chainlesschain 0.162.175 → 0.162.177

package/src/commands/eval.js

@@ -11,15 +11,22 @@
 import fs from "fs";
 import path from "path";
 import { fileURLToPath } from "url";
-import { spawn, spawnSync } from "child_process";
 import { runEvalSuite } from "../lib/eval/runner.js";
 import { getSuite } from "../lib/eval/tasks.js";
+import executionBroker from "../lib/process-execution-broker/index.js";
 import {
   TelemetryRecorder,
   formatTelemetry,
 } from "../lib/telemetry/span-recorder.js";
 import { computeTrend, formatTrend } from "../lib/eval/trend.js";
 
+export const _deps = {
+  platform: process.platform,
+  kill: process.kill.bind(process),
+  spawn: executionBroker.spawn.bind(executionBroker),
+  spawnSync: executionBroker.spawnSync.bind(executionBroker),
+};
+
 /** Append a run summary as one JSONL line to the history file. */
 function appendHistory(file, record) {
   fs.appendFileSync(file, JSON.stringify(record) + "\n", "utf8");
@@ -55,18 +62,22 @@ const BIN = path.resolve(__dirname, "..", "..", "bin", "chainlesschain.js");
  */
 function killAgentTree(child) {
   if (!child || !child.pid) return;
-  if (process.platform === "win32") {
+  if (_deps.platform === "win32") {
     try {
-      spawnSync("taskkill", ["/PID", String(child.pid), "/T", "/F"], {
+      _deps.spawnSync("taskkill", ["/PID", String(child.pid), "/T", "/F"], {
         windowsHide: true,
         timeout: 10000,
+        origin: "eval:agent-tree-kill",
+        policy: "allow",
+        scope: "eval",
+        shell: false,
       });
     } catch {
       /* fall through to the direct kill below */
     }
   } else {
     try {
-      process.kill(-child.pid, "SIGKILL"); // negative pid = process group
+      _deps.kill(-child.pid, "SIGKILL"); // negative pid = process group
       return;
     } catch {
       /* not a group leader / already gone — fall through */
@@ -105,12 +116,16 @@ function makeHeadlessRunAgent(opts = {}) {
         if (opts.model) args.push("--model", opts.model);
         if (opts.provider) args.push("--provider", opts.provider);
       }
-      const child = spawn(process.execPath, args, {
+      const child = _deps.spawn(process.execPath, args, {
         cwd,
         env: { ...process.env, CLAUDECODE: "1" },
         windowsHide: true,
         // Own process group on POSIX so a timeout can reap the whole tree.
-        detached: process.platform !== "win32",
+        detached: _deps.platform !== "win32",
+        origin: "eval:agent-run",
+        policy: "allow",
+        scope: "eval",
+        shell: false,
       });
       let out = "";
       let err = "";

package/src/commands/hook.js

@@ -173,7 +173,7 @@ export function registerHookCommand(program) {
           return;
         }
 
-        const { runHooks } = await import("../lib/hook-runner.cjs");
+        const { runHooks } = await import("../lib/hook-runner.js");
         const outcome = runHooks(matched, payload, {
           cwd: process.cwd(),
           event,
@@ -283,7 +283,7 @@ export function registerHookCommand(program) {
         // observe-only + --run: re-collect and execute the matching hooks.
         const { loadHooks, collectHooks } =
           await import("../lib/settings-hooks.cjs");
-        const { runHooks } = await import("../lib/hook-runner.cjs");
+        const { runHooks } = await import("../lib/hook-runner.js");
         const { hooks } = loadHooks({ cwd: process.cwd() });
         const matched = collectHooks(
           hooks,

package/src/commands/hub.js

@@ -531,6 +531,12 @@ async function cmdSyncAdapter(name, options) {
     // sources (wechat-pc), --db-path as an explicit alias for the DB file.
     if (options.key) opts.key = String(options.key);
     if (options.dbPath) opts.dbPath = String(options.dbPath);
+    // WhatsApp public-backup ADB path. `--key` accepts the crypt15 64-hex
+    // root key or a crypt14/encrypted_backup.key file path. Device selection
+    // follows --serial, then ADB_SERIAL, then the single connected device.
+    if (options.serial) opts.serial = String(options.serial);
+    if (options.whatsappBusiness) opts.business = true;
+    if (options.remotePath) opts.remotePath = String(options.remotePath);
     // QQ NT (qq-pc): the SQLCipher passphrase from qq-win-db-key (ASCII, e.g.
     // "5{sww#,6aq=)8=A@"). Routes qq-pc through the decrypt+parse sidecar.
     if (options.passphrase) opts.passphrase = String(options.passphrase);
@@ -3013,7 +3019,19 @@ export function registerHubCommand(program) {
     )
     .option(
       "--key <hex>",
-      "SQLCipher key (64-hex) for encrypted local DBs (e.g. wechat-pc)",
+      "Encryption key: SQLCipher 64-hex, WhatsApp crypt15 64-hex, or WhatsApp key-file path",
+    )
+    .option(
+      "--serial <adb-serial>",
+      "Android device serial for ADB-backed adapters (otherwise ADB_SERIAL or the single connected device)",
+    )
+    .option(
+      "--whatsapp-business",
+      "Pull the WhatsApp Business public backup instead of the personal app backup",
+    )
+    .option(
+      "--remote-path <android-path>",
+      "Explicit WhatsApp msgstore backup path inside an allowed public Databases directory",
     )
     .option(
       "--passphrase <key>",

package/src/commands/loop.js

@@ -23,10 +23,10 @@
  * only builds the concrete iteration (spawn + tee output) and wires SIGINT.
  */
 
-import { spawn } from "node:child_process";
 import { fileURLToPath } from "node:url";
 import chalk from "chalk";
 import { logger } from "../lib/logger.js";
+import executionBroker from "../lib/process-execution-broker/index.js";
 import {
   runLoop,
   parseDuration,
@@ -42,6 +42,10 @@ import {
   sessionExists,
 } from "../harness/jsonl-session-store.js";
 
+export const _deps = {
+  spawn: executionBroker.spawn.bind(executionBroker),
+};
+
 /**
  * Appended to the prompt under `--dynamic` so the model can self-pace: it ends
  * its reply with at most one control directive the loop parses (parseLoopDirectives).
@@ -66,10 +70,13 @@ const BIN_PATH = fileURLToPath(
  */
 function spawnIteration(cmd, args, { shell, onChild, capture }) {
   return new Promise((resolve) => {
-    const child = spawn(cmd, args, {
+    const child = _deps.spawn(cmd, args, {
       shell,
       stdio: capture ? ["inherit", "pipe", "pipe"] : "inherit",
       env: process.env,
+      origin: "loop:iteration",
+      policy: "allow",
+      scope: "loop",
     });
     if (onChild) onChild(child);
 

package/src/commands/memory.js

@@ -4,8 +4,11 @@
  */
 
 import chalk from "chalk";
+import path from "node:path";
 import { logger } from "../lib/logger.js";
 import { bootstrap, shutdown } from "../runtime/bootstrap.js";
+import { parseEditorCommand } from "./config.js";
+import { executionBroker } from "../lib/process-execution-broker/index.js";
 import {
   getMemoryDir,
   addMemory,
@@ -50,6 +53,22 @@ import {
   getMemoryManagerStatsV2,
 } from "../lib/memory-manager.js";
 
+export const _deps = {
+  execFileSync: (...args) => executionBroker.execFileSync(...args),
+};
+
+export function openMemoryEditor(editor, filePath, deps = _deps) {
+  const [file, ...editorArgs] = parseEditorCommand(editor);
+  if (!file) throw new Error("EDITOR command is empty");
+  return deps.execFileSync(file, [...editorArgs, filePath], {
+    stdio: "inherit",
+    origin: "memory:editor",
+    policy: "allow",
+    scope: "memory",
+    shell: false,
+  });
+}
+
 export function registerMemoryCommand(program) {
   const memory = program
     .command("memory")
@@ -596,17 +615,13 @@ export function registerMemoryCommand(program) {
         const content = getMemoryFile(memoryDir);
 
         if (options.edit) {
-          const { execSync } = await import("child_process");
           const editor =
             process.env.EDITOR ||
             process.env.VISUAL ||
             (process.platform === "win32" ? "notepad" : "nano");
-          const filePath = `${memoryDir}/MEMORY.md`;
+          const filePath = path.join(memoryDir, "MEMORY.md");
           try {
-            // Escape any `"` in the path so it can't break out of the quoted
-            // arg (editor stays unquoted so `$EDITOR` values with args work).
-            const safePath = filePath.replace(/"/g, '\\"');
-            execSync(`${editor} "${safePath}"`, { stdio: "inherit" });
+            openMemoryEditor(editor, filePath);
             logger.success("Memory file updated");
           } catch {
             logger.error(

package/src/commands/permissions.js

@@ -5,6 +5,7 @@
  *   cc permissions list [--json]                merged ruleset + source file
  *   cc permissions test <tool> <args...>        dry-run: which rule decides?
  *   cc permissions add <allow|ask|deny> <rule>  append a rule to a settings file
+ *   cc permissions allow|ask|deny <rule>        convenience aliases for add
  *       [--local | --user]                      (default target: project)
  *
  * The ruleset is loaded by settings-loader (user < project < local < env) and
@@ -23,7 +24,7 @@ const KIND_COLOR = {
 };
 
 const RUNTIME_ADVISORY =
-  "advisory/not enforced: this command edits and dry-runs settings rules; the Agent runtime still has separate ApprovalGate/managed-policy wiring.";
+  "settings rules are enforced by the Agent Core when loaded into the active runtime; managed host policy and ApprovalGate still apply.";
 
 function printRuntimeAdvisory() {
   logger.log(chalk.yellow(RUNTIME_ADVISORY));
@@ -48,6 +49,48 @@ function buildArgs(tool, positional, rulesMod) {
   return {};
 }
 
+async function persistPermissionRule(decision, rule, options, operation = "add") {
+  try {
+    const kind = String(decision || "").toLowerCase();
+    if (!["allow", "ask", "deny"].includes(kind)) {
+      logger.error(
+        chalk.red(`decision must be allow | ask | deny (got "${decision}")`),
+      );
+      process.exitCode = 1;
+      return;
+    }
+    const rulesMod = await import("../lib/permission-rules.cjs");
+    const mod = rulesMod.default || rulesMod;
+    if (!mod.parseRule(rule)) {
+      logger.error(
+        chalk.red(
+          `not a valid rule: "${rule}" (expected Tool or Tool(pattern), e.g. Bash(rm:*))`,
+        ),
+      );
+      process.exitCode = 1;
+      return;
+    }
+    const scope = options.user ? "user" : options.local ? "local" : "project";
+    const { addRule } = await import("../lib/settings-loader.cjs");
+    const { file, added } = addRule({
+      cwd: process.cwd(),
+      kind,
+      rule,
+      scope,
+    });
+    if (!added) {
+      logger.log(chalk.gray(`already present in ${file}: ${kind} ${rule}`));
+      return;
+    }
+    logger.log(
+      `${KIND_COLOR[kind].bold("✓ " + kind)} ${rule} ${chalk.gray("→ " + file)}`,
+    );
+  } catch (err) {
+    logger.error(chalk.red(`permissions ${operation} failed: ${err.message}`));
+    process.exitCode = 1;
+  }
+}
+
 export function registerPermissionsCommand(program) {
   const cmd = program
     .command("permissions")
@@ -336,4 +379,17 @@ export function registerPermissionsCommand(program) {
         process.exitCode = 1;
       }
     });
+
+  // Explicit decision commands make the management surface easier to script
+  // and match the common `allow <rule>` / `deny <rule>` workflow.
+  for (const decision of ["allow", "ask", "deny"]) {
+    cmd
+      .command(`${decision} <rule>`)
+      .description(`Append an ${decision} permission rule`)
+      .option("--local", "Write to .claude/settings.local.json")
+      .option("--user", "Write to ~/.claude/settings.json")
+      .action(async (rule, options) => {
+        await persistPermissionRule(decision, rule, options, decision);
+      });
+  }
 }

package/src/commands/plugin.js

@@ -1314,6 +1314,7 @@ export function registerPluginCommand(program) {
         const scope = options.scope === "project" ? "project" : "user";
         const current = optsMod.loadPluginOptionValues(name, scope, {
           cwd: process.cwd(),
+          schema,
         });
         for (const pair of options.set) {
           const eq = pair.indexOf("=");
@@ -1326,6 +1327,7 @@ export function registerPluginCommand(program) {
         }
         optsMod.setPluginOptionValues(name, current, scope, {
           cwd: process.cwd(),
+          schema,
         });
         logger.success(`Set option(s) for ${name} at ${scope} scope`);
       }

package/src/commands/review.js

@@ -28,18 +28,22 @@
  * .chainlesschain/config.json `llm` exactly like `cc agent` / `cc ask`.
  */
 
-import { spawnSync } from "node:child_process";
 import fs from "node:fs";
 import path from "node:path";
 import chalk from "chalk";
 import { logger } from "../lib/logger.js";
 import { firstBalancedJson } from "../lib/json-schema-output.js";
+import { executionBroker } from "../lib/process-execution-broker/index.js";
 import {
   dedupeFindings,
   buildReviewReport,
   findingKey,
 } from "../lib/review-pipeline.js";
 
+export const _deps = {
+  spawnSync: (...args) => executionBroker.spawnSync(...args),
+};
+
 /** Diffs larger than this are truncated before going to the model. */
 const MAX_DIFF_CHARS = 200_000;
 /** Per-untracked-file and total caps when inlining brand-new files. */
@@ -52,12 +56,16 @@ const VALID_EFFORTS = Object.freeze(["low", "medium", "high"]);
  * Run git with an argv array (no shell → no quoting hazards). UTF-8 in/out.
  * Returns trimmed stdout; throws with git's stderr on failure.
  */
-function gitCli(args, { cwd } = {}) {
-  const res = spawnSync("git", args, {
+export function gitCli(args, { cwd } = {}) {
+  const res = _deps.spawnSync("git", args, {
     cwd,
     encoding: "utf-8",
     windowsHide: true,
     maxBuffer: 256 * 1024 * 1024,
+    origin: "review:command-git",
+    policy: "allow",
+    scope: "review",
+    shell: false,
   });
   if (res.error) throw res.error;
   if (res.status !== 0) {
@@ -86,28 +94,28 @@ function isGitRepo(cwd, git = gitCli) {
  */
 export function resolveDiffArgs(opts = {}, stat = false) {
   const { staged, base, range, paths } = opts;
-  let args;
+  const args = ["diff"];
+  if (stat) args.push("--stat");
   let scope;
   let label;
   if (range) {
-    args = ["diff", range];
+    args.push("--end-of-options", range);
     scope = "range";
     label = `range ${range}`;
   } else if (base) {
     // three-dot: changes on HEAD since it diverged from <base> (PR-style).
-    args = ["diff", `${base}...HEAD`];
+    args.push("--end-of-options", `${base}...HEAD`);
     scope = "base";
     label = `${base}...HEAD`;
   } else if (staged) {
-    args = ["diff", "--cached"];
+    args.push("--cached");
     scope = "staged";
     label = "staged changes";
   } else {
-    args = ["diff", "HEAD"];
+    args.push("HEAD");
     scope = "working";
     label = "working tree vs HEAD";
   }
-  if (stat) args.push("--stat");
   const cleanPaths = Array.isArray(paths) ? paths.filter(Boolean) : [];
   if (cleanPaths.length) args.push("--", ...cleanPaths);
   return { args, scope, label };
@@ -361,13 +369,17 @@ function collectReviewDiff(scopeOpts, { cwd, git, includeUntracked }) {
 }
 
 /** Run `gh` with an argv array (no shell). UTF-8 in/out; throws on failure. */
-function ghCli(args, { cwd, input } = {}) {
-  const res = spawnSync("gh", args, {
+export function ghCli(args, { cwd, input } = {}) {
+  const res = _deps.spawnSync("gh", args, {
     cwd,
     input,
     encoding: "utf-8",
     windowsHide: true,
     maxBuffer: 64 * 1024 * 1024,
+    origin: "review:command-gh",
+    policy: "allow",
+    scope: "review",
+    shell: false,
   });
   if (res.error) throw res.error;
   if (res.status !== 0) {

package/src/commands/routine.js

@@ -13,11 +13,16 @@
  * agenda wakeup), exactly like `cc agenda run`.
  */
 
-import { spawn, execFile } from "node:child_process";
 import { readFileSync, existsSync } from "node:fs";
 import { fileURLToPath } from "node:url";
 import chalk from "chalk";
 import { logger } from "../lib/logger.js";
+import { executionBroker } from "../lib/process-execution-broker/index.js";
+
+export const _deps = {
+  spawn: (...args) => executionBroker.spawn(...args),
+  execFile: (...args) => executionBroker.execFile(...args),
+};
 
 const BIN_PATH = fileURLToPath(
   new URL("../../bin/chainlesschain.js", import.meta.url),
@@ -29,12 +34,18 @@ async function loadStore() {
 }
 
 /** Production runner: `cc agent -p <prompt> --output-format json`. */
-function defaultRunAgent({ prompt }) {
+export function defaultRunAgent({ prompt }) {
   return new Promise((resolve) => {
-    const child = spawn(
+    const child = _deps.spawn(
       process.execPath,
-      [BIN_PATH, "agent", "-p", prompt, "--output-format", "json"],
-      { windowsHide: true },
+      [BIN_PATH, "agent", "--output-format", "json"],
+      {
+        windowsHide: true,
+        origin: "routine:agent",
+        policy: "allow",
+        scope: "routine",
+        shell: false,
+      },
     );
     let out = "";
     let err = "";
@@ -42,6 +53,10 @@ function defaultRunAgent({ prompt }) {
     child.stderr?.setEncoding("utf8");
     child.stdout?.on("data", (d) => (out += d));
     child.stderr?.on("data", (d) => (err += d));
+    if (child.stdin) {
+      child.stdin.on("error", () => {});
+      child.stdin.end(prompt);
+    }
     child.on("error", (error) =>
       resolve({ exitCode: -1, output: `spawn error: ${error.message}` }),
     );
@@ -70,12 +85,20 @@ function defaultRunAgent({ prompt }) {
 }
 
 /** Production github events fetch via gh CLI. */
-function defaultFetchEvents(repo) {
+export function defaultFetchEvents(repo) {
   return new Promise((resolve) => {
-    execFile(
+    _deps.execFile(
       "gh",
       ["api", `repos/${repo}/events`, "--paginate=false"],
-      { encoding: "utf8", timeout: 8000, windowsHide: true },
+      {
+        encoding: "utf8",
+        timeout: 8000,
+        windowsHide: true,
+        origin: "routine:github-events",
+        policy: "allow",
+        scope: "routine",
+        shell: false,
+      },
       (err, stdout) => {
         if (err) return resolve([]);
         try {

package/src/commands/session.js

@@ -61,6 +61,11 @@ import {
   listWorkflowSessions,
   readWorkflowSession,
 } from "../lib/workflow-state-reader.js";
+import { executionBroker } from "../lib/process-execution-broker/index.js";
+
+export const _deps = {
+  execFileSync: (...args) => executionBroker.execFileSync(...args),
+};
 
 // DB sessions store `updated_at` as SQLite datetime('now') → "YYYY-MM-DD
 // HH:MM:SS" (UTC, space at index 10); JSONL sessions store toISOString() →
@@ -149,8 +154,7 @@ export function mapGhPrToSignals(gh = {}) {
  * mapped signals, or throws (caller degrades to a "pass --checks-file" hint).
  * 8s timeout, stderr suppressed — a missing / unauthenticated gh just fails.
  */
-async function fetchPrSignalsViaGh(target) {
-  const { execFileSync } = await import("node:child_process");
+export async function fetchPrSignalsViaGh(target) {
   const args = [
     "pr",
     "view",
@@ -159,10 +163,14 @@ async function fetchPrSignalsViaGh(target) {
     "number,state,headRefName,headRefOid,reviewDecision,statusCheckRollup",
   ];
   if (target.repo) args.push("--repo", String(target.repo));
-  const out = execFileSync("gh", args, {
+  const out = _deps.execFileSync("gh", args, {
     encoding: "utf-8",
     timeout: 8000,
     stdio: ["ignore", "pipe", "ignore"],
+    origin: "session:pr-status",
+    policy: "allow",
+    scope: "pr",
+    shell: false,
   });
   return mapGhPrToSignals(JSON.parse(out));
 }

package/src/commands/skill.js

@@ -10,6 +10,7 @@ import chalk from "chalk";
 import ora from "ora";
 import fs from "fs";
 import path from "path";
+import { createSkillProcessBroker } from "../lib/skill-process-broker.js";
 import { logger } from "../lib/logger.js";
 import {
   CLISkillLoader,
@@ -368,6 +369,7 @@ export function registerSkillCommand(program) {
           projectRoot: process.cwd(),
           workspacePath: process.cwd(),
           workspaceRoot: process.cwd(),
+          processBroker: createSkillProcessBroker(s),
         };
 
         const result = await handler.execute(task, context, s);

package/src/commands/statusline.js

@@ -27,12 +27,12 @@ export function registerStatuslineCommand(program) {
     .action(async (options) => {
       try {
         const { loadStatusLineConfig, buildContext, renderStatusLine } =
-          await import("../lib/status-line.cjs");
+          await import("../lib/status-line.js");
         const cfg = loadStatusLineConfig({ cwd: process.cwd() });
         if (!cfg) {
           logger.log(
             chalk.gray(
-              'No statusLine configured. Add to .claude/settings.json:\n' +
+              "No statusLine configured. Add to .claude/settings.json:\n" +
                 '  { "statusLine": { "type": "command", "command": "./status.sh" } }',
             ),
           );
@@ -73,7 +73,7 @@ export function registerStatuslineCommand(program) {
     .option("--json", "Output as JSON")
     .action(async (options) => {
       try {
-        const { loadStatusLineConfig } = await import("../lib/status-line.cjs");
+        const { loadStatusLineConfig } = await import("../lib/status-line.js");
         const cfg = loadStatusLineConfig({ cwd: process.cwd() });
         if (options.json) {
           console.log(JSON.stringify(cfg, null, 2));

package/src/commands/team.js

@@ -18,12 +18,16 @@
 import fs from "fs";
 import path from "path";
 import { fileURLToPath } from "url";
-import { spawn } from "child_process";
 import { TaskLeaseRegistry } from "../lib/agent-team/task-lease.js";
 import { TeamRunner } from "../lib/agent-team/team-runner.js";
 import { TeamWorktreeCoordinator } from "../lib/agent-team/team-worktree.js";
 import { TeamBudget } from "../lib/agent-team/team-budget.js";
 import { TeamMailbox } from "../lib/agent-team/team-mailbox.js";
+import { executionBroker } from "../lib/process-execution-broker/index.js";
+
+export const _deps = {
+  spawn: (...args) => executionBroker.spawn(...args),
+};
 
 const __dirname = path.dirname(fileURLToPath(import.meta.url));
 const BIN = path.resolve(__dirname, "..", "..", "bin", "chainlesschain.js");
@@ -94,17 +98,20 @@ function planWaves(reg) {
 }
 
 /** Real executor: run a task's shell `command`, success = exit 0. */
-function makeShellRunTask(logger) {
+export function makeShellRunTask(logger) {
   return function runTask({ task }) {
     const command = task.metadata?.command || task?.command;
     if (!command) {
       throw new Error(`task "${task.key}" has no \`command\` to --exec`);
     }
     return new Promise((resolve, reject) => {
-      const child = spawn(command, {
+      const child = _deps.spawn(command, [], {
         cwd: process.cwd(),
         shell: true,
         env: process.env,
+        origin: "team:shell",
+        policy: "allow",
+        scope: "team",
       });
       let err = "";
       child.stderr?.on("data", (d) => (err += d.toString("utf8")));
@@ -118,26 +125,32 @@ function makeShellRunTask(logger) {
 }
 
 /** Spawn a headless `cc agent -p` for one prompt in `cwd`; resolve on exit 0. */
-function spawnAgent(prompt, cwd, opts = {}) {
+export function spawnAgent(prompt, cwd, opts = {}) {
   return new Promise((resolve, reject) => {
     const args = [
       BIN,
       "agent",
-      "-p",
-      prompt,
       "--permission-mode",
       opts.permissionMode || "acceptEdits",
       "--output-format",
       "text",
     ];
     if (opts.model) args.push("--model", opts.model);
-    const child = spawn(process.execPath, args, {
+    const child = _deps.spawn(process.execPath, args, {
       cwd,
       env: { ...process.env, CLAUDECODE: "1" },
       windowsHide: true,
+      origin: "team:agent",
+      policy: "allow",
+      scope: "team",
+      shell: false,
     });
     let err = "";
     child.stderr?.on("data", (d) => (err += d.toString("utf8")));
+    if (child.stdin) {
+      child.stdin.on("error", () => {});
+      child.stdin.end(prompt);
+    }
     child.on("error", (e) => reject(new Error(e.message)));
     child.on("close", (code) =>
       code === 0