viber-channel 0.8.20 → 0.8.21

package/lib/bridge_spawn.ts

@@ -14,7 +14,7 @@
  * the bridge's default "register a fresh instance" path.
  */
 
-import { spawn as nodeSpawn } from "node:child_process";
+import { spawn as nodeSpawn } from "./hidden_proc.js";
 import type { AgentSpec, ChildHandle, SpawnFn } from "./supervisor.ts";
 
 /** Minimal child surface the adapter consumes (matches node's ChildProcess). */

package/lib/fingerprint.ts

@@ -1,4 +1,4 @@
-import { execSync } from "node:child_process";
+import { execSync } from "./hidden_proc.js";
 import { createHash } from "node:crypto";
 import { realpathSync } from "node:fs";
 

package/lib/hidden_proc.ts

@@ -0,0 +1,99 @@
+/**
+ * hidden_proc.ts — the ONLY door to `node:child_process` and `Bun.spawn*` in this package (#638).
+ * vibe-master and viber-gateway re-export it, so there is ONE `hide()` for the three packages.
+ *
+ * The Viber app (`viber-gateway.exe`) is a GUI-subsystem binary: it has no console. On Windows a
+ * console child of a console-less parent gets a NEW, VISIBLE console unless the spawn passes
+ * `windowsHide: true`. The runner heartbeat (every 30 s) enumerates processes through PowerShell,
+ * so each beat flashed a window.
+ *
+ * Measured (#638 step-01, bun 1.3.14, compiled `--windows-hide-console` exe started through WMI):
+ *
+ * ```
+ * execFileSync / execSync / exec / Bun.spawnSync   hide=false -> child console visible=True
+ *                                                  hide=true  -> child hwnd=0 (NO console at all)
+ * ```
+ *
+ * `hwnd=0` is a console WITHOUT a window (CREATE_NO_WINDOW), and it is inherited: the `exec` rows are
+ * already a GRANDCHILD (`cmd.exe /c powershell`) and read `hwnd=0` too. So hiding the first edge may be
+ * enough for console descendants — but not for a Bun/Node parent that spawns with its own flags.
+ * Measured again for a Bun parent (step-03): compiled GUI exe -> Bun console child spawned with
+ * hide=true -> its grandchild spawned WITHOUT hide reads `hwnd=0 visible=False`; child hide=false ->
+ * grandchild `visible=True`. So hiding the first edge is enough for console descendants.
+ * Every spawn still goes through this helper BY DECISION (plan 638, defence in depth): the next first
+ * edge is written by someone who has not read this.
+ * No-op outside Windows.
+ */
+import * as cp from "node:child_process";
+
+/** Every option object that reaches `child_process` passes here. Exported for its witness. */
+export function hide<T extends object>(opts: T | undefined): T & { windowsHide: true } {
+  return { ...(opts ?? ({} as T)), windowsHide: true };
+}
+
+type Backend = Pick<typeof cp, "exec" | "execSync" | "execFile" | "execFileSync" | "spawn">;
+
+/**
+ * `execFile` / `execFileSync` / `spawn` accept `args` OR options in 2nd place (and `execFile` a
+ * callback anywhere). Split them so a call without `args` still carries its options through `hide`.
+ */
+function splitArgs(rest: unknown[]): { args: readonly string[]; tail: unknown[] } {
+  return Array.isArray(rest[0]) ? { args: rest[0] as readonly string[], tail: rest.slice(1) } : { args: [], tail: rest };
+}
+
+function optsAndCallback(tail: unknown[]): { opts: object | undefined; cb: unknown } {
+  const cb = tail.find((t) => typeof t === "function");
+  const opts = tail.find((t) => t !== null && typeof t === "object") as object | undefined;
+  return { opts, cb };
+}
+
+/** The wrappers over a given backend. Exported so the witness can hand a recording fake (a
+ *  `mock.module` of `node:child_process` leaks into every other test file of the run). */
+export function hiddenOver(b: Backend): Backend {
+  return {
+    exec: ((command: string, ...rest: unknown[]) => {
+      const { opts, cb } = optsAndCallback(rest);
+      return b.exec(command, hide(opts as cp.ExecOptions | undefined), cb as Parameters<typeof cp.exec>[2]);
+    }) as typeof cp.exec,
+    execSync: ((command: string, options?: cp.ExecSyncOptions) => b.execSync(command, hide(options))) as typeof cp.execSync,
+    execFile: ((file: string, ...rest: unknown[]) => {
+      const { args, tail } = splitArgs(rest);
+      const { opts, cb } = optsAndCallback(tail);
+      return b.execFile(file, args, hide(opts as cp.ExecFileOptions | undefined), cb as Parameters<typeof cp.execFile>[3]);
+    }) as typeof cp.execFile,
+    execFileSync: ((file: string, ...rest: unknown[]) => {
+      const { args, tail } = splitArgs(rest);
+      return b.execFileSync(file, args, hide(tail[0] as cp.ExecFileSyncOptions | undefined));
+    }) as typeof cp.execFileSync,
+    spawn: ((command: string, ...rest: unknown[]) => {
+      const { args, tail } = splitArgs(rest);
+      return b.spawn(command, args, hide(tail[0] as cp.SpawnOptions | undefined));
+    }) as typeof cp.spawn,
+  };
+}
+
+export const { exec, execSync, execFile, execFileSync, spawn } = hiddenOver(cp);
+
+// ── Bun.spawn* (the channel, vibe-master and the gateway all run on Bun) ──
+
+type BunSpawn = typeof Bun.spawn;
+type BunSpawnSync = typeof Bun.spawnSync;
+
+/**
+ * Both forms of `Bun.spawn*`: `(cmd[], opts)` and `({ cmd, ...opts })` — in the second the options live
+ * in the FIRST argument, so hiding only the second would silently leave it visible.
+ */
+function hiddenArgs(cmd: unknown, opts: unknown): [unknown, unknown?] {
+  return Array.isArray(cmd) ? [cmd, hide(opts as object | undefined)] : [hide(cmd as object)];
+}
+
+/** The wrappers over a given `Bun`. Exported so the witness can hand a recording fake. */
+export function hiddenBunOver(b: { spawn: BunSpawn; spawnSync: BunSpawnSync }): { bunSpawn: BunSpawn; bunSpawnSync: BunSpawnSync } {
+  const call = (f: (...a: unknown[]) => unknown) => (cmd: unknown, opts?: unknown) => f(...hiddenArgs(cmd, opts));
+  return {
+    bunSpawn: call(b.spawn as (...a: unknown[]) => unknown) as BunSpawn,
+    bunSpawnSync: call(b.spawnSync as (...a: unknown[]) => unknown) as BunSpawnSync,
+  };
+}
+
+export const { bunSpawn, bunSpawnSync } = hiddenBunOver(Bun);

package/lib/parent_watchdog.ts

@@ -20,7 +20,7 @@
  * still alive". `signal 0` probes existence without delivering a signal.
  */
 
-import { execSync } from "node:child_process";
+import { execSync } from "./hidden_proc.js";
 
 /**
  * Shim processes that sit BETWEEN the real agent (e.g. claude.exe) and us in the

package/lib/process_start.ts

@@ -22,7 +22,7 @@
  * Returning `undefined` anywhere keeps the caller's conservative answer, but it is now
  * the exception rather than the rule off Windows.
  */
-import { exec, execSync } from "node:child_process";
+import { exec, execSync } from "./hidden_proc.js";
 import { readdirSync, readFileSync } from "node:fs";
 
 /**

package/lib/runner_exec.ts

@@ -13,7 +13,7 @@
  * injectable so the flow is unit-testable without shelling or a live server.
  */
 
-import { execFile } from "node:child_process";
+import { execFile } from "./hidden_proc.js";
 import { randomBytes } from "node:crypto";
 import { existsSync, mkdirSync, readFileSync, rmSync, writeFileSync } from "node:fs";
 import { join } from "node:path";

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "viber-channel",
-  "version": "0.8.20",
+  "version": "0.8.21",
   "description": "Voice + text MCP channel between a Claude Code session and the Viber UI (https://viber.dgypx.dev). Push transcripts to Claude; send_message tool delivers text back to the UI.",
   "type": "module",
   "bin": {

package/viber-codex-bridge.ts

@@ -6,7 +6,8 @@
  * messages into a bridge-owned persistent Codex app-server thread, and posts
  * Codex's final assistant reply back into Viber.
  */
-import { spawn, type ChildProcessWithoutNullStreams } from "node:child_process";
+import type { ChildProcessWithoutNullStreams } from "node:child_process";
+import { spawn } from "./lib/hidden_proc.js";
 import { createHash } from "node:crypto";
 import { existsSync, mkdirSync, readFileSync, writeFileSync } from "node:fs";
 import { dirname, join } from "node:path";