atris 3.71.3 → 3.72.1

package/lib/zen-workspace.js

@@ -0,0 +1,121 @@
+'use strict';
+
+// The workspace and understanding layers of atris zen. Zen runs the safe,
+// existing cleanups (`atris clean`), then names the few things only a person
+// can do, each with one command. That short list is the shared picture: zen
+// did everything it could, and here is exactly what is left for you.
+
+const fs = require('node:fs');
+const path = require('node:path');
+const { spawnSync } = require('node:child_process');
+
+const CLI = path.join(__dirname, '..', 'bin', 'atris.js');
+
+function plural(n, one, many) {
+  return `${n} ${n === 1 ? one : many}`;
+}
+
+function runCliJson(args, root) {
+  const result = spawnSync(process.execPath, [CLI, ...args], {
+    cwd: root,
+    encoding: 'utf8',
+    timeout: 180000,
+    env: { ...process.env, ATRIS_SKIP_UPDATE_CHECK: '1', ATRIS_NONINTERACTIVE: '1' },
+  });
+  const text = String(result.stdout || '');
+  const start = text.indexOf('{');
+  if (start < 0) return null;
+  try {
+    return JSON.parse(text.slice(start));
+  } catch {
+    return null;
+  }
+}
+
+// The map as it stands on disk: MAP.md plus any split files under atris/map/.
+function mapSnapshot(root) {
+  const files = [path.join(root, 'atris', 'MAP.md')];
+  const dir = path.join(root, 'atris', 'map');
+  try {
+    for (const name of fs.readdirSync(dir).sort()) files.push(path.join(dir, name));
+  } catch {
+    // No split map.
+  }
+  return files.map((f) => {
+    try {
+      return `${f}\0${fs.readFileSync(f, 'utf8')}`;
+    } catch {
+      return `${f}\0`;
+    }
+  }).join('\0\0');
+}
+
+function workspaceZen({ root, dryRun = false } = {}) {
+  const out = { ran: false, done: [], todo: [], yours: [] };
+  if (!root || !fs.existsSync(path.join(root, 'atris'))) return out;
+  out.ran = true;
+
+  const mapBefore = dryRun ? null : mapSnapshot(root);
+  const clean = runCliJson(dryRun ? ['clean', '--dry-run', '--json'] : ['clean', '--json'], root);
+  const r = clean?.results || {};
+  const lines = [];
+  const journals = r.journals?.archived_count || 0;
+  if (journals) lines.push(`${dryRun ? '' : 'archived '}${plural(journals, 'old journal', 'old journals')}${dryRun ? ' to archive' : ''}`);
+  const stale = r.stale_tasks?.count || 0;
+  if (stale) lines.push(`${dryRun ? '' : 'put away '}${plural(stale, 'stale task', 'stale tasks')}${dryRun ? ' to put away' : ''}`);
+  const healed = r.map_refs?.healed_count || 0;
+  if (healed) lines.push(`${dryRun ? '' : 'fixed '}${plural(healed, 'broken map link', 'broken map links')}${dryRun ? ' to fix' : ''}`);
+  const sections = r.sections?.cleaned_count || 0;
+  if (sections) lines.push(`${dryRun ? '' : 'cleared '}${plural(sections, 'empty task section', 'empty task sections')}${dryRun ? ' to clear' : ''}`);
+  if (!dryRun && mapSnapshot(root) !== mapBefore) lines.push('refreshed the map');
+  if (dryRun) out.todo.push(...lines);
+  else out.done.push(...lines);
+
+  const unhealable = r.map_refs?.unhealable_count || 0;
+  if (unhealable) out.yours.push({ text: `${plural(unhealable, 'map link points', 'map links point')} nowhere`, cmd: 'atris clean' });
+  const pages = r.stale_pages?.items || [];
+  if (pages.length) {
+    out.yours.push({
+      text: `${plural(pages.length, 'wiki page is', 'wiki pages are')} behind ${pages.length === 1 ? 'its source' : 'their sources'}`,
+      cmd: 'atris clean --dry-run',
+    });
+  }
+  const dead = r.dead_code?.count || 0;
+  if (dead) out.yours.push({ text: `${plural(dead, 'file looks', 'files look')} unused`, cmd: 'atris clean --dry-run' });
+
+  // Every wiki surface that needs pruning shares one command, so they share
+  // one line too: a person sees one job, not three.
+  try {
+    const seen = new Set();
+    const parts = [];
+    for (const f of require('./wiki').findWikiMetabolismFindings(root)) {
+      if (seen.has(f.surface)) continue;
+      seen.add(f.surface);
+      const unit = f.surface.endsWith('/') ? 'pages' : 'entries';
+      parts.push(f.code === 'over-budget'
+        ? { one: `wiki ${f.surface} has ${f.count} ${unit}, its budget is ${f.budget}`, short: `${f.surface} ${f.count} of ${f.budget}` }
+        : { one: `wiki ${f.surface} grew by ${f.growth} ${unit} since its last pruning`, short: `${f.surface} grew by ${f.growth}` });
+    }
+    if (parts.length === 1) out.yours.push({ text: parts[0].one, cmd: 'atris wiki consolidate' });
+    if (parts.length > 1) {
+      out.yours.push({ text: `wiki needs pruning in ${parts.length} places: ${parts.map((x) => x.short).join(', ')}`, cmd: 'atris wiki consolidate' });
+    }
+  } catch {
+    // No wiki, nothing to prune.
+  }
+
+  // Only ask where tasks already live; asking would otherwise create task state.
+  const state = path.join(root, '.atris', 'state');
+  const hasTasks = ['tasks.projection.json', 'atris.db'].some((f) => fs.existsSync(path.join(state, f)));
+  const reviews = hasTasks ? runCliJson(['task', 'reviews', '--json'], root) : null;
+  const ready = reviews?.queue?.counts?.certified || 0;
+  if (ready) {
+    out.yours.push({
+      text: `${plural(ready, 'finished job is', 'finished jobs are')} waiting for your ok`,
+      cmd: 'atris task reviews',
+    });
+  }
+  return out;
+}
+
+module.exports = { workspaceZen };

package/lib/zen.js

@@ -0,0 +1,409 @@
+'use strict';
+
+// Zen state: the main checkout matches origin, stray code is not left in the
+// tree, the team's live state stays on disk, and there are no leftovers
+// (stashes, idle side copies, merged branches). This module only reads.
+
+const fs = require('node:fs');
+const os = require('node:os');
+const path = require('node:path');
+const { spawnSync } = require('node:child_process');
+const { runGit } = require('./checkout-sync');
+
+// Paths that hold the team's live state or Atris-generated agent config.
+// Uncommitted changes here are expected and never break zen.
+const DEFAULT_TEAM_STATE = [
+  'atris/',
+  '.atris/',
+  '.claude/',
+  '.codex/',
+  '.cursor/',
+  'CLAUDE.md',
+  'AGENTS.md',
+  'GEMINI.md',
+  // Live data: a running app reads it from the tree, so zen never rolls it back.
+  '*.db',
+  '*.db-wal',
+  '*.db-shm',
+  '*.sqlite',
+  '*.sqlite3',
+  '*.duckdb',
+];
+
+function gitOut(args, cwd) {
+  const result = runGit(args, cwd);
+  return result.status === 0 ? result.stdout.trim() : null;
+}
+
+function readTeamState(root) {
+  const extra = [];
+  try {
+    const config = JSON.parse(fs.readFileSync(path.join(root, '.atris', 'zen.json'), 'utf8'));
+    if (Array.isArray(config.team_state)) {
+      for (const entry of config.team_state) {
+        if (typeof entry === 'string' && entry.trim()) extra.push(entry.trim());
+      }
+    }
+  } catch {
+    // No config, or unreadable config: defaults only.
+  }
+  return [...DEFAULT_TEAM_STATE, ...extra];
+}
+
+function isTeamState(file, teamState) {
+  return teamState.some((entry) => {
+    if (entry.startsWith('*.')) return file.endsWith(entry.slice(1));
+    return entry.endsWith('/') ? file.startsWith(entry) : file === entry || file.startsWith(`${entry}/`);
+  });
+}
+
+function defaultBranch(root, remote) {
+  const head = gitOut(['symbolic-ref', '--quiet', '--short', `refs/remotes/${remote}/HEAD`], root);
+  if (head && head.startsWith(`${remote}/`)) return head.slice(remote.length + 1);
+  for (const name of ['main', 'master']) {
+    if (runGit(['rev-parse', '--verify', '--quiet', `refs/remotes/${remote}/${name}`], root).status === 0) {
+      return name;
+    }
+  }
+  return null;
+}
+
+function dirtyEntries(root) {
+  const result = runGit(['status', '--porcelain=v1', '-z'], root);
+  if (result.status !== 0) return [];
+  const entries = result.stdout.split('\0');
+  const files = [];
+  for (let i = 0; i < entries.length; i += 1) {
+    const entry = entries[i];
+    if (!entry) continue;
+    const item = { xy: entry.slice(0, 2), path: entry.slice(3), orig: null };
+    // Renames and copies carry the original path as the next entry.
+    if (entry[0] === 'R' || entry[0] === 'C') {
+      item.orig = entries[i + 1] || null;
+      i += 1;
+    }
+    files.push(item);
+  }
+  return files;
+}
+
+function dirtyPaths(root) {
+  return dirtyEntries(root).map((entry) => entry.path);
+}
+
+function listWorktrees(root) {
+  const out = gitOut(['worktree', 'list', '--porcelain'], root) || '';
+  const worktrees = [];
+  let current = null;
+  for (const line of out.split('\n')) {
+    if (line.startsWith('worktree ')) {
+      current = { path: line.slice('worktree '.length), branch: null, prunable: false, locked: false };
+      worktrees.push(current);
+    } else if (current && line.startsWith('branch ')) {
+      current.branch = line.slice('branch '.length).replace(/^refs\/heads\//, '');
+    } else if (current && line.startsWith('prunable')) {
+      current.prunable = true;
+    } else if (current && (line === 'locked' || line.startsWith('locked '))) {
+      // Locked by its owner (often a running agent). Git will not remove it.
+      current.locked = true;
+    }
+  }
+  return worktrees;
+}
+
+// Text of the jobs this machine runs on a schedule: the user crontab and
+// launchd agents. A side copy named there is in use even when it looks idle.
+// ATRIS_ZEN_SCHEDULE_FILE points at a file to read instead (tests).
+function scheduleText() {
+  const override = process.env.ATRIS_ZEN_SCHEDULE_FILE;
+  if (override) {
+    try {
+      return fs.readFileSync(override, 'utf8');
+    } catch {
+      return '';
+    }
+  }
+  const parts = [];
+  const cron = spawnSync('crontab', ['-l'], { encoding: 'utf8', timeout: 5000 });
+  if (cron.status === 0) parts.push(cron.stdout);
+  const agents = path.join(os.homedir(), 'Library', 'LaunchAgents');
+  try {
+    for (const name of fs.readdirSync(agents)) {
+      if (name.endsWith('.plist')) parts.push(fs.readFileSync(path.join(agents, name), 'utf8'));
+    }
+  } catch {
+    // No launchd agents.
+  }
+  return parts.join('\n');
+}
+
+function scheduledCopies(worktrees, text = scheduleText()) {
+  if (!text) return new Set();
+  const home = os.homedir();
+  const expanded = text.replace(/\$\{?HOME\}?/g, home).replace(/(^|[\s"'=:])~\//g, `$1${home}/`);
+  const used = new Set();
+  for (const wt of worktrees) {
+    const at = path.resolve(wt.path);
+    const pattern = new RegExp(`${at.replace(/[.*+?^${}()|[\]\\]/g, '\\$&')}(?![\\w.-])`);
+    if (pattern.test(expanded)) used.add(at);
+  }
+  return used;
+}
+
+const FRESH_MINUTES = 30;
+
+function freshMinutesFromEnv() {
+  const n = Number.parseFloat(process.env.ATRIS_ZEN_FRESH_MINUTES || FRESH_MINUTES);
+  return Number.isFinite(n) ? n : FRESH_MINUTES;
+}
+
+function untrackedFiles(root, dir) {
+  const out = gitOut(['ls-files', '--others', '--exclude-standard', '-z', '--', dir], root);
+  return out ? out.split('\0').filter(Boolean) : [];
+}
+
+// Every changed file in a checkout, with untracked folders opened up.
+function changedFiles(checkout) {
+  return dirtyEntries(checkout).flatMap((entry) => {
+    const paths = entry.xy === '??' && entry.path.endsWith('/') ? untrackedFiles(checkout, entry.path) : [entry.path];
+    return entry.orig ? [...paths, entry.orig] : paths;
+  });
+}
+
+function lastTouched(checkout) {
+  let newest = 0;
+  for (const p of changedFiles(checkout)) newest = Math.max(newest, mtime(path.join(checkout, p)));
+  return newest;
+}
+
+// A side copy whose only changes are team notes, untouched and not switched
+// or committed in the fresh window, holds nothing anyone is working on. Live
+// data files never count as notes, so a copy holding one is left alone.
+function idleWithOnlyNotes(checkout, teamState, cutoff) {
+  const live = teamState.filter((entry) => entry.startsWith('*.'));
+  const files = changedFiles(checkout);
+  if (!files.length) return false;
+  if (!files.every((f) => isTeamState(f, teamState) && !isTeamState(f, live))) return false;
+  return !headMovedSince(checkout, cutoff) && lastTouched(checkout) <= cutoff;
+}
+
+const ABANDONED_DAYS = 3;
+
+function abandonedDaysFromEnv() {
+  const n = Number.parseFloat(process.env.ATRIS_ZEN_ABANDONED_DAYS || ABANDONED_DAYS);
+  return Number.isFinite(n) ? n : ABANDONED_DAYS;
+}
+
+function mtime(file) {
+  try {
+    return fs.lstatSync(file).mtimeMs;
+  } catch {
+    return 0;
+  }
+}
+
+// When the last entry in a history file was written, read from the entry
+// itself. Git upkeep (gc, reflog expire) rewrites these files without adding
+// entries, so the file time alone would make an old copy look fresh.
+function lastEntryTime(log) {
+  let fd;
+  try {
+    fd = fs.openSync(log, 'r');
+    const size = fs.fstatSync(fd).size;
+    const length = Math.min(size, 8192);
+    const buf = Buffer.alloc(length);
+    fs.readSync(fd, buf, 0, length, size - length);
+    const last = buf.toString('utf8').trimEnd().split('\n').pop() || '';
+    const m = last.match(/> (\d+) [+-]\d{4}\t/);
+    return m ? Number(m[1]) * 1000 : null;
+  } catch {
+    return null;
+  } finally {
+    if (fd !== undefined) fs.closeSync(fd);
+  }
+}
+
+// True when a checkout switched or made a commit after the cutoff.
+function headMovedSince(checkout, cutoff) {
+  const gitDir = gitOut(['rev-parse', '--git-dir'], checkout);
+  if (!gitDir) return false;
+  const dir = path.resolve(checkout, gitDir);
+  const logged = lastEntryTime(path.join(dir, 'logs', 'HEAD'));
+  if (logged !== null) return logged > cutoff;
+  return Math.max(mtime(path.join(dir, 'logs', 'HEAD')), mtime(path.join(dir, 'HEAD'))) > cutoff;
+}
+
+// A checkout whose core.bare got set to true still has its .git folder and
+// every file, but git stops looking at the files, so "not a git repository"
+// would send the reader the wrong way. Name it, with the one-line undo.
+const BARE_FLIPPED = 'git here is set to bare (core.bare is true), so it ignores the files in this folder; git config core.bare false undoes it';
+
+function flippedToBare(cwd) {
+  if (gitOut(['rev-parse', '--is-bare-repository'], cwd) !== 'true') return false;
+  const gitDir = gitOut(['rev-parse', '--absolute-git-dir'], cwd);
+  if (!gitDir || path.basename(gitDir) !== '.git') return false;
+  const folder = path.dirname(gitDir);
+  const here = fs.realpathSync(cwd);
+  return here === folder || here.startsWith(folder + path.sep);
+}
+
+function checkZen({ cwd = process.cwd(), fetch = true, freshMinutes = freshMinutesFromEnv(), now = Date.now() } = {}) {
+  const root = gitOut(['rev-parse', '--show-toplevel'], cwd);
+  if (!root) return { ok: false, error: flippedToBare(cwd) ? BARE_FLIPPED : 'not a git repository' };
+
+  const remote = gitOut(['remote'], root)?.split('\n').includes('origin') ? 'origin' : null;
+  let fetched = null;
+  if (remote && fetch) fetched = runGit(['fetch', '--quiet', remote], root).status === 0;
+
+  const main = remote ? defaultBranch(root, remote) : null;
+  const upstream = main ? `${remote}/${main}` : null;
+  const branch = gitOut(['symbolic-ref', '--quiet', '--short', 'HEAD'], root);
+  const problems = [];
+
+  if (!upstream) {
+    problems.push({ kind: 'no_upstream', text: 'no origin main branch to compare against' });
+  } else if (branch !== main) {
+    problems.push({
+      kind: 'off_main',
+      text: branch ? `on branch ${branch}, not ${main}` : `not on a branch (detached), not ${main}`,
+    });
+  }
+
+  let ahead = 0;
+  let behind = 0;
+  if (upstream) {
+    const counts = gitOut(['rev-list', '--left-right', '--count', `HEAD...${upstream}`], root);
+    if (counts) [ahead, behind] = counts.split(/\s+/).map((n) => Number.parseInt(n, 10) || 0);
+    if (ahead) problems.push({ kind: 'ahead', count: ahead, text: `${ahead} unpushed ${ahead === 1 ? 'commit' : 'commits'}` });
+    if (behind) problems.push({ kind: 'behind', count: behind, text: `${behind} ${behind === 1 ? 'commit' : 'commits'} behind ${upstream}` });
+  }
+
+  const teamState = readTeamState(root);
+  const dirty = dirtyPaths(root);
+  const stray = dirty.filter((file) => !isTeamState(file, teamState));
+  const teamFiles = dirty.length - stray.length;
+  if (stray.length) {
+    problems.push({
+      kind: 'stray_code',
+      count: stray.length,
+      files: stray,
+      text: `${stray.length} stray code ${stray.length === 1 ? 'edit' : 'edits'} outside team state`,
+    });
+  }
+
+  const stashOut = gitOut(['stash', 'list', '--format=%H'], root) || '';
+  const stashes = stashOut ? stashOut.split('\n').length : 0;
+  if (stashes) problems.push({ kind: 'stashes', count: stashes, text: `${stashes} old ${stashes === 1 ? 'stash' : 'stashes'}` });
+
+  const others = listWorktrees(root).filter((wt) => path.resolve(wt.path) !== path.resolve(root));
+  const idle = [];
+  const busy = [];
+  const notesOnly = [];
+  const inUse = [];
+  const locked = [];
+  const cutoff = now - freshMinutes * 60000;
+  const scheduled = scheduledCopies(others);
+  for (const wt of others) {
+    if (scheduled.has(path.resolve(wt.path))) continue;
+    if (wt.locked) {
+      locked.push(wt);
+      continue;
+    }
+    if (wt.prunable || !fs.existsSync(wt.path)) {
+      idle.push(wt);
+      continue;
+    }
+    const status = runGit(['status', '--porcelain'], wt.path);
+    if (status.status !== 0) busy.push(wt);
+    else if (status.stdout.trim()) (idleWithOnlyNotes(wt.path, teamState, cutoff) ? notesOnly : busy).push(wt);
+    else if (headMovedSince(wt.path, cutoff)) inUse.push(wt);
+    else idle.push(wt);
+  }
+  if (notesOnly.length) {
+    problems.push({
+      kind: 'notes_only_worktrees',
+      count: notesOnly.length,
+      paths: notesOnly.map((wt) => wt.path),
+      text: `${notesOnly.length} idle side ${notesOnly.length === 1 ? 'copy holds' : 'copies hold'} only team notes`,
+    });
+  }
+  if (idle.length) {
+    problems.push({
+      kind: 'idle_worktrees',
+      count: idle.length,
+      paths: idle.map((wt) => wt.path),
+      text: `${idle.length} idle side ${idle.length === 1 ? 'copy' : 'copies'} with no unsaved work`,
+    });
+  }
+
+  let merged = [];
+  if (upstream) {
+    const checkedOut = new Set(others.map((wt) => wt.branch).filter(Boolean));
+    merged = (gitOut(['branch', '--merged', upstream, '--format=%(refname:short)'], root) || '')
+      .split('\n')
+      .filter((name) => name && name !== branch && name !== main && !checkedOut.has(name));
+    if (merged.length) {
+      problems.push({
+        kind: 'merged_branches',
+        count: merged.length,
+        branches: merged,
+        text: `${merged.length} ${merged.length === 1 ? 'branch' : 'branches'} already merged`,
+      });
+    }
+  }
+
+  return {
+    ok: true,
+    zen: problems.length === 0,
+    root,
+    branch,
+    upstream,
+    fetched,
+    ahead,
+    behind,
+    team_files: teamFiles,
+    stashes,
+    worktrees_with_work: busy.map((wt) => wt.path),
+    worktrees_in_use: inUse.map((wt) => wt.path),
+    worktrees_locked: locked.map((wt) => wt.path),
+    fresh_minutes: freshMinutes,
+    problems,
+  };
+}
+
+// Where the side copies are, so a line about them can be acted on: home
+// shortened to ~, at most three named.
+// Side copies left with unsaved work: one place per line so a long path
+// still fits a narrow pane, then when zen will take them over.
+function sideCopyLines(paths, days) {
+  const home = os.homedir();
+  const n = paths.length;
+  const lines = [`${n} side ${n === 1 ? 'copy has' : 'copies have'} unsaved work, left for ${n === 1 ? 'its owner' : 'their owners'}`];
+  for (const p of paths.slice(0, 3)) {
+    lines.push(`  ${p === home || p.startsWith(home + path.sep) ? `~${p.slice(home.length)}` : p}`);
+  }
+  if (n > 3) lines.push(`  and ${n - 3} more`);
+  lines.push(`zen saves ${n === 1 ? 'it' : 'each one'} to zen-backup/ once nobody has touched it for ${days} ${days === 1 ? 'day' : 'days'}`);
+  return lines;
+}
+
+module.exports = {
+  ABANDONED_DAYS,
+  idleWithOnlyNotes,
+  lastTouched,
+  untrackedFiles,
+  abandonedDaysFromEnv,
+  sideCopyLines,
+  DEFAULT_TEAM_STATE,
+  FRESH_MINUTES,
+  headMovedSince,
+  mtime,
+  checkZen,
+  defaultBranch,
+  dirtyEntries,
+  gitOut,
+  isTeamState,
+  listWorktrees,
+  readTeamState,
+  scheduledCopies,
+};

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "atris",
-  "version": "3.71.3",
+  "version": "3.72.1",
   "description": "you say what you want in plain words. atris builds it, checks it, and shows you proof.",
   "main": "bin/atris.js",
   "bin": {

package/utils/api.js

@@ -77,8 +77,21 @@ function httpRequest(urlString, options) {
     const req = transport.request(requestOptions, (res) => {
       // Follow redirects (301, 302, 307, 308)
       if ([301, 302, 307, 308].includes(res.statusCode) && res.headers.location) {
-        const redirectUrl = new URL(res.headers.location, urlString).toString();
-        resolve(httpRequest(redirectUrl, options));
+        res.resume();
+        let redirectUrl;
+        try {
+          redirectUrl = new URL(res.headers.location, parsed);
+        } catch {
+          reject(new Error('invalid redirect target'));
+          return;
+        }
+        // Headers and bodies can both contain credentials. Never replay them
+        // to another origin, including a different port or an HTTPS downgrade.
+        if (redirectUrl.origin !== parsed.origin) {
+          reject(new Error(`refusing cross-origin redirect to ${redirectUrl.host || redirectUrl.protocol}`));
+          return;
+        }
+        resolve(httpRequest(redirectUrl.toString(), options));
         return;
       }
 

package/utils/auth.js

@@ -2,7 +2,7 @@ const os = require('os');
 const path = require('path');
 const { stateHome } = require('../lib/state-home');
 const fs = require('fs');
-const { exec } = require('child_process');
+const { execFile } = require('child_process');
 const readline = require('readline');
 const agentClient = require('./agent-client');
 
@@ -12,19 +12,20 @@ const agentClient = require('./agent-client');
  */
 function openBrowser(url) {
   const platform = os.platform();
-  // Sanitize URL to prevent shell injection — only allow valid URL characters
-  const sanitizedUrl = url.replace(/[^a-zA-Z0-9\-._~:/?#\[\]@!$&'()*+,;=%]/g, '');
   let command;
+  let args = [url];
 
   if (platform === 'darwin') {
-    command = `open "${sanitizedUrl}"`;
+    command = 'open';
   } else if (platform === 'win32') {
-    command = `start "" "${sanitizedUrl}"`;
+    command = 'rundll32.exe';
+    args = ['url.dll,FileProtocolHandler', url];
   } else {
-    command = `xdg-open "${sanitizedUrl}"`;
+    command = 'xdg-open';
   }
 
-  exec(command, (error) => {
+  // Pass the URL as data, including on Windows, without a command shell.
+  execFile(command, args, (error) => {
     if (error) {
       console.log(`\nCouldn't open browser automatically. Please visit:\n${url}`);
     }