tavern-harness 0.1.14 → 0.1.16

package/CHANGELOG.md

@@ -3,6 +3,78 @@
 > 本文件由 `scripts/changelog.mjs` 从 `changelog/v*.md` 生成，请勿手动编辑。
 > 版本对比链接见文末；源文件位于仓库 `changelog/` 目录。
 
+## [0.1.16] - 2026-10-25
+
+### 中文
+
+#### 修复
+
+- 修复工作区文件管理器在触屏设备上删除按钮不可见、文件夹无法删除的问题：删除按钮现在始终显示，文件夹及其内容可以一并删除，`public` 共享链接仍不可删除
+
+#### 内部
+
+- 工作区删除接口支持递归删除目录并拒绝删除 `public` 软链接，补充对应测试
+
+### English
+
+#### Fixed
+
+- Fixed the delete button staying hidden on touch devices and folders not being deletable in the workspace file manager: the button is now always visible, folders and their contents can be removed together, and the `public` shared link remains protected
+
+#### Internal
+
+- The workspace delete endpoint now removes directories recursively and refuses to delete the `public` symlink, with tests
+
+## [0.1.15] - 2026-10-25
+
+### 中文
+
+#### 新增
+
+- 本地命令支持管道与重定向：可用 `|`、`<`、`>`、`>>`、`2>`、`2>&1` 组合命令，例如 `cat log.txt | grep error`；读写路径仍限制在会话工作区内，变量展开、命令替换、heredoc、后台执行与交互式命令依旧不支持
+- 工作区文件管理器新增「在文件管理器中打开」：一键在运行 Tavern Harness 的设备上打开当前会话的工作目录；通过局域网从手机访问时会提示仅限本机
+
+#### 改进
+
+- HTML 预览支持多文件应用：HTML 现在可以加载同目录下的脚本、样式、图片和字体，沙箱内的指针锁定等交互也可正常使用
+- 大工具参数的流式生成更流畅：参数较大时自动降低草稿刷新与本地写入频率，只保留最新快照，减少界面卡顿和写入积压
+- 画中画预览更易操作：可从四角任意缩放、拖动标题栏移动窗口，移动端初始窗口尺寸更合适
+
+#### 修复
+
+- 修复模型输出中的原始 HTML 被当成页面结构渲染的问题：现在按纯文本显示，消息排版不再被意外改变
+- 修复生成大型工具参数（例如写入大文件）耗时较长时，已建立的响应可能因 60 秒无数据而中断的问题；现在只有建立连接受 20 秒超时限制，生成过程可随时手动停止
+
+#### 内部
+
+- 新增 `/preview_read` 端点与 Vite 预览中间件：按会话工作区读取预览资源，上限 8MB，并按扩展名返回正确的 MIME 类型
+- 命令执行改为流式连接管道各段与重定向文件，超时或出错时结束整个进程组
+- 补充管道、重定向与预览端点的测试，并修正生成技能的工具与参数说明
+
+### English
+
+#### Added
+
+- Local commands now support pipes and redirection: combine commands with `|`, `<`, `>`, `>>`, `2>`, and `2>&1`, for example `cat log.txt | grep error`; read and write paths stay inside the session workspace, and expansion, command substitution, heredocs, background jobs, and interactive commands remain unsupported
+- The workspace file manager has an "Open in file manager" button that opens the current conversation's workspace on the machine running Tavern Harness; when the app is opened over the LAN from a phone, it explains that this only works on the host device
+
+#### Changed
+
+- HTML previews now support multi-file apps: HTML can load same-directory scripts, styles, images, and fonts, and sandboxed interactions such as pointer lock work
+- Smoother streaming for large tool arguments: once an argument gets large, draft updates and local writes happen less often and only the latest snapshot is kept, reducing UI stalls and write backlogs
+- Picture-in-picture previews are easier to use: resize from any corner, drag the title bar to move the window, and the initial window size fits mobile screens better
+
+#### Fixed
+
+- Fixed raw HTML in model output being rendered as page structure: it now appears as plain text, so message layout is no longer altered unexpectedly
+- Fixed connected responses being interrupted after 60 seconds without data while generating large tool arguments (such as writing a big file); only establishing the connection is still subject to a 20-second timeout, and generation can be stopped manually at any time
+
+#### Internal
+
+- Added a `/preview_read` endpoint and Vite preview middleware that reads preview assets from the session workspace, caps them at 8MB, and serves the correct MIME type by extension
+- Command execution now streams between pipeline stages and to and from redirected files, ending the whole process group on timeout or failure
+- Added tests for pipes, redirection, and the preview endpoint, and clarified generated-skill tool and parameter descriptions
+
 ## [0.1.14] - 2026-10-24
 
 ### 中文
@@ -394,6 +466,8 @@
 - Vite + React + Zustand + Dexie stack with browser-side local persistence
 
 <!-- 链接定义 -->
+[0.1.16]: https://github.com/Rannichan/Tavern-Harness/compare/v0.1.15...v0.1.16
+[0.1.15]: https://github.com/Rannichan/Tavern-Harness/compare/v0.1.14...v0.1.15
 [0.1.14]: https://github.com/Rannichan/Tavern-Harness/compare/v0.1.13...v0.1.14
 [0.1.13]: https://github.com/Rannichan/Tavern-Harness/compare/v0.1.12...v0.1.13
 [0.1.12]: https://github.com/Rannichan/Tavern-Harness/compare/v0.1.11...v0.1.12

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "tavern-harness",
-  "version": "0.1.14",
+  "version": "0.1.16",
   "description": "Tavern Harness — 酒馆模式下的本地 AI Agent 助手（MyAgent-Android 的 Web 复刻）",
   "private": false,
   "type": "module",

package/sandbox-server.mjs

@@ -9,9 +9,9 @@
 //   - 仅监听 127.0.0.1（不回显到局域网）
 //   - 白名单命令直接执行，无需确认
 //   - 任一非白名单命令均需用户批准并回传服务端签发的一次性确认票据
-//   - 支持受控的 &&、||、; 连接符；无 shell 解释器（spawn shell:false），
-//     不支持管道、重定向、变量展开或命令替换
-//   - 单条命令 5s 超时，超时即 kill 进程树
+//   - 支持受控的 &&、||、;、管道及 < / > / >> 重定向；无 shell 解释器（spawn shell:false），
+//     不支持变量展开、命令替换或其它 shell 语法
+//   - 每个命令组 5s 超时，超时即 kill 进程树
 //   - 输出截断 64KB，合并 stderr
 //
 // 启动：node sandbox-server.mjs [port]   （默认 17891）
@@ -19,14 +19,15 @@
 // ============================================================
 
 import { createServer } from 'node:http';
-import { spawn, spawnSync } from 'node:child_process';
+import { spawn, spawnSync, execFile } from 'node:child_process';
 import { createHash, randomBytes, timingSafeEqual } from 'node:crypto';
 import {
-  writeFileSync, existsSync, lstatSync, readlinkSync, readFile, writeFile, mkdirSync, mkdtempSync, readdir, statSync, symlinkSync, realpathSync, rmSync, unlink, cpSync,
+  writeFileSync, existsSync, lstatSync, readlinkSync, readFile, writeFile, mkdirSync, mkdtempSync, readdir, statSync, symlinkSync, realpathSync, rmSync, unlink, cpSync, createReadStream, createWriteStream,
 } from 'node:fs';
 import { tmpdir, homedir } from 'node:os';
 import { join, dirname, resolve, sep, delimiter, isAbsolute } from 'node:path';
 import { fileURLToPath } from 'node:url';
+import { PassThrough } from 'node:stream';
 
 const __dirname = dirname(fileURLToPath(import.meta.url));
 const PORT = Number(process.argv[2] || process.env.SANDBOX_PORT || 17891);
@@ -169,22 +170,151 @@ function parseCommandLine(line) {
       quote = ch;
       continue;
     }
-    const operator = line.startsWith('&&', i) ? '&&' : line.startsWith('||', i) ? '||' : ch === ';' ? ';' : null;
+    const operator = line.startsWith('&&', i) ? '&&' : line.startsWith('||', i) ? '||' : ch === ';' ? ';' : ch === '\n' ? ';' : null;
     if (!operator) continue;
     const command = line.slice(start, i).trim();
-    if (!command) throw new Error(`Missing command before operator ${operator}`);
-    commands.push(command);
-    operators.push(operator);
+    if (!command) {
+      if (ch === '\n') {
+        start = i + 1;
+        continue;
+      }
+      throw new Error(`Missing command before operator ${operator}`);
+    }
+    if (!command.startsWith('#')) {
+      commands.push(command);
+      operators.push(operator);
+    }
     i += operator.length - 1;
     start = i + 1;
   }
   if (quote) throw new Error('Command contains an unclosed quote');
   const command = line.slice(start).trim();
-  if (!command) throw new Error('Missing command after operator');
-  commands.push(command);
+  if (!command) {
+    if (commands.length === 0) return { commands, operators: [] };
+    throw new Error('Missing command after operator');
+  }
+  if (!command.startsWith('#')) commands.push(command);
   return { commands, operators };
 }
 
+/** 在保留引号和转义的前提下，将受支持的重定向操作符变为独立 token。 */
+function separateRedirectOperators(value) {
+  let out = '';
+  let quote = null;
+  let escaped = false;
+  for (let i = 0; i < value.length; i++) {
+    const ch = value[i];
+    if (escaped) {
+      escaped = false;
+      out += ch;
+      continue;
+    }
+    if (ch === '\\') {
+      escaped = true;
+      out += ch;
+      continue;
+    }
+    if (quote) {
+      if (ch === quote) quote = null;
+      out += ch;
+      continue;
+    }
+    if (ch === "'" || ch === '"') {
+      quote = ch;
+      out += ch;
+      continue;
+    }
+    if (ch === '2' && value[i + 1] === '>') {
+      const operator = value.startsWith('2>>', i) ? '2>>' : value.startsWith('2>&1', i) ? '2>&1' : '2>';
+      out += ` ${operator} `;
+      i += operator.length - 1;
+      continue;
+    }
+    if (ch === '<' || ch === '>') {
+      const operator = ch === '>' && value[i + 1] === '>' ? '>>' : ch;
+      out += ` ${operator} `;
+      i += operator.length - 1;
+      continue;
+    }
+    out += ch;
+  }
+  return out;
+}
+
+/** 解析单个命令组中的管道和受控重定向。 */
+function parseCommandGroup(group) {
+  const segments = [];
+  let start = 0;
+  let quote = null;
+  let escaped = false;
+  for (let i = 0; i < group.length; i++) {
+    const ch = group[i];
+    if (escaped) {
+      escaped = false;
+      continue;
+    }
+    if (ch === '\\') {
+      escaped = true;
+      continue;
+    }
+    if (quote) {
+      if (ch === quote) quote = null;
+      continue;
+    }
+    if (ch === "'" || ch === '"') {
+      quote = ch;
+      continue;
+    }
+    if (ch !== '|') continue;
+    const segment = group.slice(start, i).trim();
+    if (!segment) throw new Error('Missing command before pipe');
+    segments.push(segment);
+    start = i + 1;
+  }
+  if (quote) throw new Error('Command contains an unclosed quote');
+  const lastSegment = group.slice(start).trim();
+  if (!lastSegment) throw new Error('Missing command after pipe');
+  segments.push(lastSegment);
+
+  return segments.map((segment) => {
+    const tokens = tokenize(separateRedirectOperators(segment));
+    const args = [];
+    let input = null;
+    let output = null;
+    let errorOutput = null;
+    let mergeErrorToOutput = false;
+    for (let i = 0; i < tokens.length; i++) {
+      const token = tokens[i];
+      const isRedirect = ['<', '>', '>>', '2>', '2>>', '2>&1'].includes(token);
+      if (!isRedirect) {
+        args.push(token);
+        continue;
+      }
+      if (token === '2>&1') {
+        if (mergeErrorToOutput || errorOutput) throw new Error('Multiple standard error redirections are unsupported');
+        mergeErrorToOutput = true;
+        continue;
+      }
+      const path = tokens[++i];
+      if (!path || ['<', '>', '>>', '2>', '2>>', '2>&1'].includes(path)) {
+        throw new Error(`Missing path after ${token}`);
+      }
+      if (token === '<') {
+        if (input) throw new Error('Multiple input redirections are unsupported');
+        input = path;
+      } else if (token === '>' || token === '>>') {
+        if (output) throw new Error('Multiple output redirections are unsupported');
+        output = { path, append: token === '>>' };
+      } else {
+        if (errorOutput || mergeErrorToOutput) throw new Error('Multiple standard error redirections are unsupported');
+        errorOutput = { path, append: token === '2>>' };
+      }
+    }
+    if (!args.length) throw new Error('Missing command');
+    return { cmd: args[0], args: args.slice(1), input, output, errorOutput, mergeErrorToOutput };
+  });
+}
+
 // ---- 白名单：可直接执行；名单外命令统一请求用户许可 ----
 const SHELL_ALLOWLIST_GROUPS = {
   basicInfo: [
@@ -445,6 +575,33 @@ const server = createServer(async (req, res) => {
     return;
   }
 
+  // ---- 预览资源端点（仅由 Vite 代理使用） ----
+  if (req.url === '/preview_read') {
+    let body = '';
+    for await (const chunk of req) body += chunk;
+    if (body.length > 64 * 1024) {
+      res.writeHead(413);
+      res.end(JSON.stringify({ ok: false, message: 'body too large' }));
+      return;
+    }
+    try {
+      const payload = JSON.parse(body);
+      const base = resolveSessionBase(payload?.session);
+      const rel = sanitizeWorkspaceRelativePath(payload?.path);
+      if (resolvesOutsideSession(rel, base)) throw new Error('Path is outside the workspace');
+      const file = resolve(base, rel);
+      if (!existsSync(file) || !lstatSync(file).isFile()) throw new Error('File not found');
+      assertInside(base, realpathSync(file));
+      const content = await readFilePromise(file);
+      if (content.length > 8 * 1024 * 1024) throw new Error('Preview file exceeds the 8MB limit');
+      res.end(JSON.stringify({ ok: true, content: content.toString('base64') }));
+    } catch (e) {
+      res.writeHead(400);
+      res.end(JSON.stringify({ ok: false, message: String((e && e.message) || e) }));
+    }
+    return;
+  }
+
   // ---- 真实文件工作区端点（file_read / file_write / file_delete / file_list） ----
   if (req.url === '/file_read' || req.url === '/file_write' || req.url === '/file_delete' || req.url === '/file_list') {
     let body = '';
@@ -513,11 +670,20 @@ const server = createServer(async (req, res) => {
           throw new Error('Path is outside the workspace');
         }
         const fp = resolve(base, rel);
-        if (!existsSync(fp) || !lstatSync(fp).isFile()) throw new Error('File not found');
+        if (!existsSync(fp)) throw new Error('File or directory not found');
+        const entry = lstatSync(fp);
+        if (entry.isSymbolicLink() && rel === 'public') {
+          throw new Error('The public workspace link cannot be deleted');
+        }
+        if (!entry.isFile() && !entry.isDirectory()) throw new Error('Path is not a file or directory');
         if (!deletingPublicLink) assertInside(base, realpathSync(fp));
-        await new Promise((resolveDelete, rejectDelete) => {
-          unlink(fp, (err) => (err ? rejectDelete(err) : resolveDelete()));
-        });
+        if (entry.isDirectory()) {
+          rmSync(fp, { recursive: true, force: false });
+        } else {
+          await new Promise((resolveDelete, rejectDelete) => {
+            unlink(fp, (err) => (err ? rejectDelete(err) : resolveDelete()));
+          });
+        }
         res.end(JSON.stringify({ ok: true, path: rel }));
       } else {
         // file_list：返回会话工作目录内的相对路径（分组目录）
@@ -534,6 +700,30 @@ const server = createServer(async (req, res) => {
     return;
   }
 
+  if (req.url === '/workspace_open') {
+    let body = '';
+    for await (const chunk of req) body += chunk;
+    if (body.length > 64 * 1024) {
+      res.writeHead(413);
+      res.end(JSON.stringify({ ok: false, message: 'body too large' }));
+      return;
+    }
+    try {
+      const payload = JSON.parse(body);
+      const base = resolveSessionBase(payload?.session);
+      ensureSessionBase(base);
+      const command = IS_WIN ? 'explorer.exe' : process.platform === 'darwin' ? 'open' : 'xdg-open';
+      execFile(command, [base], (error) => {
+        if (error) console.warn(`[command-service] failed to open workspace: ${error.message}`);
+      });
+      res.end(JSON.stringify({ ok: true }));
+    } catch (e) {
+      res.writeHead(400);
+      res.end(JSON.stringify({ ok: false, message: String((e && e.message) || e) }));
+    }
+    return;
+  }
+
   // ---- 会话工作目录生命周期：对话创建时预建目录、删除对话时清理目录 ----
   // session_create：幂等，目录已存在则无操作；session_delete：递归删除并忽略不存在。
   // 必须带合法会话工作目录（resolveSessionBase 已拦截 .. / 绝对路径 / 非法字符）。
@@ -624,27 +814,24 @@ const server = createServer(async (req, res) => {
     return;
   }
 
-  const lines = script.split('\n').filter((l) => l.trim() && !l.trim().startsWith('#'));
   const outputs = [];
-  for (const line of lines) {
-    try {
-      const { commands, operators } = parseCommandLine(line.trim());
-      let lastCode = 0;
-      let lastError = '';
-      for (let i = 0; i < commands.length; i++) {
-        const previousOperator = operators[i - 1];
-        if ((previousOperator === '&&' && lastCode !== 0) || (previousOperator === '||' && lastCode === 0)) continue;
-        const result = await runOne(commands[i], sessionBase);
-        lastCode = result.code;
-        lastError = result.stderr || (lastCode !== 0 ? `Exit code ${lastCode}` : '');
-        if (result.stdout) outputs.push(result.stdout.trimEnd());
-        if (result.stderr) outputs.push(result.stderr.trimEnd());
-      }
-      if (lastCode !== 0) throw new Error(lastError);
-    } catch (e) {
-      res.end(JSON.stringify({ ok: false, message: `${line.trim()}:\n${(e).message}` }));
-      return;
+  try {
+    const { commands, operators } = parseCommandLine(script);
+    let lastCode = 0;
+    let lastError = '';
+    for (let i = 0; i < commands.length; i++) {
+      const previousOperator = operators[i - 1];
+      if ((previousOperator === '&&' && lastCode !== 0) || (previousOperator === '||' && lastCode === 0)) continue;
+      const result = await runCommandGroup(commands[i], sessionBase);
+      lastCode = result.code;
+      lastError = result.stderr || (lastCode !== 0 ? `Exit code ${lastCode}` : '');
+      if (result.stdout) outputs.push(result.stdout.trimEnd());
+      if (result.stderr) outputs.push(result.stderr.trimEnd());
     }
+    if (lastCode !== 0) throw new Error(lastError);
+  } catch (e) {
+    res.end(JSON.stringify({ ok: false, message: `${(e).message}` }));
+    return;
   }
   res.end(JSON.stringify({ ok: true, output: outputs.join('\n').slice(0, MAX_OUTPUT) }));
 });
@@ -869,29 +1056,29 @@ function shellReadTargets(command, args) {
 
 function validateScript(script, sessionBase) {
   if (script.length > MAX_SCRIPT_CHARS) return 'Script exceeds 8,000 characters';
-  const lines = script.split('\n').filter((l) => l.trim() && !l.trim().startsWith('#'));
-  if (lines.length === 0) return 'Script is empty';
+  let groups;
+  try {
+    groups = parseCommandLine(script).commands.map(parseCommandGroup);
+  } catch (e) {
+    return e.message;
+  }
+  if (groups.length === 0) return 'Script is empty';
   let commandCount = 0;
   let hasNonAllowlistedCommand = false;
   let hasExternalWrite = false;
   let hasExternalRead = false;
   let hasExternalPath = false;
-  for (const line of lines) {
-    let commands;
-    try {
-      commands = parseCommandLine(line.trim()).commands;
-    } catch (e) {
-      return e.message;
-    }
+  for (const commands of groups) {
     commandCount += commands.length;
     if (commandCount > MAX_LINES) return 'Script contains more than 20 commands';
-    for (const command of commands) {
-      const [cmd, ...args] = tokenize(command);
+    for (const { cmd, args, input, output, errorOutput } of commands) {
       if (!SHELL_ALLOWED_REAL.has(cmd)) hasNonAllowlistedCommand = true;
-      if (shellWriteTargets(cmd, args).some((arg) => resolvesOutsideSession(arg, sessionBase))) {
+      const writeTargets = [...shellWriteTargets(cmd, args), ...(output ? [output.path] : []), ...(errorOutput ? [errorOutput.path] : [])];
+      if (writeTargets.some((arg) => resolvesOutsideSession(arg, sessionBase) || isPublicLinkReadPath(arg, sessionBase))) {
         hasExternalWrite = true;
       }
-      if (shellReadTargets(cmd, args).some((arg) => (
+      const readTargets = [...shellReadTargets(cmd, args), ...(input ? [input] : [])];
+      if (readTargets.some((arg) => (
         !isPublicLinkReadPath(arg, sessionBase) && resolvesOutsideSession(arg, sessionBase)
       ))) {
         hasExternalRead = true;
@@ -910,65 +1097,137 @@ function validateScript(script, sessionBase) {
   return null;
 }
 
-function runOne(line, sessionBase) {
-  const tokens = tokenize(line);
-  let cmd = tokens[0];
-  const args = tokens.slice(1);
+function commandPath(cmd) {
   const trustedPath = SHELL_ALLOWED_REAL.has(cmd) ? TRUSTED_COMMAND_PATHS.get(cmd) : null;
   if (SHELL_ALLOWED_REAL.has(cmd) && !trustedPath) {
-    return Promise.reject(new Error(`Allowlisted command ${cmd} is unavailable in a trusted system directory`));
+    throw new Error(`Allowlisted command ${cmd} is unavailable in a trusted system directory`);
   }
-  if (trustedPath) {
-    cmd = trustedPath;
+  return trustedPath ?? cmd;
+}
+
+function killChild(child) {
+  try {
+    if (IS_WIN) {
+      const killed = spawnSync('taskkill.exe', ['/PID', String(child.pid), '/T', '/F'], {
+        windowsHide: true,
+        stdio: 'ignore',
+      });
+      if (killed.error || killed.status !== 0) child.kill('SIGKILL');
+    } else {
+      process.kill(-child.pid, 'SIGKILL');
+    }
+  } catch { /* ignore */ }
+}
+
+function runCommandGroup(group, sessionBase) {
+  const commands = parseCommandGroup(group);
+  if (commands.some((command, index) => command.input && index !== 0)) {
+    return Promise.reject(new Error('Input redirection is only supported for the first pipeline command'));
   }
+  if (commands.some((command, index) => command.output && index !== commands.length - 1)) {
+    return Promise.reject(new Error('Output redirection is only supported for the last pipeline command'));
+  }
+  if (commands.some((command, index) => command.errorOutput && index !== commands.length - 1)) {
+    return Promise.reject(new Error('Standard error file redirection is only supported for the last pipeline command'));
+  }
+
   return new Promise((resolve, reject) => {
-    const cwd = sessionBase;
-    const child = spawn(cmd, args, {
-      cwd,
-      shell: false,
-      stdio: ['ignore', 'pipe', 'pipe'],
-      env: SPAWN_ENV,
-      detached: !IS_WIN,
-    });
+    const children = [];
+    const input = commands[0].input
+      ? createReadStream(join(sessionBase, commands[0].input))
+      : null;
+    const last = commands.at(-1);
+    const output = last.output
+      ? createWriteStream(join(sessionBase, last.output.path), { flags: last.output.append ? 'a' : 'w' })
+      : null;
+    const errorOutput = last.errorOutput
+      ? createWriteStream(join(sessionBase, last.errorOutput.path), { flags: last.errorOutput.append ? 'a' : 'w' })
+      : null;
     let stdout = '';
     let stderr = '';
     let settled = false;
-    const timer = setTimeout(() => {
+    let closed = 0;
+    const finish = (error) => {
       if (settled) return;
       settled = true;
-      try {
-        if (IS_WIN) {
-          const killed = spawnSync('taskkill.exe', ['/PID', String(child.pid), '/T', '/F'], {
-            windowsHide: true,
-            stdio: 'ignore',
+      clearTimeout(timer);
+      input?.destroy();
+      output?.destroy();
+      errorOutput?.destroy();
+      if (error) {
+        children.forEach(killChild);
+        reject(error);
+      } else {
+        resolve({
+          code: children.at(-1)?.exitCode ?? 1,
+          stdout,
+          stderr: stderr.trim(),
+        });
+      }
+    };
+    const timer = setTimeout(() => finish(new Error(`Command timed out (${CMD_TIMEOUT_MS}ms)`)), CMD_TIMEOUT_MS);
+
+    input?.on('error', (error) => finish(new Error(`Failed to read input: ${error.message}`)));
+    output?.on('error', (error) => finish(new Error(`Failed to write output: ${error.message}`)));
+    errorOutput?.on('error', (error) => finish(new Error(`Failed to write standard error: ${error.message}`)));
+
+    try {
+      for (const [index, command] of commands.entries()) {
+        const isLast = index === commands.length - 1;
+        const child = spawn(commandPath(command.cmd), command.args, {
+          cwd: sessionBase,
+          shell: false,
+          stdio: ['pipe', 'pipe', 'pipe'],
+          env: SPAWN_ENV,
+          detached: !IS_WIN,
+        });
+        children.push(child);
+        child.on('error', (error) => finish(new Error(`Failed to execute ${command.cmd}: ${error.message}`)));
+        if (isLast && errorOutput) {
+          child.stderr.pipe(errorOutput);
+        } else if (!command.mergeErrorToOutput) {
+          child.stderr.on('data', (data) => {
+            stderr += data;
+            if (stderr.length > MAX_OUTPUT) child.stderr.pause();
           });
-          if (killed.error || killed.status !== 0) child.kill('SIGKILL');
+        }
+        child.on('close', () => {
+          closed += 1;
+          if (closed === children.length && children.length === commands.length && !settled) finish(null);
+        });
+      }
+      for (let index = 0; index < children.length - 1; index++) {
+        const current = children[index];
+        const next = children[index + 1];
+        if (commands[index].mergeErrorToOutput) {
+          const merged = new PassThrough();
+          current.stdout.pipe(merged, { end: false });
+          current.stderr.pipe(merged);
+          merged.pipe(next.stdin);
         } else {
-          process.kill(-child.pid, 'SIGKILL');
+          current.stdout.pipe(next.stdin);
         }
-      } catch { /* ignore */ }
-      reject(new Error(`Command timed out (${CMD_TIMEOUT_MS}ms)`));
-    }, CMD_TIMEOUT_MS);
-    child.stdout.on('data', (d) => {
-      stdout += d;
-      if (stdout.length > MAX_OUTPUT) child.stdout.pause();
-    });
-    child.stderr.on('data', (d) => {
-      stderr += d;
-      if (stderr.length > MAX_OUTPUT) child.stderr.pause();
-    });
-    child.on('error', (e) => {
-      if (settled) return;
-      settled = true;
-      clearTimeout(timer);
-      reject(new Error(`Failed to execute ${cmd}: ${e.message}`));
-    });
-    child.on('close', (code) => {
-      if (settled) return;
-      settled = true;
-      clearTimeout(timer);
-      resolve({ code: code ?? 1, stdout, stderr: stderr.trim() });
-    });
+      }
+      if (input) input.pipe(children[0].stdin);
+      else children[0].stdin.end();
+      if (output) {
+        children.at(-1).stdout.pipe(output, { end: !last.mergeErrorToOutput });
+        if (last.mergeErrorToOutput) children.at(-1).stderr.pipe(output);
+      } else {
+        children.at(-1).stdout.on('data', (data) => {
+          stdout += data;
+          if (stdout.length > MAX_OUTPUT) children.at(-1).stdout.pause();
+        });
+        if (last.mergeErrorToOutput) {
+          children.at(-1).stderr.on('data', (data) => {
+            stdout += data;
+            if (stdout.length > MAX_OUTPUT) children.at(-1).stderr.pause();
+          });
+        }
+      }
+    } catch (error) {
+      finish(error);
+    }
   });
 }
 
@@ -980,7 +1239,8 @@ function readFileAsync(p) {
 }
 function readFilePromise(p, enc) {
   return new Promise((resolve, reject) => {
-    readFile(p, enc, (err, data) => (err ? reject(err) : resolve(data)));
+    if (enc === undefined) readFile(p, (err, data) => (err ? reject(err) : resolve(data)));
+    else readFile(p, enc, (err, data) => (err ? reject(err) : resolve(data)));
   });
 }
 function writeFilePromise(p, data, enc) {