refactor: reduce complexity in ramnode picker and cmdInteractive by la14-1 · Pull Request #756 · OpenRouterLabs/spawn

la14-1 · 2026-02-12T23:42:29Z

Summary

Replace RamNode's custom _pick_flavor (37 lines of hand-rolled picker logic) with a single call to the shared interactive_pick helper, eliminating code duplication with Hetzner, netcup, and Hostinger which already use this pattern
Extract inline credential-sorting logic from cmdInteractive into a standalone prioritizeCloudsByCredentials function for better testability and readability

Net reduction: 27 lines (-55 / +28)

Test plan

bash -n ramnode/lib/common.sh passes
bun test passes (6062/6075, 13 pre-existing failures unrelated to this change)
All 572 commands tests pass with 0 failures
No functional changes — both refactors preserve identical behavior

🤖 Generated with Claude Code

la14-1

Self-review by complexity-hunter:

RamNode _pick_flavor refactor: Replaced 37 lines of hand-rolled interactive picker logic with a single call to interactive_pick from shared/common.sh. This follows the same pattern already used by Hetzner, netcup, and Hostinger. The _list_flavors function already outputs pipe-delimited lines with ID as the first field, which is exactly the format interactive_pick expects. The env var check (RAMNODE_FLAVOR), default value (1GB), and display behavior are all preserved by the shared helper.

cmdInteractive credential sorting: Extracted the inline credential partitioning and hint-building logic into a standalone prioritizeCloudsByCredentials function. This is a pure function that takes clouds + manifest and returns sorted clouds, hint overrides, and credential count. The function is exported for potential future unit testing. No behavioral changes — the interactive picker works identically.

Both changes verified with bash -n and bun test (all 572 command tests pass).

la14-1 · 2026-02-12T23:44:13Z

PR Review by pr-maintainer:

Reviewed. Clean refactor extracting prioritizeCloudsByCredentials from cmdInteractive (improves testability) and replacing the 35-line custom _pick_flavor with the shared interactive_pick helper (reduces duplication). No behavioral changes, no security concerns. Ready for human approval.

louisgv

Security Review

Verdict: APPROVED

Findings

No security issues found.

Both changes are pure refactors with identical runtime behavior:

ramnode/lib/common.sh: Replaces 37-line hand-rolled _pick_flavor with a single call to the shared interactive_pick helper. No new input handling, no shell injection vectors, env var fallback pattern preserved.
cli/src/commands.ts: Extracts inline credential-sorting into prioritizeCloudsByCredentials() pure function. No new external input paths, manifest description used only in local terminal display (no XSS risk).

Tests

bash -n: PASS (ramnode/lib/common.sh)
bun test: PASS (6062/6075, 13 pre-existing failures identical to main)
curl|bash pattern: OK (source/eval fallback not modified)
macOS compat: OK (no bash 3.x incompatible patterns introduced)

Automated security review by spawn security team

louisgv · 2026-02-12T23:53:15Z

Merge Conflict Notice

This PR was approved in the security review cycle, but now has merge conflicts (likely caused by other PRs merging first: #755, #757, #758).

The PR has the security-approved label — once conflicts are resolved, it should be safe to merge.

Automated notice by spawn security review team

- Replace RamNode's custom _pick_flavor (37 lines) with shared interactive_pick helper (1 line), eliminating duplicated picker logic - Extract credential sorting from cmdInteractive into reusable prioritizeCloudsByCredentials helper for testability and clarity Agent: complexity-hunter Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

la14-1 · 2026-02-12T23:54:10Z

Rebased onto latest main to resolve merge conflict. The conflict was trivial: log_info -> log_step rename (from cf53ea1) in ramnode/lib/common.sh lines that this PR removes entirely. The code changes are identical to the previously-approved version.

Re-review summary (pr-maintainer):

Both refactors are pure behavior-preserving extractions
No security issues (no new input handling, no injection vectors)
bash -n ramnode/lib/common.sh passes
Ready for external review and merge.

la14-1

Reviewed by pr-maintainer: Clean refactoring - extracts prioritizeCloudsByCredentials from cmdInteractive for testability, delegates ramnode _pick_flavor to shared interactive_pick helper. Pure refactoring, no behavior changes. LGTM.

louisgv

Security Review

Verdict: APPROVED

Findings

No security issues found. This is a clean refactor:

prioritizeCloudsByCredentials extraction: identical logic moved from cmdInteractive to a standalone typed function. No new inputs, no injection surfaces.
_pick_flavor simplification: delegates to the shared interactive_pick helper using the same pattern as Hetzner, netcup, and Hostinger. All arguments are string literals or function names.

Tests

bash -n: PASS
bun test: PASS (6375/6388, 13 pre-existing failures unrelated to this PR)
curl|bash pattern: OK (no changes to source/eval fallback)
macOS compat: OK (no bash 3.x incompatible constructs introduced)

Automated security review by spawn security team

la14-1 · 2026-02-12T23:42:29Z

Summary

Replace RamNode's custom _pick_flavor (37 lines of hand-rolled picker logic) with a single call to the shared interactive_pick helper, eliminating code duplication with Hetzner, netcup, and Hostinger which already use this pattern
Extract inline credential-sorting logic from cmdInteractive into a standalone prioritizeCloudsByCredentials function for better testability and readability

Net reduction: 27 lines (-55 / +28)

Test plan

bash -n ramnode/lib/common.sh passes
bun test passes (6062/6075, 13 pre-existing failures unrelated to this change)
All 572 commands tests pass with 0 failures
No functional changes — both refactors preserve identical behavior

🤖 Generated with Claude Code

la14-1

Self-review by complexity-hunter:

RamNode _pick_flavor refactor: Replaced 37 lines of hand-rolled interactive picker logic with a single call to interactive_pick from shared/common.sh. This follows the same pattern already used by Hetzner, netcup, and Hostinger. The _list_flavors function already outputs pipe-delimited lines with ID as the first field, which is exactly the format interactive_pick expects. The env var check (RAMNODE_FLAVOR), default value (1GB), and display behavior are all preserved by the shared helper.

cmdInteractive credential sorting: Extracted the inline credential partitioning and hint-building logic into a standalone prioritizeCloudsByCredentials function. This is a pure function that takes clouds + manifest and returns sorted clouds, hint overrides, and credential count. The function is exported for potential future unit testing. No behavioral changes — the interactive picker works identically.

Both changes verified with bash -n and bun test (all 572 command tests pass).

la14-1 · 2026-02-12T23:44:13Z

PR Review by pr-maintainer:

Reviewed. Clean refactor extracting prioritizeCloudsByCredentials from cmdInteractive (improves testability) and replacing the 35-line custom _pick_flavor with the shared interactive_pick helper (reduces duplication). No behavioral changes, no security concerns. Ready for human approval.

louisgv

Security Review

Verdict: APPROVED

Findings

No security issues found.

Both changes are pure refactors with identical runtime behavior:

ramnode/lib/common.sh: Replaces 37-line hand-rolled _pick_flavor with a single call to the shared interactive_pick helper. No new input handling, no shell injection vectors, env var fallback pattern preserved.
cli/src/commands.ts: Extracts inline credential-sorting into prioritizeCloudsByCredentials() pure function. No new external input paths, manifest description used only in local terminal display (no XSS risk).

Tests

bash -n: PASS (ramnode/lib/common.sh)
bun test: PASS (6062/6075, 13 pre-existing failures identical to main)
curl|bash pattern: OK (source/eval fallback not modified)
macOS compat: OK (no bash 3.x incompatible patterns introduced)

Automated security review by spawn security team

louisgv · 2026-02-12T23:53:15Z

Merge Conflict Notice

This PR was approved in the security review cycle, but now has merge conflicts (likely caused by other PRs merging first: #755, #757, #758).

The PR has the security-approved label — once conflicts are resolved, it should be safe to merge.

Automated notice by spawn security review team

- Replace RamNode's custom _pick_flavor (37 lines) with shared interactive_pick helper (1 line), eliminating duplicated picker logic - Extract credential sorting from cmdInteractive into reusable prioritizeCloudsByCredentials helper for testability and clarity Agent: complexity-hunter Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

la14-1 · 2026-02-12T23:54:10Z

Rebased onto latest main to resolve merge conflict. The conflict was trivial: log_info -> log_step rename (from cf53ea1) in ramnode/lib/common.sh lines that this PR removes entirely. The code changes are identical to the previously-approved version.

Re-review summary (pr-maintainer):

Both refactors are pure behavior-preserving extractions
No security issues (no new input handling, no injection vectors)
bash -n ramnode/lib/common.sh passes
Ready for external review and merge.

la14-1

Reviewed by pr-maintainer: Clean refactoring - extracts prioritizeCloudsByCredentials from cmdInteractive for testability, delegates ramnode _pick_flavor to shared interactive_pick helper. Pure refactoring, no behavior changes. LGTM.

louisgv

Security Review

Verdict: APPROVED

Findings

No security issues found. This is a clean refactor:

prioritizeCloudsByCredentials extraction: identical logic moved from cmdInteractive to a standalone typed function. No new inputs, no injection surfaces.
_pick_flavor simplification: delegates to the shared interactive_pick helper using the same pattern as Hetzner, netcup, and Hostinger. All arguments are string literals or function names.

Tests

bash -n: PASS
bun test: PASS (6375/6388, 13 pre-existing failures unrelated to this PR)
curl|bash pattern: OK (no changes to source/eval fallback)
macOS compat: OK (no bash 3.x incompatible constructs introduced)

Automated security review by spawn security team

la14-1 · 2026-02-12T23:42:29Z

Summary

Replace RamNode's custom _pick_flavor (37 lines of hand-rolled picker logic) with a single call to the shared interactive_pick helper, eliminating code duplication with Hetzner, netcup, and Hostinger which already use this pattern
Extract inline credential-sorting logic from cmdInteractive into a standalone prioritizeCloudsByCredentials function for better testability and readability

Net reduction: 27 lines (-55 / +28)

Test plan

bash -n ramnode/lib/common.sh passes
bun test passes (6062/6075, 13 pre-existing failures unrelated to this change)
All 572 commands tests pass with 0 failures
No functional changes — both refactors preserve identical behavior

🤖 Generated with Claude Code

la14-1

Self-review by complexity-hunter:

RamNode _pick_flavor refactor: Replaced 37 lines of hand-rolled interactive picker logic with a single call to interactive_pick from shared/common.sh. This follows the same pattern already used by Hetzner, netcup, and Hostinger. The _list_flavors function already outputs pipe-delimited lines with ID as the first field, which is exactly the format interactive_pick expects. The env var check (RAMNODE_FLAVOR), default value (1GB), and display behavior are all preserved by the shared helper.

cmdInteractive credential sorting: Extracted the inline credential partitioning and hint-building logic into a standalone prioritizeCloudsByCredentials function. This is a pure function that takes clouds + manifest and returns sorted clouds, hint overrides, and credential count. The function is exported for potential future unit testing. No behavioral changes — the interactive picker works identically.

Both changes verified with bash -n and bun test (all 572 command tests pass).

la14-1 · 2026-02-12T23:44:13Z

PR Review by pr-maintainer:

Reviewed. Clean refactor extracting prioritizeCloudsByCredentials from cmdInteractive (improves testability) and replacing the 35-line custom _pick_flavor with the shared interactive_pick helper (reduces duplication). No behavioral changes, no security concerns. Ready for human approval.

louisgv

Security Review

Verdict: APPROVED

Findings

No security issues found.

Both changes are pure refactors with identical runtime behavior:

ramnode/lib/common.sh: Replaces 37-line hand-rolled _pick_flavor with a single call to the shared interactive_pick helper. No new input handling, no shell injection vectors, env var fallback pattern preserved.
cli/src/commands.ts: Extracts inline credential-sorting into prioritizeCloudsByCredentials() pure function. No new external input paths, manifest description used only in local terminal display (no XSS risk).

Tests

bash -n: PASS (ramnode/lib/common.sh)
bun test: PASS (6062/6075, 13 pre-existing failures identical to main)
curl|bash pattern: OK (source/eval fallback not modified)
macOS compat: OK (no bash 3.x incompatible patterns introduced)

Automated security review by spawn security team

louisgv · 2026-02-12T23:53:15Z

Merge Conflict Notice

This PR was approved in the security review cycle, but now has merge conflicts (likely caused by other PRs merging first: #755, #757, #758).

The PR has the security-approved label — once conflicts are resolved, it should be safe to merge.

Automated notice by spawn security review team

- Replace RamNode's custom _pick_flavor (37 lines) with shared interactive_pick helper (1 line), eliminating duplicated picker logic - Extract credential sorting from cmdInteractive into reusable prioritizeCloudsByCredentials helper for testability and clarity Agent: complexity-hunter Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

la14-1 · 2026-02-12T23:54:10Z

Rebased onto latest main to resolve merge conflict. The conflict was trivial: log_info -> log_step rename (from cf53ea1) in ramnode/lib/common.sh lines that this PR removes entirely. The code changes are identical to the previously-approved version.

Re-review summary (pr-maintainer):

Both refactors are pure behavior-preserving extractions
No security issues (no new input handling, no injection vectors)
bash -n ramnode/lib/common.sh passes
Ready for external review and merge.

la14-1

Reviewed by pr-maintainer: Clean refactoring - extracts prioritizeCloudsByCredentials from cmdInteractive for testability, delegates ramnode _pick_flavor to shared interactive_pick helper. Pure refactoring, no behavior changes. LGTM.

louisgv

Security Review

Verdict: APPROVED

Findings

No security issues found. This is a clean refactor:

prioritizeCloudsByCredentials extraction: identical logic moved from cmdInteractive to a standalone typed function. No new inputs, no injection surfaces.
_pick_flavor simplification: delegates to the shared interactive_pick helper using the same pattern as Hetzner, netcup, and Hostinger. All arguments are string literals or function names.

Tests

bash -n: PASS
bun test: PASS (6375/6388, 13 pre-existing failures unrelated to this PR)
curl|bash pattern: OK (no changes to source/eval fallback)
macOS compat: OK (no bash 3.x incompatible constructs introduced)

Automated security review by spawn security team

la14-1 · 2026-02-12T23:42:29Z

Summary

Replace RamNode's custom _pick_flavor (37 lines of hand-rolled picker logic) with a single call to the shared interactive_pick helper, eliminating code duplication with Hetzner, netcup, and Hostinger which already use this pattern
Extract inline credential-sorting logic from cmdInteractive into a standalone prioritizeCloudsByCredentials function for better testability and readability

Net reduction: 27 lines (-55 / +28)

Test plan

bash -n ramnode/lib/common.sh passes
bun test passes (6062/6075, 13 pre-existing failures unrelated to this change)
All 572 commands tests pass with 0 failures
No functional changes — both refactors preserve identical behavior

🤖 Generated with Claude Code

la14-1

Self-review by complexity-hunter:

RamNode _pick_flavor refactor: Replaced 37 lines of hand-rolled interactive picker logic with a single call to interactive_pick from shared/common.sh. This follows the same pattern already used by Hetzner, netcup, and Hostinger. The _list_flavors function already outputs pipe-delimited lines with ID as the first field, which is exactly the format interactive_pick expects. The env var check (RAMNODE_FLAVOR), default value (1GB), and display behavior are all preserved by the shared helper.

cmdInteractive credential sorting: Extracted the inline credential partitioning and hint-building logic into a standalone prioritizeCloudsByCredentials function. This is a pure function that takes clouds + manifest and returns sorted clouds, hint overrides, and credential count. The function is exported for potential future unit testing. No behavioral changes — the interactive picker works identically.

Both changes verified with bash -n and bun test (all 572 command tests pass).

la14-1 · 2026-02-12T23:44:13Z

PR Review by pr-maintainer:

Reviewed. Clean refactor extracting prioritizeCloudsByCredentials from cmdInteractive (improves testability) and replacing the 35-line custom _pick_flavor with the shared interactive_pick helper (reduces duplication). No behavioral changes, no security concerns. Ready for human approval.

louisgv

Security Review

Verdict: APPROVED

Findings

No security issues found.

Both changes are pure refactors with identical runtime behavior:

ramnode/lib/common.sh: Replaces 37-line hand-rolled _pick_flavor with a single call to the shared interactive_pick helper. No new input handling, no shell injection vectors, env var fallback pattern preserved.
cli/src/commands.ts: Extracts inline credential-sorting into prioritizeCloudsByCredentials() pure function. No new external input paths, manifest description used only in local terminal display (no XSS risk).

Tests

bash -n: PASS (ramnode/lib/common.sh)
bun test: PASS (6062/6075, 13 pre-existing failures identical to main)
curl|bash pattern: OK (source/eval fallback not modified)
macOS compat: OK (no bash 3.x incompatible patterns introduced)

Automated security review by spawn security team

louisgv · 2026-02-12T23:53:15Z

Merge Conflict Notice

This PR was approved in the security review cycle, but now has merge conflicts (likely caused by other PRs merging first: #755, #757, #758).

The PR has the security-approved label — once conflicts are resolved, it should be safe to merge.

Automated notice by spawn security review team

- Replace RamNode's custom _pick_flavor (37 lines) with shared interactive_pick helper (1 line), eliminating duplicated picker logic - Extract credential sorting from cmdInteractive into reusable prioritizeCloudsByCredentials helper for testability and clarity Agent: complexity-hunter Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

la14-1 · 2026-02-12T23:54:10Z

Rebased onto latest main to resolve merge conflict. The conflict was trivial: log_info -> log_step rename (from cf53ea1) in ramnode/lib/common.sh lines that this PR removes entirely. The code changes are identical to the previously-approved version.

Re-review summary (pr-maintainer):

Both refactors are pure behavior-preserving extractions
No security issues (no new input handling, no injection vectors)
bash -n ramnode/lib/common.sh passes
Ready for external review and merge.

la14-1

Reviewed by pr-maintainer: Clean refactoring - extracts prioritizeCloudsByCredentials from cmdInteractive for testability, delegates ramnode _pick_flavor to shared interactive_pick helper. Pure refactoring, no behavior changes. LGTM.

louisgv

Security Review

Verdict: APPROVED

Findings

No security issues found. This is a clean refactor:

prioritizeCloudsByCredentials extraction: identical logic moved from cmdInteractive to a standalone typed function. No new inputs, no injection surfaces.
_pick_flavor simplification: delegates to the shared interactive_pick helper using the same pattern as Hetzner, netcup, and Hostinger. All arguments are string literals or function names.

Tests

bash -n: PASS
bun test: PASS (6375/6388, 13 pre-existing failures unrelated to this PR)
curl|bash pattern: OK (no changes to source/eval fallback)
macOS compat: OK (no bash 3.x incompatible constructs introduced)

Automated security review by spawn security team

la14-1 · 2026-02-12T23:42:29Z

Summary

Replace RamNode's custom _pick_flavor (37 lines of hand-rolled picker logic) with a single call to the shared interactive_pick helper, eliminating code duplication with Hetzner, netcup, and Hostinger which already use this pattern
Extract inline credential-sorting logic from cmdInteractive into a standalone prioritizeCloudsByCredentials function for better testability and readability

Net reduction: 27 lines (-55 / +28)

Test plan

bash -n ramnode/lib/common.sh passes
bun test passes (6062/6075, 13 pre-existing failures unrelated to this change)
All 572 commands tests pass with 0 failures
No functional changes — both refactors preserve identical behavior

🤖 Generated with Claude Code

la14-1

Self-review by complexity-hunter:

RamNode _pick_flavor refactor: Replaced 37 lines of hand-rolled interactive picker logic with a single call to interactive_pick from shared/common.sh. This follows the same pattern already used by Hetzner, netcup, and Hostinger. The _list_flavors function already outputs pipe-delimited lines with ID as the first field, which is exactly the format interactive_pick expects. The env var check (RAMNODE_FLAVOR), default value (1GB), and display behavior are all preserved by the shared helper.

cmdInteractive credential sorting: Extracted the inline credential partitioning and hint-building logic into a standalone prioritizeCloudsByCredentials function. This is a pure function that takes clouds + manifest and returns sorted clouds, hint overrides, and credential count. The function is exported for potential future unit testing. No behavioral changes — the interactive picker works identically.

Both changes verified with bash -n and bun test (all 572 command tests pass).

la14-1 · 2026-02-12T23:44:13Z

PR Review by pr-maintainer:

Reviewed. Clean refactor extracting prioritizeCloudsByCredentials from cmdInteractive (improves testability) and replacing the 35-line custom _pick_flavor with the shared interactive_pick helper (reduces duplication). No behavioral changes, no security concerns. Ready for human approval.

louisgv

Security Review

Verdict: APPROVED

Findings

No security issues found.

Both changes are pure refactors with identical runtime behavior:

ramnode/lib/common.sh: Replaces 37-line hand-rolled _pick_flavor with a single call to the shared interactive_pick helper. No new input handling, no shell injection vectors, env var fallback pattern preserved.
cli/src/commands.ts: Extracts inline credential-sorting into prioritizeCloudsByCredentials() pure function. No new external input paths, manifest description used only in local terminal display (no XSS risk).

Tests

bash -n: PASS (ramnode/lib/common.sh)
bun test: PASS (6062/6075, 13 pre-existing failures identical to main)
curl|bash pattern: OK (source/eval fallback not modified)
macOS compat: OK (no bash 3.x incompatible patterns introduced)

Automated security review by spawn security team

louisgv · 2026-02-12T23:53:15Z

Merge Conflict Notice

This PR was approved in the security review cycle, but now has merge conflicts (likely caused by other PRs merging first: #755, #757, #758).

The PR has the security-approved label — once conflicts are resolved, it should be safe to merge.

Automated notice by spawn security review team

- Replace RamNode's custom _pick_flavor (37 lines) with shared interactive_pick helper (1 line), eliminating duplicated picker logic - Extract credential sorting from cmdInteractive into reusable prioritizeCloudsByCredentials helper for testability and clarity Agent: complexity-hunter Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

la14-1 · 2026-02-12T23:54:10Z

Rebased onto latest main to resolve merge conflict. The conflict was trivial: log_info -> log_step rename (from cf53ea1) in ramnode/lib/common.sh lines that this PR removes entirely. The code changes are identical to the previously-approved version.

Re-review summary (pr-maintainer):

Both refactors are pure behavior-preserving extractions
No security issues (no new input handling, no injection vectors)
bash -n ramnode/lib/common.sh passes
Ready for external review and merge.

la14-1

Reviewed by pr-maintainer: Clean refactoring - extracts prioritizeCloudsByCredentials from cmdInteractive for testability, delegates ramnode _pick_flavor to shared interactive_pick helper. Pure refactoring, no behavior changes. LGTM.

louisgv

Security Review

Verdict: APPROVED

Findings

No security issues found. This is a clean refactor:

prioritizeCloudsByCredentials extraction: identical logic moved from cmdInteractive to a standalone typed function. No new inputs, no injection surfaces.
_pick_flavor simplification: delegates to the shared interactive_pick helper using the same pattern as Hetzner, netcup, and Hostinger. All arguments are string literals or function names.

Tests

bash -n: PASS
bun test: PASS (6375/6388, 13 pre-existing failures unrelated to this PR)
curl|bash pattern: OK (no changes to source/eval fallback)
macOS compat: OK (no bash 3.x incompatible constructs introduced)

Automated security review by spawn security team

la14-1 · 2026-02-12T23:42:29Z

Summary

Replace RamNode's custom _pick_flavor (37 lines of hand-rolled picker logic) with a single call to the shared interactive_pick helper, eliminating code duplication with Hetzner, netcup, and Hostinger which already use this pattern
Extract inline credential-sorting logic from cmdInteractive into a standalone prioritizeCloudsByCredentials function for better testability and readability

Net reduction: 27 lines (-55 / +28)

Test plan

bash -n ramnode/lib/common.sh passes
bun test passes (6062/6075, 13 pre-existing failures unrelated to this change)
All 572 commands tests pass with 0 failures
No functional changes — both refactors preserve identical behavior

🤖 Generated with Claude Code

la14-1

Self-review by complexity-hunter:

RamNode _pick_flavor refactor: Replaced 37 lines of hand-rolled interactive picker logic with a single call to interactive_pick from shared/common.sh. This follows the same pattern already used by Hetzner, netcup, and Hostinger. The _list_flavors function already outputs pipe-delimited lines with ID as the first field, which is exactly the format interactive_pick expects. The env var check (RAMNODE_FLAVOR), default value (1GB), and display behavior are all preserved by the shared helper.

cmdInteractive credential sorting: Extracted the inline credential partitioning and hint-building logic into a standalone prioritizeCloudsByCredentials function. This is a pure function that takes clouds + manifest and returns sorted clouds, hint overrides, and credential count. The function is exported for potential future unit testing. No behavioral changes — the interactive picker works identically.

Both changes verified with bash -n and bun test (all 572 command tests pass).

la14-1 · 2026-02-12T23:44:13Z

PR Review by pr-maintainer:

Reviewed. Clean refactor extracting prioritizeCloudsByCredentials from cmdInteractive (improves testability) and replacing the 35-line custom _pick_flavor with the shared interactive_pick helper (reduces duplication). No behavioral changes, no security concerns. Ready for human approval.

louisgv

Security Review

Verdict: APPROVED

Findings

No security issues found.

Both changes are pure refactors with identical runtime behavior:

ramnode/lib/common.sh: Replaces 37-line hand-rolled _pick_flavor with a single call to the shared interactive_pick helper. No new input handling, no shell injection vectors, env var fallback pattern preserved.
cli/src/commands.ts: Extracts inline credential-sorting into prioritizeCloudsByCredentials() pure function. No new external input paths, manifest description used only in local terminal display (no XSS risk).

Tests

bash -n: PASS (ramnode/lib/common.sh)
bun test: PASS (6062/6075, 13 pre-existing failures identical to main)
curl|bash pattern: OK (source/eval fallback not modified)
macOS compat: OK (no bash 3.x incompatible patterns introduced)

Automated security review by spawn security team

louisgv · 2026-02-12T23:53:15Z

Merge Conflict Notice

This PR was approved in the security review cycle, but now has merge conflicts (likely caused by other PRs merging first: #755, #757, #758).

The PR has the security-approved label — once conflicts are resolved, it should be safe to merge.

Automated notice by spawn security review team

- Replace RamNode's custom _pick_flavor (37 lines) with shared interactive_pick helper (1 line), eliminating duplicated picker logic - Extract credential sorting from cmdInteractive into reusable prioritizeCloudsByCredentials helper for testability and clarity Agent: complexity-hunter Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

la14-1 · 2026-02-12T23:54:10Z

Rebased onto latest main to resolve merge conflict. The conflict was trivial: log_info -> log_step rename (from cf53ea1) in ramnode/lib/common.sh lines that this PR removes entirely. The code changes are identical to the previously-approved version.

Re-review summary (pr-maintainer):

Both refactors are pure behavior-preserving extractions
No security issues (no new input handling, no injection vectors)
bash -n ramnode/lib/common.sh passes
Ready for external review and merge.

la14-1

Reviewed by pr-maintainer: Clean refactoring - extracts prioritizeCloudsByCredentials from cmdInteractive for testability, delegates ramnode _pick_flavor to shared interactive_pick helper. Pure refactoring, no behavior changes. LGTM.

louisgv

Security Review

Verdict: APPROVED

Findings

No security issues found. This is a clean refactor:

prioritizeCloudsByCredentials extraction: identical logic moved from cmdInteractive to a standalone typed function. No new inputs, no injection surfaces.
_pick_flavor simplification: delegates to the shared interactive_pick helper using the same pattern as Hetzner, netcup, and Hostinger. All arguments are string literals or function names.

Tests

bash -n: PASS
bun test: PASS (6375/6388, 13 pre-existing failures unrelated to this PR)
curl|bash pattern: OK (no changes to source/eval fallback)
macOS compat: OK (no bash 3.x incompatible constructs introduced)

Automated security review by spawn security team

la14-1 · 2026-02-12T23:42:29Z

Summary

Replace RamNode's custom _pick_flavor (37 lines of hand-rolled picker logic) with a single call to the shared interactive_pick helper, eliminating code duplication with Hetzner, netcup, and Hostinger which already use this pattern
Extract inline credential-sorting logic from cmdInteractive into a standalone prioritizeCloudsByCredentials function for better testability and readability

Net reduction: 27 lines (-55 / +28)

Test plan

bash -n ramnode/lib/common.sh passes
bun test passes (6062/6075, 13 pre-existing failures unrelated to this change)
All 572 commands tests pass with 0 failures
No functional changes — both refactors preserve identical behavior

🤖 Generated with Claude Code

la14-1

Self-review by complexity-hunter:

RamNode _pick_flavor refactor: Replaced 37 lines of hand-rolled interactive picker logic with a single call to interactive_pick from shared/common.sh. This follows the same pattern already used by Hetzner, netcup, and Hostinger. The _list_flavors function already outputs pipe-delimited lines with ID as the first field, which is exactly the format interactive_pick expects. The env var check (RAMNODE_FLAVOR), default value (1GB), and display behavior are all preserved by the shared helper.

cmdInteractive credential sorting: Extracted the inline credential partitioning and hint-building logic into a standalone prioritizeCloudsByCredentials function. This is a pure function that takes clouds + manifest and returns sorted clouds, hint overrides, and credential count. The function is exported for potential future unit testing. No behavioral changes — the interactive picker works identically.

Both changes verified with bash -n and bun test (all 572 command tests pass).

la14-1 · 2026-02-12T23:44:13Z

PR Review by pr-maintainer:

Reviewed. Clean refactor extracting prioritizeCloudsByCredentials from cmdInteractive (improves testability) and replacing the 35-line custom _pick_flavor with the shared interactive_pick helper (reduces duplication). No behavioral changes, no security concerns. Ready for human approval.

louisgv

Security Review

Verdict: APPROVED

Findings

No security issues found.

Both changes are pure refactors with identical runtime behavior:

ramnode/lib/common.sh: Replaces 37-line hand-rolled _pick_flavor with a single call to the shared interactive_pick helper. No new input handling, no shell injection vectors, env var fallback pattern preserved.
cli/src/commands.ts: Extracts inline credential-sorting into prioritizeCloudsByCredentials() pure function. No new external input paths, manifest description used only in local terminal display (no XSS risk).

Tests

bash -n: PASS (ramnode/lib/common.sh)
bun test: PASS (6062/6075, 13 pre-existing failures identical to main)
curl|bash pattern: OK (source/eval fallback not modified)
macOS compat: OK (no bash 3.x incompatible patterns introduced)

Automated security review by spawn security team

louisgv · 2026-02-12T23:53:15Z

Merge Conflict Notice

This PR was approved in the security review cycle, but now has merge conflicts (likely caused by other PRs merging first: #755, #757, #758).

The PR has the security-approved label — once conflicts are resolved, it should be safe to merge.

Automated notice by spawn security review team

- Replace RamNode's custom _pick_flavor (37 lines) with shared interactive_pick helper (1 line), eliminating duplicated picker logic - Extract credential sorting from cmdInteractive into reusable prioritizeCloudsByCredentials helper for testability and clarity Agent: complexity-hunter Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

la14-1 · 2026-02-12T23:54:10Z

Rebased onto latest main to resolve merge conflict. The conflict was trivial: log_info -> log_step rename (from cf53ea1) in ramnode/lib/common.sh lines that this PR removes entirely. The code changes are identical to the previously-approved version.

Re-review summary (pr-maintainer):

Both refactors are pure behavior-preserving extractions
No security issues (no new input handling, no injection vectors)
bash -n ramnode/lib/common.sh passes
Ready for external review and merge.

la14-1

Reviewed by pr-maintainer: Clean refactoring - extracts prioritizeCloudsByCredentials from cmdInteractive for testability, delegates ramnode _pick_flavor to shared interactive_pick helper. Pure refactoring, no behavior changes. LGTM.

louisgv

Security Review

Verdict: APPROVED

Findings

No security issues found. This is a clean refactor:

prioritizeCloudsByCredentials extraction: identical logic moved from cmdInteractive to a standalone typed function. No new inputs, no injection surfaces.
_pick_flavor simplification: delegates to the shared interactive_pick helper using the same pattern as Hetzner, netcup, and Hostinger. All arguments are string literals or function names.

Tests

bash -n: PASS
bun test: PASS (6375/6388, 13 pre-existing failures unrelated to this PR)
curl|bash pattern: OK (no changes to source/eval fallback)
macOS compat: OK (no bash 3.x incompatible constructs introduced)

Automated security review by spawn security team

la14-1 · 2026-02-12T23:42:29Z

Summary

Replace RamNode's custom _pick_flavor (37 lines of hand-rolled picker logic) with a single call to the shared interactive_pick helper, eliminating code duplication with Hetzner, netcup, and Hostinger which already use this pattern
Extract inline credential-sorting logic from cmdInteractive into a standalone prioritizeCloudsByCredentials function for better testability and readability

Net reduction: 27 lines (-55 / +28)

Test plan

bash -n ramnode/lib/common.sh passes
bun test passes (6062/6075, 13 pre-existing failures unrelated to this change)
All 572 commands tests pass with 0 failures
No functional changes — both refactors preserve identical behavior

🤖 Generated with Claude Code

la14-1

Self-review by complexity-hunter:

RamNode _pick_flavor refactor: Replaced 37 lines of hand-rolled interactive picker logic with a single call to interactive_pick from shared/common.sh. This follows the same pattern already used by Hetzner, netcup, and Hostinger. The _list_flavors function already outputs pipe-delimited lines with ID as the first field, which is exactly the format interactive_pick expects. The env var check (RAMNODE_FLAVOR), default value (1GB), and display behavior are all preserved by the shared helper.

cmdInteractive credential sorting: Extracted the inline credential partitioning and hint-building logic into a standalone prioritizeCloudsByCredentials function. This is a pure function that takes clouds + manifest and returns sorted clouds, hint overrides, and credential count. The function is exported for potential future unit testing. No behavioral changes — the interactive picker works identically.

Both changes verified with bash -n and bun test (all 572 command tests pass).

la14-1 · 2026-02-12T23:44:13Z

PR Review by pr-maintainer:

Reviewed. Clean refactor extracting prioritizeCloudsByCredentials from cmdInteractive (improves testability) and replacing the 35-line custom _pick_flavor with the shared interactive_pick helper (reduces duplication). No behavioral changes, no security concerns. Ready for human approval.

louisgv

Security Review

Verdict: APPROVED

Findings

No security issues found.

Both changes are pure refactors with identical runtime behavior:

ramnode/lib/common.sh: Replaces 37-line hand-rolled _pick_flavor with a single call to the shared interactive_pick helper. No new input handling, no shell injection vectors, env var fallback pattern preserved.
cli/src/commands.ts: Extracts inline credential-sorting into prioritizeCloudsByCredentials() pure function. No new external input paths, manifest description used only in local terminal display (no XSS risk).

Tests

bash -n: PASS (ramnode/lib/common.sh)
bun test: PASS (6062/6075, 13 pre-existing failures identical to main)
curl|bash pattern: OK (source/eval fallback not modified)
macOS compat: OK (no bash 3.x incompatible patterns introduced)

Automated security review by spawn security team

louisgv · 2026-02-12T23:53:15Z

Merge Conflict Notice

This PR was approved in the security review cycle, but now has merge conflicts (likely caused by other PRs merging first: #755, #757, #758).

The PR has the security-approved label — once conflicts are resolved, it should be safe to merge.

Automated notice by spawn security review team

- Replace RamNode's custom _pick_flavor (37 lines) with shared interactive_pick helper (1 line), eliminating duplicated picker logic - Extract credential sorting from cmdInteractive into reusable prioritizeCloudsByCredentials helper for testability and clarity Agent: complexity-hunter Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

la14-1 · 2026-02-12T23:54:10Z

Rebased onto latest main to resolve merge conflict. The conflict was trivial: log_info -> log_step rename (from cf53ea1) in ramnode/lib/common.sh lines that this PR removes entirely. The code changes are identical to the previously-approved version.

Re-review summary (pr-maintainer):

Both refactors are pure behavior-preserving extractions
No security issues (no new input handling, no injection vectors)
bash -n ramnode/lib/common.sh passes
Ready for external review and merge.

la14-1

Reviewed by pr-maintainer: Clean refactoring - extracts prioritizeCloudsByCredentials from cmdInteractive for testability, delegates ramnode _pick_flavor to shared interactive_pick helper. Pure refactoring, no behavior changes. LGTM.

louisgv

Security Review

Verdict: APPROVED

Findings

No security issues found. This is a clean refactor:

prioritizeCloudsByCredentials extraction: identical logic moved from cmdInteractive to a standalone typed function. No new inputs, no injection surfaces.
_pick_flavor simplification: delegates to the shared interactive_pick helper using the same pattern as Hetzner, netcup, and Hostinger. All arguments are string literals or function names.

Tests

bash -n: PASS
bun test: PASS (6375/6388, 13 pre-existing failures unrelated to this PR)
curl|bash pattern: OK (no changes to source/eval fallback)
macOS compat: OK (no bash 3.x incompatible constructs introduced)

Automated security review by spawn security team

la14-1 commented Feb 12, 2026
View reviewed changes

la14-1 added the needs-team-review label Feb 12, 2026

louisgv previously approved these changes Feb 12, 2026
View reviewed changes

louisgv added the security-approved Security review approved label Feb 12, 2026

la14-1 dismissed louisgv’s stale review via 7533165February 12, 2026 23:53

la14-1 force-pushed the reduce-complexity branch from d5e3c88 to 7533165Compare February 12, 2026 23:53

la14-1 commented Feb 13, 2026
View reviewed changes

louisgv approved these changes Feb 13, 2026
View reviewed changes

louisgv merged commit ff0ccfd into mainFeb 13, 2026
1 check passed

louisgv deleted the reduce-complexity branch February 13, 2026 00:47

la14-1 commented Feb 12, 2026
View reviewed changes

la14-1 added the needs-team-review label Feb 12, 2026

louisgv previously approved these changes Feb 12, 2026
View reviewed changes

louisgv added the security-approved Security review approved label Feb 12, 2026

la14-1 dismissed louisgv’s stale review via 7533165February 12, 2026 23:53

la14-1 force-pushed the reduce-complexity branch from d5e3c88 to 7533165Compare February 12, 2026 23:53

la14-1 commented Feb 13, 2026
View reviewed changes

louisgv approved these changes Feb 13, 2026
View reviewed changes

louisgv merged commit ff0ccfd into mainFeb 13, 2026
1 check passed

louisgv deleted the reduce-complexity branch February 13, 2026 00:47

la14-1 commented Feb 12, 2026
View reviewed changes

la14-1 added the needs-team-review label Feb 12, 2026

louisgv previously approved these changes Feb 12, 2026
View reviewed changes

louisgv added the security-approved Security review approved label Feb 12, 2026

la14-1 dismissed louisgv’s stale review via 7533165February 12, 2026 23:53

la14-1 force-pushed the reduce-complexity branch from d5e3c88 to 7533165Compare February 12, 2026 23:53

la14-1 commented Feb 13, 2026
View reviewed changes

louisgv approved these changes Feb 13, 2026
View reviewed changes

louisgv merged commit ff0ccfd into mainFeb 13, 2026
1 check passed

louisgv deleted the reduce-complexity branch February 13, 2026 00:47

la14-1 commented Feb 12, 2026
View reviewed changes

la14-1 added the needs-team-review label Feb 12, 2026

louisgv previously approved these changes Feb 12, 2026
View reviewed changes

louisgv added the security-approved Security review approved label Feb 12, 2026

la14-1 dismissed louisgv’s stale review via 7533165February 12, 2026 23:53

la14-1 force-pushed the reduce-complexity branch from d5e3c88 to 7533165Compare February 12, 2026 23:53

la14-1 commented Feb 13, 2026
View reviewed changes

louisgv approved these changes Feb 13, 2026
View reviewed changes

louisgv merged commit ff0ccfd into mainFeb 13, 2026
1 check passed

louisgv deleted the reduce-complexity branch February 13, 2026 00:47

la14-1 commented Feb 12, 2026
View reviewed changes

la14-1 added the needs-team-review label Feb 12, 2026

louisgv previously approved these changes Feb 12, 2026
View reviewed changes

louisgv added the security-approved Security review approved label Feb 12, 2026

la14-1 dismissed louisgv’s stale review via 7533165February 12, 2026 23:53

la14-1 force-pushed the reduce-complexity branch from d5e3c88 to 7533165Compare February 12, 2026 23:53

la14-1 commented Feb 13, 2026
View reviewed changes

louisgv approved these changes Feb 13, 2026
View reviewed changes

louisgv merged commit ff0ccfd into mainFeb 13, 2026
1 check passed

louisgv deleted the reduce-complexity branch February 13, 2026 00:47

la14-1 commented Feb 12, 2026
View reviewed changes

la14-1 added the needs-team-review label Feb 12, 2026

louisgv previously approved these changes Feb 12, 2026
View reviewed changes

louisgv added the security-approved Security review approved label Feb 12, 2026

la14-1 dismissed louisgv’s stale review via 7533165February 12, 2026 23:53

la14-1 force-pushed the reduce-complexity branch from d5e3c88 to 7533165Compare February 12, 2026 23:53

la14-1 commented Feb 13, 2026
View reviewed changes

louisgv approved these changes Feb 13, 2026
View reviewed changes

louisgv merged commit ff0ccfd into mainFeb 13, 2026
1 check passed

louisgv deleted the reduce-complexity branch February 13, 2026 00:47

la14-1 commented Feb 12, 2026
View reviewed changes

la14-1 added the needs-team-review label Feb 12, 2026

louisgv previously approved these changes Feb 12, 2026
View reviewed changes

louisgv added the security-approved Security review approved label Feb 12, 2026

la14-1 dismissed louisgv’s stale review via 7533165February 12, 2026 23:53

la14-1 force-pushed the reduce-complexity branch from d5e3c88 to 7533165Compare February 12, 2026 23:53

la14-1 commented Feb 13, 2026
View reviewed changes

louisgv approved these changes Feb 13, 2026
View reviewed changes

louisgv merged commit ff0ccfd into mainFeb 13, 2026
1 check passed

louisgv deleted the reduce-complexity branch February 13, 2026 00:47

la14-1 commented Feb 12, 2026
View reviewed changes

la14-1 added the needs-team-review label Feb 12, 2026

louisgv previously approved these changes Feb 12, 2026
View reviewed changes

louisgv added the security-approved Security review approved label Feb 12, 2026

la14-1 dismissed louisgv’s stale review via 7533165February 12, 2026 23:53

la14-1 force-pushed the reduce-complexity branch from d5e3c88 to 7533165Compare February 12, 2026 23:53

la14-1 commented Feb 13, 2026
View reviewed changes

louisgv approved these changes Feb 13, 2026
View reviewed changes

louisgv merged commit ff0ccfd into mainFeb 13, 2026
1 check passed

louisgv deleted the reduce-complexity branch February 13, 2026 00:47

Uh oh!

Conversation

la14-1 commented Feb 12, 2026

Summary

Test plan

Uh oh!

la14-1 left a comment

Choose a reason for hiding this comment

Uh oh!

la14-1 commented Feb 12, 2026

Uh oh!

louisgv left a comment

Choose a reason for hiding this comment

Security Review

Findings

Tests

Uh oh!

louisgv commented Feb 12, 2026

Merge Conflict Notice

Uh oh!

la14-1 commented Feb 12, 2026

Uh oh!

la14-1 left a comment

Choose a reason for hiding this comment

Uh oh!

louisgv left a comment

Choose a reason for hiding this comment

Security Review

Findings

Tests

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

Uh oh!

Conversation

la14-1 commented Feb 12, 2026

Summary

Test plan

Uh oh!

la14-1 left a comment

Choose a reason for hiding this comment

Uh oh!

la14-1 commented Feb 12, 2026

Uh oh!

louisgv left a comment

Choose a reason for hiding this comment

Security Review

Findings

Tests

Uh oh!

louisgv commented Feb 12, 2026

Merge Conflict Notice

Uh oh!

la14-1 commented Feb 12, 2026

Uh oh!

la14-1 left a comment

Choose a reason for hiding this comment

Uh oh!

louisgv left a comment

Choose a reason for hiding this comment

Security Review

Findings

Tests

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants