handles port conflicts and timeouts - Validates API key format with override option - Works in headless and minimal environments ## Dual Execution Support - Local: bash sprite/openclaw.sh - Remote: curl URL | bash - Auto-detects context and sources library appropriately ## New Shared Functions - Logging: log_info(), log_warn(), log_error() - Sprite setup: ensure_sprite_installed/authenticated/exists() - Environment: setup_shell_environment() - OAuth: get_openrouter_api_key_oauth() with fallback - Utilities: run_sprite(), verify_sprite_connectivity() ## Documentation - REFACTORING.md - Architecture and benefits - OAUTH_FALLBACK.md - Fallback mechanism guide - CURL_BASH_SOLUTION.md - Execution mode details - EXAMPLES.md - Usage scenarios - CHANGELOG.md - Complete change history Co-Authored-By: Claude Sonnet 4.5 <noreply@anthropic.com>

Completed ENV_TEMP pattern extraction across remaining providers: 1. Modal: gptme.sh (1 script) - uses inject_env_vars_local 2. GCP: all 10 agent scripts - uses inject_env_vars_ssh 3. Fly.io: all 11 agent scripts - uses new inject_env_vars_fly - Added inject_env_vars_fly() to fly/lib/common.sh - Handles both .bashrc and .zshrc (Fly-specific requirement) 4. Sprite: amazonq, cline, gemini (3 scripts) - uses inject_env_vars_sprite Total scripts converted in this commit: 25 Total scripts converted in Round 25 Task #1: 78 scripts Each conversion replaces 11-15 lines of temp file management with a single function call that handles creation, permissions, content generation, upload, sourcing, and cleanup. The only remaining ENV_TEMP patterns are DOTENV_TEMP in nanoclaw scripts, which are agent-specific .env files and should remain as-is. Co-Authored-By: Claude Sonnet 4.5 <noreply@anthropic.com>

Add `spawn rerun [#]` to quickly relaunch a previous spawn by its history number. The list view now shows row numbers (#1, #2, ...) and relative timestamps ("2h ago", "3d ago") alongside absolute dates for better scannability. Partially addresses #492. Agent: ux-engineer Co-Authored-By: Claude Sonnet 4.5 <noreply@anthropic.com>

… parses (#3384) Reproduces with: any staged file matching the secret regex (e.g. a test fixture containing an OpenRouter / Anthropic / OpenAI key shape). The redact step ran: sed -i -E "s|${SECRET_REGEX}|${REDACT_PLACEHOLDER}|g" "$f" SECRET_REGEX is itself a `|`-separated alternation of provider patterns (`(sk-or-v1-...)|(sk-ant-api...)|(...)`). After bash expansion, sed sees multiple fields where it expected three, and bails with: sed: -e expression #1, char 67: unknown option to `s' The export then fails on the VM ("sprite exec failed (exit 1)") even though the user already approved the redaction in the host prompt. Fix: switch the sed delimiter to '#'. None of the regex tokens (provider prefixes, char classes, quantifiers, PEM marker) contain '#', and neither does the placeholder, so the substitution is unambiguous. '|' inside the pattern is now correctly interpreted by sed -E as alternation, which is what we wanted all along. Adds a regression test asserting the script uses 's#...#...#g' and not 's|...|...|g'. Bumps CLI 1.0.35 -> 1.0.36.

Numeric targets (target 140, cap 180) just become the new goal. The model will pad to hit them instead of writing a punchy 40-char banger. Remove all char-count anchors from the brevity guidance and let the good/bad examples carry the signal. - Rename section from 'BREVITY IS THE #1 RULE' to 'Keep it short' - Drop 80-140 target, 180 cap, char-count example annotations - Drop Chars line from output format and charCount from JSON - Keep only the qualitative rules: don't pad, don't explain twice, prefer one sentence, cut what isn't pulling weight - Platform 280 cap mentioned once as a ceiling, not a goal

#3390) * fix(growth): enforce brevity in tweet prompt (target ≤140, hard cap 180) Recent posted tweets were running 170-200 chars and reading as long-form marketing copy. Tighten the tweet drafting prompt: - Add a dedicated "BREVITY IS THE #1 RULE" section at the top - Target 80-140 chars, hard cap 180 chars (down from the 280 platform limit) - Good/bad length examples drawn from actual prior drafts - Require a trim pass before output - Update output format and rules to reflect the new caps * fix(growth): drop numeric char targets, lean on taste Numeric targets (target 140, cap 180) just become the new goal. The model will pad to hit them instead of writing a punchy 40-char banger. Remove all char-count anchors from the brevity guidance and let the good/bad examples carry the signal. - Rename section from 'BREVITY IS THE #1 RULE' to 'Keep it short' - Drop 80-140 target, 180 cap, char-count example annotations - Drop Chars line from output format and charCount from JSON - Keep only the qualitative rules: don't pad, don't explain twice, prefer one sentence, cut what isn't pulling weight - Platform 280 cap mentioned once as a ceiling, not a goal * fix(growth): strip all length references from tweet prompt Even mentioning '280 char limit' or 'platform limit' anchors the model to the wrong end of the range. Remove both remaining length references so the prompt is purely about taste: say less, don't pad, cut what isn't pulling weight. The platform enforces its own limit. - Drop the 'platform 280 char limit is a ceiling' paragraph - Drop 'Must fit in a tweet (under the platform limit)' from rules --------- Co-authored-by: Claude <claude@anthropic.com>

louisgv · 2026-02-07T04:06:36Z

Summary

Major refactoring to improve code maintainability, reliability, and user experience:

🏗️ Shared Library Architecture

Created sprite/lib/common.sh with 12 reusable bash functions
openclaw.sh: 258 lines → 93 lines (-64%)
claude.sh: 272 lines → 101 lines (-63%)
Total: Eliminated ~330 lines of duplicate code

🔄 OAuth Fallback Mechanism

Automatic fallback to manual API key entry when OAuth fails
Handles missing netcat (nc) gracefully
Handles port conflicts and OAuth timeouts
API key format validation with override option
Works in headless and minimal environments

🌐 Dual Execution Mode

Local: bash sprite/openclaw.sh
Remote: curl URL | bash
Auto-detects execution context and sources library appropriately

New Shared Functions

Logging:

log_info(), log_warn(), log_error()

Sprite Setup:

ensure_sprite_installed() - Install sprite CLI if needed
ensure_sprite_authenticated() - Check/prompt for auth
ensure_sprite_exists() - Create sprite if doesn't exist
verify_sprite_connectivity() - Test sprite connection
run_sprite() - Execute commands on sprite

Environment:

setup_shell_environment() - Configure PATH and zsh

OAuth:

get_openrouter_api_key_oauth() - OAuth with fallback
try_oauth_flow() - Attempt OAuth (can fail gracefully)
get_openrouter_api_key_manual() - Manual API key entry

Utilities:

open_browser() - Cross-platform browser launch

Failure Scenarios Handled

✅ Missing netcat (nc)
✅ Port already in use
✅ OAuth server startup failure
✅ OAuth timeout (2 minute default)
✅ OAuth code exchange failure
✅ No browser available
✅ User cancellation

Documentation

REFACTORING.md - Architecture overview and benefits
OAUTH_FALLBACK.md - Fallback mechanism guide
CURL_BASH_SOLUTION.md - Execution mode details
EXAMPLES.md - Real-world usage scenarios
CHANGELOG.md - Complete change history

Test Plan

Syntax validation: All scripts pass bash -n
Local execution: Scripts work when run locally
Remote execution: Test curl | bash after merge
OAuth success: Verify OAuth flow completes
OAuth fallback: Test with missing nc
Manual entry: Test API key validation

Breaking Changes

None - scripts maintain identical functionality and command-line interface.

Benefits

Maintainability: Common logic in one place
Reliability: Graceful degradation when OAuth fails
Extensibility: Future scripts can reuse all functions
User Experience: Works in more environments
Code Quality: DRY principle, better organization

🤖 Generated with Claude Code

Major refactoring to improve code maintainability and reliability: ## Shared Library Architecture - Created sprite/lib/common.sh with reusable bash functions - Reduced openclaw.sh from 258 to 93 lines (-64%) - Reduced claude.sh from 272 to 101 lines (-63%) - Eliminated ~330 lines of duplicate code ## OAuth Fallback Mechanism - Added automatic fallback to manual API key entry - Handles missing netcat (nc) gracefully - Handles port conflicts and timeouts - Validates API key format with override option - Works in headless and minimal environments ## Dual Execution Support - Local: bash sprite/openclaw.sh - Remote: curl URL | bash - Auto-detects context and sources library appropriately ## New Shared Functions - Logging: log_info(), log_warn(), log_error() - Sprite setup: ensure_sprite_installed/authenticated/exists() - Environment: setup_shell_environment() - OAuth: get_openrouter_api_key_oauth() with fallback - Utilities: run_sprite(), verify_sprite_connectivity() ## Documentation - REFACTORING.md - Architecture and benefits - OAUTH_FALLBACK.md - Fallback mechanism guide - CURL_BASH_SOLUTION.md - Execution mode details - EXAMPLES.md - Usage scenarios - CHANGELOG.md - Complete change history Co-Authored-By: Claude Sonnet 4.5 <noreply@anthropic.com>

Completed ENV_TEMP pattern extraction across remaining providers: 1. Modal: gptme.sh (1 script) - uses inject_env_vars_local 2. GCP: all 10 agent scripts - uses inject_env_vars_ssh 3. Fly.io: all 11 agent scripts - uses new inject_env_vars_fly - Added inject_env_vars_fly() to fly/lib/common.sh - Handles both .bashrc and .zshrc (Fly-specific requirement) 4. Sprite: amazonq, cline, gemini (3 scripts) - uses inject_env_vars_sprite Total scripts converted in this commit: 25 Total scripts converted in Round 25 Task #1: 78 scripts Each conversion replaces 11-15 lines of temp file management with a single function call that handles creation, permissions, content generation, upload, sourcing, and cleanup. The only remaining ENV_TEMP patterns are DOTENV_TEMP in nanoclaw scripts, which are agent-specific .env files and should remain as-is. Co-Authored-By: Claude Sonnet 4.5 <noreply@anthropic.com>

Add `spawn rerun [#]` to quickly relaunch a previous spawn by its history number. The list view now shows row numbers (#1, #2, ...) and relative timestamps ("2h ago", "3d ago") alongside absolute dates for better scannability. Partially addresses #492. Agent: ux-engineer Co-Authored-By: Claude Sonnet 4.5 <noreply@anthropic.com>

… parses (#3384) Reproduces with: any staged file matching the secret regex (e.g. a test fixture containing an OpenRouter / Anthropic / OpenAI key shape). The redact step ran: sed -i -E "s|${SECRET_REGEX}|${REDACT_PLACEHOLDER}|g" "$f" SECRET_REGEX is itself a `|`-separated alternation of provider patterns (`(sk-or-v1-...)|(sk-ant-api...)|(...)`). After bash expansion, sed sees multiple fields where it expected three, and bails with: sed: -e expression #1, char 67: unknown option to `s' The export then fails on the VM ("sprite exec failed (exit 1)") even though the user already approved the redaction in the host prompt. Fix: switch the sed delimiter to '#'. None of the regex tokens (provider prefixes, char classes, quantifiers, PEM marker) contain '#', and neither does the placeholder, so the substitution is unambiguous. '|' inside the pattern is now correctly interpreted by sed -E as alternation, which is what we wanted all along. Adds a regression test asserting the script uses 's#...#...#g' and not 's|...|...|g'. Bumps CLI 1.0.35 -> 1.0.36.

Numeric targets (target 140, cap 180) just become the new goal. The model will pad to hit them instead of writing a punchy 40-char banger. Remove all char-count anchors from the brevity guidance and let the good/bad examples carry the signal. - Rename section from 'BREVITY IS THE #1 RULE' to 'Keep it short' - Drop 80-140 target, 180 cap, char-count example annotations - Drop Chars line from output format and charCount from JSON - Keep only the qualitative rules: don't pad, don't explain twice, prefer one sentence, cut what isn't pulling weight - Platform 280 cap mentioned once as a ceiling, not a goal

#3390) * fix(growth): enforce brevity in tweet prompt (target ≤140, hard cap 180) Recent posted tweets were running 170-200 chars and reading as long-form marketing copy. Tighten the tweet drafting prompt: - Add a dedicated "BREVITY IS THE #1 RULE" section at the top - Target 80-140 chars, hard cap 180 chars (down from the 280 platform limit) - Good/bad length examples drawn from actual prior drafts - Require a trim pass before output - Update output format and rules to reflect the new caps * fix(growth): drop numeric char targets, lean on taste Numeric targets (target 140, cap 180) just become the new goal. The model will pad to hit them instead of writing a punchy 40-char banger. Remove all char-count anchors from the brevity guidance and let the good/bad examples carry the signal. - Rename section from 'BREVITY IS THE #1 RULE' to 'Keep it short' - Drop 80-140 target, 180 cap, char-count example annotations - Drop Chars line from output format and charCount from JSON - Keep only the qualitative rules: don't pad, don't explain twice, prefer one sentence, cut what isn't pulling weight - Platform 280 cap mentioned once as a ceiling, not a goal * fix(growth): strip all length references from tweet prompt Even mentioning '280 char limit' or 'platform limit' anchors the model to the wrong end of the range. Remove both remaining length references so the prompt is purely about taste: say less, don't pad, cut what isn't pulling weight. The platform enforces its own limit. - Drop the 'platform 280 char limit is a ceiling' paragraph - Drop 'Must fit in a tweet (under the platform limit)' from rules --------- Co-authored-by: Claude <claude@anthropic.com>

louisgv · 2026-02-07T04:06:36Z

Summary

Major refactoring to improve code maintainability, reliability, and user experience:

🏗️ Shared Library Architecture

Created sprite/lib/common.sh with 12 reusable bash functions
openclaw.sh: 258 lines → 93 lines (-64%)
claude.sh: 272 lines → 101 lines (-63%)
Total: Eliminated ~330 lines of duplicate code

🔄 OAuth Fallback Mechanism

Automatic fallback to manual API key entry when OAuth fails
Handles missing netcat (nc) gracefully
Handles port conflicts and OAuth timeouts
API key format validation with override option
Works in headless and minimal environments

🌐 Dual Execution Mode

Local: bash sprite/openclaw.sh
Remote: curl URL | bash
Auto-detects execution context and sources library appropriately

New Shared Functions

Logging:

log_info(), log_warn(), log_error()

Sprite Setup:

ensure_sprite_installed() - Install sprite CLI if needed
ensure_sprite_authenticated() - Check/prompt for auth
ensure_sprite_exists() - Create sprite if doesn't exist
verify_sprite_connectivity() - Test sprite connection
run_sprite() - Execute commands on sprite

Environment:

setup_shell_environment() - Configure PATH and zsh

OAuth:

get_openrouter_api_key_oauth() - OAuth with fallback
try_oauth_flow() - Attempt OAuth (can fail gracefully)
get_openrouter_api_key_manual() - Manual API key entry

Utilities:

open_browser() - Cross-platform browser launch

Failure Scenarios Handled

✅ Missing netcat (nc)
✅ Port already in use
✅ OAuth server startup failure
✅ OAuth timeout (2 minute default)
✅ OAuth code exchange failure
✅ No browser available
✅ User cancellation

Documentation

REFACTORING.md - Architecture overview and benefits
OAUTH_FALLBACK.md - Fallback mechanism guide
CURL_BASH_SOLUTION.md - Execution mode details
EXAMPLES.md - Real-world usage scenarios
CHANGELOG.md - Complete change history

Test Plan

Syntax validation: All scripts pass bash -n
Local execution: Scripts work when run locally
Remote execution: Test curl | bash after merge
OAuth success: Verify OAuth flow completes
OAuth fallback: Test with missing nc
Manual entry: Test API key validation

Breaking Changes

None - scripts maintain identical functionality and command-line interface.

Benefits

Maintainability: Common logic in one place
Reliability: Graceful degradation when OAuth fails
Extensibility: Future scripts can reuse all functions
User Experience: Works in more environments
Code Quality: DRY principle, better organization

🤖 Generated with Claude Code

Major refactoring to improve code maintainability and reliability: ## Shared Library Architecture - Created sprite/lib/common.sh with reusable bash functions - Reduced openclaw.sh from 258 to 93 lines (-64%) - Reduced claude.sh from 272 to 101 lines (-63%) - Eliminated ~330 lines of duplicate code ## OAuth Fallback Mechanism - Added automatic fallback to manual API key entry - Handles missing netcat (nc) gracefully - Handles port conflicts and timeouts - Validates API key format with override option - Works in headless and minimal environments ## Dual Execution Support - Local: bash sprite/openclaw.sh - Remote: curl URL | bash - Auto-detects context and sources library appropriately ## New Shared Functions - Logging: log_info(), log_warn(), log_error() - Sprite setup: ensure_sprite_installed/authenticated/exists() - Environment: setup_shell_environment() - OAuth: get_openrouter_api_key_oauth() with fallback - Utilities: run_sprite(), verify_sprite_connectivity() ## Documentation - REFACTORING.md - Architecture and benefits - OAUTH_FALLBACK.md - Fallback mechanism guide - CURL_BASH_SOLUTION.md - Execution mode details - EXAMPLES.md - Usage scenarios - CHANGELOG.md - Complete change history Co-Authored-By: Claude Sonnet 4.5 <noreply@anthropic.com>

Completed ENV_TEMP pattern extraction across remaining providers: 1. Modal: gptme.sh (1 script) - uses inject_env_vars_local 2. GCP: all 10 agent scripts - uses inject_env_vars_ssh 3. Fly.io: all 11 agent scripts - uses new inject_env_vars_fly - Added inject_env_vars_fly() to fly/lib/common.sh - Handles both .bashrc and .zshrc (Fly-specific requirement) 4. Sprite: amazonq, cline, gemini (3 scripts) - uses inject_env_vars_sprite Total scripts converted in this commit: 25 Total scripts converted in Round 25 Task #1: 78 scripts Each conversion replaces 11-15 lines of temp file management with a single function call that handles creation, permissions, content generation, upload, sourcing, and cleanup. The only remaining ENV_TEMP patterns are DOTENV_TEMP in nanoclaw scripts, which are agent-specific .env files and should remain as-is. Co-Authored-By: Claude Sonnet 4.5 <noreply@anthropic.com>

Add `spawn rerun [#]` to quickly relaunch a previous spawn by its history number. The list view now shows row numbers (#1, #2, ...) and relative timestamps ("2h ago", "3d ago") alongside absolute dates for better scannability. Partially addresses #492. Agent: ux-engineer Co-Authored-By: Claude Sonnet 4.5 <noreply@anthropic.com>

… parses (#3384) Reproduces with: any staged file matching the secret regex (e.g. a test fixture containing an OpenRouter / Anthropic / OpenAI key shape). The redact step ran: sed -i -E "s|${SECRET_REGEX}|${REDACT_PLACEHOLDER}|g" "$f" SECRET_REGEX is itself a `|`-separated alternation of provider patterns (`(sk-or-v1-...)|(sk-ant-api...)|(...)`). After bash expansion, sed sees multiple fields where it expected three, and bails with: sed: -e expression #1, char 67: unknown option to `s' The export then fails on the VM ("sprite exec failed (exit 1)") even though the user already approved the redaction in the host prompt. Fix: switch the sed delimiter to '#'. None of the regex tokens (provider prefixes, char classes, quantifiers, PEM marker) contain '#', and neither does the placeholder, so the substitution is unambiguous. '|' inside the pattern is now correctly interpreted by sed -E as alternation, which is what we wanted all along. Adds a regression test asserting the script uses 's#...#...#g' and not 's|...|...|g'. Bumps CLI 1.0.35 -> 1.0.36.

Numeric targets (target 140, cap 180) just become the new goal. The model will pad to hit them instead of writing a punchy 40-char banger. Remove all char-count anchors from the brevity guidance and let the good/bad examples carry the signal. - Rename section from 'BREVITY IS THE #1 RULE' to 'Keep it short' - Drop 80-140 target, 180 cap, char-count example annotations - Drop Chars line from output format and charCount from JSON - Keep only the qualitative rules: don't pad, don't explain twice, prefer one sentence, cut what isn't pulling weight - Platform 280 cap mentioned once as a ceiling, not a goal

#3390) * fix(growth): enforce brevity in tweet prompt (target ≤140, hard cap 180) Recent posted tweets were running 170-200 chars and reading as long-form marketing copy. Tighten the tweet drafting prompt: - Add a dedicated "BREVITY IS THE #1 RULE" section at the top - Target 80-140 chars, hard cap 180 chars (down from the 280 platform limit) - Good/bad length examples drawn from actual prior drafts - Require a trim pass before output - Update output format and rules to reflect the new caps * fix(growth): drop numeric char targets, lean on taste Numeric targets (target 140, cap 180) just become the new goal. The model will pad to hit them instead of writing a punchy 40-char banger. Remove all char-count anchors from the brevity guidance and let the good/bad examples carry the signal. - Rename section from 'BREVITY IS THE #1 RULE' to 'Keep it short' - Drop 80-140 target, 180 cap, char-count example annotations - Drop Chars line from output format and charCount from JSON - Keep only the qualitative rules: don't pad, don't explain twice, prefer one sentence, cut what isn't pulling weight - Platform 280 cap mentioned once as a ceiling, not a goal * fix(growth): strip all length references from tweet prompt Even mentioning '280 char limit' or 'platform limit' anchors the model to the wrong end of the range. Remove both remaining length references so the prompt is purely about taste: say less, don't pad, cut what isn't pulling weight. The platform enforces its own limit. - Drop the 'platform 280 char limit is a ceiling' paragraph - Drop 'Must fit in a tweet (under the platform limit)' from rules --------- Co-authored-by: Claude <claude@anthropic.com>

louisgv · 2026-02-07T04:06:36Z

Summary

Major refactoring to improve code maintainability, reliability, and user experience:

🏗️ Shared Library Architecture

Created sprite/lib/common.sh with 12 reusable bash functions
openclaw.sh: 258 lines → 93 lines (-64%)
claude.sh: 272 lines → 101 lines (-63%)
Total: Eliminated ~330 lines of duplicate code

🔄 OAuth Fallback Mechanism

Automatic fallback to manual API key entry when OAuth fails
Handles missing netcat (nc) gracefully
Handles port conflicts and OAuth timeouts
API key format validation with override option
Works in headless and minimal environments

🌐 Dual Execution Mode

Local: bash sprite/openclaw.sh
Remote: curl URL | bash
Auto-detects execution context and sources library appropriately

New Shared Functions

Logging:

log_info(), log_warn(), log_error()

Sprite Setup:

ensure_sprite_installed() - Install sprite CLI if needed
ensure_sprite_authenticated() - Check/prompt for auth
ensure_sprite_exists() - Create sprite if doesn't exist
verify_sprite_connectivity() - Test sprite connection
run_sprite() - Execute commands on sprite

Environment:

setup_shell_environment() - Configure PATH and zsh

OAuth:

get_openrouter_api_key_oauth() - OAuth with fallback
try_oauth_flow() - Attempt OAuth (can fail gracefully)
get_openrouter_api_key_manual() - Manual API key entry

Utilities:

open_browser() - Cross-platform browser launch

Failure Scenarios Handled

✅ Missing netcat (nc)
✅ Port already in use
✅ OAuth server startup failure
✅ OAuth timeout (2 minute default)
✅ OAuth code exchange failure
✅ No browser available
✅ User cancellation

Documentation

REFACTORING.md - Architecture overview and benefits
OAUTH_FALLBACK.md - Fallback mechanism guide
CURL_BASH_SOLUTION.md - Execution mode details
EXAMPLES.md - Real-world usage scenarios
CHANGELOG.md - Complete change history

Test Plan

Syntax validation: All scripts pass bash -n
Local execution: Scripts work when run locally
Remote execution: Test curl | bash after merge
OAuth success: Verify OAuth flow completes
OAuth fallback: Test with missing nc
Manual entry: Test API key validation

Breaking Changes

None - scripts maintain identical functionality and command-line interface.

Benefits

Maintainability: Common logic in one place
Reliability: Graceful degradation when OAuth fails
Extensibility: Future scripts can reuse all functions
User Experience: Works in more environments
Code Quality: DRY principle, better organization

🤖 Generated with Claude Code

Major refactoring to improve code maintainability and reliability: ## Shared Library Architecture - Created sprite/lib/common.sh with reusable bash functions - Reduced openclaw.sh from 258 to 93 lines (-64%) - Reduced claude.sh from 272 to 101 lines (-63%) - Eliminated ~330 lines of duplicate code ## OAuth Fallback Mechanism - Added automatic fallback to manual API key entry - Handles missing netcat (nc) gracefully - Handles port conflicts and timeouts - Validates API key format with override option - Works in headless and minimal environments ## Dual Execution Support - Local: bash sprite/openclaw.sh - Remote: curl URL | bash - Auto-detects context and sources library appropriately ## New Shared Functions - Logging: log_info(), log_warn(), log_error() - Sprite setup: ensure_sprite_installed/authenticated/exists() - Environment: setup_shell_environment() - OAuth: get_openrouter_api_key_oauth() with fallback - Utilities: run_sprite(), verify_sprite_connectivity() ## Documentation - REFACTORING.md - Architecture and benefits - OAUTH_FALLBACK.md - Fallback mechanism guide - CURL_BASH_SOLUTION.md - Execution mode details - EXAMPLES.md - Usage scenarios - CHANGELOG.md - Complete change history Co-Authored-By: Claude Sonnet 4.5 <noreply@anthropic.com>

Completed ENV_TEMP pattern extraction across remaining providers: 1. Modal: gptme.sh (1 script) - uses inject_env_vars_local 2. GCP: all 10 agent scripts - uses inject_env_vars_ssh 3. Fly.io: all 11 agent scripts - uses new inject_env_vars_fly - Added inject_env_vars_fly() to fly/lib/common.sh - Handles both .bashrc and .zshrc (Fly-specific requirement) 4. Sprite: amazonq, cline, gemini (3 scripts) - uses inject_env_vars_sprite Total scripts converted in this commit: 25 Total scripts converted in Round 25 Task #1: 78 scripts Each conversion replaces 11-15 lines of temp file management with a single function call that handles creation, permissions, content generation, upload, sourcing, and cleanup. The only remaining ENV_TEMP patterns are DOTENV_TEMP in nanoclaw scripts, which are agent-specific .env files and should remain as-is. Co-Authored-By: Claude Sonnet 4.5 <noreply@anthropic.com>

Add `spawn rerun [#]` to quickly relaunch a previous spawn by its history number. The list view now shows row numbers (#1, #2, ...) and relative timestamps ("2h ago", "3d ago") alongside absolute dates for better scannability. Partially addresses #492. Agent: ux-engineer Co-Authored-By: Claude Sonnet 4.5 <noreply@anthropic.com>

… parses (#3384) Reproduces with: any staged file matching the secret regex (e.g. a test fixture containing an OpenRouter / Anthropic / OpenAI key shape). The redact step ran: sed -i -E "s|${SECRET_REGEX}|${REDACT_PLACEHOLDER}|g" "$f" SECRET_REGEX is itself a `|`-separated alternation of provider patterns (`(sk-or-v1-...)|(sk-ant-api...)|(...)`). After bash expansion, sed sees multiple fields where it expected three, and bails with: sed: -e expression #1, char 67: unknown option to `s' The export then fails on the VM ("sprite exec failed (exit 1)") even though the user already approved the redaction in the host prompt. Fix: switch the sed delimiter to '#'. None of the regex tokens (provider prefixes, char classes, quantifiers, PEM marker) contain '#', and neither does the placeholder, so the substitution is unambiguous. '|' inside the pattern is now correctly interpreted by sed -E as alternation, which is what we wanted all along. Adds a regression test asserting the script uses 's#...#...#g' and not 's|...|...|g'. Bumps CLI 1.0.35 -> 1.0.36.

Numeric targets (target 140, cap 180) just become the new goal. The model will pad to hit them instead of writing a punchy 40-char banger. Remove all char-count anchors from the brevity guidance and let the good/bad examples carry the signal. - Rename section from 'BREVITY IS THE #1 RULE' to 'Keep it short' - Drop 80-140 target, 180 cap, char-count example annotations - Drop Chars line from output format and charCount from JSON - Keep only the qualitative rules: don't pad, don't explain twice, prefer one sentence, cut what isn't pulling weight - Platform 280 cap mentioned once as a ceiling, not a goal

#3390) * fix(growth): enforce brevity in tweet prompt (target ≤140, hard cap 180) Recent posted tweets were running 170-200 chars and reading as long-form marketing copy. Tighten the tweet drafting prompt: - Add a dedicated "BREVITY IS THE #1 RULE" section at the top - Target 80-140 chars, hard cap 180 chars (down from the 280 platform limit) - Good/bad length examples drawn from actual prior drafts - Require a trim pass before output - Update output format and rules to reflect the new caps * fix(growth): drop numeric char targets, lean on taste Numeric targets (target 140, cap 180) just become the new goal. The model will pad to hit them instead of writing a punchy 40-char banger. Remove all char-count anchors from the brevity guidance and let the good/bad examples carry the signal. - Rename section from 'BREVITY IS THE #1 RULE' to 'Keep it short' - Drop 80-140 target, 180 cap, char-count example annotations - Drop Chars line from output format and charCount from JSON - Keep only the qualitative rules: don't pad, don't explain twice, prefer one sentence, cut what isn't pulling weight - Platform 280 cap mentioned once as a ceiling, not a goal * fix(growth): strip all length references from tweet prompt Even mentioning '280 char limit' or 'platform limit' anchors the model to the wrong end of the range. Remove both remaining length references so the prompt is purely about taste: say less, don't pad, cut what isn't pulling weight. The platform enforces its own limit. - Drop the 'platform 280 char limit is a ceiling' paragraph - Drop 'Must fit in a tweet (under the platform limit)' from rules --------- Co-authored-by: Claude <claude@anthropic.com>

louisgv · 2026-02-07T04:06:36Z

Summary

Major refactoring to improve code maintainability, reliability, and user experience:

🏗️ Shared Library Architecture

Created sprite/lib/common.sh with 12 reusable bash functions
openclaw.sh: 258 lines → 93 lines (-64%)
claude.sh: 272 lines → 101 lines (-63%)
Total: Eliminated ~330 lines of duplicate code

🔄 OAuth Fallback Mechanism

Automatic fallback to manual API key entry when OAuth fails
Handles missing netcat (nc) gracefully
Handles port conflicts and OAuth timeouts
API key format validation with override option
Works in headless and minimal environments

🌐 Dual Execution Mode

Local: bash sprite/openclaw.sh
Remote: curl URL | bash
Auto-detects execution context and sources library appropriately

New Shared Functions

Logging:

log_info(), log_warn(), log_error()

Sprite Setup:

ensure_sprite_installed() - Install sprite CLI if needed
ensure_sprite_authenticated() - Check/prompt for auth
ensure_sprite_exists() - Create sprite if doesn't exist
verify_sprite_connectivity() - Test sprite connection
run_sprite() - Execute commands on sprite

Environment:

setup_shell_environment() - Configure PATH and zsh

OAuth:

get_openrouter_api_key_oauth() - OAuth with fallback
try_oauth_flow() - Attempt OAuth (can fail gracefully)
get_openrouter_api_key_manual() - Manual API key entry

Utilities:

open_browser() - Cross-platform browser launch

Failure Scenarios Handled

✅ Missing netcat (nc)
✅ Port already in use
✅ OAuth server startup failure
✅ OAuth timeout (2 minute default)
✅ OAuth code exchange failure
✅ No browser available
✅ User cancellation

Documentation

REFACTORING.md - Architecture overview and benefits
OAUTH_FALLBACK.md - Fallback mechanism guide
CURL_BASH_SOLUTION.md - Execution mode details
EXAMPLES.md - Real-world usage scenarios
CHANGELOG.md - Complete change history

Test Plan

Syntax validation: All scripts pass bash -n
Local execution: Scripts work when run locally
Remote execution: Test curl | bash after merge
OAuth success: Verify OAuth flow completes
OAuth fallback: Test with missing nc
Manual entry: Test API key validation

Breaking Changes

None - scripts maintain identical functionality and command-line interface.

Benefits

Maintainability: Common logic in one place
Reliability: Graceful degradation when OAuth fails
Extensibility: Future scripts can reuse all functions
User Experience: Works in more environments
Code Quality: DRY principle, better organization

🤖 Generated with Claude Code

Major refactoring to improve code maintainability and reliability: ## Shared Library Architecture - Created sprite/lib/common.sh with reusable bash functions - Reduced openclaw.sh from 258 to 93 lines (-64%) - Reduced claude.sh from 272 to 101 lines (-63%) - Eliminated ~330 lines of duplicate code ## OAuth Fallback Mechanism - Added automatic fallback to manual API key entry - Handles missing netcat (nc) gracefully - Handles port conflicts and timeouts - Validates API key format with override option - Works in headless and minimal environments ## Dual Execution Support - Local: bash sprite/openclaw.sh - Remote: curl URL | bash - Auto-detects context and sources library appropriately ## New Shared Functions - Logging: log_info(), log_warn(), log_error() - Sprite setup: ensure_sprite_installed/authenticated/exists() - Environment: setup_shell_environment() - OAuth: get_openrouter_api_key_oauth() with fallback - Utilities: run_sprite(), verify_sprite_connectivity() ## Documentation - REFACTORING.md - Architecture and benefits - OAUTH_FALLBACK.md - Fallback mechanism guide - CURL_BASH_SOLUTION.md - Execution mode details - EXAMPLES.md - Usage scenarios - CHANGELOG.md - Complete change history Co-Authored-By: Claude Sonnet 4.5 <noreply@anthropic.com>

Completed ENV_TEMP pattern extraction across remaining providers: 1. Modal: gptme.sh (1 script) - uses inject_env_vars_local 2. GCP: all 10 agent scripts - uses inject_env_vars_ssh 3. Fly.io: all 11 agent scripts - uses new inject_env_vars_fly - Added inject_env_vars_fly() to fly/lib/common.sh - Handles both .bashrc and .zshrc (Fly-specific requirement) 4. Sprite: amazonq, cline, gemini (3 scripts) - uses inject_env_vars_sprite Total scripts converted in this commit: 25 Total scripts converted in Round 25 Task #1: 78 scripts Each conversion replaces 11-15 lines of temp file management with a single function call that handles creation, permissions, content generation, upload, sourcing, and cleanup. The only remaining ENV_TEMP patterns are DOTENV_TEMP in nanoclaw scripts, which are agent-specific .env files and should remain as-is. Co-Authored-By: Claude Sonnet 4.5 <noreply@anthropic.com>

Add `spawn rerun [#]` to quickly relaunch a previous spawn by its history number. The list view now shows row numbers (#1, #2, ...) and relative timestamps ("2h ago", "3d ago") alongside absolute dates for better scannability. Partially addresses #492. Agent: ux-engineer Co-Authored-By: Claude Sonnet 4.5 <noreply@anthropic.com>

… parses (#3384) Reproduces with: any staged file matching the secret regex (e.g. a test fixture containing an OpenRouter / Anthropic / OpenAI key shape). The redact step ran: sed -i -E "s|${SECRET_REGEX}|${REDACT_PLACEHOLDER}|g" "$f" SECRET_REGEX is itself a `|`-separated alternation of provider patterns (`(sk-or-v1-...)|(sk-ant-api...)|(...)`). After bash expansion, sed sees multiple fields where it expected three, and bails with: sed: -e expression #1, char 67: unknown option to `s' The export then fails on the VM ("sprite exec failed (exit 1)") even though the user already approved the redaction in the host prompt. Fix: switch the sed delimiter to '#'. None of the regex tokens (provider prefixes, char classes, quantifiers, PEM marker) contain '#', and neither does the placeholder, so the substitution is unambiguous. '|' inside the pattern is now correctly interpreted by sed -E as alternation, which is what we wanted all along. Adds a regression test asserting the script uses 's#...#...#g' and not 's|...|...|g'. Bumps CLI 1.0.35 -> 1.0.36.

Numeric targets (target 140, cap 180) just become the new goal. The model will pad to hit them instead of writing a punchy 40-char banger. Remove all char-count anchors from the brevity guidance and let the good/bad examples carry the signal. - Rename section from 'BREVITY IS THE #1 RULE' to 'Keep it short' - Drop 80-140 target, 180 cap, char-count example annotations - Drop Chars line from output format and charCount from JSON - Keep only the qualitative rules: don't pad, don't explain twice, prefer one sentence, cut what isn't pulling weight - Platform 280 cap mentioned once as a ceiling, not a goal

#3390) * fix(growth): enforce brevity in tweet prompt (target ≤140, hard cap 180) Recent posted tweets were running 170-200 chars and reading as long-form marketing copy. Tighten the tweet drafting prompt: - Add a dedicated "BREVITY IS THE #1 RULE" section at the top - Target 80-140 chars, hard cap 180 chars (down from the 280 platform limit) - Good/bad length examples drawn from actual prior drafts - Require a trim pass before output - Update output format and rules to reflect the new caps * fix(growth): drop numeric char targets, lean on taste Numeric targets (target 140, cap 180) just become the new goal. The model will pad to hit them instead of writing a punchy 40-char banger. Remove all char-count anchors from the brevity guidance and let the good/bad examples carry the signal. - Rename section from 'BREVITY IS THE #1 RULE' to 'Keep it short' - Drop 80-140 target, 180 cap, char-count example annotations - Drop Chars line from output format and charCount from JSON - Keep only the qualitative rules: don't pad, don't explain twice, prefer one sentence, cut what isn't pulling weight - Platform 280 cap mentioned once as a ceiling, not a goal * fix(growth): strip all length references from tweet prompt Even mentioning '280 char limit' or 'platform limit' anchors the model to the wrong end of the range. Remove both remaining length references so the prompt is purely about taste: say less, don't pad, cut what isn't pulling weight. The platform enforces its own limit. - Drop the 'platform 280 char limit is a ceiling' paragraph - Drop 'Must fit in a tweet (under the platform limit)' from rules --------- Co-authored-by: Claude <claude@anthropic.com>

louisgv · 2026-02-07T04:06:36Z

Summary

Major refactoring to improve code maintainability, reliability, and user experience:

🏗️ Shared Library Architecture

Created sprite/lib/common.sh with 12 reusable bash functions
openclaw.sh: 258 lines → 93 lines (-64%)
claude.sh: 272 lines → 101 lines (-63%)
Total: Eliminated ~330 lines of duplicate code

🔄 OAuth Fallback Mechanism

Automatic fallback to manual API key entry when OAuth fails
Handles missing netcat (nc) gracefully
Handles port conflicts and OAuth timeouts
API key format validation with override option
Works in headless and minimal environments

🌐 Dual Execution Mode

Local: bash sprite/openclaw.sh
Remote: curl URL | bash
Auto-detects execution context and sources library appropriately

New Shared Functions

Logging:

log_info(), log_warn(), log_error()

Sprite Setup:

ensure_sprite_installed() - Install sprite CLI if needed
ensure_sprite_authenticated() - Check/prompt for auth
ensure_sprite_exists() - Create sprite if doesn't exist
verify_sprite_connectivity() - Test sprite connection
run_sprite() - Execute commands on sprite

Environment:

setup_shell_environment() - Configure PATH and zsh

OAuth:

get_openrouter_api_key_oauth() - OAuth with fallback
try_oauth_flow() - Attempt OAuth (can fail gracefully)
get_openrouter_api_key_manual() - Manual API key entry

Utilities:

open_browser() - Cross-platform browser launch

Failure Scenarios Handled

✅ Missing netcat (nc)
✅ Port already in use
✅ OAuth server startup failure
✅ OAuth timeout (2 minute default)
✅ OAuth code exchange failure
✅ No browser available
✅ User cancellation

Documentation

REFACTORING.md - Architecture overview and benefits
OAUTH_FALLBACK.md - Fallback mechanism guide
CURL_BASH_SOLUTION.md - Execution mode details
EXAMPLES.md - Real-world usage scenarios
CHANGELOG.md - Complete change history

Test Plan

Syntax validation: All scripts pass bash -n
Local execution: Scripts work when run locally
Remote execution: Test curl | bash after merge
OAuth success: Verify OAuth flow completes
OAuth fallback: Test with missing nc
Manual entry: Test API key validation

Breaking Changes

None - scripts maintain identical functionality and command-line interface.

Benefits

Maintainability: Common logic in one place
Reliability: Graceful degradation when OAuth fails
Extensibility: Future scripts can reuse all functions
User Experience: Works in more environments
Code Quality: DRY principle, better organization

🤖 Generated with Claude Code

Major refactoring to improve code maintainability and reliability: ## Shared Library Architecture - Created sprite/lib/common.sh with reusable bash functions - Reduced openclaw.sh from 258 to 93 lines (-64%) - Reduced claude.sh from 272 to 101 lines (-63%) - Eliminated ~330 lines of duplicate code ## OAuth Fallback Mechanism - Added automatic fallback to manual API key entry - Handles missing netcat (nc) gracefully - Handles port conflicts and timeouts - Validates API key format with override option - Works in headless and minimal environments ## Dual Execution Support - Local: bash sprite/openclaw.sh - Remote: curl URL | bash - Auto-detects context and sources library appropriately ## New Shared Functions - Logging: log_info(), log_warn(), log_error() - Sprite setup: ensure_sprite_installed/authenticated/exists() - Environment: setup_shell_environment() - OAuth: get_openrouter_api_key_oauth() with fallback - Utilities: run_sprite(), verify_sprite_connectivity() ## Documentation - REFACTORING.md - Architecture and benefits - OAUTH_FALLBACK.md - Fallback mechanism guide - CURL_BASH_SOLUTION.md - Execution mode details - EXAMPLES.md - Usage scenarios - CHANGELOG.md - Complete change history Co-Authored-By: Claude Sonnet 4.5 <noreply@anthropic.com>

Completed ENV_TEMP pattern extraction across remaining providers: 1. Modal: gptme.sh (1 script) - uses inject_env_vars_local 2. GCP: all 10 agent scripts - uses inject_env_vars_ssh 3. Fly.io: all 11 agent scripts - uses new inject_env_vars_fly - Added inject_env_vars_fly() to fly/lib/common.sh - Handles both .bashrc and .zshrc (Fly-specific requirement) 4. Sprite: amazonq, cline, gemini (3 scripts) - uses inject_env_vars_sprite Total scripts converted in this commit: 25 Total scripts converted in Round 25 Task #1: 78 scripts Each conversion replaces 11-15 lines of temp file management with a single function call that handles creation, permissions, content generation, upload, sourcing, and cleanup. The only remaining ENV_TEMP patterns are DOTENV_TEMP in nanoclaw scripts, which are agent-specific .env files and should remain as-is. Co-Authored-By: Claude Sonnet 4.5 <noreply@anthropic.com>

Add `spawn rerun [#]` to quickly relaunch a previous spawn by its history number. The list view now shows row numbers (#1, #2, ...) and relative timestamps ("2h ago", "3d ago") alongside absolute dates for better scannability. Partially addresses #492. Agent: ux-engineer Co-Authored-By: Claude Sonnet 4.5 <noreply@anthropic.com>

… parses (#3384) Reproduces with: any staged file matching the secret regex (e.g. a test fixture containing an OpenRouter / Anthropic / OpenAI key shape). The redact step ran: sed -i -E "s|${SECRET_REGEX}|${REDACT_PLACEHOLDER}|g" "$f" SECRET_REGEX is itself a `|`-separated alternation of provider patterns (`(sk-or-v1-...)|(sk-ant-api...)|(...)`). After bash expansion, sed sees multiple fields where it expected three, and bails with: sed: -e expression #1, char 67: unknown option to `s' The export then fails on the VM ("sprite exec failed (exit 1)") even though the user already approved the redaction in the host prompt. Fix: switch the sed delimiter to '#'. None of the regex tokens (provider prefixes, char classes, quantifiers, PEM marker) contain '#', and neither does the placeholder, so the substitution is unambiguous. '|' inside the pattern is now correctly interpreted by sed -E as alternation, which is what we wanted all along. Adds a regression test asserting the script uses 's#...#...#g' and not 's|...|...|g'. Bumps CLI 1.0.35 -> 1.0.36.

Numeric targets (target 140, cap 180) just become the new goal. The model will pad to hit them instead of writing a punchy 40-char banger. Remove all char-count anchors from the brevity guidance and let the good/bad examples carry the signal. - Rename section from 'BREVITY IS THE #1 RULE' to 'Keep it short' - Drop 80-140 target, 180 cap, char-count example annotations - Drop Chars line from output format and charCount from JSON - Keep only the qualitative rules: don't pad, don't explain twice, prefer one sentence, cut what isn't pulling weight - Platform 280 cap mentioned once as a ceiling, not a goal

#3390) * fix(growth): enforce brevity in tweet prompt (target ≤140, hard cap 180) Recent posted tweets were running 170-200 chars and reading as long-form marketing copy. Tighten the tweet drafting prompt: - Add a dedicated "BREVITY IS THE #1 RULE" section at the top - Target 80-140 chars, hard cap 180 chars (down from the 280 platform limit) - Good/bad length examples drawn from actual prior drafts - Require a trim pass before output - Update output format and rules to reflect the new caps * fix(growth): drop numeric char targets, lean on taste Numeric targets (target 140, cap 180) just become the new goal. The model will pad to hit them instead of writing a punchy 40-char banger. Remove all char-count anchors from the brevity guidance and let the good/bad examples carry the signal. - Rename section from 'BREVITY IS THE #1 RULE' to 'Keep it short' - Drop 80-140 target, 180 cap, char-count example annotations - Drop Chars line from output format and charCount from JSON - Keep only the qualitative rules: don't pad, don't explain twice, prefer one sentence, cut what isn't pulling weight - Platform 280 cap mentioned once as a ceiling, not a goal * fix(growth): strip all length references from tweet prompt Even mentioning '280 char limit' or 'platform limit' anchors the model to the wrong end of the range. Remove both remaining length references so the prompt is purely about taste: say less, don't pad, cut what isn't pulling weight. The platform enforces its own limit. - Drop the 'platform 280 char limit is a ceiling' paragraph - Drop 'Must fit in a tweet (under the platform limit)' from rules --------- Co-authored-by: Claude <claude@anthropic.com>

louisgv · 2026-02-07T04:06:36Z

Summary

Major refactoring to improve code maintainability, reliability, and user experience:

🏗️ Shared Library Architecture

Created sprite/lib/common.sh with 12 reusable bash functions
openclaw.sh: 258 lines → 93 lines (-64%)
claude.sh: 272 lines → 101 lines (-63%)
Total: Eliminated ~330 lines of duplicate code

🔄 OAuth Fallback Mechanism

Automatic fallback to manual API key entry when OAuth fails
Handles missing netcat (nc) gracefully
Handles port conflicts and OAuth timeouts
API key format validation with override option
Works in headless and minimal environments

🌐 Dual Execution Mode

Local: bash sprite/openclaw.sh
Remote: curl URL | bash
Auto-detects execution context and sources library appropriately

New Shared Functions

Logging:

log_info(), log_warn(), log_error()

Sprite Setup:

ensure_sprite_installed() - Install sprite CLI if needed
ensure_sprite_authenticated() - Check/prompt for auth
ensure_sprite_exists() - Create sprite if doesn't exist
verify_sprite_connectivity() - Test sprite connection
run_sprite() - Execute commands on sprite

Environment:

setup_shell_environment() - Configure PATH and zsh

OAuth:

get_openrouter_api_key_oauth() - OAuth with fallback
try_oauth_flow() - Attempt OAuth (can fail gracefully)
get_openrouter_api_key_manual() - Manual API key entry

Utilities:

open_browser() - Cross-platform browser launch

Failure Scenarios Handled

✅ Missing netcat (nc)
✅ Port already in use
✅ OAuth server startup failure
✅ OAuth timeout (2 minute default)
✅ OAuth code exchange failure
✅ No browser available
✅ User cancellation

Documentation

REFACTORING.md - Architecture overview and benefits
OAUTH_FALLBACK.md - Fallback mechanism guide
CURL_BASH_SOLUTION.md - Execution mode details
EXAMPLES.md - Real-world usage scenarios
CHANGELOG.md - Complete change history

Test Plan

Syntax validation: All scripts pass bash -n
Local execution: Scripts work when run locally
Remote execution: Test curl | bash after merge
OAuth success: Verify OAuth flow completes
OAuth fallback: Test with missing nc
Manual entry: Test API key validation

Breaking Changes

None - scripts maintain identical functionality and command-line interface.

Benefits

Maintainability: Common logic in one place
Reliability: Graceful degradation when OAuth fails
Extensibility: Future scripts can reuse all functions
User Experience: Works in more environments
Code Quality: DRY principle, better organization

🤖 Generated with Claude Code

Major refactoring to improve code maintainability and reliability: ## Shared Library Architecture - Created sprite/lib/common.sh with reusable bash functions - Reduced openclaw.sh from 258 to 93 lines (-64%) - Reduced claude.sh from 272 to 101 lines (-63%) - Eliminated ~330 lines of duplicate code ## OAuth Fallback Mechanism - Added automatic fallback to manual API key entry - Handles missing netcat (nc) gracefully - Handles port conflicts and timeouts - Validates API key format with override option - Works in headless and minimal environments ## Dual Execution Support - Local: bash sprite/openclaw.sh - Remote: curl URL | bash - Auto-detects context and sources library appropriately ## New Shared Functions - Logging: log_info(), log_warn(), log_error() - Sprite setup: ensure_sprite_installed/authenticated/exists() - Environment: setup_shell_environment() - OAuth: get_openrouter_api_key_oauth() with fallback - Utilities: run_sprite(), verify_sprite_connectivity() ## Documentation - REFACTORING.md - Architecture and benefits - OAUTH_FALLBACK.md - Fallback mechanism guide - CURL_BASH_SOLUTION.md - Execution mode details - EXAMPLES.md - Usage scenarios - CHANGELOG.md - Complete change history Co-Authored-By: Claude Sonnet 4.5 <noreply@anthropic.com>

Completed ENV_TEMP pattern extraction across remaining providers: 1. Modal: gptme.sh (1 script) - uses inject_env_vars_local 2. GCP: all 10 agent scripts - uses inject_env_vars_ssh 3. Fly.io: all 11 agent scripts - uses new inject_env_vars_fly - Added inject_env_vars_fly() to fly/lib/common.sh - Handles both .bashrc and .zshrc (Fly-specific requirement) 4. Sprite: amazonq, cline, gemini (3 scripts) - uses inject_env_vars_sprite Total scripts converted in this commit: 25 Total scripts converted in Round 25 Task #1: 78 scripts Each conversion replaces 11-15 lines of temp file management with a single function call that handles creation, permissions, content generation, upload, sourcing, and cleanup. The only remaining ENV_TEMP patterns are DOTENV_TEMP in nanoclaw scripts, which are agent-specific .env files and should remain as-is. Co-Authored-By: Claude Sonnet 4.5 <noreply@anthropic.com>

Add `spawn rerun [#]` to quickly relaunch a previous spawn by its history number. The list view now shows row numbers (#1, #2, ...) and relative timestamps ("2h ago", "3d ago") alongside absolute dates for better scannability. Partially addresses #492. Agent: ux-engineer Co-Authored-By: Claude Sonnet 4.5 <noreply@anthropic.com>

… parses (#3384) Reproduces with: any staged file matching the secret regex (e.g. a test fixture containing an OpenRouter / Anthropic / OpenAI key shape). The redact step ran: sed -i -E "s|${SECRET_REGEX}|${REDACT_PLACEHOLDER}|g" "$f" SECRET_REGEX is itself a `|`-separated alternation of provider patterns (`(sk-or-v1-...)|(sk-ant-api...)|(...)`). After bash expansion, sed sees multiple fields where it expected three, and bails with: sed: -e expression #1, char 67: unknown option to `s' The export then fails on the VM ("sprite exec failed (exit 1)") even though the user already approved the redaction in the host prompt. Fix: switch the sed delimiter to '#'. None of the regex tokens (provider prefixes, char classes, quantifiers, PEM marker) contain '#', and neither does the placeholder, so the substitution is unambiguous. '|' inside the pattern is now correctly interpreted by sed -E as alternation, which is what we wanted all along. Adds a regression test asserting the script uses 's#...#...#g' and not 's|...|...|g'. Bumps CLI 1.0.35 -> 1.0.36.

Numeric targets (target 140, cap 180) just become the new goal. The model will pad to hit them instead of writing a punchy 40-char banger. Remove all char-count anchors from the brevity guidance and let the good/bad examples carry the signal. - Rename section from 'BREVITY IS THE #1 RULE' to 'Keep it short' - Drop 80-140 target, 180 cap, char-count example annotations - Drop Chars line from output format and charCount from JSON - Keep only the qualitative rules: don't pad, don't explain twice, prefer one sentence, cut what isn't pulling weight - Platform 280 cap mentioned once as a ceiling, not a goal

#3390) * fix(growth): enforce brevity in tweet prompt (target ≤140, hard cap 180) Recent posted tweets were running 170-200 chars and reading as long-form marketing copy. Tighten the tweet drafting prompt: - Add a dedicated "BREVITY IS THE #1 RULE" section at the top - Target 80-140 chars, hard cap 180 chars (down from the 280 platform limit) - Good/bad length examples drawn from actual prior drafts - Require a trim pass before output - Update output format and rules to reflect the new caps * fix(growth): drop numeric char targets, lean on taste Numeric targets (target 140, cap 180) just become the new goal. The model will pad to hit them instead of writing a punchy 40-char banger. Remove all char-count anchors from the brevity guidance and let the good/bad examples carry the signal. - Rename section from 'BREVITY IS THE #1 RULE' to 'Keep it short' - Drop 80-140 target, 180 cap, char-count example annotations - Drop Chars line from output format and charCount from JSON - Keep only the qualitative rules: don't pad, don't explain twice, prefer one sentence, cut what isn't pulling weight - Platform 280 cap mentioned once as a ceiling, not a goal * fix(growth): strip all length references from tweet prompt Even mentioning '280 char limit' or 'platform limit' anchors the model to the wrong end of the range. Remove both remaining length references so the prompt is purely about taste: say less, don't pad, cut what isn't pulling weight. The platform enforces its own limit. - Drop the 'platform 280 char limit is a ceiling' paragraph - Drop 'Must fit in a tweet (under the platform limit)' from rules --------- Co-authored-by: Claude <claude@anthropic.com>

louisgv · 2026-02-07T04:06:36Z

Summary

Major refactoring to improve code maintainability, reliability, and user experience:

🏗️ Shared Library Architecture

Created sprite/lib/common.sh with 12 reusable bash functions
openclaw.sh: 258 lines → 93 lines (-64%)
claude.sh: 272 lines → 101 lines (-63%)
Total: Eliminated ~330 lines of duplicate code

🔄 OAuth Fallback Mechanism

Automatic fallback to manual API key entry when OAuth fails
Handles missing netcat (nc) gracefully
Handles port conflicts and OAuth timeouts
API key format validation with override option
Works in headless and minimal environments

🌐 Dual Execution Mode

Local: bash sprite/openclaw.sh
Remote: curl URL | bash
Auto-detects execution context and sources library appropriately

New Shared Functions

Logging:

log_info(), log_warn(), log_error()

Sprite Setup:

ensure_sprite_installed() - Install sprite CLI if needed
ensure_sprite_authenticated() - Check/prompt for auth
ensure_sprite_exists() - Create sprite if doesn't exist
verify_sprite_connectivity() - Test sprite connection
run_sprite() - Execute commands on sprite

Environment:

setup_shell_environment() - Configure PATH and zsh

OAuth:

get_openrouter_api_key_oauth() - OAuth with fallback
try_oauth_flow() - Attempt OAuth (can fail gracefully)
get_openrouter_api_key_manual() - Manual API key entry

Utilities:

open_browser() - Cross-platform browser launch

Failure Scenarios Handled

✅ Missing netcat (nc)
✅ Port already in use
✅ OAuth server startup failure
✅ OAuth timeout (2 minute default)
✅ OAuth code exchange failure
✅ No browser available
✅ User cancellation

Documentation

REFACTORING.md - Architecture overview and benefits
OAUTH_FALLBACK.md - Fallback mechanism guide
CURL_BASH_SOLUTION.md - Execution mode details
EXAMPLES.md - Real-world usage scenarios
CHANGELOG.md - Complete change history

Test Plan

Syntax validation: All scripts pass bash -n
Local execution: Scripts work when run locally
Remote execution: Test curl | bash after merge
OAuth success: Verify OAuth flow completes
OAuth fallback: Test with missing nc
Manual entry: Test API key validation

Breaking Changes

None - scripts maintain identical functionality and command-line interface.

Benefits

Maintainability: Common logic in one place
Reliability: Graceful degradation when OAuth fails
Extensibility: Future scripts can reuse all functions
User Experience: Works in more environments
Code Quality: DRY principle, better organization

🤖 Generated with Claude Code

Major refactoring to improve code maintainability and reliability: ## Shared Library Architecture - Created sprite/lib/common.sh with reusable bash functions - Reduced openclaw.sh from 258 to 93 lines (-64%) - Reduced claude.sh from 272 to 101 lines (-63%) - Eliminated ~330 lines of duplicate code ## OAuth Fallback Mechanism - Added automatic fallback to manual API key entry - Handles missing netcat (nc) gracefully - Handles port conflicts and timeouts - Validates API key format with override option - Works in headless and minimal environments ## Dual Execution Support - Local: bash sprite/openclaw.sh - Remote: curl URL | bash - Auto-detects context and sources library appropriately ## New Shared Functions - Logging: log_info(), log_warn(), log_error() - Sprite setup: ensure_sprite_installed/authenticated/exists() - Environment: setup_shell_environment() - OAuth: get_openrouter_api_key_oauth() with fallback - Utilities: run_sprite(), verify_sprite_connectivity() ## Documentation - REFACTORING.md - Architecture and benefits - OAUTH_FALLBACK.md - Fallback mechanism guide - CURL_BASH_SOLUTION.md - Execution mode details - EXAMPLES.md - Usage scenarios - CHANGELOG.md - Complete change history Co-Authored-By: Claude Sonnet 4.5 <noreply@anthropic.com>

Completed ENV_TEMP pattern extraction across remaining providers: 1. Modal: gptme.sh (1 script) - uses inject_env_vars_local 2. GCP: all 10 agent scripts - uses inject_env_vars_ssh 3. Fly.io: all 11 agent scripts - uses new inject_env_vars_fly - Added inject_env_vars_fly() to fly/lib/common.sh - Handles both .bashrc and .zshrc (Fly-specific requirement) 4. Sprite: amazonq, cline, gemini (3 scripts) - uses inject_env_vars_sprite Total scripts converted in this commit: 25 Total scripts converted in Round 25 Task #1: 78 scripts Each conversion replaces 11-15 lines of temp file management with a single function call that handles creation, permissions, content generation, upload, sourcing, and cleanup. The only remaining ENV_TEMP patterns are DOTENV_TEMP in nanoclaw scripts, which are agent-specific .env files and should remain as-is. Co-Authored-By: Claude Sonnet 4.5 <noreply@anthropic.com>

Add `spawn rerun [#]` to quickly relaunch a previous spawn by its history number. The list view now shows row numbers (#1, #2, ...) and relative timestamps ("2h ago", "3d ago") alongside absolute dates for better scannability. Partially addresses #492. Agent: ux-engineer Co-Authored-By: Claude Sonnet 4.5 <noreply@anthropic.com>

… parses (#3384) Reproduces with: any staged file matching the secret regex (e.g. a test fixture containing an OpenRouter / Anthropic / OpenAI key shape). The redact step ran: sed -i -E "s|${SECRET_REGEX}|${REDACT_PLACEHOLDER}|g" "$f" SECRET_REGEX is itself a `|`-separated alternation of provider patterns (`(sk-or-v1-...)|(sk-ant-api...)|(...)`). After bash expansion, sed sees multiple fields where it expected three, and bails with: sed: -e expression #1, char 67: unknown option to `s' The export then fails on the VM ("sprite exec failed (exit 1)") even though the user already approved the redaction in the host prompt. Fix: switch the sed delimiter to '#'. None of the regex tokens (provider prefixes, char classes, quantifiers, PEM marker) contain '#', and neither does the placeholder, so the substitution is unambiguous. '|' inside the pattern is now correctly interpreted by sed -E as alternation, which is what we wanted all along. Adds a regression test asserting the script uses 's#...#...#g' and not 's|...|...|g'. Bumps CLI 1.0.35 -> 1.0.36.

Numeric targets (target 140, cap 180) just become the new goal. The model will pad to hit them instead of writing a punchy 40-char banger. Remove all char-count anchors from the brevity guidance and let the good/bad examples carry the signal. - Rename section from 'BREVITY IS THE #1 RULE' to 'Keep it short' - Drop 80-140 target, 180 cap, char-count example annotations - Drop Chars line from output format and charCount from JSON - Keep only the qualitative rules: don't pad, don't explain twice, prefer one sentence, cut what isn't pulling weight - Platform 280 cap mentioned once as a ceiling, not a goal

#3390) * fix(growth): enforce brevity in tweet prompt (target ≤140, hard cap 180) Recent posted tweets were running 170-200 chars and reading as long-form marketing copy. Tighten the tweet drafting prompt: - Add a dedicated "BREVITY IS THE #1 RULE" section at the top - Target 80-140 chars, hard cap 180 chars (down from the 280 platform limit) - Good/bad length examples drawn from actual prior drafts - Require a trim pass before output - Update output format and rules to reflect the new caps * fix(growth): drop numeric char targets, lean on taste Numeric targets (target 140, cap 180) just become the new goal. The model will pad to hit them instead of writing a punchy 40-char banger. Remove all char-count anchors from the brevity guidance and let the good/bad examples carry the signal. - Rename section from 'BREVITY IS THE #1 RULE' to 'Keep it short' - Drop 80-140 target, 180 cap, char-count example annotations - Drop Chars line from output format and charCount from JSON - Keep only the qualitative rules: don't pad, don't explain twice, prefer one sentence, cut what isn't pulling weight - Platform 280 cap mentioned once as a ceiling, not a goal * fix(growth): strip all length references from tweet prompt Even mentioning '280 char limit' or 'platform limit' anchors the model to the wrong end of the range. Remove both remaining length references so the prompt is purely about taste: say less, don't pad, cut what isn't pulling weight. The platform enforces its own limit. - Drop the 'platform 280 char limit is a ceiling' paragraph - Drop 'Must fit in a tweet (under the platform limit)' from rules --------- Co-authored-by: Claude <claude@anthropic.com>

louisgv merged commit c0536e3 into mainFeb 7, 2026

louisgv deleted the refactor/shared-lib-oauth-fallback branch February 8, 2026 05:15

la14-1 mentioned this pull request Feb 11, 2026
feat: add spawn rerun command and relative timestamps in history #495
Closed
5 tasks

This was referenced Feb 14, 2026
feat: Add Codex CLI on HOSTKEY #1071
Merged
fix: HIGH severity security issues (command injection + weak VNC password) #1150
Merged

AhmedTMM mentioned this pull request Feb 18, 2026
fix: prevent SSH hangs, fix command escaping, pin Python 3.12 for aider #1439
Merged
5 tasks

louisgv mentioned this pull request Feb 19, 2026
fix: harden openclaw across all clouds #1456
Merged
6 tasks

la14-1 mentioned this pull request Feb 22, 2026
feat: convert sprite/ cloud provider from Bash to TypeScript #1692
Merged

louisgv mentioned this pull request Feb 24, 2026
[Bug]: AWS Lightsail must be manually enabled for new accounts — no guidance provided #1838
Closed

This was referenced Mar 9, 2026
[Bug]: OpenClaw commands not found after SSH reconnect + Ctrl+C kills instance instead of exiting agent #2394
Closed
fix(e2e): fix OPENROUTER_API_KEY fallback and sprite env whitelist #2491
Merged

This was referenced Mar 24, 2026
fix(security): prevent sed injection and integer overflow (fixes #2961, #2962) #2964
Merged
[Bug]: CI/CD supply chain hardening — pin GitHub Actions to commit SHAs, version-lock tools #2982
Closed

AhmedTMM mentioned this pull request May 2, 2026
fix(export): use '#' as sed delimiter (regex '|' was clashing) #3384
Merged
4 tasks

la14-1 mentioned this pull request May 4, 2026
fix(growth): emphasise brevity in tweet prompt (no numbers, no limits) #3390
Merged
3 tasks