fix(cli): skip non-shell parent processes in shell detection

When run via npx, ps -o comm= returns the npm command (e.g.
'npm exec termbeam@latest') instead of a real shell. This was
passed directly to node-pty, causing posix_spawnp to fail.

Now validates the detected parent process looks like a real shell
(no spaces, not npm/node) and falls back to $SHELL or /bin/sh.

Also adds e2e tests for CLI banner output and invalid shell
rejection.

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

Author: dorlugasigal

src/cli.js

@@ -76,7 +76,10 @@ function getWindowsAncestors(startPid, maxDepth = 4) {
       if (cols.length <= Math.max(nameIdx, pidIdx, ppidIdx)) continue;
       const pid = parseInt(cols[pidIdx], 10);
       if (Number.isFinite(pid)) {
-        processes.set(pid, { name: cols[nameIdx].trim().toLowerCase(), ppid: parseInt(cols[ppidIdx], 10) });
+        processes.set(pid, {
+          name: cols[nameIdx].trim().toLowerCase(),
+          ppid: parseInt(cols[ppidIdx], 10),
+        });
       }
     }
 
@@ -137,8 +140,14 @@ function getDefaultShell() {
     const comm = result.trim();
     if (comm) {
       const shell = comm.startsWith('-') ? comm.slice(1) : comm;
-      log.debug(`Detected parent shell: ${shell}`);
-      return shell;
+      log.debug(`Detected parent process: ${shell}`);
+      // Validate it looks like a real shell (single token, no spaces)
+      // When run via npx, comm can be "npm exec ..." which is not a shell
+      if (!shell.includes(' ') && !shell.startsWith('npm') && !shell.startsWith('node')) {
+        log.debug(`Using detected shell: ${shell}`);
+        return shell;
+      }
+      log.debug(`Parent process "${shell}" is not a shell, falling back`);
     }
   } catch (err) {
     log.debug(`Could not detect parent shell: ${err.message}`);
@@ -157,10 +166,16 @@ function parseArgs() {
   // Resolve log level early (env + args) so shell detection logs are visible
   let logLevel = process.env.TERMBEAM_LOG_LEVEL || 'info';
   for (const arg of process.argv.slice(2)) {
-    if (arg.startsWith('--log-level=')) { logLevel = arg.split('=')[1]; break; }
+    if (arg.startsWith('--log-level=')) {
+      logLevel = arg.split('=')[1];
+      break;
+    }
   }
   for (let i = 2; i < process.argv.length; i++) {
-    if (process.argv[i] === '--log-level' && process.argv[i + 1]) { logLevel = process.argv[i + 1]; break; }
+    if (process.argv[i] === '--log-level' && process.argv[i + 1]) {
+      logLevel = process.argv[i + 1];
+      break;
+    }
   }
   log.setLevel(logLevel);
 
@@ -227,7 +242,19 @@ function parseArgs() {
   const { getVersion } = require('./version');
   const version = getVersion();
 
-  return { port, host, password, useTunnel, persistedTunnel, shell, shellArgs, cwd, defaultShell, version, logLevel };
+  return {
+    port,
+    host,
+    password,
+    useTunnel,
+    persistedTunnel,
+    shell,
+    shellArgs,
+    cwd,
+    defaultShell,
+    version,
+    logLevel,
+  };
 }
 
 module.exports = { parseArgs, printHelp };

test/integration.test.js

@@ -1,6 +1,8 @@
 const { describe, it, after } = require('node:test');
 const assert = require('node:assert');
 const http = require('http');
+const { spawn } = require('child_process');
+const path = require('path');
 const WebSocket = require('ws');
 const { createTermBeamServer } = require('../src/server');
 
@@ -59,8 +61,14 @@ function waitForOpen(ws, timeout = 5000) {
   return new Promise((resolve, reject) => {
     if (ws.readyState === WebSocket.OPEN) return resolve();
     const timer = setTimeout(() => reject(new Error('WebSocket open timeout')), timeout);
-    ws.on('open', () => { clearTimeout(timer); resolve(); });
-    ws.on('error', (err) => { clearTimeout(timer); reject(err); });
+    ws.on('open', () => {
+      clearTimeout(timer);
+      resolve();
+    });
+    ws.on('error', (err) => {
+      clearTimeout(timer);
+      reject(err);
+    });
   });
 }
 
@@ -117,7 +125,10 @@ describe('Integration', () => {
           port: inst.port,
           path: '/api/auth',
           method: 'POST',
-          headers: { 'Content-Type': 'application/json', 'Content-Length': Buffer.byteLength(authBody) },
+          headers: {
+            'Content-Type': 'application/json',
+            'Content-Length': Buffer.byteLength(authBody),
+          },
         },
         authBody,
       );
@@ -176,7 +187,11 @@ describe('Integration', () => {
 
       // Send input and wait for output containing the echo marker
       const marker = `helloTB${Date.now()}`;
-      const outputPromise = waitForMessage(ws, (m) => m.type === 'output' && m.data.includes(marker), 15000);
+      const outputPromise = waitForMessage(
+        ws,
+        (m) => m.type === 'output' && m.data.includes(marker),
+        15000,
+      );
       ws.send(JSON.stringify({ type: 'input', data: `echo ${marker}\r` }));
       const outputMsg = await outputPromise;
       assert.ok(outputMsg.data.includes(marker), 'Output should contain the echoed marker');
@@ -235,7 +250,10 @@ describe('Integration', () => {
           port: inst.port,
           path: '/api/sessions',
           method: 'POST',
-          headers: { 'Content-Type': 'application/json', 'Content-Length': Buffer.byteLength(createBody) },
+          headers: {
+            'Content-Type': 'application/json',
+            'Content-Length': Buffer.byteLength(createBody),
+          },
         },
         createBody,
       );
@@ -277,7 +295,10 @@ describe('Integration', () => {
             resolve();
           }
         }, 100);
-        setTimeout(() => { clearInterval(poll); resolve(); }, 5000);
+        setTimeout(() => {
+          clearInterval(poll);
+          resolve();
+        }, 5000);
       });
 
       // GET /api/sessions should only have the default session
@@ -334,7 +355,10 @@ describe('Integration', () => {
             port: inst.port,
             path: '/api/auth',
             method: 'POST',
-            headers: { 'Content-Type': 'application/json', 'Content-Length': Buffer.byteLength(wrongBody) },
+            headers: {
+              'Content-Type': 'application/json',
+              'Content-Length': Buffer.byteLength(wrongBody),
+            },
           },
           wrongBody,
         );
@@ -348,11 +372,91 @@ describe('Integration', () => {
           port: inst.port,
           path: '/api/auth',
           method: 'POST',
-          headers: { 'Content-Type': 'application/json', 'Content-Length': Buffer.byteLength(wrongBody) },
+          headers: {
+            'Content-Type': 'application/json',
+            'Content-Length': Buffer.byteLength(wrongBody),
+          },
         },
         wrongBody,
       );
       assert.strictEqual(res6.statusCode, 429, '6th attempt should be rate limited');
     });
   });
+
+  describe('CLI entry point produces output (npx simulation)', () => {
+    it('should print the banner when invoked via a wrapper script', async () => {
+      const entryPoint = path.resolve(__dirname, '..', 'bin', 'termbeam.js');
+      const output = await new Promise((resolve, reject) => {
+        let buf = '';
+        const child = spawn(process.execPath, [entryPoint, '--no-tunnel', '--no-password'], {
+          env: { ...process.env, TERMBEAM_LOG_LEVEL: 'error', PORT: '0' },
+          stdio: ['ignore', 'pipe', 'pipe'],
+        });
+        child.stdout.on('data', (d) => {
+          buf += d;
+        });
+        child.stderr.on('data', (d) => {
+          buf += d;
+        });
+        const timer = setTimeout(() => {
+          child.kill('SIGTERM');
+          resolve(buf);
+        }, 5000);
+        child.on('error', (err) => {
+          clearTimeout(timer);
+          reject(err);
+        });
+        child.on('exit', () => {
+          clearTimeout(timer);
+          resolve(buf);
+        });
+      });
+      assert.ok(
+        output.includes('Beam your terminal') || output.includes('TERMBEAM'),
+        'Should print banner, got: ' + output.slice(0, 200),
+      );
+    });
+  });
+
+  describe('Server rejects invalid shell and falls back gracefully', () => {
+    let inst;
+    after(() => inst?.shutdown());
+
+    it('should start even when defaultShell is an invalid process name', async () => {
+      // Simulate the npx bug: defaultShell is garbage but shell is a real shell
+      inst = await startServer({
+        defaultShell: 'npm exec termbeam@latest --log-level=debug',
+      });
+      const res = await httpRequest({
+        hostname: '127.0.0.1',
+        port: inst.port,
+        path: '/api/sessions',
+        method: 'GET',
+      });
+      assert.strictEqual(res.statusCode, 200);
+      const sessions = JSON.parse(res.data);
+      assert.ok(sessions.length >= 1, 'Should have at least one session');
+    });
+
+    it('POST /api/sessions with invalid shell should return 400', async () => {
+      if (!inst) inst = await startServer();
+      const body = JSON.stringify({ name: 'bad', shell: 'npm exec termbeam' });
+      const res = await httpRequest(
+        {
+          hostname: '127.0.0.1',
+          port: inst.port,
+          path: '/api/sessions',
+          method: 'POST',
+          headers: {
+            'Content-Type': 'application/json',
+            'Content-Length': Buffer.byteLength(body),
+          },
+        },
+        body,
+      );
+      assert.strictEqual(res.statusCode, 400);
+      const data = JSON.parse(res.data);
+      assert.strictEqual(data.error, 'Invalid shell');
+    });
+  });
 });