pyclaudecli 1.0.2__tar.gz → 1.0.4__tar.gz

{pyclaudecli-1.0.2 → pyclaudecli-1.0.4}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.5
 Name: pyclaudecli
-Version: 1.0.2
+Version: 1.0.4
 Summary: Python library wrapping the Claude Code CLI: prompts, background agents, auth, MCP, plugins, and more
 Author-email: Suriya Ravichandran <suriyaravichandran@itrendsolution.com>
 License: MIT
@@ -9,7 +9,10 @@ Keywords: anthropic,automation,claude,claude-code,cli,sdk,wrapper
 Classifier: Development Status :: 3 - Alpha
 Classifier: Intended Audience :: Developers
 Classifier: License :: OSI Approved :: MIT License
+Classifier: Operating System :: MacOS
+Classifier: Operating System :: Microsoft :: Windows
 Classifier: Operating System :: OS Independent
+Classifier: Operating System :: POSIX :: Linux
 Classifier: Programming Language :: Python :: 3
 Classifier: Programming Language :: Python :: 3 :: Only
 Classifier: Programming Language :: Python :: 3.8
@@ -17,6 +20,7 @@ Classifier: Programming Language :: Python :: 3.9
 Classifier: Programming Language :: Python :: 3.10
 Classifier: Programming Language :: Python :: 3.11
 Classifier: Programming Language :: Python :: 3.12
+Classifier: Programming Language :: Python :: 3.13
 Classifier: Topic :: Software Development :: Libraries :: Python Modules
 Requires-Python: >=3.8
 Description-Content-Type: text/markdown
@@ -41,6 +45,7 @@ It's a thin wrapper, not a reimplementation — every call runs the real `claude
 - [Command-line usage](#command-line-usage)
 - [Errors](#errors)
 - [`build_flags`](#build_flags)
+- [Security notes](#security-notes)
 - [Every method, with an example](#every-method-with-an-example)
 - [Development](#development)
 - [License](#license)
@@ -53,6 +58,10 @@ pip install pyclaudecli
 
 Requires the `claude` CLI itself to be installed and on `PATH` (see the [Claude Code docs](https://claude.com/claude-code)).
 
+Runs on Linux, macOS and Windows, Python 3.8+. On Windows the CLI is installed as
+`claude.cmd`, which `CreateProcess` won't find from a bare `"claude"` — the wrapper
+resolves it through `PATHEXT` for you, so the default `ClaudeCLI()` works there too.
+
 ## Quickstart
 
 ```python
@@ -81,6 +90,15 @@ claude = ClaudeCLI(
 )
 ```
 
+`env` is merged **over** the current environment, so `PATH`, `HOME` and the rest still
+reach the CLI — passing one API key doesn't cost you the ability to find the binary or
+its credentials. Pass `replace_env=True` if you really want the child to start from a
+clean slate:
+
+```python
+claude = ClaudeCLI(env={"PATH": "/usr/bin", "HOME": "/tmp/sandbox"}, replace_env=True)
+```
+
 ## Authentication
 
 `claude` handles auth itself, so `pyclaudecli` just drives it. You have two options.
@@ -410,13 +428,52 @@ gateway.terminate()
 
 See `ClaudeCLI`'s docstrings for the exact CLI flags behind each method — it covers every top-level `claude` command (`auth`, `mcp`, `plugin`, `project`, `agents`/background sessions, `auto-mode`, `doctor`, `update`, `install`, `import`, `ultrareview`, `gateway`) plus the main prompt flags. Anything not exposed as a named parameter can still be passed through via each method's `extra_flags` dict.
 
+## Security notes
+
+A few things the wrapper does on your behalf, worth knowing if you're feeding it input
+from anywhere but your own code:
+
+**Prompts can't smuggle in CLI flags.** `prompt()`, `prompt_stream()`, `start_background()`
+and the `pyclaudecli` command put `--` between the options and your text, so a prompt that
+starts with a dash is text, not a flag. Without it, user-supplied input like
+`--dangerously-skip-permissions` or `--settings /tmp/evil.json` would be parsed by the CLI:
+
+```python
+claude.prompt("--version")   # asks Claude about "--version"; does not run the flag
+```
+
+Flags you actually want still go through named parameters or `extra_flags`. Note this
+protection covers the prompt text — if you interpolate untrusted input into a *flag value*
+(`model=`, `settings=`, `add_dir=`), validate it yourself.
+
+**Errors don't spill credentials.** `ClaudeCLIError.args`/`.cmd` and the exception message
+are redacted before they're raised, so MCP auth headers, injected `--env` values, tokens
+inside an `mcp add-json` payload and anything shaped like `sk-ant-…`, `Bearer …` or
+`password=…` come back as `<redacted>`. Flag names survive so the command is still
+recognisable, and long values are truncated. Tracebacks and log aggregators get the
+redacted form; `exc.stdout`/`exc.stderr` still hold the raw output for local debugging.
+
+**Login codes are handled as single-use secrets.** `auth_login()` writes exactly one line
+to the CLI's stdin — a code containing a newline can't inject extra input — and drops the
+code and the captured output from memory once it's submitted. The child process and its
+pipes are always cleaned up, including when your `code_provider` raises.
+
+Two things it deliberately does *not* do: it never runs a shell (every call is an argv
+list, so there's no shell-injection surface), and it doesn't manage credentials itself —
+auth lives with the `claude` CLI and your environment. Remember the argv of a running
+process is visible to other users on the same machine via `ps`, so prefer env vars over
+flags for anything sensitive.
+
+Every call is an argv list on every platform — no shell, and no `shell=True` fallback on
+Windows, so quoting rules can't be turned into an injection.
+
 ## Development
 
 ```bash
 git clone https://github.com/Suriya-Ravichandran/pyclaudecli.git
 cd pyclaudecli
 pip install -e .
-pytest
+pytest          # offline; does not invoke the claude binary
 ```
 
 ## License

{pyclaudecli-1.0.2 → pyclaudecli-1.0.4}/README.md

@@ -18,6 +18,7 @@ It's a thin wrapper, not a reimplementation — every call runs the real `claude
 - [Command-line usage](#command-line-usage)
 - [Errors](#errors)
 - [`build_flags`](#build_flags)
+- [Security notes](#security-notes)
 - [Every method, with an example](#every-method-with-an-example)
 - [Development](#development)
 - [License](#license)
@@ -30,6 +31,10 @@ pip install pyclaudecli
 
 Requires the `claude` CLI itself to be installed and on `PATH` (see the [Claude Code docs](https://claude.com/claude-code)).
 
+Runs on Linux, macOS and Windows, Python 3.8+. On Windows the CLI is installed as
+`claude.cmd`, which `CreateProcess` won't find from a bare `"claude"` — the wrapper
+resolves it through `PATHEXT` for you, so the default `ClaudeCLI()` works there too.
+
 ## Quickstart
 
 ```python
@@ -58,6 +63,15 @@ claude = ClaudeCLI(
 )
 ```
 
+`env` is merged **over** the current environment, so `PATH`, `HOME` and the rest still
+reach the CLI — passing one API key doesn't cost you the ability to find the binary or
+its credentials. Pass `replace_env=True` if you really want the child to start from a
+clean slate:
+
+```python
+claude = ClaudeCLI(env={"PATH": "/usr/bin", "HOME": "/tmp/sandbox"}, replace_env=True)
+```
+
 ## Authentication
 
 `claude` handles auth itself, so `pyclaudecli` just drives it. You have two options.
@@ -387,13 +401,52 @@ gateway.terminate()
 
 See `ClaudeCLI`'s docstrings for the exact CLI flags behind each method — it covers every top-level `claude` command (`auth`, `mcp`, `plugin`, `project`, `agents`/background sessions, `auto-mode`, `doctor`, `update`, `install`, `import`, `ultrareview`, `gateway`) plus the main prompt flags. Anything not exposed as a named parameter can still be passed through via each method's `extra_flags` dict.
 
+## Security notes
+
+A few things the wrapper does on your behalf, worth knowing if you're feeding it input
+from anywhere but your own code:
+
+**Prompts can't smuggle in CLI flags.** `prompt()`, `prompt_stream()`, `start_background()`
+and the `pyclaudecli` command put `--` between the options and your text, so a prompt that
+starts with a dash is text, not a flag. Without it, user-supplied input like
+`--dangerously-skip-permissions` or `--settings /tmp/evil.json` would be parsed by the CLI:
+
+```python
+claude.prompt("--version")   # asks Claude about "--version"; does not run the flag
+```
+
+Flags you actually want still go through named parameters or `extra_flags`. Note this
+protection covers the prompt text — if you interpolate untrusted input into a *flag value*
+(`model=`, `settings=`, `add_dir=`), validate it yourself.
+
+**Errors don't spill credentials.** `ClaudeCLIError.args`/`.cmd` and the exception message
+are redacted before they're raised, so MCP auth headers, injected `--env` values, tokens
+inside an `mcp add-json` payload and anything shaped like `sk-ant-…`, `Bearer …` or
+`password=…` come back as `<redacted>`. Flag names survive so the command is still
+recognisable, and long values are truncated. Tracebacks and log aggregators get the
+redacted form; `exc.stdout`/`exc.stderr` still hold the raw output for local debugging.
+
+**Login codes are handled as single-use secrets.** `auth_login()` writes exactly one line
+to the CLI's stdin — a code containing a newline can't inject extra input — and drops the
+code and the captured output from memory once it's submitted. The child process and its
+pipes are always cleaned up, including when your `code_provider` raises.
+
+Two things it deliberately does *not* do: it never runs a shell (every call is an argv
+list, so there's no shell-injection surface), and it doesn't manage credentials itself —
+auth lives with the `claude` CLI and your environment. Remember the argv of a running
+process is visible to other users on the same machine via `ps`, so prefer env vars over
+flags for anything sensitive.
+
+Every call is an argv list on every platform — no shell, and no `shell=True` fallback on
+Windows, so quoting rules can't be turned into an injection.
+
 ## Development
 
 ```bash
 git clone https://github.com/Suriya-Ravichandran/pyclaudecli.git
 cd pyclaudecli
 pip install -e .
-pytest
+pytest          # offline; does not invoke the claude binary
 ```
 
 ## License

{pyclaudecli-1.0.2 → pyclaudecli-1.0.4}/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "hatchling.build"
 
 [project]
 name = "pyclaudecli"
-version = "1.0.2"
+version = "1.0.4"
 description = "Python library wrapping the Claude Code CLI: prompts, background agents, auth, MCP, plugins, and more"
 readme = "README.md"
 requires-python = ">=3.8"
@@ -25,6 +25,10 @@ classifiers = [
     "Programming Language :: Python :: 3.10",
     "Programming Language :: Python :: 3.11",
     "Programming Language :: Python :: 3.12",
+    "Programming Language :: Python :: 3.13",
+    "Operating System :: POSIX :: Linux",
+    "Operating System :: MacOS",
+    "Operating System :: Microsoft :: Windows",
     "Topic :: Software Development :: Libraries :: Python Modules",
 ]
 

{pyclaudecli-1.0.2 → pyclaudecli-1.0.4}/src/pyclaudecli/__init__.py

@@ -3,7 +3,7 @@
 from .client import ClaudeCLI, build_flags
 from .exceptions import ClaudeCLIError, ClaudeNotFoundError, ClaudeTimeoutError
 
-__version__ = "1.0.2"
+__version__ = "1.0.4"
 
 __all__ = [
     "ClaudeCLI",

{pyclaudecli-1.0.2 → pyclaudecli-1.0.4}/src/pyclaudecli/__main__.py

@@ -45,7 +45,9 @@ def main(argv: Optional[List[str]] = None) -> int:
     model, prompt = parse_args(argv)
     client = ClaudeCLI()
     try:
-        result = client.run(["--print", "--model", model, prompt], check=False)
+        # `--` keeps a prompt that starts with a dash from being parsed as
+        # flags by the CLI (this parser passes unknown args through as text).
+        result = client.run(["--print", "--model", model, "--", prompt], check=False)
     except Exception as exc:  # ClaudeNotFoundError, etc.
         print(str(exc), file=sys.stderr)
         return 1

pyclaudecli-1.0.4/src/pyclaudecli/_process.py

@@ -0,0 +1,379 @@
+"""Low-level process plumbing shared by ClaudeCLI's methods."""
+
+from __future__ import annotations
+
+import os
+import queue
+import re
+import shutil
+import subprocess
+import threading
+import time
+from dataclasses import dataclass
+from typing import Callable, Iterator, Optional, Sequence
+
+from .exceptions import ClaudeCLIError, ClaudeNotFoundError, ClaudeTimeoutError
+
+_URL_PATTERN = re.compile(r"https://\S+")
+
+# Flags whose values are credentials (MCP auth headers, injected env vars).
+_SECRET_FLAGS = frozenset({"--header", "--env", "--client-id", "--client-secret"})
+
+# Credential shapes that can turn up anywhere in an argv, including inside the
+# JSON blob passed to `mcp add-json`.
+_SECRET_VALUE_PATTERN = re.compile(
+    r"""(
+        sk-ant-[\w-]+                      # Anthropic API keys
+      | pypi-[\w-]+                        # PyPI tokens
+      | gh[pousr]_[A-Za-z0-9]+             # GitHub tokens
+      | [Bb]earer\s+\S+                    # bearer tokens
+      | (?i:[\w.-]*(?:token|secret|key|password|passwd|auth)[\w.-]*)
+        \s*["\s]*[=:]\s*"?[^\s"',}]+       # anything token/secret/key-ish = value
+    )""",
+    re.VERBOSE,
+)
+
+_REDACTED = "<redacted>"
+_MAX_ARG_LEN = 120
+_MAX_DETAIL_LEN = 2000
+_MAX_LOGIN_BUFFER = 64 * 1024
+
+
+def redact_arg(value: str, limit: Optional[int] = _MAX_ARG_LEN) -> str:
+    """Masks credential-looking substrings, and truncates very long values."""
+    cleaned = _SECRET_VALUE_PATTERN.sub(_REDACTED, str(value))
+    if limit is not None and len(cleaned) > limit:
+        cleaned = cleaned[:limit] + "…"
+    return cleaned
+
+
+def redact_command(command: Sequence[str]) -> list:
+    """Returns a copy of an argv safe to put in an error message or a log.
+
+    Values of credential-bearing flags are replaced wholesale; everything else
+    is scanned for embedded secrets and truncated. Flag *names* survive, so the
+    command stays recognisable when debugging.
+    """
+    safe = []
+    masking = False
+    for token in command:
+        token = str(token)
+        if token.startswith("-"):
+            masking = token in _SECRET_FLAGS
+            safe.append(token)
+            continue
+        safe.append(_REDACTED if masking else redact_arg(token))
+    return safe
+
+
+def format_command(command: Sequence[str]) -> str:
+    """A redacted, shell-ish rendering of an argv for error messages."""
+    return " ".join(redact_command(command))
+
+
+def resolve_binary(binary: str, env: Optional[dict] = None) -> str:
+    """Finds the executable to run, the same way a shell would.
+
+    On Windows the `claude` CLI is an npm shim (`claude.cmd`), and
+    CreateProcess only ever appends `.exe` — so a bare "claude" is not found
+    unless it is resolved through PATHEXT first. `shutil.which` handles that,
+    and on POSIX it is a no-op beyond returning the absolute path.
+
+    Falls back to the name as given (an explicit path, or something the OS can
+    still resolve), so the usual ClaudeNotFoundError is what callers see.
+    """
+    if os.path.dirname(binary):
+        return binary
+    path = (env or os.environ).get("PATH")
+    return shutil.which(binary, path=path) or binary
+
+
+class _PipeReader:
+    """Reads a child's stdout from a thread, so waiting works everywhere.
+
+    `select` only accepts sockets on Windows, so it cannot be used to poll a
+    subprocess pipe. A daemon thread doing blocking reads is portable, and
+    still hands back partial output the moment it arrives — which matters for
+    a login prompt that never ends in a newline.
+    """
+
+    _EOF = object()
+
+    def __init__(self, fd: int) -> None:
+        self._fd = fd
+        self._chunks: "queue.Queue" = queue.Queue()
+        self._thread = threading.Thread(target=self._pump, daemon=True)
+        self._thread.start()
+
+    def _pump(self) -> None:
+        try:
+            while True:
+                data = os.read(self._fd, 4096)
+                if not data:
+                    break
+                self._chunks.put(data)
+        except (OSError, ValueError):
+            pass  # pipe closed underneath us; treated as EOF
+        finally:
+            self._chunks.put(self._EOF)
+
+    def read(self, timeout: float) -> Optional[str]:
+        """Returns decoded output, "" if nothing arrived in time, None at EOF."""
+        try:
+            item = self._chunks.get(timeout=timeout)
+        except queue.Empty:
+            return ""
+        if item is self._EOF:
+            return None
+        return item.decode("utf-8", errors="replace")
+
+
+@dataclass
+class CommandResult:
+    args: list
+    returncode: int
+    stdout: str
+    stderr: str
+
+    @property
+    def ok(self) -> bool:
+        return self.returncode == 0
+
+
+def run(
+    binary: str,
+    args: Sequence[str],
+    *,
+    cwd: Optional[str] = None,
+    env: Optional[dict] = None,
+    input_text: Optional[str] = None,
+    timeout: Optional[float] = None,
+    check: bool = True,
+) -> CommandResult:
+    command = [resolve_binary(binary, env), *args]
+    try:
+        completed = subprocess.run(
+            command,
+            cwd=cwd,
+            env=env,
+            input=input_text,
+            capture_output=True,
+            text=True,
+            timeout=timeout,
+        )
+    except FileNotFoundError as exc:
+        raise ClaudeNotFoundError(
+            f"'{binary}' was not found on PATH. Is Claude Code installed?",
+            cmd=redact_command(command),
+        ) from exc
+    except subprocess.TimeoutExpired as exc:
+        stdout = exc.stdout.decode() if isinstance(exc.stdout, bytes) else (exc.stdout or "")
+        stderr = exc.stderr.decode() if isinstance(exc.stderr, bytes) else (exc.stderr or "")
+        raise ClaudeTimeoutError(
+            f"'{format_command(command)}' did not finish within {timeout}s",
+            cmd=redact_command(command),
+            stdout=stdout,
+            stderr=stderr,
+        ) from exc
+
+    result = CommandResult(command, completed.returncode, completed.stdout, completed.stderr)
+    if check and not result.ok:
+        detail = redact_arg((result.stderr or result.stdout or "").strip(), limit=_MAX_DETAIL_LEN)
+        raise ClaudeCLIError(
+            f"'{format_command(command)}' exited with {result.returncode}: {detail}",
+            returncode=result.returncode,
+            stdout=result.stdout,
+            stderr=result.stderr,
+            cmd=redact_command(command),
+        )
+    return result
+
+
+def stream_lines(
+    binary: str,
+    args: Sequence[str],
+    *,
+    cwd: Optional[str] = None,
+    env: Optional[dict] = None,
+) -> Iterator[str]:
+    """Runs a command and yields decoded stdout lines as they arrive."""
+    command = [resolve_binary(binary, env), *args]
+    try:
+        proc = subprocess.Popen(
+            command,
+            cwd=cwd,
+            env=env,
+            stdout=subprocess.PIPE,
+            stderr=subprocess.STDOUT,
+            text=True,
+            bufsize=1,
+        )
+    except FileNotFoundError as exc:
+        raise ClaudeNotFoundError(
+            f"'{binary}' was not found on PATH. Is Claude Code installed?",
+            cmd=redact_command(command),
+        ) from exc
+
+    assert proc.stdout is not None
+    try:
+        for line in proc.stdout:
+            yield line.rstrip("\n")
+    finally:
+        proc.stdout.close()
+        returncode = proc.wait()
+        if returncode != 0:
+            raise ClaudeCLIError(
+                f"'{format_command(command)}' exited with {returncode}",
+                returncode=returncode,
+                cmd=redact_command(command),
+            )
+
+
+def run_interactive(
+    binary: str,
+    args: Sequence[str],
+    *,
+    cwd: Optional[str] = None,
+    env: Optional[dict] = None,
+) -> int:
+    """Runs a command with stdio inherited from the current process.
+
+    For subcommands that need a real terminal (attach, setup-token, an
+    interactive mcp/import picker) rather than captured output.
+    """
+    command = [resolve_binary(binary, env), *args]
+    try:
+        return subprocess.call(command, cwd=cwd, env=env)
+    except FileNotFoundError as exc:
+        raise ClaudeNotFoundError(
+            f"'{binary}' was not found on PATH. Is Claude Code installed?",
+            cmd=redact_command(command),
+        ) from exc
+
+
+def oauth_login(
+    binary: str,
+    args: Sequence[str],
+    *,
+    cwd: Optional[str] = None,
+    env: Optional[dict] = None,
+    code: Optional[str] = None,
+    code_provider: Optional[Callable[[str], str]] = None,
+    on_output: Optional[Callable[[str], None]] = None,
+    prompt_marker: str = "Paste code here",
+    timeout: float = 180,
+) -> int:
+    """Drives an interactive OAuth login (`claude auth login` / `mcp login`).
+
+    Streams the child's output (forwarding it to `on_output`, if given) until
+    it prints its "paste the code" prompt, then writes back `code` — or
+    whatever `code_provider(url)` returns, where `url` is the login URL
+    found in the output so far. Falls back to `input()` if neither is given.
+    Returns the child's exit code.
+    """
+    command = [resolve_binary(binary, env), *args]
+    try:
+        proc = subprocess.Popen(
+            command,
+            cwd=cwd,
+            env=env,
+            stdin=subprocess.PIPE,
+            stdout=subprocess.PIPE,
+            stderr=subprocess.STDOUT,
+            text=True,
+            bufsize=1,
+        )
+    except FileNotFoundError as exc:
+        raise ClaudeNotFoundError(
+            f"'{binary}' was not found on PATH. Is Claude Code installed?",
+            cmd=redact_command(command),
+        ) from exc
+
+    assert proc.stdout is not None and proc.stdin is not None
+    # Send exactly "\n", not the platform line ending: on Windows text mode
+    # would translate it to "\r\n" and the CLI would read a stray CR.
+    if hasattr(proc.stdin, "reconfigure"):
+        proc.stdin.reconfigure(newline="\n")
+    reader = _PipeReader(proc.stdout.fileno())
+    buffer = ""
+    url: Optional[str] = None
+    deadline = time.time() + timeout
+
+    try:
+        while time.time() < deadline and proc.poll() is None:
+            chunk = reader.read(0.5)
+            if chunk is None:  # the child closed its output
+                break
+            if not chunk:
+                continue
+
+            buffer += chunk
+            # A login that never reaches its prompt must not grow the buffer
+            # without bound; the marker and URL both live near the tail.
+            if len(buffer) > _MAX_LOGIN_BUFFER:
+                buffer = buffer[-_MAX_LOGIN_BUFFER:]
+            if on_output:
+                on_output(chunk)
+
+            if url is None:
+                match = _URL_PATTERN.search(buffer)
+                if match:
+                    url = match.group(0)
+
+            if prompt_marker in buffer:
+                if code is not None:
+                    entered_code = code
+                elif code_provider is not None:
+                    entered_code = code_provider(url or "")
+                else:
+                    entered_code = input("\nPaste the code from the browser here: ")
+
+                # Only ever hand the child a single line: a code carrying a
+                # newline would otherwise write extra lines into its stdin.
+                entered_code = str(entered_code or "").splitlines()
+                entered_code = entered_code[0].strip() if entered_code else ""
+
+                proc.stdin.write(entered_code + "\n")
+                proc.stdin.flush()
+                proc.stdin.close()
+                # Drop the code and the captured output rather than holding
+                # them in memory for the rest of the call.
+                entered_code = ""
+                buffer = ""
+                break
+        else:
+            if proc.poll() is None:
+                raise ClaudeTimeoutError(
+                    f"'{format_command(command)}' did not produce a login prompt within {timeout}s",
+                    cmd=redact_command(command),
+                )
+
+        drain_deadline = time.time() + 30
+        while proc.poll() is None and time.time() < drain_deadline:
+            chunk = reader.read(0.5)
+            if chunk is None:
+                break
+            if chunk and on_output:
+                on_output(chunk)
+
+        # Reaching EOF on stdout does not mean the child has exited yet, so
+        # give it a moment to actually finish rather than calling it a timeout.
+        try:
+            return proc.wait(timeout=max(drain_deadline - time.time(), 5))
+        except subprocess.TimeoutExpired:
+            raise ClaudeTimeoutError(
+                f"'{format_command(command)}' did not finish after the code was submitted",
+                cmd=redact_command(command),
+            ) from None
+    finally:
+        # Never leave a half-driven login (or its pipes) behind, whatever
+        # went wrong — including an exception raised by `code_provider`.
+        if proc.poll() is None:
+            proc.kill()
+            proc.wait()
+        for stream in (proc.stdin, proc.stdout):
+            try:
+                if stream is not None and not stream.closed:
+                    stream.close()
+            except (OSError, ValueError):
+                pass