fix: prevent SSH hangs, fix command escaping, pin Python 3.12 for aider

[AhmedTMM]

Summary

• Fix SSH stdin theft — add < /dev/null to ssh_run_server and generic_ssh_wait so sequential SSH calls don't steal stdin from the parent script, which was the Refactor spawn scripts with shared library and OAuth fallback #1 cause of agent install hangs on SSH-based clouds (Hetzner, AWS, DigitalOcean, GCP, OVH)
• Add SSH keepalive — add ServerAliveInterval=15, ServerAliveCountMax=3, ConnectTimeout=10 to default SSH_OPTS to prevent silent connection drops during long-running installs
• Restore Fly.io stderr — remove 2>/dev/null from Fly.io run_server so remote command errors are visible instead of silently swallowed
• Fix Fly.io command escaping — remove extra double-quotes around $escaped_cmd in run_server and interactive_session that broke &&, ||, | operators
• Fix Daytona command escaping — remove broken printf '%q' from run_server and interactive_session where it escaped shell operators into literal characters (no intermediate shell layer to consume the escapes)
• Pin aider to Python 3.12 — replace --with audioop-lts with --python 3.12 across all 9 clouds, letting uv use Python 3.12 which still has the audioop module built in

Test plan

• bash -n syntax check on all 12 modified files
• bash test/mock.sh — 270 tests, same pass rate as baseline (pre-existing flaky timeouts unrelated to changes)
• Manual test: spawn aider fly — verify aider installs and launches without hanging
• Manual test: spawn claude hetzner — verify SSH session doesn't hang during install
• Verify Daytona multi-part commands (&& chains) work correctly after printf '%q' removal

🤖 Generated with Claude Code

[louisgv]

Security Review

Verdict: APPROVED
Commit: bc2e480

Summary

This PR fixes SSH hangs and pins aider to Python 3.12. The command escaping changes are architecturally correct for each provider's exec model.

Findings

MEDIUM — fly/lib/common.sh:384,389,422 — Removed double quotes around escaped commands

• Technically creates word-splitting risk, but all callers pass hardcoded trusted strings
• No user input flows into run_server() or interactive_session()
• Risk mitigated by hardcoded command construction pattern throughout codebase

LOW — daytona/lib/common.sh:218,248 — Removed printf '%q' escaping

• Architecturally correct for Daytona's exec ... bash -c model
• Shell operators must remain unescaped to function properly
• All callers verified to pass trusted hardcoded commands only

POSITIVE — shared/common.sh:2169,2221 — Added < /dev/null to SSH calls

• Prevents SSH from consuming parent script's stdin
• Fixes hangs when sequential SSH calls steal input from later prompts
• Good defensive practice

Tests

• bash -n: PASS (all modified .sh files)
• test suite: PASS (80/80 tests passed)
• curl|bash compatibility: OK (source fallback pattern unchanged)
• macOS bash 3.x compat: OK (no bash 4+ features introduced)

Recommendation

The removal of command escaping is safe under the current architecture where all commands are hardcoded. Future code must maintain this invariant — any user input MUST go through validation (model IDs, paths) before command construction.

The PR includes excellent inline documentation explaining WHY escaping was removed, which will help prevent future regressions.

---

-- security/pr-reviewer

[AhmedTMM]

Summary

• Fix SSH stdin theft — add < /dev/null to ssh_run_server and generic_ssh_wait so sequential SSH calls don't steal stdin from the parent script, which was the Refactor spawn scripts with shared library and OAuth fallback #1 cause of agent install hangs on SSH-based clouds (Hetzner, AWS, DigitalOcean, GCP, OVH)
• Add SSH keepalive — add ServerAliveInterval=15, ServerAliveCountMax=3, ConnectTimeout=10 to default SSH_OPTS to prevent silent connection drops during long-running installs
• Restore Fly.io stderr — remove 2>/dev/null from Fly.io run_server so remote command errors are visible instead of silently swallowed
• Fix Fly.io command escaping — remove extra double-quotes around $escaped_cmd in run_server and interactive_session that broke &&, ||, | operators
• Fix Daytona command escaping — remove broken printf '%q' from run_server and interactive_session where it escaped shell operators into literal characters (no intermediate shell layer to consume the escapes)
• Pin aider to Python 3.12 — replace --with audioop-lts with --python 3.12 across all 9 clouds, letting uv use Python 3.12 which still has the audioop module built in

Test plan

• bash -n syntax check on all 12 modified files
• bash test/mock.sh — 270 tests, same pass rate as baseline (pre-existing flaky timeouts unrelated to changes)
• Manual test: spawn aider fly — verify aider installs and launches without hanging
• Manual test: spawn claude hetzner — verify SSH session doesn't hang during install
• Verify Daytona multi-part commands (&& chains) work correctly after printf '%q' removal

🤖 Generated with Claude Code

[louisgv]

Security Review

Verdict: APPROVED
Commit: bc2e480

Summary

This PR fixes SSH hangs and pins aider to Python 3.12. The command escaping changes are architecturally correct for each provider's exec model.

Findings

MEDIUM — fly/lib/common.sh:384,389,422 — Removed double quotes around escaped commands

• Technically creates word-splitting risk, but all callers pass hardcoded trusted strings
• No user input flows into run_server() or interactive_session()
• Risk mitigated by hardcoded command construction pattern throughout codebase

LOW — daytona/lib/common.sh:218,248 — Removed printf '%q' escaping

• Architecturally correct for Daytona's exec ... bash -c model
• Shell operators must remain unescaped to function properly
• All callers verified to pass trusted hardcoded commands only

POSITIVE — shared/common.sh:2169,2221 — Added < /dev/null to SSH calls

• Prevents SSH from consuming parent script's stdin
• Fixes hangs when sequential SSH calls steal input from later prompts
• Good defensive practice

Tests

• bash -n: PASS (all modified .sh files)
• test suite: PASS (80/80 tests passed)
• curl|bash compatibility: OK (source fallback pattern unchanged)
• macOS bash 3.x compat: OK (no bash 4+ features introduced)

Recommendation

The removal of command escaping is safe under the current architecture where all commands are hardcoded. Future code must maintain this invariant — any user input MUST go through validation (model IDs, paths) before command construction.

The PR includes excellent inline documentation explaining WHY escaping was removed, which will help prevent future regressions.

---

-- security/pr-reviewer

[AhmedTMM]

Summary

• Fix SSH stdin theft — add < /dev/null to ssh_run_server and generic_ssh_wait so sequential SSH calls don't steal stdin from the parent script, which was the Refactor spawn scripts with shared library and OAuth fallback #1 cause of agent install hangs on SSH-based clouds (Hetzner, AWS, DigitalOcean, GCP, OVH)
• Add SSH keepalive — add ServerAliveInterval=15, ServerAliveCountMax=3, ConnectTimeout=10 to default SSH_OPTS to prevent silent connection drops during long-running installs
• Restore Fly.io stderr — remove 2>/dev/null from Fly.io run_server so remote command errors are visible instead of silently swallowed
• Fix Fly.io command escaping — remove extra double-quotes around $escaped_cmd in run_server and interactive_session that broke &&, ||, | operators
• Fix Daytona command escaping — remove broken printf '%q' from run_server and interactive_session where it escaped shell operators into literal characters (no intermediate shell layer to consume the escapes)
• Pin aider to Python 3.12 — replace --with audioop-lts with --python 3.12 across all 9 clouds, letting uv use Python 3.12 which still has the audioop module built in

Test plan

• bash -n syntax check on all 12 modified files
• bash test/mock.sh — 270 tests, same pass rate as baseline (pre-existing flaky timeouts unrelated to changes)
• Manual test: spawn aider fly — verify aider installs and launches without hanging
• Manual test: spawn claude hetzner — verify SSH session doesn't hang during install
• Verify Daytona multi-part commands (&& chains) work correctly after printf '%q' removal

🤖 Generated with Claude Code

[louisgv]

Security Review

Verdict: APPROVED
Commit: bc2e480

Summary

This PR fixes SSH hangs and pins aider to Python 3.12. The command escaping changes are architecturally correct for each provider's exec model.

Findings

MEDIUM — fly/lib/common.sh:384,389,422 — Removed double quotes around escaped commands

• Technically creates word-splitting risk, but all callers pass hardcoded trusted strings
• No user input flows into run_server() or interactive_session()
• Risk mitigated by hardcoded command construction pattern throughout codebase

LOW — daytona/lib/common.sh:218,248 — Removed printf '%q' escaping

• Architecturally correct for Daytona's exec ... bash -c model
• Shell operators must remain unescaped to function properly
• All callers verified to pass trusted hardcoded commands only

POSITIVE — shared/common.sh:2169,2221 — Added < /dev/null to SSH calls

• Prevents SSH from consuming parent script's stdin
• Fixes hangs when sequential SSH calls steal input from later prompts
• Good defensive practice

Tests

• bash -n: PASS (all modified .sh files)
• test suite: PASS (80/80 tests passed)
• curl|bash compatibility: OK (source fallback pattern unchanged)
• macOS bash 3.x compat: OK (no bash 4+ features introduced)

Recommendation

The removal of command escaping is safe under the current architecture where all commands are hardcoded. Future code must maintain this invariant — any user input MUST go through validation (model IDs, paths) before command construction.

The PR includes excellent inline documentation explaining WHY escaping was removed, which will help prevent future regressions.

---

-- security/pr-reviewer

[AhmedTMM]

Summary

• Fix SSH stdin theft — add < /dev/null to ssh_run_server and generic_ssh_wait so sequential SSH calls don't steal stdin from the parent script, which was the Refactor spawn scripts with shared library and OAuth fallback #1 cause of agent install hangs on SSH-based clouds (Hetzner, AWS, DigitalOcean, GCP, OVH)
• Add SSH keepalive — add ServerAliveInterval=15, ServerAliveCountMax=3, ConnectTimeout=10 to default SSH_OPTS to prevent silent connection drops during long-running installs
• Restore Fly.io stderr — remove 2>/dev/null from Fly.io run_server so remote command errors are visible instead of silently swallowed
• Fix Fly.io command escaping — remove extra double-quotes around $escaped_cmd in run_server and interactive_session that broke &&, ||, | operators
• Fix Daytona command escaping — remove broken printf '%q' from run_server and interactive_session where it escaped shell operators into literal characters (no intermediate shell layer to consume the escapes)
• Pin aider to Python 3.12 — replace --with audioop-lts with --python 3.12 across all 9 clouds, letting uv use Python 3.12 which still has the audioop module built in

Test plan

• bash -n syntax check on all 12 modified files
• bash test/mock.sh — 270 tests, same pass rate as baseline (pre-existing flaky timeouts unrelated to changes)
• Manual test: spawn aider fly — verify aider installs and launches without hanging
• Manual test: spawn claude hetzner — verify SSH session doesn't hang during install
• Verify Daytona multi-part commands (&& chains) work correctly after printf '%q' removal

🤖 Generated with Claude Code

[louisgv]

Security Review

Verdict: APPROVED
Commit: bc2e480

Summary

This PR fixes SSH hangs and pins aider to Python 3.12. The command escaping changes are architecturally correct for each provider's exec model.

Findings

MEDIUM — fly/lib/common.sh:384,389,422 — Removed double quotes around escaped commands

• Technically creates word-splitting risk, but all callers pass hardcoded trusted strings
• No user input flows into run_server() or interactive_session()
• Risk mitigated by hardcoded command construction pattern throughout codebase

LOW — daytona/lib/common.sh:218,248 — Removed printf '%q' escaping

• Architecturally correct for Daytona's exec ... bash -c model
• Shell operators must remain unescaped to function properly
• All callers verified to pass trusted hardcoded commands only

POSITIVE — shared/common.sh:2169,2221 — Added < /dev/null to SSH calls

• Prevents SSH from consuming parent script's stdin
• Fixes hangs when sequential SSH calls steal input from later prompts
• Good defensive practice

Tests

• bash -n: PASS (all modified .sh files)
• test suite: PASS (80/80 tests passed)
• curl|bash compatibility: OK (source fallback pattern unchanged)
• macOS bash 3.x compat: OK (no bash 4+ features introduced)

Recommendation

The removal of command escaping is safe under the current architecture where all commands are hardcoded. Future code must maintain this invariant — any user input MUST go through validation (model IDs, paths) before command construction.

The PR includes excellent inline documentation explaining WHY escaping was removed, which will help prevent future regressions.

---

-- security/pr-reviewer

[AhmedTMM]

Summary

• Fix SSH stdin theft — add < /dev/null to ssh_run_server and generic_ssh_wait so sequential SSH calls don't steal stdin from the parent script, which was the Refactor spawn scripts with shared library and OAuth fallback #1 cause of agent install hangs on SSH-based clouds (Hetzner, AWS, DigitalOcean, GCP, OVH)
• Add SSH keepalive — add ServerAliveInterval=15, ServerAliveCountMax=3, ConnectTimeout=10 to default SSH_OPTS to prevent silent connection drops during long-running installs
• Restore Fly.io stderr — remove 2>/dev/null from Fly.io run_server so remote command errors are visible instead of silently swallowed
• Fix Fly.io command escaping — remove extra double-quotes around $escaped_cmd in run_server and interactive_session that broke &&, ||, | operators
• Fix Daytona command escaping — remove broken printf '%q' from run_server and interactive_session where it escaped shell operators into literal characters (no intermediate shell layer to consume the escapes)
• Pin aider to Python 3.12 — replace --with audioop-lts with --python 3.12 across all 9 clouds, letting uv use Python 3.12 which still has the audioop module built in

Test plan

• bash -n syntax check on all 12 modified files
• bash test/mock.sh — 270 tests, same pass rate as baseline (pre-existing flaky timeouts unrelated to changes)
• Manual test: spawn aider fly — verify aider installs and launches without hanging
• Manual test: spawn claude hetzner — verify SSH session doesn't hang during install
• Verify Daytona multi-part commands (&& chains) work correctly after printf '%q' removal

🤖 Generated with Claude Code

[louisgv]

Security Review

Verdict: APPROVED
Commit: bc2e480

Summary

This PR fixes SSH hangs and pins aider to Python 3.12. The command escaping changes are architecturally correct for each provider's exec model.

Findings

MEDIUM — fly/lib/common.sh:384,389,422 — Removed double quotes around escaped commands

• Technically creates word-splitting risk, but all callers pass hardcoded trusted strings
• No user input flows into run_server() or interactive_session()
• Risk mitigated by hardcoded command construction pattern throughout codebase

LOW — daytona/lib/common.sh:218,248 — Removed printf '%q' escaping

• Architecturally correct for Daytona's exec ... bash -c model
• Shell operators must remain unescaped to function properly
• All callers verified to pass trusted hardcoded commands only

POSITIVE — shared/common.sh:2169,2221 — Added < /dev/null to SSH calls

• Prevents SSH from consuming parent script's stdin
• Fixes hangs when sequential SSH calls steal input from later prompts
• Good defensive practice

Tests

• bash -n: PASS (all modified .sh files)
• test suite: PASS (80/80 tests passed)
• curl|bash compatibility: OK (source fallback pattern unchanged)
• macOS bash 3.x compat: OK (no bash 4+ features introduced)

Recommendation

The removal of command escaping is safe under the current architecture where all commands are hardcoded. Future code must maintain this invariant — any user input MUST go through validation (model IDs, paths) before command construction.

The PR includes excellent inline documentation explaining WHY escaping was removed, which will help prevent future regressions.

---

-- security/pr-reviewer

[AhmedTMM]

Summary

• Fix SSH stdin theft — add < /dev/null to ssh_run_server and generic_ssh_wait so sequential SSH calls don't steal stdin from the parent script, which was the Refactor spawn scripts with shared library and OAuth fallback #1 cause of agent install hangs on SSH-based clouds (Hetzner, AWS, DigitalOcean, GCP, OVH)
• Add SSH keepalive — add ServerAliveInterval=15, ServerAliveCountMax=3, ConnectTimeout=10 to default SSH_OPTS to prevent silent connection drops during long-running installs
• Restore Fly.io stderr — remove 2>/dev/null from Fly.io run_server so remote command errors are visible instead of silently swallowed
• Fix Fly.io command escaping — remove extra double-quotes around $escaped_cmd in run_server and interactive_session that broke &&, ||, | operators
• Fix Daytona command escaping — remove broken printf '%q' from run_server and interactive_session where it escaped shell operators into literal characters (no intermediate shell layer to consume the escapes)
• Pin aider to Python 3.12 — replace --with audioop-lts with --python 3.12 across all 9 clouds, letting uv use Python 3.12 which still has the audioop module built in

Test plan

• bash -n syntax check on all 12 modified files
• bash test/mock.sh — 270 tests, same pass rate as baseline (pre-existing flaky timeouts unrelated to changes)
• Manual test: spawn aider fly — verify aider installs and launches without hanging
• Manual test: spawn claude hetzner — verify SSH session doesn't hang during install
• Verify Daytona multi-part commands (&& chains) work correctly after printf '%q' removal

🤖 Generated with Claude Code

[louisgv]

Security Review

Verdict: APPROVED
Commit: bc2e480

Summary

This PR fixes SSH hangs and pins aider to Python 3.12. The command escaping changes are architecturally correct for each provider's exec model.

Findings

MEDIUM — fly/lib/common.sh:384,389,422 — Removed double quotes around escaped commands

• Technically creates word-splitting risk, but all callers pass hardcoded trusted strings
• No user input flows into run_server() or interactive_session()
• Risk mitigated by hardcoded command construction pattern throughout codebase

LOW — daytona/lib/common.sh:218,248 — Removed printf '%q' escaping

• Architecturally correct for Daytona's exec ... bash -c model
• Shell operators must remain unescaped to function properly
• All callers verified to pass trusted hardcoded commands only

POSITIVE — shared/common.sh:2169,2221 — Added < /dev/null to SSH calls

• Prevents SSH from consuming parent script's stdin
• Fixes hangs when sequential SSH calls steal input from later prompts
• Good defensive practice

Tests

• bash -n: PASS (all modified .sh files)
• test suite: PASS (80/80 tests passed)
• curl|bash compatibility: OK (source fallback pattern unchanged)
• macOS bash 3.x compat: OK (no bash 4+ features introduced)

Recommendation

The removal of command escaping is safe under the current architecture where all commands are hardcoded. Future code must maintain this invariant — any user input MUST go through validation (model IDs, paths) before command construction.

The PR includes excellent inline documentation explaining WHY escaping was removed, which will help prevent future regressions.

---

-- security/pr-reviewer

[AhmedTMM]

Summary

• Fix SSH stdin theft — add < /dev/null to ssh_run_server and generic_ssh_wait so sequential SSH calls don't steal stdin from the parent script, which was the Refactor spawn scripts with shared library and OAuth fallback #1 cause of agent install hangs on SSH-based clouds (Hetzner, AWS, DigitalOcean, GCP, OVH)
• Add SSH keepalive — add ServerAliveInterval=15, ServerAliveCountMax=3, ConnectTimeout=10 to default SSH_OPTS to prevent silent connection drops during long-running installs
• Restore Fly.io stderr — remove 2>/dev/null from Fly.io run_server so remote command errors are visible instead of silently swallowed
• Fix Fly.io command escaping — remove extra double-quotes around $escaped_cmd in run_server and interactive_session that broke &&, ||, | operators
• Fix Daytona command escaping — remove broken printf '%q' from run_server and interactive_session where it escaped shell operators into literal characters (no intermediate shell layer to consume the escapes)
• Pin aider to Python 3.12 — replace --with audioop-lts with --python 3.12 across all 9 clouds, letting uv use Python 3.12 which still has the audioop module built in

Test plan

• bash -n syntax check on all 12 modified files
• bash test/mock.sh — 270 tests, same pass rate as baseline (pre-existing flaky timeouts unrelated to changes)
• Manual test: spawn aider fly — verify aider installs and launches without hanging
• Manual test: spawn claude hetzner — verify SSH session doesn't hang during install
• Verify Daytona multi-part commands (&& chains) work correctly after printf '%q' removal

🤖 Generated with Claude Code

[louisgv]

Security Review

Verdict: APPROVED
Commit: bc2e480

Summary

This PR fixes SSH hangs and pins aider to Python 3.12. The command escaping changes are architecturally correct for each provider's exec model.

Findings

MEDIUM — fly/lib/common.sh:384,389,422 — Removed double quotes around escaped commands

• Technically creates word-splitting risk, but all callers pass hardcoded trusted strings
• No user input flows into run_server() or interactive_session()
• Risk mitigated by hardcoded command construction pattern throughout codebase

LOW — daytona/lib/common.sh:218,248 — Removed printf '%q' escaping

• Architecturally correct for Daytona's exec ... bash -c model
• Shell operators must remain unescaped to function properly
• All callers verified to pass trusted hardcoded commands only

POSITIVE — shared/common.sh:2169,2221 — Added < /dev/null to SSH calls

• Prevents SSH from consuming parent script's stdin
• Fixes hangs when sequential SSH calls steal input from later prompts
• Good defensive practice

Tests

• bash -n: PASS (all modified .sh files)
• test suite: PASS (80/80 tests passed)
• curl|bash compatibility: OK (source fallback pattern unchanged)
• macOS bash 3.x compat: OK (no bash 4+ features introduced)

Recommendation

The removal of command escaping is safe under the current architecture where all commands are hardcoded. Future code must maintain this invariant — any user input MUST go through validation (model IDs, paths) before command construction.

The PR includes excellent inline documentation explaining WHY escaping was removed, which will help prevent future regressions.

---

-- security/pr-reviewer

[AhmedTMM]

Summary

• Fix SSH stdin theft — add < /dev/null to ssh_run_server and generic_ssh_wait so sequential SSH calls don't steal stdin from the parent script, which was the Refactor spawn scripts with shared library and OAuth fallback #1 cause of agent install hangs on SSH-based clouds (Hetzner, AWS, DigitalOcean, GCP, OVH)
• Add SSH keepalive — add ServerAliveInterval=15, ServerAliveCountMax=3, ConnectTimeout=10 to default SSH_OPTS to prevent silent connection drops during long-running installs
• Restore Fly.io stderr — remove 2>/dev/null from Fly.io run_server so remote command errors are visible instead of silently swallowed
• Fix Fly.io command escaping — remove extra double-quotes around $escaped_cmd in run_server and interactive_session that broke &&, ||, | operators
• Fix Daytona command escaping — remove broken printf '%q' from run_server and interactive_session where it escaped shell operators into literal characters (no intermediate shell layer to consume the escapes)
• Pin aider to Python 3.12 — replace --with audioop-lts with --python 3.12 across all 9 clouds, letting uv use Python 3.12 which still has the audioop module built in

Test plan

• bash -n syntax check on all 12 modified files
• bash test/mock.sh — 270 tests, same pass rate as baseline (pre-existing flaky timeouts unrelated to changes)
• Manual test: spawn aider fly — verify aider installs and launches without hanging
• Manual test: spawn claude hetzner — verify SSH session doesn't hang during install
• Verify Daytona multi-part commands (&& chains) work correctly after printf '%q' removal

🤖 Generated with Claude Code

[louisgv]

Security Review

Verdict: APPROVED
Commit: bc2e480

Summary

This PR fixes SSH hangs and pins aider to Python 3.12. The command escaping changes are architecturally correct for each provider's exec model.

Findings

MEDIUM — fly/lib/common.sh:384,389,422 — Removed double quotes around escaped commands

• Technically creates word-splitting risk, but all callers pass hardcoded trusted strings
• No user input flows into run_server() or interactive_session()
• Risk mitigated by hardcoded command construction pattern throughout codebase

LOW — daytona/lib/common.sh:218,248 — Removed printf '%q' escaping

• Architecturally correct for Daytona's exec ... bash -c model
• Shell operators must remain unescaped to function properly
• All callers verified to pass trusted hardcoded commands only

POSITIVE — shared/common.sh:2169,2221 — Added < /dev/null to SSH calls

• Prevents SSH from consuming parent script's stdin
• Fixes hangs when sequential SSH calls steal input from later prompts
• Good defensive practice

Tests

• bash -n: PASS (all modified .sh files)
• test suite: PASS (80/80 tests passed)
• curl|bash compatibility: OK (source fallback pattern unchanged)
• macOS bash 3.x compat: OK (no bash 4+ features introduced)

Recommendation

The removal of command escaping is safe under the current architecture where all commands are hardcoded. Future code must maintain this invariant — any user input MUST go through validation (model IDs, paths) before command construction.

The PR includes excellent inline documentation explaining WHY escaping was removed, which will help prevent future regressions.

---

-- security/pr-reviewer