@chatpanel/bridge 0.10.21 → 0.10.23

package/package.json

@@ -1,8 +1,8 @@
 {
   "name": "@chatpanel/bridge",
-  "version": "0.10.21",
+  "version": "0.10.23",
   "type": "module",
-  "description": "Local bridge that exposes the AI coding agents installed on your machine — Claude Code (CLI), Codex (CLI), and Antigravity CLI (formerly Gemini CLI, which remains available for business/enterprise) — to the ChatPanel Chrome extension over a localhost SSE endpoint. Bring your own agent.",
+  "description": "Local bridge that exposes the AI coding agents installed on your machine \u2014 Claude Code (CLI), Codex (CLI), and Antigravity CLI (formerly Gemini CLI, which remains available for business/enterprise) \u2014 to the ChatPanel Chrome extension over a localhost SSE endpoint. Bring your own agent.",
   "keywords": [
     "chatpanel",
     "claude-code",

package/src/engines/antigravity.js

@@ -16,6 +16,8 @@ import os from 'node:os';
 import path from 'node:path';
 import { findAgentBin } from '../env.js';
 import { buildCliPrompt } from './prompt.js';
+import { killOnAbort } from '../proc.js';
+import { pushExtraArgs, FORBIDDEN } from './args.js';
 
 const IDLE_MS = Number(process.env.CHATPANEL_AGY_TIMEOUT_MS) || 180_000;
 const SCRATCH = path.join(os.tmpdir(), 'chatpanel-agy-scratch');
@@ -78,7 +80,7 @@ function writeImages(images, dir) {
   return files;
 }
 
-export async function chat({ messages, system, options, images }, emit) {
+export async function chat({ messages, system, options, images }, emit, { signal } = {}) {
   try {
     mkdirSync(SCRATCH, { recursive: true });
   } catch {
@@ -102,7 +104,8 @@ export async function chat({ messages, system, options, images }, emit) {
   const args = ['-p', prompt];
   if (options.model) args.push('--model', options.model);
   if (options.permissionMode === 'bypassPermissions') args.push('--dangerously-skip-permissions');
-  if (options.extraArgs) args.push(...String(options.extraArgs).split(/\s+/).filter(Boolean));
+  // Drop caller extras that would auto-approve tools (shared sanitizer).
+  pushExtraArgs(args, options.extraArgs, FORBIDDEN.antigravity, emit);
 
   await new Promise((resolve, reject) => {
     let child;
@@ -113,6 +116,8 @@ export async function chat({ messages, system, options, images }, emit) {
       return reject(new Error(`Failed to start agy: ${e.message}`));
     }
 
+    const detach = killOnAbort(child, signal); // Stop → terminate the agy child
+
     let out = '';
     let err = '';
     let streamed = false;
@@ -137,12 +142,15 @@ export async function chat({ messages, system, options, images }, emit) {
     child.stderr.on('data', (d) => { armIdle(); err += d.toString(); });
     child.on('error', (e) => {
       clearTimeout(idleTimer);
+      detach();
       cleanup();
       reject(new Error(`Failed to start agy: ${e.message}`));
     });
     child.on('close', (code) => {
       clearTimeout(idleTimer);
+      detach();
       cleanup();
+      if (signal?.aborted) { resolve(); return; } // Stop pressed — end quietly
       if (code === 0) {
         if (!streamed) emit({ type: 'delta', text: out.trim() || '(no output)' });
         emit({ type: 'done', text: '' });

package/src/engines/args.js

@@ -0,0 +1,47 @@
+// Caller-supplied "extra CLI arguments" sanitizer (shared by every engine).
+//
+// The extension/model can pass free-form extraArgs to the agent CLI. A prompt-
+// injected model must NOT be able to smuggle a flag that re-opens the sandbox /
+// permission boundary the engine deliberately sets (e.g. Codex's
+// --dangerously-bypass-approvals-and-sandbox, Claude's --permission-mode). Since
+// these flags take values, partial filtering is unsafe — if ANY forbidden token is
+// present we drop the WHOLE extraArgs. Previously only claude.js did this; codex,
+// antigravity and custom pushed extraArgs unfiltered (this closes that gap).
+
+export function splitArgs(raw) {
+  return String(raw || '').split(/\s+/).filter(Boolean);
+}
+
+// Per-engine escalation flags. Long flags use \b so `--flag=value` is caught too;
+// short flags are exact-matched so we don't over-block a benign token.
+export const FORBIDDEN = {
+  claude: /^--?(permission-mode|allowed-?tools|disallowed-?tools|dangerously|add-dir|mcp-config|setting-sources|permission-prompt-tool)/i,
+  // Codex: sandbox / approval escalation + `-c key=val` (can set approval_policy or
+  // sandbox_mode in TOML) + `-C/--cd` (retarget the working dir).
+  codex: /^(-s|-a|-c|-C)$|^--(dangerously[\w-]*|sandbox|ask-for-approval|full-auto|yolo|config|cd)\b/i,
+  antigravity: /^--(dangerously[\w-]*|skip-permissions|trust-all-?tools|yolo|full-auto)\b/i,
+  // Custom runs an arbitrary CLI, so only clearly-dangerous LONG flags are blocked
+  // (no short-flag guesses that might collide with a benign tool option).
+  custom: /^--(dangerously[\w-]*|skip-permissions|trust-all-?tools|no-sandbox|bypass|yolo|full-auto|permission-mode|allowed-?tools|disallowed-?tools|mcp-config)\b/i,
+  // Copilot's escalation surface is its own family of --allow-* flags (which the
+  // `custom` pattern above does NOT cover: "allow-all-tools" != "allowed-tools").
+  // Also block re-targeting the working dir (-C / --add-dir) and injecting MCP
+  // servers, since the engine sets those deliberately per turn.
+  copilot: /^(-C)$|^--(allow-all[\w-]*|allow-tool|allow-url|allow-path|yolo|add-dir|additional-mcp-config|disable-builtin-mcps|deny-tool|deny-url|autopilot|mode)\b/i,
+};
+
+// Returns { args, blocked }. `blocked:true` => the whole extraArgs was dropped.
+export function sanitizeExtraArgs(raw, forbidden) {
+  const tokens = splitArgs(raw);
+  if (tokens.some((t) => forbidden.test(t))) return { args: [], blocked: true };
+  return { args: tokens, blocked: false };
+}
+
+// Convenience for the engines: sanitize, push the safe tokens onto `args`, and emit
+// a status when something was dropped.
+export function pushExtraArgs(args, raw, forbidden, emit) {
+  if (!raw) return;
+  const { args: extra, blocked } = sanitizeExtraArgs(raw, forbidden);
+  if (blocked) { try { emit?.({ type: 'status', text: '(ignored unsafe extraArgs)' }); } catch { /* ignore */ } return; }
+  args.push(...extra);
+}

package/src/engines/claude.js

@@ -19,6 +19,8 @@ import os from 'node:os';
 import path from 'node:path';
 import { resolveClaude, buildSpawnSpec, isCompiledBinary, selfMcpStdio } from '../env.js';
 import { buildCliPrompt } from './prompt.js';
+import { killOnAbort } from '../proc.js';
+import { pushExtraArgs, FORBIDDEN } from './args.js';
 
 // Write base64 data-URL images to temp files. Claude Code reads them with its
 // Read tool (which feeds images to the model as vision), so we just reference the
@@ -95,7 +97,7 @@ export function claudeMcpConfig(mcp) {
 // Spawn claude (however it resolves) and stream its stream-json output via
 // `emit`. Resolves with { streamedAny, resultText } once it closes 0. Returns
 // null (no spawn) when claude can't be resolved, so the caller can fall back.
-function runClaude({ prompt, args, cwd, emit }) {
+function runClaude({ prompt, args, cwd, emit, signal }) {
   const spec = resolveClaude();
   if (!spec) return null;
   const [bin, argv, opts] = buildSpawnSpec(spec, args, cwd);
@@ -108,6 +110,8 @@ function runClaude({ prompt, args, cwd, emit }) {
       return reject(new Error(`Failed to start claude: ${e.message}`));
     }
 
+    const detach = killOnAbort(child, signal); // Stop → terminate the claude child
+
     let stdout = '';
     let stderr = '';
     let streamedAny = false;
@@ -145,10 +149,13 @@ function runClaude({ prompt, args, cwd, emit }) {
     child.stderr.on('data', (d) => { armIdle(); stderr += d.toString(); });
     child.on('error', (e) => {
       clearTimeout(idleTimer);
+      detach();
       reject(new Error(`Failed to start claude (${bin}): ${e.message}`));
     });
     child.on('close', (code) => {
       clearTimeout(idleTimer);
+      detach();
+      if (signal?.aborted) { resolve({ streamedAny, resultText }); return; } // Stop pressed — end quietly
       if (code === 0) resolve({ streamedAny, resultText });
       else reject(new Error(`Claude Code exited ${code}: ${stderr.trim().split('\n').pop() || 'failed'}`));
     });
@@ -204,7 +211,7 @@ export function handleMessage(msg, emit, alreadyStreamed) {
   return out;
 }
 
-export async function chat({ messages, system, options, images }, emit) {
+export async function chat({ messages, system, options, images }, emit, { signal } = {}) {
   const permissionMode = options.permissionMode || 'default';
   // Explicit project dir, else null → CLI runs in home (or WSL home).
   const cwd = options.workingDir ? path.resolve(options.workingDir) : null;
@@ -259,22 +266,13 @@ export async function chat({ messages, system, options, images }, emit) {
     }: ${imageFiles.join(', ')}`;
   }
 
-  if (options.extraArgs) {
-    const extra = String(options.extraArgs).split(/\s+/).filter(Boolean);
-    // Never let caller-supplied extras re-open the read-only boundary the mode
-    // flags above establish. If ANY security-sensitive flag is present, drop the
-    // whole extraArgs (these tokens take values, so partial filtering is unsafe).
-    const FORBIDDEN = /^--?(permission-mode|allowed-?tools|disallowed-?tools|dangerously|add-dir|mcp-config|setting-sources|permission-prompt-tool)/i;
-    if (extra.some((t) => FORBIDDEN.test(t))) {
-      emit({ type: 'status', text: '(ignored unsafe extraArgs)' });
-    } else {
-      args.push(...extra);
-    }
-  }
-  const run = runClaude({ prompt, args, cwd, emit });
+  // Never let caller-supplied extras re-open the read-only boundary the mode flags
+  // above establish (shared sanitizer — see args.js).
+  pushExtraArgs(args, options.extraArgs, FORBIDDEN.claude, emit);
+  const run = runClaude({ prompt, args, cwd, emit, signal });
   if (run === null) {
     cleanup(); // SDK fallback doesn't take images yet
-    return sdkChat({ messages, system, options }, emit);
+    return sdkChat({ messages, system, options }, emit, { signal });
   }
   try {
     const { streamedAny, resultText } = await run;
@@ -335,11 +333,18 @@ function loadSdk() {
   return sdkPromise;
 }
 
-async function sdkChat({ messages, system, options }, emit) {
+async function sdkChat({ messages, system, options }, emit, { signal } = {}) {
   const sdk = await loadSdk();
   if (!sdk) throw new Error(lastReason);
   const { query } = sdk;
 
+  // The SDK cancels the run when this controller aborts — forward the request signal.
+  const abortController = new AbortController();
+  if (signal) {
+    if (signal.aborted) abortController.abort();
+    else signal.addEventListener('abort', () => abortController.abort(), { once: true });
+  }
+
   const permissionMode = options.permissionMode || 'default';
   const cwd = options.workingDir ? path.resolve(options.workingDir) : os.homedir();
   const writesAllowed = permissionMode === 'acceptEdits' || permissionMode === 'bypassPermissions';
@@ -358,6 +363,7 @@ async function sdkChat({ messages, system, options }, emit) {
       permissionMode,
       includePartialMessages: true,
       canUseTool,
+      abortController,
       settingSources: options.useLocalConfig === false ? [] : ['user', 'project'],
       systemPrompt: system
         ? { type: 'preset', preset: 'claude_code', append: system }
@@ -366,10 +372,15 @@ async function sdkChat({ messages, system, options }, emit) {
       ...(process.env.CHATPANEL_MAX_TURNS ? { maxTurns: Number(process.env.CHATPANEL_MAX_TURNS) } : {}),
     },
   });
-  for await (const message of iterator) {
-    const r = handleMessage(message, emit, streamedAny);
-    if (r.streamed) streamedAny = true;
-    if (r.result != null) resultText = r.result;
+  try {
+    for await (const message of iterator) {
+      const r = handleMessage(message, emit, streamedAny);
+      if (r.streamed) streamedAny = true;
+      if (r.result != null) resultText = r.result;
+    }
+  } catch (e) {
+    if (signal?.aborted || abortController.signal.aborted) return; // Stop pressed — end quietly
+    throw e;
   }
   emit({ type: 'done', text: streamedAny ? '' : resultText });
 }

package/src/engines/cli-agents.js

@@ -1,18 +1,19 @@
 // Built-in CLI agents — pi, opencode, kiro — that reuse the shared custom-engine
-// runner (runSpec) with a FIXED spec each. Unlike the Pro "custom" engine, these
-// are NOT entitlement-gated: they ship as built-ins, and the extension bounds
-// free users to a single usable agent (FREE_LIMITS.bridgeAgents). Bring-your-own
-// arbitrary CLIs stay Pro via custom.js.
+// runner (runSpec) with a fixed spec each. These are fixed built-in engines and are
+// not entitlement-gated; custom BYO CLIs are handled by custom.js.
 //
 // Specs come from each CLI's actual flags:
 //   pi       — pi -p "<prompt>"        · --model · @{path} images · --list-models
 //   opencode — opencode run "<prompt>" · -m provider/model · -f {path} images · models
 //   kiro     — kiro-cli chat --no-interactive "<prompt>" · --model · --list-models
 
-import { runSpec, listSpecModels } from './custom.js';
+import { runSpec, listSpecModels, runForStdout } from './custom.js';
 import { findAgentBin } from '../env.js';
 
-function makeCliAgent(command, spec, notFoundHint) {
+// `listModels` override hook: a CLI whose model listing isn't "one id per line"
+// (Copilot prints a quoted list inside `help config`) passes its own parser here
+// instead of forcing the generic one to grow special cases.
+function makeCliAgent(command, spec, notFoundHint, overrides = {}) {
   let installed = false;
   let lastProbe = 0;
   const resolvedSpec = { ...spec, command };
@@ -32,10 +33,11 @@ function makeCliAgent(command, spec, notFoundHint) {
       return installed ? { ok: true } : { ok: false, reason: notFoundHint };
     },
     listModels(options = {}) {
+      if (overrides.listModels) return overrides.listModels(command, options);
       return listSpecModels(command, spec.listModelsArgs, options.workingDir);
     },
-    chat(input, emit) {
-      return runSpec(resolvedSpec, input, emit);
+    chat(input, emit, opts) {
+      return runSpec(resolvedSpec, input, emit, opts);
     },
   };
 }
@@ -96,3 +98,153 @@ export const kiro = makeCliAgent(
   },
   'kiro-cli not found on PATH. Install Kiro CLI, then sign in.',
 );
+
+// GitHub Copilot CLI. Verified against 1.0.80 (`copilot`, not the old
+// `gh copilot` extension).
+//
+// The two things that make or break headless Copilot:
+//   1. --allow-all-tools is REQUIRED in -p mode. Without it EVERY tool call dies
+//      with "Permission denied and could not request permission from user" — the
+//      CLI has no TTY to ask on — so the agent answers as if it had no tools.
+//   2. --output-format json turns the TUI into clean NDJSON we can stream;
+//      the default text output is not parseable as a live stream.
+// Both live in the base spec because neither is optional for this integration.
+//
+// Permission mode maps onto Copilot's real permission surface (see
+// permissionArgs): tools always run unattended, while filesystem reach beyond the
+// working dir and arbitrary URL access are what the mode actually escalates.
+const COPILOT_BASE_ARGS = [
+  '-p', '{prompt}',
+  '--output-format', 'json',
+  '--no-color',
+  '--log-level', 'none',
+  // Headless hygiene: never block asking the user a question, never self-update
+  // mid-turn, and don't ship the session to GitHub web/mobile from a ChatPanel
+  // turn (Copilot exports by default; ChatPanel keeps chat local by policy).
+  '--no-ask-user',
+  '--no-auto-update',
+  '--no-remote',
+  '--no-remote-export',
+];
+
+export const copilot = makeCliAgent(
+  'copilot',
+  {
+    args: COPILOT_BASE_ARGS,
+    promptVia: 'arg',
+    modelArg: '--model {model}',
+    // Non-interactive-only flag; one per image.
+    imageArg: '--attachment {path}',
+    format: 'copilot-json',
+    // Copilot takes per-run MCP servers, so browser tools work WITHOUT touching
+    // the user's ~/.copilot/mcp-config.json (unlike opencode/kiro, which only
+    // read global config). `@` prefix = "this is a file path, not inline JSON";
+    // the shape runSpec writes ({mcpServers:{name:{command,args}}}) is the one
+    // Copilot expects — verified.
+    mcpArg: '--additional-mcp-config @{file}',
+    permissionArgs: {
+      // Tools yes (or nothing works); no path escape, no arbitrary URLs.
+      default: ['--allow-all-tools'],
+      // Edits anywhere on disk, still no arbitrary URL fetching.
+      acceptEdits: ['--allow-all-tools', '--allow-all-paths'],
+      // == --allow-all-tools --allow-all-paths --allow-all-urls
+      bypassPermissions: ['--allow-all'],
+    },
+    forbidden: 'copilot',
+    label: 'GitHub Copilot',
+  },
+  'copilot not found on PATH. Install GitHub Copilot CLI, then run `copilot login`.',
+  { listModels: (command, options) => listCopilotModels(command, options.workingDir) },
+);
+
+// Copilot has no `--list-models`, and an invalid --model reports only that the
+// model is unavailable without naming the valid ones. `copilot help config`
+// documents the live list under its `model` key, so read it there — the ids stay
+// in step with the installed CLI instead of being hardcoded here.
+export async function listCopilotModels(command = 'copilot', workingDir) {
+  const stdout = await runForStdout(command, ['help', 'config'], workingDir);
+  const out = [];
+  const seen = new Set();
+  let inModelBlock = false;
+  for (const raw of String(stdout || '').split('\n')) {
+    // Section keys are printed as `  `key`: description`.
+    const key = /^\s*`([A-Za-z][\w.]*)`\s*:/.exec(raw);
+    if (key) {
+      inModelBlock = key[1] === 'model';
+      continue;
+    }
+    if (!inModelBlock) continue;
+    const m = /^\s*-\s*"([^"]+)"\s*$/.exec(raw);
+    if (!m) continue;
+    const id = m[1];
+    if (seen.has(id)) continue;
+    seen.add(id);
+    out.push(id);
+    if (out.length >= 200) break;
+  }
+  // `auto` is a real, documented value (Copilot routes the turn itself) but it is
+  // not in the enumerated list — offer it first.
+  return out.length ? ['auto', ...out] : [];
+}
+
+// DeepSeek Harness. The launcher is `dsh`; `--profile headless` is the shipped
+// one-shot template ("answer one task, print the final assistant message, exit").
+//
+// Deliberately sparse compared to the others, because the CLI surface is sparse:
+// the headless profile takes ONLY the task text. There is no --model, no JSON
+// output and no resume flag — dsh is a Cordis plugin tree, so the model adapter,
+// tools and MCP are chosen by the PROFILE, not by argv. Power users retarget it
+// with `--patch <file>` through the agent's "Extra arguments" field.
+//
+// Two consequences worth knowing before wiring UI to this:
+//   * `modelArg` is absent, so a model picked in Settings is ignored by design
+//     (runSpec skips model injection without a template) — configure it in the
+//     profile instead.
+//   * Output arrives as ONE chunk at the end, not token-by-token, so the turn
+//     shows progress but no live typing.
+export const deepseek = makeCliAgent(
+  'dsh',
+  {
+    args: ['--profile', 'headless', '{prompt}'],
+    promptVia: 'arg',
+    format: 'text',
+    // No --model flag exists. dsh takes the model as a CONFIG OVERLAY: --patch
+    // replaces one row of the composed plugin tree by id, and the model lives in
+    // the `agent-default-model` row. runSpec writes this file per turn.
+    modelPatch: {
+      arg: '--patch {file}',
+      // A patch replaces the row's WHOLE config, so provider must be restated.
+      build: (model) => `- id: ${DSH_MODEL_ROW}\n  config:\n    provider: ${DSH_PROVIDER}\n    model: ${JSON.stringify(model)}\n`,
+    },
+    label: 'DeepSeek Harness',
+  },
+  'dsh not found on PATH. Install DeepSeek Harness, then run `dsh --profile headless "hi"` once to check the profile.',
+  { listModels: (command, options) => listDshModels(command, options.workingDir) },
+);
+
+const DSH_MODEL_ROW = 'agent-default-model';
+const DSH_PROVIDER = 'deepseek-official';
+// dsh ships no model catalog command. The provider names its supported ids only
+// when you send a bad one ("The supported API model names are ..."), so these are
+// those ids, unioned with whatever the profile is actually set to. The field
+// still accepts any id — this is a convenience menu, not a whitelist.
+const DSH_KNOWN_MODELS = ['deepseek-v4-flash', 'deepseek-v4-pro'];
+
+// dsh publishes no model catalog — there is no `--list-models`, and the composed
+// config tree carries only the model the profile is CURRENTLY set to. So "Load
+// models" reports that one truthfully rather than inventing a menu; the field
+// still accepts any id the provider serves, applied via the patch above.
+export async function listDshModels(command = 'dsh', workingDir) {
+  const stdout = await runForStdout(command, ['--profile', 'headless', '--dump-config'], workingDir, 60000);
+  const lines = String(stdout || '').split('\n');
+  const rowStart = new RegExp(`^-\\s*id:\\s*${DSH_MODEL_ROW}\\s*$`);
+  for (let i = 0; i < lines.length; i++) {
+    if (!rowStart.test(lines[i])) continue;
+    // Scan this row's block for `model: <id>`, stopping at the next top-level row.
+    for (let j = i + 1; j < lines.length && !/^-\s*id:/.test(lines[j]); j++) {
+      const m = /^\s*model:\s*['"]?([\w.:-]+)['"]?\s*$/.exec(lines[j]);
+      if (m) return [...new Set([m[1], ...DSH_KNOWN_MODELS])];
+    }
+  }
+  return [...DSH_KNOWN_MODELS];
+}

package/src/engines/codex.js

@@ -15,12 +15,14 @@
 // the agent to point it at a real project.
 
 import { spawn, spawnSync } from 'node:child_process';
+import { killOnAbort } from '../proc.js';
 import { readFile, unlink, writeFile } from 'node:fs/promises';
 import { existsSync, mkdirSync, symlinkSync, readFileSync } from 'node:fs';
 import os from 'node:os';
 import path from 'node:path';
 import { findAgentBin, selfMcpStdio } from '../env.js';
 import { buildCliPrompt } from './prompt.js';
+import { pushExtraArgs, FORBIDDEN } from './args.js';
 
 // Idle timeout: re-armed on every stdout/stderr chunk, so a long run that keeps
 // streaming never trips it — only true silence does. Override with
@@ -136,7 +138,7 @@ async function writeImages(images, tag) {
   return files;
 }
 
-export async function chat({ messages, system, options, images }, emit) {
+export async function chat({ messages, system, options, images }, emit, { signal } = {}) {
   ensureScratch();
   const tag = `${Date.now()}-${Math.random().toString(36).slice(2)}`;
   const outFile = path.join(os.tmpdir(), `chatpanel-codex-${tag}.txt`);
@@ -162,7 +164,8 @@ export async function chat({ messages, system, options, images }, emit) {
   // `-c key=value` parses value as TOML; JSON.stringify yields valid TOML here.
   args.push(...codexMcpConfigArgs(options.mcp));
   if (options.model) args.push('-m', options.model);
-  if (options.extraArgs) args.push(...String(options.extraArgs).split(/\s+/).filter(Boolean));
+  // Drop caller extras that would re-open the sandbox/approval boundary (shared sanitizer).
+  pushExtraArgs(args, options.extraArgs, FORBIDDEN.codex, emit);
   for (const f of imageFiles) args.push('-i', f); // attach images to the initial prompt
   args.push('-');
 
@@ -183,6 +186,8 @@ export async function chat({ messages, system, options, images }, emit) {
       return reject(new Error(`Failed to start codex: ${e.message}`));
     }
 
+    const detach = killOnAbort(child, signal); // Stop → SIGTERM/SIGKILL the codex child
+
     let stdout = '';
     let stderr = '';
     let idleTimer;
@@ -213,11 +218,13 @@ export async function chat({ messages, system, options, images }, emit) {
     child.stderr.on('data', (d) => { armIdle(); stderr += d.toString(); });
     child.on('error', (e) => {
       clearTimeout(idleTimer);
+      detach();
       cleanupImages();
       reject(e);
     });
     child.on('close', async (code) => {
       clearTimeout(idleTimer);
+      detach();
       let text = '';
       try {
         text = (await readFile(outFile, 'utf8')).trim();
@@ -226,6 +233,7 @@ export async function chat({ messages, system, options, images }, emit) {
       }
       unlink(outFile).catch(() => {});
       cleanupImages();
+      if (signal?.aborted) { resolve(); return; } // Stop pressed — end quietly, no error
       if (code === 0) {
         emit({ type: 'delta', text: text || '(no output)' });
         emit({ type: 'done', text: '' });