fix: sanitize API key interpolation in run_server commands

[la14-1]

Fixes#736

Summary

• Replaced inline ${OPENROUTER_API_KEY} interpolation in run_server command strings with safe inject_env_vars_ssh / inject_env_vars_local helpers across 8 agent scripts
• These helpers write env vars to a local temp file (with chmod 600), upload it to the remote server, and source it — completely avoiding shell metacharacter interpretation of API key values
• For kamatera/nanoclaw.sh, the .env file write also uses a temp file upload instead of inline interpolation

Why this matters

If an API key contained shell metacharacters (e.g., $(cmd), backticks, ; cmd), the previous pattern would execute them on the remote server. The inject_env_vars_* helpers from shared/common.sh already handle this safely by single-quoting values in generate_env_config().

Affected files

File	Fix
latitude/continue.sh	inject_env_vars_ssh
scaleway/continue.sh	inject_env_vars_ssh
upcloud/continue.sh	inject_env_vars_ssh
kamatera/nanoclaw.sh	temp file upload for .env
daytona/continue.sh	inject_env_vars_local
e2b/continue.sh	inject_env_vars_local
modal/continue.sh	inject_env_vars_local
github-codespaces/continue.sh	inject_env_vars_local

Note on #737

Issue #737 (.gitignore gap) is already resolved — the current .gitignore uses the broad pattern .claude/skills/*/start-*.sh which covers all skill subdirectories.

Test plan

• bash -n passes on all 8 changed files
• bun test — no regressions (12 pre-existing failures on main, unchanged)

🤖 Generated with Claude Code

[la14-1]

Self-review by security-auditor:

All 8 files correctly migrated from inline API key interpolation to safe injection helpers.

Verification checklist:

• SSH-based clouds (latitude, scaleway, upcloud) correctly use inject_env_vars_ssh with server IP as first arg
• Non-SSH clouds (daytona, e2b, modal, github-codespaces) correctly use inject_env_vars_local without server IP
• kamatera/nanoclaw.sh .env write uses temp file upload pattern (mktemp + chmod 600 + upload_file + mv) to avoid shell interpolation
• bash -n passes on all 8 files
• No test regressions (12 pre-existing failures on main, unchanged)
• The inject_env_vars_* helpers use generate_env_config() which single-quotes values, preventing $(), backtick, and semicolon injection

Note on #737: The .gitignore already has .claude/skills/*/start-*.sh (the broad glob pattern). No change needed — the issue was resolved by a prior commit (8140c1b).

[louisgv]

Security Review

Verdict: APPROVED

Summary

This PR replaces inline shell interpolation of API keys in run_server commands with the safe inject_env_vars_ssh / inject_env_vars_local helper functions. These helpers write env vars to a temp file, upload it, and append to shell config on the remote side — avoiding shell command interpolation of secrets entirely. This is a clear security improvement.

The kamatera/nanoclaw.sh change additionally replaces a printf-based .env write via run_server with a local temp file + upload approach, which similarly avoids passing the API key through remote shell interpolation.

Findings

• No CRITICAL issues found
• No HIGH issues found
• No MEDIUM issues found
• [LOW] github-codespaces/continue.sh — the original code used run_in_codespace but the PR switches to inject_env_vars_local upload_file run_server. This is actually correct because the codespaces lib defines upload_file() and run_server() wrappers that internally use CODESPACE_NAME, matching the inject_env_vars_local interface.
• [LOW] kamatera/nanoclaw.sh:44-49 — the temp file approach is good. chmod 600 and track_temp_file ensure proper permissions and cleanup. The uploaded file at /tmp/nanoclaw_env is immediately moved to ~/nanoclaw/.env, minimizing exposure window.

Tests

• bash -n: PASS (all 8 files)
• bun test: N/A (no .ts files changed)
• curl|bash pattern: OK (source/eval fallback patterns unchanged)
• macOS compat: OK (no echo -e, no source <(), no ((var++)), no set -u, no local in subshells)

Notes

• This PR has merge conflicts (CONFLICTING status) and cannot be auto-merged. The author will need to resolve conflicts before merging.
• The security improvement is sound: moving from inline shell interpolation of API keys to file-based injection eliminates a class of command injection risks where special characters in API keys could break shell quoting.

---

Automated security review by spawn security team

[louisgv]

Security Review

Verdict: APPROVED

Summary

This PR correctly replaces unsafe inline ${OPENROUTER_API_KEY} interpolation in run_server command strings with the safe inject_env_vars_ssh / inject_env_vars_local helpers across 8 agent scripts. The core defense is generate_env_config() in shared/common.sh, which single-quotes values and escapes embedded single quotes using the standard '\'' pattern — this prevents shell injection from API keys containing $(cmd), backticks, semicolons, or other metacharacters.

Findings

• [LOW] kamatera/nanoclaw.sh:47 — The .env file written via printf '%s' does not quote the value. If the API key contains characters that a .env parser might interpret (e.g., #, \n), it could be misread. In practice, NanoClaw uses node.js dotenv which handles this safely, and the value originates from OpenRouter OAuth which uses alphanumeric tokens. Risk is negligible.
• [LOW] kamatera/nanoclaw.sh:48-49 — The uploaded temp file at /tmp/nanoclaw_env on the remote server may briefly have default (world-readable) permissions before being mv'd. Since this is a freshly provisioned single-user server where the operator is root, this is not exploitable in practice.

No CRITICAL or HIGH issues found.

Tests

• bash -n: PASS (all 8 files)
• bun test: N/A (no test changes in this PR)
• curl|bash pattern: OK (all files use correct local-or-remote eval fallback)
• macOS compat: OK (no echo -e, source <(), ((var++)), set -u, or local-in-subshell)

Security Analysis

• Command injection: FIXED — the entire point of this PR. Inline ${OPENROUTER_API_KEY} in remote shell commands is replaced with temp-file-based injection that never passes the value through shell expansion.
• Credential leaks: OK — temp files created with chmod 600, tracked for cleanup via shred/rm on exit.
• Unsafe patterns: None introduced. No eval of user input, no source <().
• generate_env_config: Correct single-quote escaping (' → '\''). Values inside single quotes cannot be shell-expanded.

Note

This PR has merge conflicts (CONFLICTING status) that need resolution before merging.

---

Automated security review by spawn security team

[louisgv]

Security review passed with APPROVED verdict (2 LOW findings, no CRITICAL/HIGH). This PR has merge conflicts that need to be resolved before merging.

[la14-1]

Closing this PR as all changes are already present on main. The security fixes for API key interpolation in these 8 scripts (daytona/continue.sh, e2b/continue.sh, github-codespaces/continue.sh, kamatera/nanoclaw.sh, latitude/continue.sh, modal/continue.sh, scaleway/continue.sh, upcloud/continue.sh) were applied through other PRs. Rebasing confirms zero diff against main.

[la14-1]

Fixes#736

Summary

• Replaced inline ${OPENROUTER_API_KEY} interpolation in run_server command strings with safe inject_env_vars_ssh / inject_env_vars_local helpers across 8 agent scripts
• These helpers write env vars to a local temp file (with chmod 600), upload it to the remote server, and source it — completely avoiding shell metacharacter interpretation of API key values
• For kamatera/nanoclaw.sh, the .env file write also uses a temp file upload instead of inline interpolation

Why this matters

If an API key contained shell metacharacters (e.g., $(cmd), backticks, ; cmd), the previous pattern would execute them on the remote server. The inject_env_vars_* helpers from shared/common.sh already handle this safely by single-quoting values in generate_env_config().

Affected files

File	Fix
latitude/continue.sh	inject_env_vars_ssh
scaleway/continue.sh	inject_env_vars_ssh
upcloud/continue.sh	inject_env_vars_ssh
kamatera/nanoclaw.sh	temp file upload for .env
daytona/continue.sh	inject_env_vars_local
e2b/continue.sh	inject_env_vars_local
modal/continue.sh	inject_env_vars_local
github-codespaces/continue.sh	inject_env_vars_local

Note on #737

Issue #737 (.gitignore gap) is already resolved — the current .gitignore uses the broad pattern .claude/skills/*/start-*.sh which covers all skill subdirectories.

Test plan

• bash -n passes on all 8 changed files
• bun test — no regressions (12 pre-existing failures on main, unchanged)

🤖 Generated with Claude Code

[la14-1]

Self-review by security-auditor:

All 8 files correctly migrated from inline API key interpolation to safe injection helpers.

Verification checklist:

• SSH-based clouds (latitude, scaleway, upcloud) correctly use inject_env_vars_ssh with server IP as first arg
• Non-SSH clouds (daytona, e2b, modal, github-codespaces) correctly use inject_env_vars_local without server IP
• kamatera/nanoclaw.sh .env write uses temp file upload pattern (mktemp + chmod 600 + upload_file + mv) to avoid shell interpolation
• bash -n passes on all 8 files
• No test regressions (12 pre-existing failures on main, unchanged)
• The inject_env_vars_* helpers use generate_env_config() which single-quotes values, preventing $(), backtick, and semicolon injection

Note on #737: The .gitignore already has .claude/skills/*/start-*.sh (the broad glob pattern). No change needed — the issue was resolved by a prior commit (8140c1b).

[louisgv]

Security Review

Verdict: APPROVED

Summary

This PR replaces inline shell interpolation of API keys in run_server commands with the safe inject_env_vars_ssh / inject_env_vars_local helper functions. These helpers write env vars to a temp file, upload it, and append to shell config on the remote side — avoiding shell command interpolation of secrets entirely. This is a clear security improvement.

The kamatera/nanoclaw.sh change additionally replaces a printf-based .env write via run_server with a local temp file + upload approach, which similarly avoids passing the API key through remote shell interpolation.

Findings

• No CRITICAL issues found
• No HIGH issues found
• No MEDIUM issues found
• [LOW] github-codespaces/continue.sh — the original code used run_in_codespace but the PR switches to inject_env_vars_local upload_file run_server. This is actually correct because the codespaces lib defines upload_file() and run_server() wrappers that internally use CODESPACE_NAME, matching the inject_env_vars_local interface.
• [LOW] kamatera/nanoclaw.sh:44-49 — the temp file approach is good. chmod 600 and track_temp_file ensure proper permissions and cleanup. The uploaded file at /tmp/nanoclaw_env is immediately moved to ~/nanoclaw/.env, minimizing exposure window.

Tests

• bash -n: PASS (all 8 files)
• bun test: N/A (no .ts files changed)
• curl|bash pattern: OK (source/eval fallback patterns unchanged)
• macOS compat: OK (no echo -e, no source <(), no ((var++)), no set -u, no local in subshells)

Notes

• This PR has merge conflicts (CONFLICTING status) and cannot be auto-merged. The author will need to resolve conflicts before merging.
• The security improvement is sound: moving from inline shell interpolation of API keys to file-based injection eliminates a class of command injection risks where special characters in API keys could break shell quoting.

---

Automated security review by spawn security team

[louisgv]

Security Review

Verdict: APPROVED

Summary

This PR correctly replaces unsafe inline ${OPENROUTER_API_KEY} interpolation in run_server command strings with the safe inject_env_vars_ssh / inject_env_vars_local helpers across 8 agent scripts. The core defense is generate_env_config() in shared/common.sh, which single-quotes values and escapes embedded single quotes using the standard '\'' pattern — this prevents shell injection from API keys containing $(cmd), backticks, semicolons, or other metacharacters.

Findings

• [LOW] kamatera/nanoclaw.sh:47 — The .env file written via printf '%s' does not quote the value. If the API key contains characters that a .env parser might interpret (e.g., #, \n), it could be misread. In practice, NanoClaw uses node.js dotenv which handles this safely, and the value originates from OpenRouter OAuth which uses alphanumeric tokens. Risk is negligible.
• [LOW] kamatera/nanoclaw.sh:48-49 — The uploaded temp file at /tmp/nanoclaw_env on the remote server may briefly have default (world-readable) permissions before being mv'd. Since this is a freshly provisioned single-user server where the operator is root, this is not exploitable in practice.

No CRITICAL or HIGH issues found.

Tests

• bash -n: PASS (all 8 files)
• bun test: N/A (no test changes in this PR)
• curl|bash pattern: OK (all files use correct local-or-remote eval fallback)
• macOS compat: OK (no echo -e, source <(), ((var++)), set -u, or local-in-subshell)

Security Analysis

• Command injection: FIXED — the entire point of this PR. Inline ${OPENROUTER_API_KEY} in remote shell commands is replaced with temp-file-based injection that never passes the value through shell expansion.
• Credential leaks: OK — temp files created with chmod 600, tracked for cleanup via shred/rm on exit.
• Unsafe patterns: None introduced. No eval of user input, no source <().
• generate_env_config: Correct single-quote escaping (' → '\''). Values inside single quotes cannot be shell-expanded.

Note

This PR has merge conflicts (CONFLICTING status) that need resolution before merging.

---

Automated security review by spawn security team

[louisgv]

Security review passed with APPROVED verdict (2 LOW findings, no CRITICAL/HIGH). This PR has merge conflicts that need to be resolved before merging.

[la14-1]

Closing this PR as all changes are already present on main. The security fixes for API key interpolation in these 8 scripts (daytona/continue.sh, e2b/continue.sh, github-codespaces/continue.sh, kamatera/nanoclaw.sh, latitude/continue.sh, modal/continue.sh, scaleway/continue.sh, upcloud/continue.sh) were applied through other PRs. Rebasing confirms zero diff against main.

[la14-1]

Fixes#736

Summary

• Replaced inline ${OPENROUTER_API_KEY} interpolation in run_server command strings with safe inject_env_vars_ssh / inject_env_vars_local helpers across 8 agent scripts
• These helpers write env vars to a local temp file (with chmod 600), upload it to the remote server, and source it — completely avoiding shell metacharacter interpretation of API key values
• For kamatera/nanoclaw.sh, the .env file write also uses a temp file upload instead of inline interpolation

Why this matters

If an API key contained shell metacharacters (e.g., $(cmd), backticks, ; cmd), the previous pattern would execute them on the remote server. The inject_env_vars_* helpers from shared/common.sh already handle this safely by single-quoting values in generate_env_config().

Affected files

File	Fix
latitude/continue.sh	inject_env_vars_ssh
scaleway/continue.sh	inject_env_vars_ssh
upcloud/continue.sh	inject_env_vars_ssh
kamatera/nanoclaw.sh	temp file upload for .env
daytona/continue.sh	inject_env_vars_local
e2b/continue.sh	inject_env_vars_local
modal/continue.sh	inject_env_vars_local
github-codespaces/continue.sh	inject_env_vars_local

Note on #737

Issue #737 (.gitignore gap) is already resolved — the current .gitignore uses the broad pattern .claude/skills/*/start-*.sh which covers all skill subdirectories.

Test plan

• bash -n passes on all 8 changed files
• bun test — no regressions (12 pre-existing failures on main, unchanged)

🤖 Generated with Claude Code

[la14-1]

Self-review by security-auditor:

All 8 files correctly migrated from inline API key interpolation to safe injection helpers.

Verification checklist:

• SSH-based clouds (latitude, scaleway, upcloud) correctly use inject_env_vars_ssh with server IP as first arg
• Non-SSH clouds (daytona, e2b, modal, github-codespaces) correctly use inject_env_vars_local without server IP
• kamatera/nanoclaw.sh .env write uses temp file upload pattern (mktemp + chmod 600 + upload_file + mv) to avoid shell interpolation
• bash -n passes on all 8 files
• No test regressions (12 pre-existing failures on main, unchanged)
• The inject_env_vars_* helpers use generate_env_config() which single-quotes values, preventing $(), backtick, and semicolon injection

Note on #737: The .gitignore already has .claude/skills/*/start-*.sh (the broad glob pattern). No change needed — the issue was resolved by a prior commit (8140c1b).

[louisgv]

Security Review

Verdict: APPROVED

Summary

This PR replaces inline shell interpolation of API keys in run_server commands with the safe inject_env_vars_ssh / inject_env_vars_local helper functions. These helpers write env vars to a temp file, upload it, and append to shell config on the remote side — avoiding shell command interpolation of secrets entirely. This is a clear security improvement.

The kamatera/nanoclaw.sh change additionally replaces a printf-based .env write via run_server with a local temp file + upload approach, which similarly avoids passing the API key through remote shell interpolation.

Findings

• No CRITICAL issues found
• No HIGH issues found
• No MEDIUM issues found
• [LOW] github-codespaces/continue.sh — the original code used run_in_codespace but the PR switches to inject_env_vars_local upload_file run_server. This is actually correct because the codespaces lib defines upload_file() and run_server() wrappers that internally use CODESPACE_NAME, matching the inject_env_vars_local interface.
• [LOW] kamatera/nanoclaw.sh:44-49 — the temp file approach is good. chmod 600 and track_temp_file ensure proper permissions and cleanup. The uploaded file at /tmp/nanoclaw_env is immediately moved to ~/nanoclaw/.env, minimizing exposure window.

Tests

• bash -n: PASS (all 8 files)
• bun test: N/A (no .ts files changed)
• curl|bash pattern: OK (source/eval fallback patterns unchanged)
• macOS compat: OK (no echo -e, no source <(), no ((var++)), no set -u, no local in subshells)

Notes

• This PR has merge conflicts (CONFLICTING status) and cannot be auto-merged. The author will need to resolve conflicts before merging.
• The security improvement is sound: moving from inline shell interpolation of API keys to file-based injection eliminates a class of command injection risks where special characters in API keys could break shell quoting.

---

Automated security review by spawn security team

[louisgv]

Security Review

Verdict: APPROVED

Summary

This PR correctly replaces unsafe inline ${OPENROUTER_API_KEY} interpolation in run_server command strings with the safe inject_env_vars_ssh / inject_env_vars_local helpers across 8 agent scripts. The core defense is generate_env_config() in shared/common.sh, which single-quotes values and escapes embedded single quotes using the standard '\'' pattern — this prevents shell injection from API keys containing $(cmd), backticks, semicolons, or other metacharacters.

Findings

• [LOW] kamatera/nanoclaw.sh:47 — The .env file written via printf '%s' does not quote the value. If the API key contains characters that a .env parser might interpret (e.g., #, \n), it could be misread. In practice, NanoClaw uses node.js dotenv which handles this safely, and the value originates from OpenRouter OAuth which uses alphanumeric tokens. Risk is negligible.
• [LOW] kamatera/nanoclaw.sh:48-49 — The uploaded temp file at /tmp/nanoclaw_env on the remote server may briefly have default (world-readable) permissions before being mv'd. Since this is a freshly provisioned single-user server where the operator is root, this is not exploitable in practice.

No CRITICAL or HIGH issues found.

Tests

• bash -n: PASS (all 8 files)
• bun test: N/A (no test changes in this PR)
• curl|bash pattern: OK (all files use correct local-or-remote eval fallback)
• macOS compat: OK (no echo -e, source <(), ((var++)), set -u, or local-in-subshell)

Security Analysis

• Command injection: FIXED — the entire point of this PR. Inline ${OPENROUTER_API_KEY} in remote shell commands is replaced with temp-file-based injection that never passes the value through shell expansion.
• Credential leaks: OK — temp files created with chmod 600, tracked for cleanup via shred/rm on exit.
• Unsafe patterns: None introduced. No eval of user input, no source <().
• generate_env_config: Correct single-quote escaping (' → '\''). Values inside single quotes cannot be shell-expanded.

Note

This PR has merge conflicts (CONFLICTING status) that need resolution before merging.

---

Automated security review by spawn security team

[louisgv]

Security review passed with APPROVED verdict (2 LOW findings, no CRITICAL/HIGH). This PR has merge conflicts that need to be resolved before merging.

[la14-1]

Closing this PR as all changes are already present on main. The security fixes for API key interpolation in these 8 scripts (daytona/continue.sh, e2b/continue.sh, github-codespaces/continue.sh, kamatera/nanoclaw.sh, latitude/continue.sh, modal/continue.sh, scaleway/continue.sh, upcloud/continue.sh) were applied through other PRs. Rebasing confirms zero diff against main.

[la14-1]

Fixes#736

Summary

• Replaced inline ${OPENROUTER_API_KEY} interpolation in run_server command strings with safe inject_env_vars_ssh / inject_env_vars_local helpers across 8 agent scripts
• These helpers write env vars to a local temp file (with chmod 600), upload it to the remote server, and source it — completely avoiding shell metacharacter interpretation of API key values
• For kamatera/nanoclaw.sh, the .env file write also uses a temp file upload instead of inline interpolation

Why this matters

If an API key contained shell metacharacters (e.g., $(cmd), backticks, ; cmd), the previous pattern would execute them on the remote server. The inject_env_vars_* helpers from shared/common.sh already handle this safely by single-quoting values in generate_env_config().

Affected files

File	Fix
latitude/continue.sh	inject_env_vars_ssh
scaleway/continue.sh	inject_env_vars_ssh
upcloud/continue.sh	inject_env_vars_ssh
kamatera/nanoclaw.sh	temp file upload for .env
daytona/continue.sh	inject_env_vars_local
e2b/continue.sh	inject_env_vars_local
modal/continue.sh	inject_env_vars_local
github-codespaces/continue.sh	inject_env_vars_local

Note on #737

Issue #737 (.gitignore gap) is already resolved — the current .gitignore uses the broad pattern .claude/skills/*/start-*.sh which covers all skill subdirectories.

Test plan

• bash -n passes on all 8 changed files
• bun test — no regressions (12 pre-existing failures on main, unchanged)

🤖 Generated with Claude Code

[la14-1]

Self-review by security-auditor:

All 8 files correctly migrated from inline API key interpolation to safe injection helpers.

Verification checklist:

• SSH-based clouds (latitude, scaleway, upcloud) correctly use inject_env_vars_ssh with server IP as first arg
• Non-SSH clouds (daytona, e2b, modal, github-codespaces) correctly use inject_env_vars_local without server IP
• kamatera/nanoclaw.sh .env write uses temp file upload pattern (mktemp + chmod 600 + upload_file + mv) to avoid shell interpolation
• bash -n passes on all 8 files
• No test regressions (12 pre-existing failures on main, unchanged)
• The inject_env_vars_* helpers use generate_env_config() which single-quotes values, preventing $(), backtick, and semicolon injection

Note on #737: The .gitignore already has .claude/skills/*/start-*.sh (the broad glob pattern). No change needed — the issue was resolved by a prior commit (8140c1b).

[louisgv]

Security Review

Verdict: APPROVED

Summary

This PR replaces inline shell interpolation of API keys in run_server commands with the safe inject_env_vars_ssh / inject_env_vars_local helper functions. These helpers write env vars to a temp file, upload it, and append to shell config on the remote side — avoiding shell command interpolation of secrets entirely. This is a clear security improvement.

The kamatera/nanoclaw.sh change additionally replaces a printf-based .env write via run_server with a local temp file + upload approach, which similarly avoids passing the API key through remote shell interpolation.

Findings

• No CRITICAL issues found
• No HIGH issues found
• No MEDIUM issues found
• [LOW] github-codespaces/continue.sh — the original code used run_in_codespace but the PR switches to inject_env_vars_local upload_file run_server. This is actually correct because the codespaces lib defines upload_file() and run_server() wrappers that internally use CODESPACE_NAME, matching the inject_env_vars_local interface.
• [LOW] kamatera/nanoclaw.sh:44-49 — the temp file approach is good. chmod 600 and track_temp_file ensure proper permissions and cleanup. The uploaded file at /tmp/nanoclaw_env is immediately moved to ~/nanoclaw/.env, minimizing exposure window.

Tests

• bash -n: PASS (all 8 files)
• bun test: N/A (no .ts files changed)
• curl|bash pattern: OK (source/eval fallback patterns unchanged)
• macOS compat: OK (no echo -e, no source <(), no ((var++)), no set -u, no local in subshells)

Notes

• This PR has merge conflicts (CONFLICTING status) and cannot be auto-merged. The author will need to resolve conflicts before merging.
• The security improvement is sound: moving from inline shell interpolation of API keys to file-based injection eliminates a class of command injection risks where special characters in API keys could break shell quoting.

---

Automated security review by spawn security team

[louisgv]

Security Review

Verdict: APPROVED

Summary

This PR correctly replaces unsafe inline ${OPENROUTER_API_KEY} interpolation in run_server command strings with the safe inject_env_vars_ssh / inject_env_vars_local helpers across 8 agent scripts. The core defense is generate_env_config() in shared/common.sh, which single-quotes values and escapes embedded single quotes using the standard '\'' pattern — this prevents shell injection from API keys containing $(cmd), backticks, semicolons, or other metacharacters.

Findings

• [LOW] kamatera/nanoclaw.sh:47 — The .env file written via printf '%s' does not quote the value. If the API key contains characters that a .env parser might interpret (e.g., #, \n), it could be misread. In practice, NanoClaw uses node.js dotenv which handles this safely, and the value originates from OpenRouter OAuth which uses alphanumeric tokens. Risk is negligible.
• [LOW] kamatera/nanoclaw.sh:48-49 — The uploaded temp file at /tmp/nanoclaw_env on the remote server may briefly have default (world-readable) permissions before being mv'd. Since this is a freshly provisioned single-user server where the operator is root, this is not exploitable in practice.

No CRITICAL or HIGH issues found.

Tests

• bash -n: PASS (all 8 files)
• bun test: N/A (no test changes in this PR)
• curl|bash pattern: OK (all files use correct local-or-remote eval fallback)
• macOS compat: OK (no echo -e, source <(), ((var++)), set -u, or local-in-subshell)

Security Analysis

• Command injection: FIXED — the entire point of this PR. Inline ${OPENROUTER_API_KEY} in remote shell commands is replaced with temp-file-based injection that never passes the value through shell expansion.
• Credential leaks: OK — temp files created with chmod 600, tracked for cleanup via shred/rm on exit.
• Unsafe patterns: None introduced. No eval of user input, no source <().
• generate_env_config: Correct single-quote escaping (' → '\''). Values inside single quotes cannot be shell-expanded.

Note

This PR has merge conflicts (CONFLICTING status) that need resolution before merging.

---

Automated security review by spawn security team

[louisgv]

Security review passed with APPROVED verdict (2 LOW findings, no CRITICAL/HIGH). This PR has merge conflicts that need to be resolved before merging.

[la14-1]

Closing this PR as all changes are already present on main. The security fixes for API key interpolation in these 8 scripts (daytona/continue.sh, e2b/continue.sh, github-codespaces/continue.sh, kamatera/nanoclaw.sh, latitude/continue.sh, modal/continue.sh, scaleway/continue.sh, upcloud/continue.sh) were applied through other PRs. Rebasing confirms zero diff against main.

[la14-1]

Fixes#736

Summary

• Replaced inline ${OPENROUTER_API_KEY} interpolation in run_server command strings with safe inject_env_vars_ssh / inject_env_vars_local helpers across 8 agent scripts
• These helpers write env vars to a local temp file (with chmod 600), upload it to the remote server, and source it — completely avoiding shell metacharacter interpretation of API key values
• For kamatera/nanoclaw.sh, the .env file write also uses a temp file upload instead of inline interpolation

Why this matters

If an API key contained shell metacharacters (e.g., $(cmd), backticks, ; cmd), the previous pattern would execute them on the remote server. The inject_env_vars_* helpers from shared/common.sh already handle this safely by single-quoting values in generate_env_config().

Affected files

File	Fix
latitude/continue.sh	inject_env_vars_ssh
scaleway/continue.sh	inject_env_vars_ssh
upcloud/continue.sh	inject_env_vars_ssh
kamatera/nanoclaw.sh	temp file upload for .env
daytona/continue.sh	inject_env_vars_local
e2b/continue.sh	inject_env_vars_local
modal/continue.sh	inject_env_vars_local
github-codespaces/continue.sh	inject_env_vars_local

Note on #737

Issue #737 (.gitignore gap) is already resolved — the current .gitignore uses the broad pattern .claude/skills/*/start-*.sh which covers all skill subdirectories.

Test plan

• bash -n passes on all 8 changed files
• bun test — no regressions (12 pre-existing failures on main, unchanged)

🤖 Generated with Claude Code

[la14-1]

Self-review by security-auditor:

All 8 files correctly migrated from inline API key interpolation to safe injection helpers.

Verification checklist:

• SSH-based clouds (latitude, scaleway, upcloud) correctly use inject_env_vars_ssh with server IP as first arg
• Non-SSH clouds (daytona, e2b, modal, github-codespaces) correctly use inject_env_vars_local without server IP
• kamatera/nanoclaw.sh .env write uses temp file upload pattern (mktemp + chmod 600 + upload_file + mv) to avoid shell interpolation
• bash -n passes on all 8 files
• No test regressions (12 pre-existing failures on main, unchanged)
• The inject_env_vars_* helpers use generate_env_config() which single-quotes values, preventing $(), backtick, and semicolon injection

Note on #737: The .gitignore already has .claude/skills/*/start-*.sh (the broad glob pattern). No change needed — the issue was resolved by a prior commit (8140c1b).

[louisgv]

Security Review

Verdict: APPROVED

Summary

This PR replaces inline shell interpolation of API keys in run_server commands with the safe inject_env_vars_ssh / inject_env_vars_local helper functions. These helpers write env vars to a temp file, upload it, and append to shell config on the remote side — avoiding shell command interpolation of secrets entirely. This is a clear security improvement.

The kamatera/nanoclaw.sh change additionally replaces a printf-based .env write via run_server with a local temp file + upload approach, which similarly avoids passing the API key through remote shell interpolation.

Findings

• No CRITICAL issues found
• No HIGH issues found
• No MEDIUM issues found
• [LOW] github-codespaces/continue.sh — the original code used run_in_codespace but the PR switches to inject_env_vars_local upload_file run_server. This is actually correct because the codespaces lib defines upload_file() and run_server() wrappers that internally use CODESPACE_NAME, matching the inject_env_vars_local interface.
• [LOW] kamatera/nanoclaw.sh:44-49 — the temp file approach is good. chmod 600 and track_temp_file ensure proper permissions and cleanup. The uploaded file at /tmp/nanoclaw_env is immediately moved to ~/nanoclaw/.env, minimizing exposure window.

Tests

• bash -n: PASS (all 8 files)
• bun test: N/A (no .ts files changed)
• curl|bash pattern: OK (source/eval fallback patterns unchanged)
• macOS compat: OK (no echo -e, no source <(), no ((var++)), no set -u, no local in subshells)

Notes

• This PR has merge conflicts (CONFLICTING status) and cannot be auto-merged. The author will need to resolve conflicts before merging.
• The security improvement is sound: moving from inline shell interpolation of API keys to file-based injection eliminates a class of command injection risks where special characters in API keys could break shell quoting.

---

Automated security review by spawn security team

[louisgv]

Security Review

Verdict: APPROVED

Summary

This PR correctly replaces unsafe inline ${OPENROUTER_API_KEY} interpolation in run_server command strings with the safe inject_env_vars_ssh / inject_env_vars_local helpers across 8 agent scripts. The core defense is generate_env_config() in shared/common.sh, which single-quotes values and escapes embedded single quotes using the standard '\'' pattern — this prevents shell injection from API keys containing $(cmd), backticks, semicolons, or other metacharacters.

Findings

• [LOW] kamatera/nanoclaw.sh:47 — The .env file written via printf '%s' does not quote the value. If the API key contains characters that a .env parser might interpret (e.g., #, \n), it could be misread. In practice, NanoClaw uses node.js dotenv which handles this safely, and the value originates from OpenRouter OAuth which uses alphanumeric tokens. Risk is negligible.
• [LOW] kamatera/nanoclaw.sh:48-49 — The uploaded temp file at /tmp/nanoclaw_env on the remote server may briefly have default (world-readable) permissions before being mv'd. Since this is a freshly provisioned single-user server where the operator is root, this is not exploitable in practice.

No CRITICAL or HIGH issues found.

Tests

• bash -n: PASS (all 8 files)
• bun test: N/A (no test changes in this PR)
• curl|bash pattern: OK (all files use correct local-or-remote eval fallback)
• macOS compat: OK (no echo -e, source <(), ((var++)), set -u, or local-in-subshell)

Security Analysis

• Command injection: FIXED — the entire point of this PR. Inline ${OPENROUTER_API_KEY} in remote shell commands is replaced with temp-file-based injection that never passes the value through shell expansion.
• Credential leaks: OK — temp files created with chmod 600, tracked for cleanup via shred/rm on exit.
• Unsafe patterns: None introduced. No eval of user input, no source <().
• generate_env_config: Correct single-quote escaping (' → '\''). Values inside single quotes cannot be shell-expanded.

Note

This PR has merge conflicts (CONFLICTING status) that need resolution before merging.

---

Automated security review by spawn security team

[louisgv]

Security review passed with APPROVED verdict (2 LOW findings, no CRITICAL/HIGH). This PR has merge conflicts that need to be resolved before merging.

[la14-1]

Closing this PR as all changes are already present on main. The security fixes for API key interpolation in these 8 scripts (daytona/continue.sh, e2b/continue.sh, github-codespaces/continue.sh, kamatera/nanoclaw.sh, latitude/continue.sh, modal/continue.sh, scaleway/continue.sh, upcloud/continue.sh) were applied through other PRs. Rebasing confirms zero diff against main.

[la14-1]

Fixes#736

Summary

• Replaced inline ${OPENROUTER_API_KEY} interpolation in run_server command strings with safe inject_env_vars_ssh / inject_env_vars_local helpers across 8 agent scripts
• These helpers write env vars to a local temp file (with chmod 600), upload it to the remote server, and source it — completely avoiding shell metacharacter interpretation of API key values
• For kamatera/nanoclaw.sh, the .env file write also uses a temp file upload instead of inline interpolation

Why this matters

If an API key contained shell metacharacters (e.g., $(cmd), backticks, ; cmd), the previous pattern would execute them on the remote server. The inject_env_vars_* helpers from shared/common.sh already handle this safely by single-quoting values in generate_env_config().

Affected files

File	Fix
latitude/continue.sh	inject_env_vars_ssh
scaleway/continue.sh	inject_env_vars_ssh
upcloud/continue.sh	inject_env_vars_ssh
kamatera/nanoclaw.sh	temp file upload for .env
daytona/continue.sh	inject_env_vars_local
e2b/continue.sh	inject_env_vars_local
modal/continue.sh	inject_env_vars_local
github-codespaces/continue.sh	inject_env_vars_local

Note on #737

Issue #737 (.gitignore gap) is already resolved — the current .gitignore uses the broad pattern .claude/skills/*/start-*.sh which covers all skill subdirectories.

Test plan

• bash -n passes on all 8 changed files
• bun test — no regressions (12 pre-existing failures on main, unchanged)

🤖 Generated with Claude Code

[la14-1]

Self-review by security-auditor:

All 8 files correctly migrated from inline API key interpolation to safe injection helpers.

Verification checklist:

• SSH-based clouds (latitude, scaleway, upcloud) correctly use inject_env_vars_ssh with server IP as first arg
• Non-SSH clouds (daytona, e2b, modal, github-codespaces) correctly use inject_env_vars_local without server IP
• kamatera/nanoclaw.sh .env write uses temp file upload pattern (mktemp + chmod 600 + upload_file + mv) to avoid shell interpolation
• bash -n passes on all 8 files
• No test regressions (12 pre-existing failures on main, unchanged)
• The inject_env_vars_* helpers use generate_env_config() which single-quotes values, preventing $(), backtick, and semicolon injection

Note on #737: The .gitignore already has .claude/skills/*/start-*.sh (the broad glob pattern). No change needed — the issue was resolved by a prior commit (8140c1b).

[louisgv]

Security Review

Verdict: APPROVED

Summary

This PR replaces inline shell interpolation of API keys in run_server commands with the safe inject_env_vars_ssh / inject_env_vars_local helper functions. These helpers write env vars to a temp file, upload it, and append to shell config on the remote side — avoiding shell command interpolation of secrets entirely. This is a clear security improvement.

The kamatera/nanoclaw.sh change additionally replaces a printf-based .env write via run_server with a local temp file + upload approach, which similarly avoids passing the API key through remote shell interpolation.

Findings

• No CRITICAL issues found
• No HIGH issues found
• No MEDIUM issues found
• [LOW] github-codespaces/continue.sh — the original code used run_in_codespace but the PR switches to inject_env_vars_local upload_file run_server. This is actually correct because the codespaces lib defines upload_file() and run_server() wrappers that internally use CODESPACE_NAME, matching the inject_env_vars_local interface.
• [LOW] kamatera/nanoclaw.sh:44-49 — the temp file approach is good. chmod 600 and track_temp_file ensure proper permissions and cleanup. The uploaded file at /tmp/nanoclaw_env is immediately moved to ~/nanoclaw/.env, minimizing exposure window.

Tests

• bash -n: PASS (all 8 files)
• bun test: N/A (no .ts files changed)
• curl|bash pattern: OK (source/eval fallback patterns unchanged)
• macOS compat: OK (no echo -e, no source <(), no ((var++)), no set -u, no local in subshells)

Notes

• This PR has merge conflicts (CONFLICTING status) and cannot be auto-merged. The author will need to resolve conflicts before merging.
• The security improvement is sound: moving from inline shell interpolation of API keys to file-based injection eliminates a class of command injection risks where special characters in API keys could break shell quoting.

---

Automated security review by spawn security team

[louisgv]

Security Review

Verdict: APPROVED

Summary

This PR correctly replaces unsafe inline ${OPENROUTER_API_KEY} interpolation in run_server command strings with the safe inject_env_vars_ssh / inject_env_vars_local helpers across 8 agent scripts. The core defense is generate_env_config() in shared/common.sh, which single-quotes values and escapes embedded single quotes using the standard '\'' pattern — this prevents shell injection from API keys containing $(cmd), backticks, semicolons, or other metacharacters.

Findings

• [LOW] kamatera/nanoclaw.sh:47 — The .env file written via printf '%s' does not quote the value. If the API key contains characters that a .env parser might interpret (e.g., #, \n), it could be misread. In practice, NanoClaw uses node.js dotenv which handles this safely, and the value originates from OpenRouter OAuth which uses alphanumeric tokens. Risk is negligible.
• [LOW] kamatera/nanoclaw.sh:48-49 — The uploaded temp file at /tmp/nanoclaw_env on the remote server may briefly have default (world-readable) permissions before being mv'd. Since this is a freshly provisioned single-user server where the operator is root, this is not exploitable in practice.

No CRITICAL or HIGH issues found.

Tests

• bash -n: PASS (all 8 files)
• bun test: N/A (no test changes in this PR)
• curl|bash pattern: OK (all files use correct local-or-remote eval fallback)
• macOS compat: OK (no echo -e, source <(), ((var++)), set -u, or local-in-subshell)

Security Analysis

• Command injection: FIXED — the entire point of this PR. Inline ${OPENROUTER_API_KEY} in remote shell commands is replaced with temp-file-based injection that never passes the value through shell expansion.
• Credential leaks: OK — temp files created with chmod 600, tracked for cleanup via shred/rm on exit.
• Unsafe patterns: None introduced. No eval of user input, no source <().
• generate_env_config: Correct single-quote escaping (' → '\''). Values inside single quotes cannot be shell-expanded.

Note

This PR has merge conflicts (CONFLICTING status) that need resolution before merging.

---

Automated security review by spawn security team

[louisgv]

Security review passed with APPROVED verdict (2 LOW findings, no CRITICAL/HIGH). This PR has merge conflicts that need to be resolved before merging.

[la14-1]

Closing this PR as all changes are already present on main. The security fixes for API key interpolation in these 8 scripts (daytona/continue.sh, e2b/continue.sh, github-codespaces/continue.sh, kamatera/nanoclaw.sh, latitude/continue.sh, modal/continue.sh, scaleway/continue.sh, upcloud/continue.sh) were applied through other PRs. Rebasing confirms zero diff against main.

[la14-1]

Fixes#736

Summary

• Replaced inline ${OPENROUTER_API_KEY} interpolation in run_server command strings with safe inject_env_vars_ssh / inject_env_vars_local helpers across 8 agent scripts
• These helpers write env vars to a local temp file (with chmod 600), upload it to the remote server, and source it — completely avoiding shell metacharacter interpretation of API key values
• For kamatera/nanoclaw.sh, the .env file write also uses a temp file upload instead of inline interpolation

Why this matters

If an API key contained shell metacharacters (e.g., $(cmd), backticks, ; cmd), the previous pattern would execute them on the remote server. The inject_env_vars_* helpers from shared/common.sh already handle this safely by single-quoting values in generate_env_config().

Affected files

File	Fix
latitude/continue.sh	inject_env_vars_ssh
scaleway/continue.sh	inject_env_vars_ssh
upcloud/continue.sh	inject_env_vars_ssh
kamatera/nanoclaw.sh	temp file upload for .env
daytona/continue.sh	inject_env_vars_local
e2b/continue.sh	inject_env_vars_local
modal/continue.sh	inject_env_vars_local
github-codespaces/continue.sh	inject_env_vars_local

Note on #737

Issue #737 (.gitignore gap) is already resolved — the current .gitignore uses the broad pattern .claude/skills/*/start-*.sh which covers all skill subdirectories.

Test plan

• bash -n passes on all 8 changed files
• bun test — no regressions (12 pre-existing failures on main, unchanged)

🤖 Generated with Claude Code

[la14-1]

Self-review by security-auditor:

All 8 files correctly migrated from inline API key interpolation to safe injection helpers.

Verification checklist:

• SSH-based clouds (latitude, scaleway, upcloud) correctly use inject_env_vars_ssh with server IP as first arg
• Non-SSH clouds (daytona, e2b, modal, github-codespaces) correctly use inject_env_vars_local without server IP
• kamatera/nanoclaw.sh .env write uses temp file upload pattern (mktemp + chmod 600 + upload_file + mv) to avoid shell interpolation
• bash -n passes on all 8 files
• No test regressions (12 pre-existing failures on main, unchanged)
• The inject_env_vars_* helpers use generate_env_config() which single-quotes values, preventing $(), backtick, and semicolon injection

Note on #737: The .gitignore already has .claude/skills/*/start-*.sh (the broad glob pattern). No change needed — the issue was resolved by a prior commit (8140c1b).

[louisgv]

Security Review

Verdict: APPROVED

Summary

This PR replaces inline shell interpolation of API keys in run_server commands with the safe inject_env_vars_ssh / inject_env_vars_local helper functions. These helpers write env vars to a temp file, upload it, and append to shell config on the remote side — avoiding shell command interpolation of secrets entirely. This is a clear security improvement.

The kamatera/nanoclaw.sh change additionally replaces a printf-based .env write via run_server with a local temp file + upload approach, which similarly avoids passing the API key through remote shell interpolation.

Findings

• No CRITICAL issues found
• No HIGH issues found
• No MEDIUM issues found
• [LOW] github-codespaces/continue.sh — the original code used run_in_codespace but the PR switches to inject_env_vars_local upload_file run_server. This is actually correct because the codespaces lib defines upload_file() and run_server() wrappers that internally use CODESPACE_NAME, matching the inject_env_vars_local interface.
• [LOW] kamatera/nanoclaw.sh:44-49 — the temp file approach is good. chmod 600 and track_temp_file ensure proper permissions and cleanup. The uploaded file at /tmp/nanoclaw_env is immediately moved to ~/nanoclaw/.env, minimizing exposure window.

Tests

• bash -n: PASS (all 8 files)
• bun test: N/A (no .ts files changed)
• curl|bash pattern: OK (source/eval fallback patterns unchanged)
• macOS compat: OK (no echo -e, no source <(), no ((var++)), no set -u, no local in subshells)

Notes

• This PR has merge conflicts (CONFLICTING status) and cannot be auto-merged. The author will need to resolve conflicts before merging.
• The security improvement is sound: moving from inline shell interpolation of API keys to file-based injection eliminates a class of command injection risks where special characters in API keys could break shell quoting.

---

Automated security review by spawn security team

[louisgv]

Security Review

Verdict: APPROVED

Summary

This PR correctly replaces unsafe inline ${OPENROUTER_API_KEY} interpolation in run_server command strings with the safe inject_env_vars_ssh / inject_env_vars_local helpers across 8 agent scripts. The core defense is generate_env_config() in shared/common.sh, which single-quotes values and escapes embedded single quotes using the standard '\'' pattern — this prevents shell injection from API keys containing $(cmd), backticks, semicolons, or other metacharacters.

Findings

• [LOW] kamatera/nanoclaw.sh:47 — The .env file written via printf '%s' does not quote the value. If the API key contains characters that a .env parser might interpret (e.g., #, \n), it could be misread. In practice, NanoClaw uses node.js dotenv which handles this safely, and the value originates from OpenRouter OAuth which uses alphanumeric tokens. Risk is negligible.
• [LOW] kamatera/nanoclaw.sh:48-49 — The uploaded temp file at /tmp/nanoclaw_env on the remote server may briefly have default (world-readable) permissions before being mv'd. Since this is a freshly provisioned single-user server where the operator is root, this is not exploitable in practice.

No CRITICAL or HIGH issues found.

Tests

• bash -n: PASS (all 8 files)
• bun test: N/A (no test changes in this PR)
• curl|bash pattern: OK (all files use correct local-or-remote eval fallback)
• macOS compat: OK (no echo -e, source <(), ((var++)), set -u, or local-in-subshell)

Security Analysis

• Command injection: FIXED — the entire point of this PR. Inline ${OPENROUTER_API_KEY} in remote shell commands is replaced with temp-file-based injection that never passes the value through shell expansion.
• Credential leaks: OK — temp files created with chmod 600, tracked for cleanup via shred/rm on exit.
• Unsafe patterns: None introduced. No eval of user input, no source <().
• generate_env_config: Correct single-quote escaping (' → '\''). Values inside single quotes cannot be shell-expanded.

Note

This PR has merge conflicts (CONFLICTING status) that need resolution before merging.

---

Automated security review by spawn security team

[louisgv]

Security review passed with APPROVED verdict (2 LOW findings, no CRITICAL/HIGH). This PR has merge conflicts that need to be resolved before merging.

[la14-1]

Closing this PR as all changes are already present on main. The security fixes for API key interpolation in these 8 scripts (daytona/continue.sh, e2b/continue.sh, github-codespaces/continue.sh, kamatera/nanoclaw.sh, latitude/continue.sh, modal/continue.sh, scaleway/continue.sh, upcloud/continue.sh) were applied through other PRs. Rebasing confirms zero diff against main.

[la14-1]

Fixes#736

Summary

• Replaced inline ${OPENROUTER_API_KEY} interpolation in run_server command strings with safe inject_env_vars_ssh / inject_env_vars_local helpers across 8 agent scripts
• These helpers write env vars to a local temp file (with chmod 600), upload it to the remote server, and source it — completely avoiding shell metacharacter interpretation of API key values
• For kamatera/nanoclaw.sh, the .env file write also uses a temp file upload instead of inline interpolation

Why this matters

If an API key contained shell metacharacters (e.g., $(cmd), backticks, ; cmd), the previous pattern would execute them on the remote server. The inject_env_vars_* helpers from shared/common.sh already handle this safely by single-quoting values in generate_env_config().

Affected files

File	Fix
latitude/continue.sh	inject_env_vars_ssh
scaleway/continue.sh	inject_env_vars_ssh
upcloud/continue.sh	inject_env_vars_ssh
kamatera/nanoclaw.sh	temp file upload for .env
daytona/continue.sh	inject_env_vars_local
e2b/continue.sh	inject_env_vars_local
modal/continue.sh	inject_env_vars_local
github-codespaces/continue.sh	inject_env_vars_local

Note on #737

Issue #737 (.gitignore gap) is already resolved — the current .gitignore uses the broad pattern .claude/skills/*/start-*.sh which covers all skill subdirectories.

Test plan

• bash -n passes on all 8 changed files
• bun test — no regressions (12 pre-existing failures on main, unchanged)

🤖 Generated with Claude Code

[la14-1]

Self-review by security-auditor:

All 8 files correctly migrated from inline API key interpolation to safe injection helpers.

Verification checklist:

• SSH-based clouds (latitude, scaleway, upcloud) correctly use inject_env_vars_ssh with server IP as first arg
• Non-SSH clouds (daytona, e2b, modal, github-codespaces) correctly use inject_env_vars_local without server IP
• kamatera/nanoclaw.sh .env write uses temp file upload pattern (mktemp + chmod 600 + upload_file + mv) to avoid shell interpolation
• bash -n passes on all 8 files
• No test regressions (12 pre-existing failures on main, unchanged)
• The inject_env_vars_* helpers use generate_env_config() which single-quotes values, preventing $(), backtick, and semicolon injection

Note on #737: The .gitignore already has .claude/skills/*/start-*.sh (the broad glob pattern). No change needed — the issue was resolved by a prior commit (8140c1b).

[louisgv]

Security Review

Verdict: APPROVED

Summary

This PR replaces inline shell interpolation of API keys in run_server commands with the safe inject_env_vars_ssh / inject_env_vars_local helper functions. These helpers write env vars to a temp file, upload it, and append to shell config on the remote side — avoiding shell command interpolation of secrets entirely. This is a clear security improvement.

The kamatera/nanoclaw.sh change additionally replaces a printf-based .env write via run_server with a local temp file + upload approach, which similarly avoids passing the API key through remote shell interpolation.

Findings

• No CRITICAL issues found
• No HIGH issues found
• No MEDIUM issues found
• [LOW] github-codespaces/continue.sh — the original code used run_in_codespace but the PR switches to inject_env_vars_local upload_file run_server. This is actually correct because the codespaces lib defines upload_file() and run_server() wrappers that internally use CODESPACE_NAME, matching the inject_env_vars_local interface.
• [LOW] kamatera/nanoclaw.sh:44-49 — the temp file approach is good. chmod 600 and track_temp_file ensure proper permissions and cleanup. The uploaded file at /tmp/nanoclaw_env is immediately moved to ~/nanoclaw/.env, minimizing exposure window.

Tests

• bash -n: PASS (all 8 files)
• bun test: N/A (no .ts files changed)
• curl|bash pattern: OK (source/eval fallback patterns unchanged)
• macOS compat: OK (no echo -e, no source <(), no ((var++)), no set -u, no local in subshells)

Notes

• This PR has merge conflicts (CONFLICTING status) and cannot be auto-merged. The author will need to resolve conflicts before merging.
• The security improvement is sound: moving from inline shell interpolation of API keys to file-based injection eliminates a class of command injection risks where special characters in API keys could break shell quoting.

---

Automated security review by spawn security team

[louisgv]

Security Review

Verdict: APPROVED

Summary

This PR correctly replaces unsafe inline ${OPENROUTER_API_KEY} interpolation in run_server command strings with the safe inject_env_vars_ssh / inject_env_vars_local helpers across 8 agent scripts. The core defense is generate_env_config() in shared/common.sh, which single-quotes values and escapes embedded single quotes using the standard '\'' pattern — this prevents shell injection from API keys containing $(cmd), backticks, semicolons, or other metacharacters.

Findings

• [LOW] kamatera/nanoclaw.sh:47 — The .env file written via printf '%s' does not quote the value. If the API key contains characters that a .env parser might interpret (e.g., #, \n), it could be misread. In practice, NanoClaw uses node.js dotenv which handles this safely, and the value originates from OpenRouter OAuth which uses alphanumeric tokens. Risk is negligible.
• [LOW] kamatera/nanoclaw.sh:48-49 — The uploaded temp file at /tmp/nanoclaw_env on the remote server may briefly have default (world-readable) permissions before being mv'd. Since this is a freshly provisioned single-user server where the operator is root, this is not exploitable in practice.

No CRITICAL or HIGH issues found.

Tests

• bash -n: PASS (all 8 files)
• bun test: N/A (no test changes in this PR)
• curl|bash pattern: OK (all files use correct local-or-remote eval fallback)
• macOS compat: OK (no echo -e, source <(), ((var++)), set -u, or local-in-subshell)

Security Analysis

• Command injection: FIXED — the entire point of this PR. Inline ${OPENROUTER_API_KEY} in remote shell commands is replaced with temp-file-based injection that never passes the value through shell expansion.
• Credential leaks: OK — temp files created with chmod 600, tracked for cleanup via shred/rm on exit.
• Unsafe patterns: None introduced. No eval of user input, no source <().
• generate_env_config: Correct single-quote escaping (' → '\''). Values inside single quotes cannot be shell-expanded.

Note

This PR has merge conflicts (CONFLICTING status) that need resolution before merging.

---

Automated security review by spawn security team

[louisgv]

Security review passed with APPROVED verdict (2 LOW findings, no CRITICAL/HIGH). This PR has merge conflicts that need to be resolved before merging.

[la14-1]

Closing this PR as all changes are already present on main. The security fixes for API key interpolation in these 8 scripts (daytona/continue.sh, e2b/continue.sh, github-codespaces/continue.sh, kamatera/nanoclaw.sh, latitude/continue.sh, modal/continue.sh, scaleway/continue.sh, upcloud/continue.sh) were applied through other PRs. Rebasing confirms zero diff against main.