fix: install_agent double-escaping + github-auth reliability

[AhmedTMM]

Summary

• Remove double-escaping in install_agent — printf '%q' + bash -c was applied in install_agent(), then again by each cloud's run_server. This turned &&, ||, > into literal characters, making source treat the entire command as a filename. All agent installs with compound commands were broken.
• Use local github-auth.sh when running from a checkout — instead of always curling from main, base64-encode the local copy and send it inline. Fixes like the sudo-skip-for-root now take effect immediately without waiting for a merge.
• Handle github-auth errors gracefully — gh setup is optional; failures now log a warning instead of terminating the spawn session.

Test plan

• bash -n shared/common.sh passes
• bash test/mock.sh — 269/270 pass (1 pre-existing flaky timeout)
• Verified install_agent no longer wraps commands in printf '%q' + bash -c
• Verified offer_github_auth guards run_callback with || log_warn

🤖 Generated with Claude Code

[louisgv]

Security Review

Verdict: APPROVED
Commit: 5a3ca68

Summary

This PR improves reliability and error handling across all cloud providers with no security regressions. All critical security patterns remain intact.

Findings

NONE - No security issues identified.

Security Analysis

✅ PASSED - API Key Validation

• Lines 315-335, 339-368: New verify_openrouter_key() and verify_openrouter_model() functions add defense-in-depth
• Proper timeout handling (5-10s connect/max-time)
• Graceful degradation (network errors don't block)
• No credential leakage in error messages

✅ PASSED - GitHub Token Handling

• Lines 1344-1356: Base64 encoding of local github-auth.sh for safe inline transport
• printf '%q' escaping still used for SPAWN_GITHUB_TOKEN (line 1354)
• No token exposure in command construction
• Base64 decode pattern is safe: printf '%s' '${_gh_b64}' | base64 -d | bash

✅ PASSED - Command Injection Protection

• Lines 1448-1459: install_agent() comment correctly documents why double-escaping was removed
• The raw command is passed to cloud callbacks which already handle remote transport escaping
• Shell operators (&&, ||, >, |) work correctly in install commands
• No new injection vectors introduced

✅ PASSED - Sudo Handling in github-auth.sh

• Lines 52-74: Proper root check before using sudo (id -u)
• Prevents unnecessary privilege escalation in rootful containers (Fly.io)
• Maintains security in rootless environments

✅ PASSED - Error Handling

• Lines 1693-1694, 1708, 1739-1741: Non-fatal failures use || log_warn or || true
• Critical operations (install_agent, cloud_provision) still fatal on failure
• No security-critical operations silently ignored

✅ PASSED - OpenClaw Gateway

• All openclaw.sh files: Added </dev/null & disown to prevent stdin blocking
• Gateway token generation unchanged (still secure random via openssl rand -hex 16)
• Config file permissions unchanged (still 600 via mktemp defaults)

✅ PASSED - Temp File Security

• Lines 1616-1619, 1680-1683: Unpredictable temp file names still used (/tmp/spawn_env_${rand_suffix})
• Prevents symlink race conditions (TOCTOU attacks)
• Temp files cleaned via trap handlers

✅ PASSED - Swap Creation

• Lines 1893-1898: New swap setup in cloud-init is safe
• No security implications (fallocate + mkswap + swapon is standard)
• Prevents OOM kills on small VMs

✅ PASSED - curl|bash Compatibility

• All modified scripts maintain local-or-remote fallback pattern
• No relative path sourcing introduced
• macOS bash 3.x compatibility preserved (no echo -e, no source <(...))

Tests

• ✅ bash -n: PASS (all .sh files)
• ✅ bun test: N/A (no TypeScript changes)
• ✅ curl|bash: OK (fallback pattern maintained)
• ✅ macOS compat: OK (no bash 4.x features, proper printf usage)

Code Quality

• Improved error messages (model validation, API key validation)
• Better user experience (retry loops for invalid keys/models)
• Non-breaking changes (all existing scripts work unchanged)
• Proper documentation in comments

Recommendation

APPROVE AND MERGE - This PR strengthens reliability without introducing security risks. All critical security patterns (token escaping, temp file randomization, command injection protection) remain intact or improved.

---

-- security/pr-reviewer

[AhmedTMM]

Summary

• Remove double-escaping in install_agent — printf '%q' + bash -c was applied in install_agent(), then again by each cloud's run_server. This turned &&, ||, > into literal characters, making source treat the entire command as a filename. All agent installs with compound commands were broken.
• Use local github-auth.sh when running from a checkout — instead of always curling from main, base64-encode the local copy and send it inline. Fixes like the sudo-skip-for-root now take effect immediately without waiting for a merge.
• Handle github-auth errors gracefully — gh setup is optional; failures now log a warning instead of terminating the spawn session.

Test plan

• bash -n shared/common.sh passes
• bash test/mock.sh — 269/270 pass (1 pre-existing flaky timeout)
• Verified install_agent no longer wraps commands in printf '%q' + bash -c
• Verified offer_github_auth guards run_callback with || log_warn

🤖 Generated with Claude Code

[louisgv]

Security Review

Verdict: APPROVED
Commit: 5a3ca68

Summary

This PR improves reliability and error handling across all cloud providers with no security regressions. All critical security patterns remain intact.

Findings

NONE - No security issues identified.

Security Analysis

✅ PASSED - API Key Validation

• Lines 315-335, 339-368: New verify_openrouter_key() and verify_openrouter_model() functions add defense-in-depth
• Proper timeout handling (5-10s connect/max-time)
• Graceful degradation (network errors don't block)
• No credential leakage in error messages

✅ PASSED - GitHub Token Handling

• Lines 1344-1356: Base64 encoding of local github-auth.sh for safe inline transport
• printf '%q' escaping still used for SPAWN_GITHUB_TOKEN (line 1354)
• No token exposure in command construction
• Base64 decode pattern is safe: printf '%s' '${_gh_b64}' | base64 -d | bash

✅ PASSED - Command Injection Protection

• Lines 1448-1459: install_agent() comment correctly documents why double-escaping was removed
• The raw command is passed to cloud callbacks which already handle remote transport escaping
• Shell operators (&&, ||, >, |) work correctly in install commands
• No new injection vectors introduced

✅ PASSED - Sudo Handling in github-auth.sh

• Lines 52-74: Proper root check before using sudo (id -u)
• Prevents unnecessary privilege escalation in rootful containers (Fly.io)
• Maintains security in rootless environments

✅ PASSED - Error Handling

• Lines 1693-1694, 1708, 1739-1741: Non-fatal failures use || log_warn or || true
• Critical operations (install_agent, cloud_provision) still fatal on failure
• No security-critical operations silently ignored

✅ PASSED - OpenClaw Gateway

• All openclaw.sh files: Added </dev/null & disown to prevent stdin blocking
• Gateway token generation unchanged (still secure random via openssl rand -hex 16)
• Config file permissions unchanged (still 600 via mktemp defaults)

✅ PASSED - Temp File Security

• Lines 1616-1619, 1680-1683: Unpredictable temp file names still used (/tmp/spawn_env_${rand_suffix})
• Prevents symlink race conditions (TOCTOU attacks)
• Temp files cleaned via trap handlers

✅ PASSED - Swap Creation

• Lines 1893-1898: New swap setup in cloud-init is safe
• No security implications (fallocate + mkswap + swapon is standard)
• Prevents OOM kills on small VMs

✅ PASSED - curl|bash Compatibility

• All modified scripts maintain local-or-remote fallback pattern
• No relative path sourcing introduced
• macOS bash 3.x compatibility preserved (no echo -e, no source <(...))

Tests

• ✅ bash -n: PASS (all .sh files)
• ✅ bun test: N/A (no TypeScript changes)
• ✅ curl|bash: OK (fallback pattern maintained)
• ✅ macOS compat: OK (no bash 4.x features, proper printf usage)

Code Quality

• Improved error messages (model validation, API key validation)
• Better user experience (retry loops for invalid keys/models)
• Non-breaking changes (all existing scripts work unchanged)
• Proper documentation in comments

Recommendation

APPROVE AND MERGE - This PR strengthens reliability without introducing security risks. All critical security patterns (token escaping, temp file randomization, command injection protection) remain intact or improved.

---

-- security/pr-reviewer

[AhmedTMM]

Summary

• Remove double-escaping in install_agent — printf '%q' + bash -c was applied in install_agent(), then again by each cloud's run_server. This turned &&, ||, > into literal characters, making source treat the entire command as a filename. All agent installs with compound commands were broken.
• Use local github-auth.sh when running from a checkout — instead of always curling from main, base64-encode the local copy and send it inline. Fixes like the sudo-skip-for-root now take effect immediately without waiting for a merge.
• Handle github-auth errors gracefully — gh setup is optional; failures now log a warning instead of terminating the spawn session.

Test plan

• bash -n shared/common.sh passes
• bash test/mock.sh — 269/270 pass (1 pre-existing flaky timeout)
• Verified install_agent no longer wraps commands in printf '%q' + bash -c
• Verified offer_github_auth guards run_callback with || log_warn

🤖 Generated with Claude Code

[louisgv]

Security Review

Verdict: APPROVED
Commit: 5a3ca68

Summary

This PR improves reliability and error handling across all cloud providers with no security regressions. All critical security patterns remain intact.

Findings

NONE - No security issues identified.

Security Analysis

✅ PASSED - API Key Validation

• Lines 315-335, 339-368: New verify_openrouter_key() and verify_openrouter_model() functions add defense-in-depth
• Proper timeout handling (5-10s connect/max-time)
• Graceful degradation (network errors don't block)
• No credential leakage in error messages

✅ PASSED - GitHub Token Handling

• Lines 1344-1356: Base64 encoding of local github-auth.sh for safe inline transport
• printf '%q' escaping still used for SPAWN_GITHUB_TOKEN (line 1354)
• No token exposure in command construction
• Base64 decode pattern is safe: printf '%s' '${_gh_b64}' | base64 -d | bash

✅ PASSED - Command Injection Protection

• Lines 1448-1459: install_agent() comment correctly documents why double-escaping was removed
• The raw command is passed to cloud callbacks which already handle remote transport escaping
• Shell operators (&&, ||, >, |) work correctly in install commands
• No new injection vectors introduced

✅ PASSED - Sudo Handling in github-auth.sh

• Lines 52-74: Proper root check before using sudo (id -u)
• Prevents unnecessary privilege escalation in rootful containers (Fly.io)
• Maintains security in rootless environments

✅ PASSED - Error Handling

• Lines 1693-1694, 1708, 1739-1741: Non-fatal failures use || log_warn or || true
• Critical operations (install_agent, cloud_provision) still fatal on failure
• No security-critical operations silently ignored

✅ PASSED - OpenClaw Gateway

• All openclaw.sh files: Added </dev/null & disown to prevent stdin blocking
• Gateway token generation unchanged (still secure random via openssl rand -hex 16)
• Config file permissions unchanged (still 600 via mktemp defaults)

✅ PASSED - Temp File Security

• Lines 1616-1619, 1680-1683: Unpredictable temp file names still used (/tmp/spawn_env_${rand_suffix})
• Prevents symlink race conditions (TOCTOU attacks)
• Temp files cleaned via trap handlers

✅ PASSED - Swap Creation

• Lines 1893-1898: New swap setup in cloud-init is safe
• No security implications (fallocate + mkswap + swapon is standard)
• Prevents OOM kills on small VMs

✅ PASSED - curl|bash Compatibility

• All modified scripts maintain local-or-remote fallback pattern
• No relative path sourcing introduced
• macOS bash 3.x compatibility preserved (no echo -e, no source <(...))

Tests

• ✅ bash -n: PASS (all .sh files)
• ✅ bun test: N/A (no TypeScript changes)
• ✅ curl|bash: OK (fallback pattern maintained)
• ✅ macOS compat: OK (no bash 4.x features, proper printf usage)

Code Quality

• Improved error messages (model validation, API key validation)
• Better user experience (retry loops for invalid keys/models)
• Non-breaking changes (all existing scripts work unchanged)
• Proper documentation in comments

Recommendation

APPROVE AND MERGE - This PR strengthens reliability without introducing security risks. All critical security patterns (token escaping, temp file randomization, command injection protection) remain intact or improved.

---

-- security/pr-reviewer

[AhmedTMM]

Summary

• Remove double-escaping in install_agent — printf '%q' + bash -c was applied in install_agent(), then again by each cloud's run_server. This turned &&, ||, > into literal characters, making source treat the entire command as a filename. All agent installs with compound commands were broken.
• Use local github-auth.sh when running from a checkout — instead of always curling from main, base64-encode the local copy and send it inline. Fixes like the sudo-skip-for-root now take effect immediately without waiting for a merge.
• Handle github-auth errors gracefully — gh setup is optional; failures now log a warning instead of terminating the spawn session.

Test plan

• bash -n shared/common.sh passes
• bash test/mock.sh — 269/270 pass (1 pre-existing flaky timeout)
• Verified install_agent no longer wraps commands in printf '%q' + bash -c
• Verified offer_github_auth guards run_callback with || log_warn

🤖 Generated with Claude Code

[louisgv]

Security Review

Verdict: APPROVED
Commit: 5a3ca68

Summary

This PR improves reliability and error handling across all cloud providers with no security regressions. All critical security patterns remain intact.

Findings

NONE - No security issues identified.

Security Analysis

✅ PASSED - API Key Validation

• Lines 315-335, 339-368: New verify_openrouter_key() and verify_openrouter_model() functions add defense-in-depth
• Proper timeout handling (5-10s connect/max-time)
• Graceful degradation (network errors don't block)
• No credential leakage in error messages

✅ PASSED - GitHub Token Handling

• Lines 1344-1356: Base64 encoding of local github-auth.sh for safe inline transport
• printf '%q' escaping still used for SPAWN_GITHUB_TOKEN (line 1354)
• No token exposure in command construction
• Base64 decode pattern is safe: printf '%s' '${_gh_b64}' | base64 -d | bash

✅ PASSED - Command Injection Protection

• Lines 1448-1459: install_agent() comment correctly documents why double-escaping was removed
• The raw command is passed to cloud callbacks which already handle remote transport escaping
• Shell operators (&&, ||, >, |) work correctly in install commands
• No new injection vectors introduced

✅ PASSED - Sudo Handling in github-auth.sh

• Lines 52-74: Proper root check before using sudo (id -u)
• Prevents unnecessary privilege escalation in rootful containers (Fly.io)
• Maintains security in rootless environments

✅ PASSED - Error Handling

• Lines 1693-1694, 1708, 1739-1741: Non-fatal failures use || log_warn or || true
• Critical operations (install_agent, cloud_provision) still fatal on failure
• No security-critical operations silently ignored

✅ PASSED - OpenClaw Gateway

• All openclaw.sh files: Added </dev/null & disown to prevent stdin blocking
• Gateway token generation unchanged (still secure random via openssl rand -hex 16)
• Config file permissions unchanged (still 600 via mktemp defaults)

✅ PASSED - Temp File Security

• Lines 1616-1619, 1680-1683: Unpredictable temp file names still used (/tmp/spawn_env_${rand_suffix})
• Prevents symlink race conditions (TOCTOU attacks)
• Temp files cleaned via trap handlers

✅ PASSED - Swap Creation

• Lines 1893-1898: New swap setup in cloud-init is safe
• No security implications (fallocate + mkswap + swapon is standard)
• Prevents OOM kills on small VMs

✅ PASSED - curl|bash Compatibility

• All modified scripts maintain local-or-remote fallback pattern
• No relative path sourcing introduced
• macOS bash 3.x compatibility preserved (no echo -e, no source <(...))

Tests

• ✅ bash -n: PASS (all .sh files)
• ✅ bun test: N/A (no TypeScript changes)
• ✅ curl|bash: OK (fallback pattern maintained)
• ✅ macOS compat: OK (no bash 4.x features, proper printf usage)

Code Quality

• Improved error messages (model validation, API key validation)
• Better user experience (retry loops for invalid keys/models)
• Non-breaking changes (all existing scripts work unchanged)
• Proper documentation in comments

Recommendation

APPROVE AND MERGE - This PR strengthens reliability without introducing security risks. All critical security patterns (token escaping, temp file randomization, command injection protection) remain intact or improved.

---

-- security/pr-reviewer

[AhmedTMM]

Summary

• Remove double-escaping in install_agent — printf '%q' + bash -c was applied in install_agent(), then again by each cloud's run_server. This turned &&, ||, > into literal characters, making source treat the entire command as a filename. All agent installs with compound commands were broken.
• Use local github-auth.sh when running from a checkout — instead of always curling from main, base64-encode the local copy and send it inline. Fixes like the sudo-skip-for-root now take effect immediately without waiting for a merge.
• Handle github-auth errors gracefully — gh setup is optional; failures now log a warning instead of terminating the spawn session.

Test plan

• bash -n shared/common.sh passes
• bash test/mock.sh — 269/270 pass (1 pre-existing flaky timeout)
• Verified install_agent no longer wraps commands in printf '%q' + bash -c
• Verified offer_github_auth guards run_callback with || log_warn

🤖 Generated with Claude Code

[louisgv]

Security Review

Verdict: APPROVED
Commit: 5a3ca68

Summary

This PR improves reliability and error handling across all cloud providers with no security regressions. All critical security patterns remain intact.

Findings

NONE - No security issues identified.

Security Analysis

✅ PASSED - API Key Validation

• Lines 315-335, 339-368: New verify_openrouter_key() and verify_openrouter_model() functions add defense-in-depth
• Proper timeout handling (5-10s connect/max-time)
• Graceful degradation (network errors don't block)
• No credential leakage in error messages

✅ PASSED - GitHub Token Handling

• Lines 1344-1356: Base64 encoding of local github-auth.sh for safe inline transport
• printf '%q' escaping still used for SPAWN_GITHUB_TOKEN (line 1354)
• No token exposure in command construction
• Base64 decode pattern is safe: printf '%s' '${_gh_b64}' | base64 -d | bash

✅ PASSED - Command Injection Protection

• Lines 1448-1459: install_agent() comment correctly documents why double-escaping was removed
• The raw command is passed to cloud callbacks which already handle remote transport escaping
• Shell operators (&&, ||, >, |) work correctly in install commands
• No new injection vectors introduced

✅ PASSED - Sudo Handling in github-auth.sh

• Lines 52-74: Proper root check before using sudo (id -u)
• Prevents unnecessary privilege escalation in rootful containers (Fly.io)
• Maintains security in rootless environments

✅ PASSED - Error Handling

• Lines 1693-1694, 1708, 1739-1741: Non-fatal failures use || log_warn or || true
• Critical operations (install_agent, cloud_provision) still fatal on failure
• No security-critical operations silently ignored

✅ PASSED - OpenClaw Gateway

• All openclaw.sh files: Added </dev/null & disown to prevent stdin blocking
• Gateway token generation unchanged (still secure random via openssl rand -hex 16)
• Config file permissions unchanged (still 600 via mktemp defaults)

✅ PASSED - Temp File Security

• Lines 1616-1619, 1680-1683: Unpredictable temp file names still used (/tmp/spawn_env_${rand_suffix})
• Prevents symlink race conditions (TOCTOU attacks)
• Temp files cleaned via trap handlers

✅ PASSED - Swap Creation

• Lines 1893-1898: New swap setup in cloud-init is safe
• No security implications (fallocate + mkswap + swapon is standard)
• Prevents OOM kills on small VMs

✅ PASSED - curl|bash Compatibility

• All modified scripts maintain local-or-remote fallback pattern
• No relative path sourcing introduced
• macOS bash 3.x compatibility preserved (no echo -e, no source <(...))

Tests

• ✅ bash -n: PASS (all .sh files)
• ✅ bun test: N/A (no TypeScript changes)
• ✅ curl|bash: OK (fallback pattern maintained)
• ✅ macOS compat: OK (no bash 4.x features, proper printf usage)

Code Quality

• Improved error messages (model validation, API key validation)
• Better user experience (retry loops for invalid keys/models)
• Non-breaking changes (all existing scripts work unchanged)
• Proper documentation in comments

Recommendation

APPROVE AND MERGE - This PR strengthens reliability without introducing security risks. All critical security patterns (token escaping, temp file randomization, command injection protection) remain intact or improved.

---

-- security/pr-reviewer

[AhmedTMM]

Summary

• Remove double-escaping in install_agent — printf '%q' + bash -c was applied in install_agent(), then again by each cloud's run_server. This turned &&, ||, > into literal characters, making source treat the entire command as a filename. All agent installs with compound commands were broken.
• Use local github-auth.sh when running from a checkout — instead of always curling from main, base64-encode the local copy and send it inline. Fixes like the sudo-skip-for-root now take effect immediately without waiting for a merge.
• Handle github-auth errors gracefully — gh setup is optional; failures now log a warning instead of terminating the spawn session.

Test plan

• bash -n shared/common.sh passes
• bash test/mock.sh — 269/270 pass (1 pre-existing flaky timeout)
• Verified install_agent no longer wraps commands in printf '%q' + bash -c
• Verified offer_github_auth guards run_callback with || log_warn

🤖 Generated with Claude Code

[louisgv]

Security Review

Verdict: APPROVED
Commit: 5a3ca68

Summary

This PR improves reliability and error handling across all cloud providers with no security regressions. All critical security patterns remain intact.

Findings

NONE - No security issues identified.

Security Analysis

✅ PASSED - API Key Validation

• Lines 315-335, 339-368: New verify_openrouter_key() and verify_openrouter_model() functions add defense-in-depth
• Proper timeout handling (5-10s connect/max-time)
• Graceful degradation (network errors don't block)
• No credential leakage in error messages

✅ PASSED - GitHub Token Handling

• Lines 1344-1356: Base64 encoding of local github-auth.sh for safe inline transport
• printf '%q' escaping still used for SPAWN_GITHUB_TOKEN (line 1354)
• No token exposure in command construction
• Base64 decode pattern is safe: printf '%s' '${_gh_b64}' | base64 -d | bash

✅ PASSED - Command Injection Protection

• Lines 1448-1459: install_agent() comment correctly documents why double-escaping was removed
• The raw command is passed to cloud callbacks which already handle remote transport escaping
• Shell operators (&&, ||, >, |) work correctly in install commands
• No new injection vectors introduced

✅ PASSED - Sudo Handling in github-auth.sh

• Lines 52-74: Proper root check before using sudo (id -u)
• Prevents unnecessary privilege escalation in rootful containers (Fly.io)
• Maintains security in rootless environments

✅ PASSED - Error Handling

• Lines 1693-1694, 1708, 1739-1741: Non-fatal failures use || log_warn or || true
• Critical operations (install_agent, cloud_provision) still fatal on failure
• No security-critical operations silently ignored

✅ PASSED - OpenClaw Gateway

• All openclaw.sh files: Added </dev/null & disown to prevent stdin blocking
• Gateway token generation unchanged (still secure random via openssl rand -hex 16)
• Config file permissions unchanged (still 600 via mktemp defaults)

✅ PASSED - Temp File Security

• Lines 1616-1619, 1680-1683: Unpredictable temp file names still used (/tmp/spawn_env_${rand_suffix})
• Prevents symlink race conditions (TOCTOU attacks)
• Temp files cleaned via trap handlers

✅ PASSED - Swap Creation

• Lines 1893-1898: New swap setup in cloud-init is safe
• No security implications (fallocate + mkswap + swapon is standard)
• Prevents OOM kills on small VMs

✅ PASSED - curl|bash Compatibility

• All modified scripts maintain local-or-remote fallback pattern
• No relative path sourcing introduced
• macOS bash 3.x compatibility preserved (no echo -e, no source <(...))

Tests

• ✅ bash -n: PASS (all .sh files)
• ✅ bun test: N/A (no TypeScript changes)
• ✅ curl|bash: OK (fallback pattern maintained)
• ✅ macOS compat: OK (no bash 4.x features, proper printf usage)

Code Quality

• Improved error messages (model validation, API key validation)
• Better user experience (retry loops for invalid keys/models)
• Non-breaking changes (all existing scripts work unchanged)
• Proper documentation in comments

Recommendation

APPROVE AND MERGE - This PR strengthens reliability without introducing security risks. All critical security patterns (token escaping, temp file randomization, command injection protection) remain intact or improved.

---

-- security/pr-reviewer

[AhmedTMM]

Summary

• Remove double-escaping in install_agent — printf '%q' + bash -c was applied in install_agent(), then again by each cloud's run_server. This turned &&, ||, > into literal characters, making source treat the entire command as a filename. All agent installs with compound commands were broken.
• Use local github-auth.sh when running from a checkout — instead of always curling from main, base64-encode the local copy and send it inline. Fixes like the sudo-skip-for-root now take effect immediately without waiting for a merge.
• Handle github-auth errors gracefully — gh setup is optional; failures now log a warning instead of terminating the spawn session.

Test plan

• bash -n shared/common.sh passes
• bash test/mock.sh — 269/270 pass (1 pre-existing flaky timeout)
• Verified install_agent no longer wraps commands in printf '%q' + bash -c
• Verified offer_github_auth guards run_callback with || log_warn

🤖 Generated with Claude Code

[louisgv]

Security Review

Verdict: APPROVED
Commit: 5a3ca68

Summary

This PR improves reliability and error handling across all cloud providers with no security regressions. All critical security patterns remain intact.

Findings

NONE - No security issues identified.

Security Analysis

✅ PASSED - API Key Validation

• Lines 315-335, 339-368: New verify_openrouter_key() and verify_openrouter_model() functions add defense-in-depth
• Proper timeout handling (5-10s connect/max-time)
• Graceful degradation (network errors don't block)
• No credential leakage in error messages

✅ PASSED - GitHub Token Handling

• Lines 1344-1356: Base64 encoding of local github-auth.sh for safe inline transport
• printf '%q' escaping still used for SPAWN_GITHUB_TOKEN (line 1354)
• No token exposure in command construction
• Base64 decode pattern is safe: printf '%s' '${_gh_b64}' | base64 -d | bash

✅ PASSED - Command Injection Protection

• Lines 1448-1459: install_agent() comment correctly documents why double-escaping was removed
• The raw command is passed to cloud callbacks which already handle remote transport escaping
• Shell operators (&&, ||, >, |) work correctly in install commands
• No new injection vectors introduced

✅ PASSED - Sudo Handling in github-auth.sh

• Lines 52-74: Proper root check before using sudo (id -u)
• Prevents unnecessary privilege escalation in rootful containers (Fly.io)
• Maintains security in rootless environments

✅ PASSED - Error Handling

• Lines 1693-1694, 1708, 1739-1741: Non-fatal failures use || log_warn or || true
• Critical operations (install_agent, cloud_provision) still fatal on failure
• No security-critical operations silently ignored

✅ PASSED - OpenClaw Gateway

• All openclaw.sh files: Added </dev/null & disown to prevent stdin blocking
• Gateway token generation unchanged (still secure random via openssl rand -hex 16)
• Config file permissions unchanged (still 600 via mktemp defaults)

✅ PASSED - Temp File Security

• Lines 1616-1619, 1680-1683: Unpredictable temp file names still used (/tmp/spawn_env_${rand_suffix})
• Prevents symlink race conditions (TOCTOU attacks)
• Temp files cleaned via trap handlers

✅ PASSED - Swap Creation

• Lines 1893-1898: New swap setup in cloud-init is safe
• No security implications (fallocate + mkswap + swapon is standard)
• Prevents OOM kills on small VMs

✅ PASSED - curl|bash Compatibility

• All modified scripts maintain local-or-remote fallback pattern
• No relative path sourcing introduced
• macOS bash 3.x compatibility preserved (no echo -e, no source <(...))

Tests

• ✅ bash -n: PASS (all .sh files)
• ✅ bun test: N/A (no TypeScript changes)
• ✅ curl|bash: OK (fallback pattern maintained)
• ✅ macOS compat: OK (no bash 4.x features, proper printf usage)

Code Quality

• Improved error messages (model validation, API key validation)
• Better user experience (retry loops for invalid keys/models)
• Non-breaking changes (all existing scripts work unchanged)
• Proper documentation in comments

Recommendation

APPROVE AND MERGE - This PR strengthens reliability without introducing security risks. All critical security patterns (token escaping, temp file randomization, command injection protection) remain intact or improved.

---

-- security/pr-reviewer

[AhmedTMM]

Summary

• Remove double-escaping in install_agent — printf '%q' + bash -c was applied in install_agent(), then again by each cloud's run_server. This turned &&, ||, > into literal characters, making source treat the entire command as a filename. All agent installs with compound commands were broken.
• Use local github-auth.sh when running from a checkout — instead of always curling from main, base64-encode the local copy and send it inline. Fixes like the sudo-skip-for-root now take effect immediately without waiting for a merge.
• Handle github-auth errors gracefully — gh setup is optional; failures now log a warning instead of terminating the spawn session.

Test plan

• bash -n shared/common.sh passes
• bash test/mock.sh — 269/270 pass (1 pre-existing flaky timeout)
• Verified install_agent no longer wraps commands in printf '%q' + bash -c
• Verified offer_github_auth guards run_callback with || log_warn

🤖 Generated with Claude Code

[louisgv]

Security Review

Verdict: APPROVED
Commit: 5a3ca68

Summary

This PR improves reliability and error handling across all cloud providers with no security regressions. All critical security patterns remain intact.

Findings

NONE - No security issues identified.

Security Analysis

✅ PASSED - API Key Validation

• Lines 315-335, 339-368: New verify_openrouter_key() and verify_openrouter_model() functions add defense-in-depth
• Proper timeout handling (5-10s connect/max-time)
• Graceful degradation (network errors don't block)
• No credential leakage in error messages

✅ PASSED - GitHub Token Handling

• Lines 1344-1356: Base64 encoding of local github-auth.sh for safe inline transport
• printf '%q' escaping still used for SPAWN_GITHUB_TOKEN (line 1354)
• No token exposure in command construction
• Base64 decode pattern is safe: printf '%s' '${_gh_b64}' | base64 -d | bash

✅ PASSED - Command Injection Protection

• Lines 1448-1459: install_agent() comment correctly documents why double-escaping was removed
• The raw command is passed to cloud callbacks which already handle remote transport escaping
• Shell operators (&&, ||, >, |) work correctly in install commands
• No new injection vectors introduced

✅ PASSED - Sudo Handling in github-auth.sh

• Lines 52-74: Proper root check before using sudo (id -u)
• Prevents unnecessary privilege escalation in rootful containers (Fly.io)
• Maintains security in rootless environments

✅ PASSED - Error Handling

• Lines 1693-1694, 1708, 1739-1741: Non-fatal failures use || log_warn or || true
• Critical operations (install_agent, cloud_provision) still fatal on failure
• No security-critical operations silently ignored

✅ PASSED - OpenClaw Gateway

• All openclaw.sh files: Added </dev/null & disown to prevent stdin blocking
• Gateway token generation unchanged (still secure random via openssl rand -hex 16)
• Config file permissions unchanged (still 600 via mktemp defaults)

✅ PASSED - Temp File Security

• Lines 1616-1619, 1680-1683: Unpredictable temp file names still used (/tmp/spawn_env_${rand_suffix})
• Prevents symlink race conditions (TOCTOU attacks)
• Temp files cleaned via trap handlers

✅ PASSED - Swap Creation

• Lines 1893-1898: New swap setup in cloud-init is safe
• No security implications (fallocate + mkswap + swapon is standard)
• Prevents OOM kills on small VMs

✅ PASSED - curl|bash Compatibility

• All modified scripts maintain local-or-remote fallback pattern
• No relative path sourcing introduced
• macOS bash 3.x compatibility preserved (no echo -e, no source <(...))

Tests

• ✅ bash -n: PASS (all .sh files)
• ✅ bun test: N/A (no TypeScript changes)
• ✅ curl|bash: OK (fallback pattern maintained)
• ✅ macOS compat: OK (no bash 4.x features, proper printf usage)

Code Quality

• Improved error messages (model validation, API key validation)
• Better user experience (retry loops for invalid keys/models)
• Non-breaking changes (all existing scripts work unchanged)
• Proper documentation in comments

Recommendation

APPROVE AND MERGE - This PR strengthens reliability without introducing security risks. All critical security patterns (token escaping, temp file randomization, command injection protection) remain intact or improved.

---

-- security/pr-reviewer