claude-simple 0.2.28 → 0.2.31

package/src/agents/sessions.js

@@ -4,6 +4,7 @@ import readline from 'readline';
 import path from 'path';
 import os from 'os';
 import crypto from 'crypto';
+import { pathsEqual } from '../platform.js';
 
 // ─── Claude ───────────────────────────────────────────────────────────────────
 
@@ -105,7 +106,7 @@ async function scanClaudeConfigDir(configDir, nameMap, filterCwd) {
       const filePath = path.join(projectDir, fileEntry.name);
       try {
         const [stat, meta] = await Promise.all([fs.stat(filePath), readClaudeSessionMeta(filePath)]);
-        if (filterCwd && meta.cwd !== filterCwd) return;
+        if (filterCwd && !pathsEqual(meta.cwd, filterCwd)) return;
         const sessionId = meta.sessionId || fileEntry.name.replace('.jsonl', '');
         const firstMsg = await readClaudeFirstMessage(filePath);
         sessions.push({
@@ -286,13 +287,20 @@ async function findCodexRollouts(codexHome) {
   return files;
 }
 
+const codexMetadata = new Map();
 async function readCodexMeta(filePath) {
+  const stat = await fs.stat(filePath);
+  const cached = codexMetadata.get(filePath);
+  if (cached?.size === stat.size && cached?.mtimeMs === stat.mtimeMs) return cached.meta;
   let id = null, cwd = null, ts = null, turnCount = 0;
   try {
     // Full scan: meta is early; turnCount needs whole file
     const stream = fsSync.createReadStream(filePath);
     const rl = readline.createInterface({ input: stream, crlfDelay: Infinity });
     for await (const line of rl) {
+      const head = line.slice(0, 400);
+      if (!/"type"\s*:\s*"(?:session_meta|turn_context)"/.test(head) &&
+          !/"(?:role|type)"\s*:\s*"(?:user|user_message)"/.test(head)) continue;
       try {
         const d = JSON.parse(line);
         if (d.type === 'session_meta' && d.payload) {
@@ -316,7 +324,10 @@ async function readCodexMeta(filePath) {
     const m = path.basename(filePath).match(/([0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12})/i);
     if (m) id = m[1];
   }
-  return { id, cwd, ts, turnCount };
+  const meta = { id, cwd, ts, turnCount };
+  codexMetadata.set(filePath, { size: stat.size, mtimeMs: stat.mtimeMs, meta });
+  while (codexMetadata.size > 2000) codexMetadata.delete(codexMetadata.keys().next().value);
+  return meta;
 }
 
 export async function scanCodexSessions(codexHome, filterCwd = null) {
@@ -325,25 +336,27 @@ export async function scanCodexSessions(codexHome, filterCwd = null) {
   const rollouts = await findCodexRollouts(home);
   const sessions = [];
 
-  await Promise.all(rollouts.map(async filePath => {
-    try {
-      const [stat, meta] = await Promise.all([fs.stat(filePath), readCodexMeta(filePath)]);
-      if (!meta.id) return;
-      if (filterCwd && meta.cwd && meta.cwd !== filterCwd) return;
-      const idx = index.get(meta.id);
-      sessions.push({
-        sessionId: meta.id,
-        agent: 'codex',
-        cwd: meta.cwd || null,
-        configDir: home,
-        display: idx?.thread_name || meta.id.slice(0, 8),
-        updatedAt: stat.mtimeMs,
-        hasMemory: false,
-        filePath,
-        turnCount: meta.turnCount || 0,
-      });
-    } catch {}
-  }));
+  for (let offset = 0; offset < rollouts.length; offset += 8) {
+    await Promise.all(rollouts.slice(offset, offset + 8).map(async filePath => {
+      try {
+        const [stat, meta] = await Promise.all([fs.stat(filePath), readCodexMeta(filePath)]);
+        if (!meta.id) return;
+        if (filterCwd && meta.cwd && !pathsEqual(meta.cwd, filterCwd)) return;
+        const idx = index.get(meta.id);
+        sessions.push({
+          sessionId: meta.id,
+          agent: 'codex',
+          cwd: meta.cwd || null,
+          configDir: home,
+          display: idx?.thread_name || meta.id.slice(0, 8),
+          updatedAt: stat.mtimeMs,
+          hasMemory: false,
+          filePath,
+          turnCount: meta.turnCount || 0,
+        });
+      } catch {}
+    }));
+  }
   return sessions;
 }
 
@@ -361,12 +374,36 @@ export async function findCodexSessionFile(sessionId, codexHome) {
   return null;
 }
 
+const codexTranscripts = new Map();
+
 export async function parseCodexMessages(filePath) {
-  const messages = [];
+  const stat = await fs.stat(filePath);
+  let entry = codexTranscripts.get(filePath);
+  if (entry?.loading) {
+    await entry.loading;
+    return parseCodexMessages(filePath);
+  }
+  if (!entry || entry.ino !== stat.ino || stat.size < entry.size ||
+      (stat.size === entry.size && stat.mtimeMs !== entry.mtimeMs)) {
+    entry = { ino: stat.ino, size: 0, offset: 0, messages: [], seenAssistant: new Set(), seenCalls: new Set() };
+    codexTranscripts.set(filePath, entry);
+  }
+  codexTranscripts.delete(filePath);
+  codexTranscripts.set(filePath, entry);
+  while (codexTranscripts.size > 8) codexTranscripts.delete(codexTranscripts.keys().next().value);
+  if (entry.size === stat.size && entry.mtimeMs === stat.mtimeMs) return entry.messages;
+  const loading = updateCodexTranscript(filePath, entry, stat);
+  entry.loading = loading;
+  try { await loading; } finally { entry.loading = null; }
+  return entry.messages;
+}
+
+async function updateCodexTranscript(filePath, entry, stat) {
+  const messages = entry.messages;
   // Codex writes the same assistant turn twice:
   //   response_item (message/assistant)  AND  event_msg (agent_message)
   // Prefer response_item; only use event_msg when that text wasn't already seen.
-  const seenAssistant = new Set();
+  const seenAssistant = entry.seenAssistant;
 
   const assistantKey = (text, ts) => {
     const t = String(text || '').trim();
@@ -389,54 +426,81 @@ export async function parseCodexMessages(filePath) {
   };
 
   try {
-    const stream = fsSync.createReadStream(filePath);
-    const rl = readline.createInterface({ input: stream, crlfDelay: Infinity });
-    for await (const line of rl) {
-      let d;
-      try { d = JSON.parse(line); } catch { continue; }
-
-      if (d.type === 'response_item' && d.payload) {
-        const p = d.payload;
-        if (p.type === 'message' && p.role === 'user') {
-          const texts = (p.content || [])
-            .filter(c => c.type === 'input_text' || c.type === 'text')
-            .map(c => c.text || '')
-            .filter(Boolean);
-          const text = texts.join('\n').trim();
-          // skip huge injected system/env blobs
-          if (text && !text.startsWith('# AGENTS.md') && !text.startsWith('<environment_context')
-              && !text.startsWith('<permissions') && text.length < 2000) {
-            messages.push({ role: 'user', type: 'text', content: text, ts: d.timestamp });
+    if (stat.size <= entry.offset) return;
+    const stream = fsSync.createReadStream(filePath, { start: entry.offset, end: stat.size - 1 });
+    let pending = Buffer.alloc(0);
+    for await (const chunk of stream) {
+      pending = pending.length ? Buffer.concat([pending, chunk]) : chunk;
+      let start = 0;
+      let end;
+      while ((end = pending.indexOf(10, start)) !== -1) {
+        const line = pending.subarray(start, end).toString('utf8');
+        entry.offset += end - start + 1;
+        start = end + 1;
+        // Reasoning and tool outputs dominate large rollouts. Do not JSON-parse
+        // their multi-megabyte payloads when building the visible transcript.
+        const head = line.slice(0, 400);
+        if (!/"type"\s*:\s*"(?:response_item|event_msg)"/.test(head) ||
+            !/"type"\s*:\s*"(?:message|agent_message|function_call|command_execution|custom_tool_call)"/.test(head)) continue;
+        let d;
+        try { d = JSON.parse(line); } catch { continue; }
+
+        if (d.type === 'response_item' && d.payload) {
+          const p = d.payload;
+          if (p.type === 'message' && p.role === 'user') {
+            const texts = (p.content || [])
+              .filter(c => c.type === 'input_text' || c.type === 'text')
+              .map(c => c.text || '')
+              .filter(Boolean);
+            const text = texts.join('\n').trim();
+            // skip huge injected system/env blobs
+            if (text && !text.startsWith('# AGENTS.md') && !text.startsWith('<environment_context')
+                && !text.startsWith('<permissions')) {
+              seenAssistant.clear();
+              messages.push({ role: 'user', type: 'text', content: text, ts: d.timestamp });
+            }
+          } else if (p.type === 'message' && p.role === 'assistant') {
+            const texts = (p.content || [])
+              .filter(c => c.type === 'output_text' || c.type === 'text')
+              .map(c => c.text || '')
+              .filter(Boolean);
+            pushAssistant(texts.join('\n'), d.timestamp);
+          } else if (p.type === 'function_call') {
+            if (p.call_id && entry.seenCalls.has(p.call_id)) continue;
+            if (p.call_id) entry.seenCalls.add(p.call_id);
+            let input = p.arguments;
+            try { input = typeof input === 'string' ? JSON.parse(input) : input; } catch {}
+            messages.push({ role: 'tool', type: 'tool_use', name: p.name || 'function', id: p.call_id, input: input ?? {}, ts: d.timestamp });
+          } else if (p.type === 'command_execution' || p.type === 'custom_tool_call') {
+            if (p.call_id && entry.seenCalls.has(p.call_id)) continue;
+            if (p.call_id) entry.seenCalls.add(p.call_id);
+            let input = p.input;
+            try { input = typeof input === 'string' ? JSON.parse(input) : input; } catch {}
+            messages.push({
+              role: 'tool',
+              type: 'tool_use',
+              name: p.type === 'command_execution' ? 'Bash' : (p.name || 'tool'),
+              id: p.call_id,
+              input: p.type === 'command_execution' ? { command: p.command || '' } : (input ?? {}),
+              ts: d.timestamp,
+            });
           }
-        } else if (p.type === 'message' && p.role === 'assistant') {
-          const texts = (p.content || [])
-            .filter(c => c.type === 'output_text' || c.type === 'text')
-            .map(c => c.text || '')
-            .filter(Boolean);
-          pushAssistant(texts.join('\n'), d.timestamp);
-        } else if (p.type === 'function_call') {
-          let input = p.arguments;
-          try { input = typeof input === 'string' ? JSON.parse(input) : input; } catch {}
-          messages.push({ role: 'tool', type: 'tool_use', name: p.name || 'function', input: input ?? {}, ts: d.timestamp });
-        } else if (p.type === 'command_execution' || p.type === 'custom_tool_call') {
-          messages.push({
-            role: 'tool',
-            type: 'tool_use',
-            name: p.type === 'command_execution' ? 'Bash' : (p.name || 'tool'),
-            input: { command: p.command || p.input || '' },
-            ts: d.timestamp,
-          });
         }
-      }
 
-      // Secondary channel — skip if response_item already recorded the same body
-      if (d.type === 'event_msg' && d.payload?.type === 'agent_message') {
-        const text = d.payload.message || d.payload.text;
-        pushAssistant(text, d.timestamp);
+        // Secondary channel — skip if response_item already recorded the same body
+        if (d.type === 'event_msg' && d.payload?.type === 'agent_message') {
+          const text = d.payload.message || d.payload.text;
+          pushAssistant(text, d.timestamp);
+        }
       }
+      pending = pending.subarray(start);
     }
-  } catch {}
-  return messages;
+    entry.size = stat.size;
+    entry.mtimeMs = stat.mtimeMs;
+  } catch (error) {
+    codexTranscripts.delete(filePath);
+    throw error;
+  }
 }
 
 function replaceSessionId(value, sourceSessionId, targetSessionId) {
@@ -611,7 +675,7 @@ export async function scanGrokSessions(grokHome, filterCwd = null) {
     // dir name is encodeURIComponent(cwd)
     let cwd;
     try { cwd = decodeURIComponent(dirEntry.name); } catch { cwd = dirEntry.name; }
-    if (filterCwd && cwd !== filterCwd) return;
+    if (filterCwd && !pathsEqual(cwd, filterCwd)) return;
 
     const projectDir = path.join(sessionsRoot, dirEntry.name);
     let sessionDirs;
@@ -1191,7 +1255,7 @@ export async function scanGeminiSessions(geminiHome, filterCwd = null) {
       records.set(sessionId, existing);
     }));
   } catch {}
-  return [...records.values()].filter(s => !filterCwd || s.cwd === filterCwd);
+  return [...records.values()].filter(s => !filterCwd || pathsEqual(s.cwd, filterCwd));
 }
 
 export async function parseGeminiMessages(filePath) {
@@ -1329,7 +1393,7 @@ export async function scanCursorSessions(cursorHome, filterCwd = null) {
       });
     }));
   } catch {}
-  return sessions.filter(s => !filterCwd || s.cwd === filterCwd);
+  return sessions.filter(s => !filterCwd || pathsEqual(s.cwd, filterCwd));
 }
 
 async function loadCursorContext(sessionId, cursorHome) {

package/src/app.js

@@ -33,10 +33,12 @@ import { discoverAllAgentModels } from './agents/models.js';
 import { createTextBatcher } from './agents/stream-batch.js';
 import { normalizeCommand, mapAgentEmit } from './runtime/protocol.js';
 import { createOutbox } from './runtime/outbox.js';
+import { broadcastChatFrame } from './runtime/chat-broadcast.js';
 import { createExternalSessionMirror } from './runtime/external-session-sync.js';
 import { resolveApproval, cancelApprovalsForSession } from './runtime/approvals.js';
 import { createMcpHttpHandler, createMcpService } from './mcp.js';
 import { createCollab, roleAtLeast, proxyToLocalPort, machineId as localMachineId } from './collab.js';
+import { createQuotaReader } from './agent-quota.js';
 import { parseHistoryQuery, sliceHistoryMessages } from './session-history.js';
 import {
   CLAUDE_ENV_KEYS,
@@ -49,6 +51,17 @@ import {
   normalizeProfileName,
   envForProfile,
 } from './agent-env.js';
+import {
+  containedPath,
+  defaultInteractiveShell,
+  expandHome,
+  processKillSignal,
+  resolveWinExecutable,
+  shellExecSpec,
+  spawnCommandOpts,
+  userLocalBinDirs,
+} from './platform.js';
+import { canonicalizeProjectApiPath } from './project-api-path.js';
 const __dirname = path.dirname(fileURLToPath(import.meta.url));
 const rootDir = path.join(__dirname, '..');
 
@@ -63,18 +76,28 @@ const SESSION_META_FILE  = process.env.SESSION_META_FILE  || path.join(rootDir,
 // without requiring the service unit to mirror an interactive shell PATH.
 function resolveUserLocalCommand(configured, fallback) {
   const command = configured || fallback;
-  if (command.includes('/') || command.includes('\\')) return command.replace(/^~/, os.homedir());
-  for (const dir of [path.join(os.homedir(), '.local', 'bin'), path.join(os.homedir(), 'bin')]) {
+  if (command.includes('/') || command.includes('\\')) return expandHome(command);
+  for (const dir of userLocalBinDirs()) {
     const candidate = path.join(dir, command);
     if (fsSync.existsSync(candidate)) return candidate;
+    if (process.platform === 'win32') {
+      for (const ext of ['.cmd', '.exe', '.bat']) {
+        if (fsSync.existsSync(candidate + ext)) return candidate + ext;
+      }
+    }
   }
   return command;
 }
-const CLAUDE_CLI_PATH = process.env.CLAUDE_CLI_PATH || 'claude';
-const CODEX_CLI_PATH  = process.env.CODEX_CLI_PATH  || 'codex';
-const GROK_CLI_PATH   = process.env.GROK_CLI_PATH   || 'grok';
-const GEMINI_CLI_PATH = resolveUserLocalCommand(process.env.GEMINI_CLI_PATH || process.env.AGY_PATH, 'agy');
-const CURSOR_AGENT_PATH = process.env.CURSOR_AGENT_PATH || 'cursor-agent';
+function resolveAgentCommand(configured, fallback) {
+  const local = resolveUserLocalCommand(configured, fallback);
+  return resolveWinExecutable(local, { extraDirs: userLocalBinDirs() });
+}
+
+const CLAUDE_CLI_PATH = resolveAgentCommand(process.env.CLAUDE_CLI_PATH, 'claude');
+const CODEX_CLI_PATH  = resolveAgentCommand(process.env.CODEX_CLI_PATH, 'codex');
+const GROK_CLI_PATH   = resolveAgentCommand(process.env.GROK_CLI_PATH, 'grok');
+const GEMINI_CLI_PATH = resolveAgentCommand(process.env.GEMINI_CLI_PATH || process.env.AGY_PATH, 'agy');
+const CURSOR_AGENT_PATH = resolveAgentCommand(process.env.CURSOR_AGENT_PATH, 'cursor-agent');
 const CODEX_HOME = (process.env.CODEX_HOME || path.join(os.homedir(), '.codex')).replace(/^~/, os.homedir());
 const GROK_HOME  = (process.env.GROK_HOME  || path.join(os.homedir(), '.grok')).replace(/^~/, os.homedir());
 const GEMINI_HOME = (process.env.GEMINI_HOME || path.join(os.homedir(), '.gemini')).replace(/^~/, os.homedir());
@@ -286,20 +309,20 @@ function authMiddleware(req, res, next) {
 // ─── Path helpers ─────────────────────────────────────────────────────────────
 function safePath(base, rel) {
   const resolved = path.resolve(base, rel || '');
-  if (!resolved.startsWith(path.resolve(base))) throw new Error('Path traversal');
+  if (!containedPath(base, resolved)) throw new Error('Path traversal');
   return resolved;
 }
 
 function expandPath(p) {
-  if (!p) return p;
-  return p.replace(/^~/, os.homedir());
+  return expandHome(p);
 }
 
 function resolveProjectRoot(req) {
   const root = req.query.root || req.body?.root;
   if (root) {
     const resolved = path.resolve(expandPath(root));
-    if (!path.isAbsolute(resolved) || resolved === '/' || resolved.includes('\0'))
+    const driveRoot = path.parse(resolved).root;
+    if (!path.isAbsolute(resolved) || resolved === '/' || resolved === driveRoot || resolved.includes('\0'))
       throw new Error('Invalid root path');
     return resolved;
   }
@@ -309,7 +332,7 @@ function resolveProjectRoot(req) {
 // ─── Git helpers ──────────────────────────────────────────────────────────────
 function git(args, cwd) {
   return new Promise((resolve, reject) => {
-    const child = spawn('git', args, { cwd, shell: false });
+    const child = spawn('git', args, { cwd, ...spawnCommandOpts() });
     let out = '', err = '';
     child.stdout.on('data', d => out += d);
     child.stderr.on('data', d => err += d);
@@ -337,17 +360,8 @@ function sendJson(ws, data) {
   }
 }
 
-function broadcastChat(sessionId, data, fallbackWs) {
-  let n = 0;
-  if (sessionId) {
-    for (const c of chatClients) {
-      if (c.sessionId === sessionId) {
-        sendJson(c.ws, data);
-        n++;
-      }
-    }
-  }
-  if (n === 0 && fallbackWs) sendJson(fallbackWs, data);
+function broadcastChat(sessionId, data, ownerWs) {
+  broadcastChatFrame(chatClients, sessionId, data, ownerWs, sendJson);
 }
 
 async function listSessions(filterCwd = null, agentFilter = null) {
@@ -506,7 +520,15 @@ function compactHistoryMessages(messages) {
 
 // ─── App factory ──────────────────────────────────────────────────────────────
 export function createApp() {
+  const readQuota = createQuotaReader({ claudePath: CLAUDE_CLI_PATH, codexPath: CODEX_CLI_PATH, codexHome: CODEX_HOME,
+    grokHome: GROK_HOME, defaultClaudeDir: CLAUDE_CONFIG_DIRS[0], allowedClaudeDirs: () => CLAUDE_CONFIG_DIRS });
   const app = express();
+  app.use((req, _res, next) => {
+    const pathOnly = (req.url || '').split('?')[0];
+    const canon = canonicalizeProjectApiPath(pathOnly);
+    if (canon !== pathOnly) req.url = canon + (req.url.includes('?') ? req.url.slice(req.url.indexOf('?')) : '');
+    next();
+  });
   const COLLAB_FILE = process.env.COLLAB_FILE || path.join(rootDir, '.collab.json');
   const collab = createCollab({ filePath: COLLAB_FILE });
   const allowRemoteProxy = process.env.PORT_PROXY_ALLOW_REMOTE === '1';
@@ -627,7 +649,12 @@ export function createApp() {
     })().catch(e => res.status(500).json({ error: e.message }));
   });
 
-  app.use(express.json({ limit: '10mb' }));
+  const jsonBodyParser = express.json({ limit: '10mb' });
+  app.use((req, res, next) => {
+    // Proxy bodies belong to the target app, including arbitrary JSON bytes.
+    if (req.path === '/api/port-proxy' || req.path.startsWith('/r/')) return next();
+    return jsonBodyParser(req, res, next);
+  });
 
   // MCP uses a separate short-lived bearer token. Normal UI JWTs deliberately
   // cannot call /mcp, so a browser token leaked through a URL cannot become an
@@ -989,6 +1016,14 @@ export function createApp() {
     }
   });
 
+  app.get('/api/agents/quota', authMiddleware, async (req, res) => {
+    res.setHeader('Cache-Control', 'private, no-store');
+    const agent = req.query.agent;
+    if (!['claude', 'codex', 'grok'].includes(agent)) return res.status(400).json({ error: 'Unsupported agent' });
+    try { res.json(await readQuota({ agent, configDir: req.query.configDir })); }
+    catch { res.status(400).json({ error: 'Unknown Claude config directory' }); }
+  });
+
   app.get('/api/projects/:id/files', authMiddleware, async (req, res) => {
     try {
       const projectPath = resolveProjectRoot(req);
@@ -1322,10 +1357,12 @@ export function createApp() {
         const since = Date.now() - days * 86400000;
         sessions = sessions.filter(s => (s.updatedAt || 0) >= since);
       }
+      const offset = Math.max(0, parseInt(req.query.offset || '0', 10) || 0);
+      sessions = sessions.slice(offset);
       if (limit > 0 && sessions.length > limit) sessions = sessions.slice(0, limit);
       const etag = `"s${crypto.createHash('sha1').update(JSON.stringify(sessions)).digest('base64url').slice(0, 20)}"`;
       res.setHeader('ETag', etag);
-      res.setHeader('Cache-Control', 'private, max-age=15');
+      res.setHeader('Cache-Control', 'private, no-store, no-cache');
       if (req.headers['if-none-match'] === etag) return res.status(304).end();
       res.json(sessions);
     } catch (e) {
@@ -2132,10 +2169,11 @@ export function createApp() {
         const shellCmd = cmd.command || '';
         const cwd = cmd.cwd || os.homedir();
         wireSend({ type: 'shell-start', command: shellCmd });
-        shellProc = spawn(process.env.SHELL || 'bash', ['-c', shellCmd], {
+        const spec = shellExecSpec(shellCmd);
+        shellProc = spawn(spec.bin, spec.args, {
           cwd,
           env: { ...process.env },
-          shell: false,
+          ...spawnCommandOpts({ extra: { shell: false } }),
         });
         shellOut = createTextBatcher(
           (data) => wireSend({ type: 'shell-output', stream: 'stdout', data }),
@@ -2194,17 +2232,21 @@ export function createApp() {
 
     let proc;
     let hasPython = false;
-    try {
-      execSync('python3 --version', { stdio: 'ignore' });
-      hasPython = true;
-    } catch {}
+    const win = process.platform === 'win32';
+    if (!win) {
+      try {
+        execSync('python3 --version', { stdio: 'ignore' });
+        hasPython = true;
+      } catch {}
+    }
 
     const cols = parseInt(url.searchParams.get('cols') || '80', 10);
     const rows = parseInt(url.searchParams.get('rows') || '24', 10);
 
     try {
-      const shellBin = process.env.SHELL || 'zsh';
-      if (hasPython) {
+      const interactive = defaultInteractiveShell();
+      const shellBin = interactive.bin;
+      if (hasPython && !win) {
         const pythonScript = `
 import os, pty, sys, termios, fcntl, struct, select
 shell = '${shellBin}'
@@ -2245,14 +2287,16 @@ else:
           stdio: ['pipe', 'pipe', 'pipe'],
         });
       } else {
-        const args = ['-i'];
-        if (shellBin.includes('bash')) {
+        const args = [...interactive.args];
+        if (!win && !args.length) args.push('-i');
+        if (!win && shellBin.includes('bash')) {
           args.push('--norc', '--noprofile');
         }
         proc = spawn(shellBin, args, {
           cwd: fsSync.existsSync(cwd) ? cwd : os.homedir(),
           env: { ...process.env, TERM: 'xterm-256color', PS1: '\\[\\033[32m\\]\\w\\[\\033[0m\\]$ ', HISTFILE: '' },
           stdio: ['pipe', 'pipe', 'pipe'],
+          ...spawnCommandOpts({ extra: { shell: false } }),
         });
       }
     } catch (e) {
@@ -2279,7 +2323,7 @@ else:
       }
     });
 
-    ws.on('close', () => { outBatch.flush(); try { proc.kill('SIGHUP'); } catch {} });
+    ws.on('close', () => { outBatch.flush(); try { proc.kill(processKillSignal()); } catch {} });
     ws.on('error', e => console.error('[ws/shell]', e.message));
   });
 

package/src/auto-update.js

@@ -80,6 +80,8 @@ function runNpmInstall(mode, pkgName, version, cwd) {
       cwd: mode === 'global' ? osHomedir() : cwd,
       env: process.env,
       stdio: ['ignore', 'pipe', 'pipe'],
+      shell: process.platform === 'win32',
+      windowsHide: process.platform === 'win32',
     });
     let out = '';
     let err = '';

package/src/collab.js

@@ -250,6 +250,8 @@ export function proxyToLocalPort({ host, port, reqPath, method, headers, body, a
     }, (res) => {
       const chunks = [];
       res.on('data', c => chunks.push(c));
+      res.on('error', reject);
+      res.on('aborted', () => reject(new Error('upstream response aborted')));
       res.on('end', () => resolve({
         status: res.statusCode,
         headers: res.headers,
@@ -257,6 +259,7 @@ export function proxyToLocalPort({ host, port, reqPath, method, headers, body, a
       }));
     });
     r.on('error', reject);
+    r.on('timeout', () => r.destroy(new Error('upstream request timed out')));
     if (body && body.length) r.write(body);
     r.end();
   });