fix(client): resolve 8 real user-impacting bugs across web, desktop, TUI, and server

- packages/app/src/context/global-sdk.tsx: track abort listener reference
  defensively across SSE reconnect loop to prevent listener leak if
  cleanup path is hit unexpectedly
- packages/app/src/utils/server-auth.ts: apply timeout even when an
  external AbortSignal is provided; fix btoa() to use Buffer.from()
  so non-ASCII credentials don't cause InvalidCharacterError
- packages/shared/src/local-instance.ts: destroy write stream on error
  to prevent file descriptor leak; remove early return on Windows
  taskkill so stop() resolves even when taskkill fails
- packages/codeplane/src/tui/worker.ts: wrap Rpc.emit in try/catch and
  store GlobalBus handler so it can be removed on shutdown, preventing
  listener leak and crash cascade
- packages/codeplane/src/server/server.ts: rethrow after logging cron
  scheduler / prompt queue worker start failures so startup is not
  silently degraded
- packages/codeplane/src/server/proxy.ts: add closed flag and
  closeRemote helper so proxied WebSocket connections are always
  explicitly closed and cannot leak

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

Author: Codeplane Agent

packages/app/src/context/global-sdk.tsx

@@ -104,6 +104,7 @@ const globalSdkContext = createSimpleContext({
     const aborted = (error: unknown) => abortError.safeParse(error).success
 
     let attempt: AbortController | undefined
+    let currentOnAbort: (() => void) | undefined
     let run: Promise<void> | undefined
     let started = false
     const HEARTBEAT_TIMEOUT_MS = 45_000
@@ -128,11 +129,15 @@ const globalSdkContext = createSimpleContext({
       run = (async () => {
         // oxlint-disable-next-line no-unmodified-loop-condition -- `started` is set to false by stop() which also aborts; both flags are checked to allow graceful exit
         while (!abort.signal.aborted && started) {
+          if (currentOnAbort) {
+            abort.signal.removeEventListener("abort", currentOnAbort)
+          }
           attempt = new AbortController()
           lastEventAt = Date.now()
           const onAbort = () => {
             attempt?.abort()
           }
+          currentOnAbort = onAbort
           abort.signal.addEventListener("abort", onAbort)
           try {
             const events = await eventSdk.global.event({
@@ -183,7 +188,10 @@ const globalSdkContext = createSimpleContext({
               })
             }
           } finally {
-            abort.signal.removeEventListener("abort", onAbort)
+            if (currentOnAbort) {
+              abort.signal.removeEventListener("abort", currentOnAbort)
+            }
+            currentOnAbort = undefined
             attempt = undefined
             clearHeartbeat()
           }

packages/app/src/utils/server-auth.ts

@@ -24,7 +24,8 @@ const UNREACHABLE: ServerAuthStatus = {
 
 function basicAuthHeader(server: ServerConnection.HttpBase): string | undefined {
   if (!server.password) return
-  return `Basic ${btoa(`${server.username ?? "codeplane"}:${server.password}`)}`
+  const credential = `${server.username ?? "codeplane"}:${server.password}`
+  return `Basic ${Buffer.from(credential).toString("base64")}`
 }
 
 function credentialsFor(server: ServerConnection.HttpBase): RequestCredentials | undefined {
@@ -48,10 +49,12 @@ export async function checkServerAuth(
   const base = server.url.replace(/\/+$/, "")
   const auth = basicAuthHeader(server)
 
-  const controller = opts?.signal ? undefined : new AbortController()
-  const timer =
-    controller && opts?.timeoutMs ? setTimeout(() => controller.abort(), opts.timeoutMs) : undefined
-  const signal = opts?.signal ?? controller?.signal
+  const controller = new AbortController()
+  const signal = opts?.signal ?? controller.signal
+  if (opts?.signal) {
+    opts.signal.addEventListener("abort", () => controller.abort(), { once: true })
+  }
+  const timer = opts?.timeoutMs ? setTimeout(() => controller.abort(), opts.timeoutMs) : undefined
 
   try {
     const headers: Record<string, string> = {}
@@ -115,10 +118,12 @@ export async function verifyTotp(
   const auth = basicAuthHeader(server)
   if (!auth) return { ok: false, reason: "unauthorized" }
 
-  const controller = opts?.signal ? undefined : new AbortController()
-  const timer =
-    controller && opts?.timeoutMs ? setTimeout(() => controller.abort(), opts.timeoutMs) : undefined
-  const signal = opts?.signal ?? controller?.signal
+  const controller = new AbortController()
+  const signal = opts?.signal ?? controller.signal
+  if (opts?.signal) {
+    opts.signal.addEventListener("abort", () => controller.abort(), { once: true })
+  }
+  const timer = opts?.timeoutMs ? setTimeout(() => controller.abort(), opts.timeoutMs) : undefined
 
   try {
     const res = await fetcher(`${base}/global/auth/verify`, {

packages/codeplane/src/cli/cmd/instance.ts

@@ -986,7 +986,10 @@ export const InstanceSignInCommand = cmd({
     UI.println(UI.Style.TEXT_DIM + "(Empty line cancels.)")
     UI.println(UI.Style.TEXT_NORMAL + "")
 
-    await open(saved!.url).catch(() => undefined)
+    await open(saved!.url).catch((e) => {
+      UI.println(UI.Style.TEXT_WARNING_BOLD + `Could not open browser automatically: ${e instanceof Error ? e.message : String(e)}`)
+      UI.println(UI.Style.TEXT_NORMAL + `Open this URL manually: ${saved!.url}`)
+    })
 
     const headerLine = await new Promise<string>((resolve) => {
       const rl = createInterface({ input: process.stdin, output: process.stdout })

packages/codeplane/src/server/proxy.ts

@@ -63,6 +63,15 @@ const app = (upgrade: UpgradeWebSocket) =>
       const url = c.req.header("x-codeplane-proxy-url")
       const queue: Msg[] = []
       let remote: WebSocket | undefined
+      let closed = false
+      const closeRemote = () => {
+        if (closed) return
+        closed = true
+        if (remote && remote.readyState < WebSocket.CLOSING) {
+          remote.close()
+        }
+        remote = undefined
+      }
       return {
         onOpen(_, ws) {
           if (!url) {
@@ -82,7 +91,9 @@ const app = (upgrade: UpgradeWebSocket) =>
             ws.close(1011, "proxy error")
           }
           remote.onclose = (event) => {
-            ws.close(event.code, event.reason)
+            if (remote?.readyState !== WebSocket.CLOSED) {
+              ws.close(event.code, event.reason)
+            }
           }
         },
         onMessage(event) {
@@ -95,7 +106,7 @@ const app = (upgrade: UpgradeWebSocket) =>
           queue.push(data)
         },
         onClose(event) {
-          remote?.close(event.code, event.reason)
+          closeRemote()
         },
       }
     }),

packages/codeplane/src/server/routes/global.ts

@@ -497,7 +497,7 @@ export const GlobalRoutes = lazy(() =>
           return c.json({ ok: true as const, method: "reload" as const })
         } catch (error) {
           log.warn("restart dispose failed, falling back to process exit", { error })
-          setTimeout(() => process.exit(0), 500)
+          setTimeout(() => process.exit(0), 3000)
           return c.json({ ok: true as const, method: "exit" as const })
         }
       },
@@ -681,6 +681,13 @@ export const GlobalRoutes = lazy(() =>
         // but the in-process binary is unchanged. Exit so the container's restart
         // policy brings us back on the new binary. Delay so the response flushes.
         if (restart) {
+          GlobalBus.emit("event", {
+            directory: "global",
+            payload: {
+              type: GlobalDisposedEvent.type,
+              properties: {},
+            },
+          })
           setTimeout(() => process.exit(0), 3000)
         }
         return c.json({

packages/codeplane/src/server/routes/instance/session.ts

@@ -448,12 +448,18 @@ export const SessionRoutes = lazy(() =>
           // requeue a job the user just stopped.
           const queue = yield* PromptQueue.Service
           yield* queue.cancelSession(sessionID).pipe(Effect.catch(() => Effect.succeed(0)))
-          yield* svc.cancel(sessionID).pipe(Effect.catch(() => Effect.void))
+          yield* svc.cancel(sessionID)
           const todo = yield* Todo.Service
-          yield* todo.update({ sessionID, todos: [] }).pipe(Effect.catch(() => Effect.void))
-          yield* svc.recordError({ sessionID, error: aborted }).pipe(Effect.catch(() => Effect.void))
+          yield* todo.update({ sessionID, todos: [] }).pipe(
+            Effect.catch((e) => Effect.sync(() => log.warn("abort todo cleanup failed", { sessionID, error: e }))),
+          )
+          yield* svc.recordError({ sessionID, error: aborted }).pipe(
+            Effect.catch((e) => Effect.sync(() => log.warn("abort recordError failed", { sessionID, error: e }))),
+          )
           const status = yield* SessionStatus.Service
-          yield* status.set(sessionID, { type: "idle" }).pipe(Effect.catch(() => Effect.void))
+          yield* status.set(sessionID, { type: "idle" }).pipe(
+            Effect.catch((e) => Effect.sync(() => log.warn("abort status set failed", { sessionID, error: e }))),
+          )
           return true
         }),
     )
@@ -911,7 +917,11 @@ export const SessionRoutes = lazy(() =>
               svc.prompt({ ...body, sessionID } as unknown as SessionPrompt.PromptInput),
             ),
           )
-          void stream.write(JSON.stringify(msg))
+          try {
+            await stream.write(JSON.stringify(msg))
+          } catch {
+            // Client already disconnected; the prompt was processed server-side.
+          }
         })
       },
     )

packages/codeplane/src/server/server.ts

@@ -175,9 +175,11 @@ export async function listen(opts: {
   const server = await built.runtime.listen(opts)
   await cronSchedulerRuntime.runPromise((svc) => svc.start()).catch((err) => {
     log.error("failed to start cron scheduler", { error: err instanceof Error ? err.message : String(err) })
+    throw err
   })
   await promptQueueWorkerRuntime.runPromise((svc) => svc.start()).catch((err) => {
     log.error("failed to start prompt queue worker", { error: err instanceof Error ? err.message : String(err) })
+    throw err
   })
   UpdateChecker.start()
 

packages/codeplane/src/tui/routes/home.tsx

@@ -10,8 +10,6 @@ import { usePromptRef } from "../context/prompt"
 import { useLocal } from "../context/local"
 import { TuiPluginRuntime } from "@/tui/plugin/runtime"
 import { useTheme } from "../context/theme"
-
-let once = false
 const placeholder = {
   normal: ["Fix a TODO in the codebase", "What is the tech stack of this project?", "Fix broken tests"],
   shell: ["ls -la", "git status", "pwd"],
@@ -26,20 +24,21 @@ export function Home() {
   const args = useArgs()
   const local = useLocal()
   const { theme } = useTheme()
+  const [bound, setBound] = createSignal(false)
   let sent = false
 
   const bind = (r: PromptRef | undefined) => {
     setRef(r)
     promptRef.set(r)
-    if (once || !r) return
+    if (bound() || !r) return
     if (route.prompt) {
       r.set(route.prompt)
-      once = true
+      setBound(true)
       return
     }
     if (!args.prompt) return
     r.set({ input: args.prompt, parts: [] })
-    once = true
+    setBound(true)
   }
 
   // Wait for sync and model store to be ready before auto-submitting --prompt

packages/codeplane/src/tui/util/clipboard.ts

@@ -23,7 +23,7 @@ const getClipboardy = lazy(async () => {
  * the terminal emulator handle the clipboard locally.
  */
 function writeOsc52(text: string): void {
-  if (!process.stdout.isTTY && process.env["CODEPLANE_DISABLE_CLIPBOARD"] !== "1") return
+  if (!process.stdout.isTTY || process.env["CODEPLANE_DISABLE_CLIPBOARD"] === "1") return
   const base64 = Buffer.from(text).toString("base64")
   const osc52 = `\x1b]52;c;${base64}\x07`
   const passthrough = process.env["TMUX"] || process.env["STY"]

packages/codeplane/src/tui/worker.ts

@@ -48,10 +48,18 @@ process.on("uncaughtException", (e) => {
   })
 })
 
-// Subscribe to global events and forward them via RPC
-GlobalBus.on("event", (event) => {
-  Rpc.emit("global.event", event)
-})
+// Subscribe to global events and forward them via RPC.
+// Track the handler so it can be removed on shutdown to avoid leaking
+// listeners across reload cycles.
+let globalEventHandler: ((event: unknown) => void) | undefined
+globalEventHandler = (event: unknown) => {
+  try {
+    Rpc.emit("global.event", event)
+  } catch (error) {
+    console.error("[worker] global event forward failed", error)
+  }
+}
+GlobalBus.on("event", globalEventHandler)
 
 let server: Awaited<ReturnType<typeof Server.listen>> | undefined
 
@@ -106,6 +114,10 @@ export const rpc = {
 
     await InstanceRuntime.disposeAllInstances()
     if (server) await server.stop(true)
+    if (globalEventHandler) {
+      GlobalBus.off("event", globalEventHandler)
+      globalEventHandler = undefined
+    }
   },
 }