From cb0e7ecc5041c993014b6179c8a4f13b7c96581e Mon Sep 17 00:00:00 2001 From: Thomas Kelly Date: Thu, 9 Apr 2026 14:57:46 -0500 Subject: [PATCH 1/2] Removed 'shell: true' everywhere applicable --- src/services/SummaryService.ts | 4 +--- standalone/StandaloneMessageHandler.ts | 2 +- 2 files changed, 2 insertions(+), 4 deletions(-) diff --git a/src/services/SummaryService.ts b/src/services/SummaryService.ts index ba77bdc..fc74b32 100644 --- a/src/services/SummaryService.ts +++ b/src/services/SummaryService.ts @@ -188,7 +188,6 @@ Return ONLY a JSON array in the same order: [{"title":"...","description":"...", const child = spawn(backend.path, args, { cwd: os.tmpdir(), env: CHILD_ENV, - shell: process.platform === 'win32', // required to execute .cmd/.bat files on Windows signal: ac.signal, }); @@ -266,8 +265,7 @@ Return ONLY a JSON array in the same order: [{"title":"...","description":"...", const binPath = stdout.trim().split('\n')[0].trim(); const child = spawn(binPath, ['--version'], { timeout: CLI_CHECK_TIMEOUT_MS, - env: CHILD_ENV, - shell: isWindows // required to execute .cmd/.bat files on Windows + env: CHILD_ENV }); child.on('error', () => resolve(undefined)); child.on('close', (code) => resolve(code === 0 ? binPath : undefined)); diff --git a/standalone/StandaloneMessageHandler.ts b/standalone/StandaloneMessageHandler.ts index 80bcf69..0140342 100644 --- a/standalone/StandaloneMessageHandler.ts +++ b/standalone/StandaloneMessageHandler.ts @@ -365,7 +365,7 @@ export class StandaloneMessageHandler { /** Open a workspace folder in an editor (VSCode, Cursor, etc.). */ private openInEditor(cmd: string, cwd: string) { - execFile(cmd, [cwd], { shell: process.platform === 'win32' }, (err) => { + execFile(cmd, [cwd], (err) => { if (err) { console.error(`Claudine: Failed to open ${cmd}`, err); this._send({ type: 'error', message: `Failed to open ${cmd}: ${err.message}` }); From d79915c57b0f4ec3a6bfa311b339b48d2a30030d Mon Sep 17 00:00:00 2001 From: Thomas Kelly Date: Thu, 9 Apr 2026 15:03:57 -0500 Subject: [PATCH 2/2] Pass minimal environment to child terminals in Standalone --- standalone/StandaloneMessageHandler.ts | 22 +++++++++++++++++----- 1 file changed, 17 insertions(+), 5 deletions(-) diff --git a/standalone/StandaloneMessageHandler.ts b/standalone/StandaloneMessageHandler.ts index 0140342..82692fd 100644 --- a/standalone/StandaloneMessageHandler.ts +++ b/standalone/StandaloneMessageHandler.ts @@ -376,11 +376,23 @@ export class StandaloneMessageHandler { /** Resume a Claude Code conversation in a terminal emulator. */ private openInTerminal(cwd: string, sessionId: string) { const platform = process.platform; - // Strip Node.js debugger variables that interfere with child processes (mainly relevant to - // VS Code debug sessions). NODE_OPTIONS may carry debugger bootstrap flags (--require) that - // claude's embedded Node can't resolve. - const env = { ...process.env }; - delete env['NODE_OPTIONS']; + // Use a minimal env to avoid leaking secrets and stripping Node.js debugger + // variables (e.g. NODE_OPTIONS) that interfere with child processes. + const env: NodeJS.ProcessEnv = { + PATH: process.env.PATH, + HOME: process.env.HOME, + LANG: process.env.LANG, + TERM: process.env.TERM, + // Windows: needed for terminal emulators to locate config dirs and resolve .cmd files + ...(platform === 'win32' && { + APPDATA: process.env.APPDATA, + USERPROFILE: process.env.USERPROFILE, + PATHEXT: process.env.PATHEXT, + SystemRoot: process.env.SystemRoot, + TEMP: process.env.TEMP, + TMP: process.env.TMP, + }), + }; const resumeCmd = `claude --resume ${sessionId}`;