@auroraflow/code 0.0.11 → 0.0.13

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@auroraflow/code",
-  "version": "0.0.11",
+  "version": "0.0.13",
   "type": "module",
   "description": "Aurora launcher and sidecar for official Codex and Claude Code clients.",
   "repository": {

package/packages/clients/src/index.js

@@ -211,10 +211,11 @@ function tomlString(value) {
 }
 
 async function spawnAndExit(command, args, env) {
-  const child = spawn(command, args, {
+  const spec = windowsCommandSpec(command, args);
+  const child = spawn(spec.command, spec.args, {
     stdio: "inherit",
     env,
-    shell: process.platform === "win32" && command.endsWith(".cmd")
+    shell: spec.shell
   });
   child.on("error", error => {
     console.error(`Failed to start ${command}: ${error.message}`);
@@ -225,11 +226,12 @@ async function spawnAndExit(command, args, env) {
 
 function spawnAndWait(command, args, env) {
   return new Promise((resolve, reject) => {
-    const child = spawn(command, args, {
+    const spec = windowsCommandSpec(command, args);
+    const child = spawn(spec.command, spec.args, {
       cwd: packageRoot,
       stdio: "inherit",
       env,
-      shell: process.platform === "win32"
+      shell: spec.shell
     });
     child.on("error", reject);
     child.on("exit", code => {
@@ -240,8 +242,34 @@ function spawnAndWait(command, args, env) {
 }
 
 function spawnSyncCompat(command, args) {
-  return spawnSync(command, args, {
+  const spec = windowsCommandSpec(command, args);
+  return spawnSync(spec.command, spec.args, {
     encoding: "utf8",
-    shell: process.platform === "win32" && command.endsWith(".cmd")
+    shell: spec.shell
   });
 }
+
+function windowsCommandSpec(command, args) {
+  if (process.platform !== "win32" || !command.toLowerCase().endsWith(".cmd")) {
+    return { command, args, shell: false };
+  }
+  // Windows npm global bins are .cmd shims, commonly under "C:\Program Files".
+  // Running that path through shell=true without quoting makes cmd.exe split at
+  // the space and try to execute "C:\Program". Invoke cmd.exe explicitly with
+  // one quoted command line so paths with spaces survive.
+  return {
+    command: process.env.ComSpec || "cmd.exe",
+    args: ["/d", "/s", "/c", windowsCmdLine([command, ...args])],
+    shell: false
+  };
+}
+
+function windowsCmdLine(parts) {
+  return parts.map(windowsCmdQuote).join(" ");
+}
+
+function windowsCmdQuote(value) {
+  const text = String(value);
+  if (/^[A-Za-z0-9_./:=+-]+$/.test(text)) return text;
+  return `"${text.replace(/"/g, '""')}"`;
+}

package/packages/sidecar/src/index.js

@@ -15,6 +15,20 @@ const CODEX_MODEL_CAPABILITIES_PATH = join(CODEX_HOME, "model_capabilities.json"
 const GATEWAY_HEADER_TIMEOUT_MS = 60000;
 const GATEWAY_IDLE_TIMEOUT_MS = 120000;
 
+// Keep the sidecar->gateway TLS connection warm. The expensive part of a cold
+// request is the ~1s TLS handshake to the gateway edge; undici pools the
+// connection but drops it after ~4s idle, so every think-pause re-handshakes
+// ("时快时慢"). A lightweight heartbeat under that idle window keeps one pooled
+// connection alive so real requests reuse a warm socket. It only runs within a
+// window after real activity, so an idle/abandoned sidecar stops chattering.
+const GATEWAY_KEEPALIVE_INTERVAL_MS = 3000;
+const GATEWAY_KEEPWARM_WINDOW_MS = 10 * 60 * 1000;
+let lastActivityAt = 0;
+
+function markActivity() {
+  lastActivityAt = Date.now();
+}
+
 // ensureSidecarIdentity generates the local token once and persists it so the
 // OS service, the launcher, and the running client all agree on a stable
 // token/port across restarts and node upgrades. Random-per-run tokens broke
@@ -79,9 +93,35 @@ export async function startSidecar(options = {}) {
   server.listen(port, AURORA_LOCALHOST, async () => {
     await writeSidecarInfo({ port, token, baseURL: `http://${AURORA_LOCALHOST}:${port}` });
     console.error(`Aurora sidecar listening on http://${AURORA_LOCALHOST}:${port}`);
+    // Open the warm window and pre-warm the gateway connection so the very
+    // first client request reuses an established TLS socket.
+    markActivity();
+    startGatewayKeepAlive();
   });
 }
 
+function startGatewayKeepAlive() {
+  const beat = async () => {
+    if (Date.now() - lastActivityAt > GATEWAY_KEEPWARM_WINDOW_MS) return;
+    try {
+      const state = await readState();
+      const gatewayURL = trimSlash(state.gatewayURL ?? "https://auroramos.com");
+      // Same origin as proxyRuntime → same undici pool, so this keeps the edge
+      // TLS handshake amortized for real requests. The body MUST be drained:
+      // undici destroys (does not pool) a connection whose response body was
+      // left unconsumed, which silently defeats the warm-up. Result ignored.
+      const response = await fetch(gatewayURL, { signal: AbortSignal.timeout(GATEWAY_HEADER_TIMEOUT_MS) });
+      await response.text();
+    } catch {
+      // Best effort; a failed heartbeat just means the next real request pays
+      // a cold handshake, which is the pre-fix behaviour.
+    }
+  };
+  const timer = setInterval(beat, GATEWAY_KEEPALIVE_INTERVAL_MS);
+  timer.unref();
+  beat();
+}
+
 async function pingLocalSidecar(port, token) {
   try {
     const response = await fetch(`http://${AURORA_LOCALHOST}:${port}/aurora/status`, {
@@ -134,6 +174,7 @@ async function handle(request, response, token) {
 }
 
 async function proxyModels(response, incomingURL) {
+  markActivity();
   const state = await readState();
   const gatewayURL = trimSlash(state.gatewayURL ?? "https://auroramos.com");
   const clientVersion = incomingURL.searchParams.get("client_version");
@@ -159,6 +200,7 @@ async function proxyModels(response, incomingURL) {
 }
 
 async function proxyRuntime(request, response, path) {
+  markActivity();
   const state = await readState();
   const body = await readBody(request);
   const capabilitiesByAlias = await readCodexModelCapabilities();