frizz 0.7.3 → 0.7.4

package/dist/dev-child.js

@@ -20647,11 +20647,17 @@ function windowsShimTarget(shimPath) {
     return void 0;
   }
 }
+function searchPath(env) {
+  const direct = env.PATH ?? env.Path ?? env.path;
+  if (direct !== void 0) return direct;
+  for (const [key, value] of Object.entries(env)) if (key.toLowerCase() === "path") return value ?? "";
+  return "";
+}
 function resolveClaudeExecutableAbsolute(bin, env = process.env) {
   const candidate = bin && bin.length > 0 ? bin : "claude";
   if (isAbsolute2(candidate)) return candidate;
   const windows = process.platform === "win32";
-  for (const dir of (env.PATH ?? "").split(delimiter)) {
+  for (const dir of searchPath(env).split(delimiter)) {
     if (!dir) continue;
     if (windows) {
       const exe = join14(dir, `${candidate}.exe`);
@@ -32453,7 +32459,11 @@ async function acquireLock(path) {
 }
 async function runClaudeUsage(claudeBin) {
   const { stdout } = await execFileAsync(
-    claudeBin,
+    // Never a bare name: on Windows `execFile("claude")` is ENOENT and `execFile("claude.cmd")` is
+    // EINVAL (node refuses .cmd/.bat without a shell since CVE-2024-27980), so this reader could
+    // never reach the CLI there and every quota refresh threw. See auth-status.ts for the measurement.
+    // A resolver throw is a refresh failure like any other — the callers' stale-serving catch owns it.
+    resolveClaudeExecutableAbsolute(claudeBin),
     ["-p", "/usage", "--safe-mode", "--output-format", "json", "--no-session-persistence", "--tools", ""],
     { encoding: "utf8", timeout: CLI_TIMEOUT_MS, maxBuffer: 2 * 1024 * 1024 }
   );
@@ -32660,6 +32670,7 @@ var init_claude_quota = __esm({
   "packages/server/src/backend/claude-quota.ts"() {
     "use strict";
     init_frizz_paths();
+    init_claude_broker_host();
     execFileAsync = promisify2(execFile2);
     USAGE_URL = "https://api.anthropic.com/api/oauth/usage";
     OAUTH_BETA = "oauth-2025-04-20";
@@ -34782,8 +34793,8 @@ function parseClaudeAuthStatusJson(stdout) {
   }
 }
 async function readClaudeAuthStatusCli(opts) {
-  const bin = opts?.claudeBin ?? "claude";
   try {
+    const bin = resolveClaudeExecutableAbsolute(opts?.claudeBin);
     const { stdout } = await execFileAsync2(bin, ["auth", "status", "--json"], {
       encoding: "utf8",
       timeout: opts?.timeoutMs ?? 5e3,
@@ -34888,6 +34899,7 @@ var init_auth_status = __esm({
     "use strict";
     init_claude_quota();
     init_codex();
+    init_claude_broker_host();
     execFileAsync2 = promisify4(execFile4);
     ProviderAuthRequiredError = class extends Error {
       backend;
@@ -44726,7 +44738,11 @@ function readThreadTranscript(project, storage, slug, backendFor) {
     const found = discoverTranscriptId(logDirOf(project), row.session_id, { exclude });
     return projectDeliveryLedger(found ? readTranscript(project, found) : msgs, ledger);
   }
-  if (FOREIGN_SESSION_ID_RE.test(slug)) return readTranscript(project, slug);
+  if (FOREIGN_SESSION_ID_RE.test(slug)) {
+    const source = sourceForThread(project, storage, slug, backendFor);
+    if (!source) return [];
+    return source.backend === "codex" ? readCodexTranscriptFile(source.path, slug) : readTranscript(project, slug);
+  }
   return [];
 }
 function projectTranscriptAgentLifecycles(messages, lookup) {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "frizz",
-  "version": "0.7.3",
+  "version": "0.7.4",
   "private": false,
   "description": "A local web UI for running many coding agents at once",
   "keywords": [