Harden client and WebSocket proxy

start-server.js

@@ -8,15 +8,16 @@ const __dirname = dirname(fileURLToPath(import.meta.url));
 console.log('Starting WebSocket server');
 const wsServer = spawn('node', ['src/websocket-server.js'], {
   stdio: 'inherit',
-  shell: true,
+  shell: false,
   cwd: __dirname
 });
 
 // Start the SvelteKit dev server
 console.log('Starting SvelteKit dev server');
-const sveltekit = spawn('npm', ['run', 'dev'], {
+const npmCommand = process.platform === 'win32' ? 'npm.cmd' : 'npm';
+const sveltekit = spawn(npmCommand, ['run', 'dev'], {
   stdio: 'inherit',
-  shell: true,
+  shell: false,
   cwd: __dirname
 });
 
@@ -41,4 +42,4 @@ process.on('SIGTERM', () => {
   wsServer.kill('SIGTERM');
   sveltekit.kill('SIGTERM');
   process.exit(0);
-});
+});