@adhdev/daemon-core 0.9.82-rc.378 → 0.9.82-rc.379

package/dist/providers/spec/fsm-driver.d.ts

@@ -2,6 +2,7 @@ import { type SpecPtyEvent } from './adapter.js';
 import type { PtyTransportFactory } from '../../cli-adapters/pty-transport.js';
 import { type TraceEntry } from './evaluator.js';
 import { type TransitionEval } from './fsm-evaluator.js';
+import { chunkPreservingSurrogates as chunkPreservingSurrogatesShared } from '../../cli-adapters/pty-write-chunking.js';
 export type DashboardEvent = {
     kind: 'pty_data';
     chunk: string;
@@ -155,10 +156,11 @@ export interface SpecDriverOpts {
     extraCliArgs?: string[];
 }
 export declare function resolveSubmitDelayMs(specBeforeSubmit: number | undefined, text: string): number;
-/** Split `text` into chunks of at most `size` UTF-16 units without ever cutting
- *  between a high and low surrogate (which would corrupt an astral char — emoji,
- *  etc. — on the UTF-8 PTY write). */
-export declare function chunkPreservingSurrogates(text: string, size: number): string[];
+/** Re-export of the shared surrogate-safe splitter so existing imports of
+ *  `chunkPreservingSurrogates` from this module keep working. The implementation
+ *  lives in ../../cli-adapters/pty-write-chunking so the spec driver and the
+ *  legacy adapter share one definition. */
+export declare const chunkPreservingSurrogates: typeof chunkPreservingSurrogatesShared;
 export declare function guessExt(mime: string): string;
 type HistoryEntry = DriverHistoryEntry;
 export declare class FsmDriver implements ISpecDriver {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@adhdev/daemon-core",
-  "version": "0.9.82-rc.378",
+  "version": "0.9.82-rc.379",
   "description": "ADHDev daemon core — CDP, IDE detection, providers, command execution",
   "main": "dist/index.js",
   "types": "dist/index.d.ts",
@@ -46,7 +46,7 @@
   "author": "vilmire",
   "license": "AGPL-3.0-or-later",
   "dependencies": {
-    "@adhdev/mesh-shared": "0.9.82-rc.378",
+    "@adhdev/mesh-shared": "0.9.82-rc.379",
     "@adhdev/session-host-core": "*",
     "@agentclientprotocol/sdk": "^0.16.1",
     "ajv": "^8.20.0",

package/src/cli-adapters/provider-cli-adapter.ts

@@ -27,6 +27,12 @@ import {
     type PtyRuntimeTransport,
     type PtyTransportFactory,
 } from './pty-transport.js';
+import {
+    WIN32_PTY_WRITE_CHUNK_CHARS,
+    WIN32_PTY_WRITE_CHUNK_GAP_MS,
+    chunkPreservingSurrogates,
+    shouldChunkWin32Write,
+} from './pty-write-chunking.js';
 import {
     buildCliScreenSnapshot,
     compactPromptText,
@@ -744,6 +750,11 @@ export class ProviderCliAdapter implements CliAdapter {
             `[${this.cliType}] Startup settled (${trigger}, stableMs=${stableMs}, modal=${!!startupModal}) providerDir=${this.providerResolutionMeta.providerDir || '-'} scriptDir=${this.providerResolutionMeta.scriptDir || '-'} scriptsPath=${this.providerResolutionMeta.scriptsPath || '-'}`
         );
         this.onStatusChange?.();
+        // Readiness barrier flush: a message queued because the session was not yet
+        // ready (sendMessageNow's not_ready_pending_prompt path) has no turn-completion
+        // event to trigger its flush. Now that the interactive prompt is up and we are
+        // idle, drain it. No-op when the queue is empty or we settled to a modal.
+        if (!startupModal) this.schedulePendingOutboundFlush();
     }
 
     private scheduleStartupSettleCheck(): void {
@@ -1153,9 +1164,42 @@ export class ProviderCliAdapter implements CliAdapter {
 
     private async writeToPty(data: string): Promise<void> {
         if (!this.ptyProcess) throw new Error(`${this.cliName} is not running`);
+        // win32 ConPTY paced write: a single unbounded write beyond ~1KB overflows
+        // the console input pipe and drops LEADING bytes (the "long message gets
+        // truncated, head lost / tail kept" failure). Split a large payload into
+        // bounded, surrogate-safe chunks written with a short gap so the console
+        // reader keeps up. Small payloads (the common case — short prompts, lone
+        // submit keys) still go out in a single write.
+        //
+        // The submit key, when present, is the TAIL of `data` (callers pass
+        // `body + sendKey` for the atomic-submit paths). Because we chunk the
+        // combined string, the submit key always rides in the SAME final write as
+        // the body's tail — the win32 invariant that ConPTY recognizes it as a
+        // submit — and is never emitted before the whole body has been written
+        // (no partial-body submit). Body-only writes (wait_for_echo strategy) have
+        // their submit key sent separately by the caller afterwards, unchanged.
+        if (process.platform === 'win32' && shouldChunkWin32Write(data.length)) {
+            await this.writeWin32Chunked(data);
+            return;
+        }
         await this.ptyProcess.write(data);
     }
 
+    /** Write `data` to the PTY in bounded, surrogate-safe chunks with a short
+     *  inter-chunk gap (win32 paced write). Awaits each chunk's write and the gap
+     *  so the returned promise resolves only after the FINAL chunk (carrying any
+     *  trailing submit key) has been written. */
+    private async writeWin32Chunked(data: string): Promise<void> {
+        const chunks = chunkPreservingSurrogates(data, WIN32_PTY_WRITE_CHUNK_CHARS);
+        for (let i = 0; i < chunks.length; i += 1) {
+            if (!this.ptyProcess) throw new Error(`${this.cliName} is not running`);
+            await this.ptyProcess.write(chunks[i]);
+            if (i + 1 < chunks.length) {
+                await new Promise<void>(resolve => setTimeout(resolve, WIN32_PTY_WRITE_CHUNK_GAP_MS));
+            }
+        }
+    }
+
     private resetPendingSendState(reason: string): void {
         this.responseBuffer = '';
         if (this.responseTimeout) { clearTimeout(this.responseTimeout); this.responseTimeout = null; }
@@ -1472,7 +1516,24 @@ export class ProviderCliAdapter implements CliAdapter {
                 LOG.info('CLI', `[${this.cliType}] sendMessage recovered idle prompt readiness`);
             }
         }
-        if (!this.ready) throw new Error(`${this.cliName} not ready (status: ${this.engine.currentStatus})`);
+        if (!this.ready) {
+            // Readiness barrier (queue-until-ready). A task dispatched the instant a
+            // freshly-spawned session is launched can arrive BEFORE the PTY prints its
+            // interactive prompt (this.ready flips ~2-6s later). Previously this threw
+            // "not ready" and the delegated-task delivery promise requeued the task,
+            // which on win32 raced the auto-launch cooldown and could strand the worker
+            // idle with no work (the "first big message lost" failure). Instead, when the
+            // caller allows queueing, BUFFER the message in the pending-outbound queue and
+            // return — the startup-settle path flips this.ready and flushes the queue once
+            // the prompt is actually up (see resolveStartupState → flushPendingOutboundQueue),
+            // so the message is delivered late rather than dropped. A non-queueable caller
+            // (e.g. an internal flush) still throws so it isn't silently swallowed.
+            if (allowQueue) {
+                this.enqueuePendingOutboundMessage(text, 'not_ready_pending_prompt');
+                return;
+            }
+            throw new Error(`${this.cliName} not ready (status: ${this.engine.currentStatus})`);
+        }
         const parsedSessionStatus = typeof parsedStatusBeforeSend?.status === 'string'
             ? String(parsedStatusBeforeSend.status)
             : '';

package/src/cli-adapters/pty-write-chunking.ts

@@ -0,0 +1,106 @@
+/**
+ * Shared win32 ConPTY paced-write chunking.
+ *
+ * A single unbounded ConPTY `write()` can overflow the console input pipe and
+ * drop LEADING bytes once the payload exceeds ~1KB — the "long task message gets
+ * truncated (head lost, tail kept)" failure. The fix is to split a large body
+ * into bounded chunks written with a short inter-chunk gap so the console input
+ * buffer keeps up. Small bodies still go out in a single write.
+ *
+ * This module is the SINGLE source of truth for the chunk size / gap / surrogate-
+ * safe split so the two write paths that need it — the spec FsmDriver
+ * (writeWin32Body) and the legacy ProviderCliAdapter (writeToPty / submit paths)
+ * — cannot drift apart and regress on one side (the original bug: "one branch
+ * patched, the other not").
+ */
+'use strict';
+
+// Defensive paced PTY write tuning. 1024 chars per chunk stays comfortably under
+// the ConPTY input-pipe threshold; an 8ms gap lets the console reader drain
+// between chunks without adding meaningful latency to a normal-sized prompt.
+export const WIN32_PTY_WRITE_CHUNK_CHARS = 1024;
+export const WIN32_PTY_WRITE_CHUNK_GAP_MS = 8;
+
+/** Split `text` into chunks of at most `size` UTF-16 units without ever cutting
+ *  between a high and low surrogate (which would corrupt an astral char — emoji,
+ *  etc. — on the UTF-8 PTY write). */
+export function chunkPreservingSurrogates(text: string, size: number): string[] {
+    const chunks: string[] = [];
+    let offset = 0;
+    while (offset < text.length) {
+        let end = Math.min(text.length, offset + size);
+        if (end < text.length) {
+            const code = text.charCodeAt(end - 1);
+            // Boundary lands on a high surrogate → pull back one so the pair stays
+            // together in the next chunk.
+            if (code >= 0xd800 && code <= 0xdbff) end -= 1;
+        }
+        if (end <= offset) end = Math.min(text.length, offset + size); // size 1 on a lone surrogate
+        chunks.push(text.slice(offset, end));
+        offset = end;
+    }
+    return chunks;
+}
+
+/** True when a body of `length` UTF-16 units should be paced into multiple
+ *  chunks on win32 rather than written in a single PTY write. */
+export function shouldChunkWin32Write(length: number): boolean {
+    return length > WIN32_PTY_WRITE_CHUNK_CHARS;
+}
+
+/**
+ * Drive a paced, surrogate-safe chunked write of `text` over a `write(chunk)`
+ * sink, calling `onChunkWritten` after each chunk (e.g. to advance an input-
+ * activity timestamp) and `onDone` once the final chunk is out. The optional
+ * `setTimer` lets the caller own the timer handle (so it can be cleared on
+ * shutdown) and supply a custom scheduler in tests; it defaults to setTimeout.
+ *
+ * Bodies at or below the chunk threshold are written in a SINGLE write — the
+ * common case — so this is a no-op pacing wrapper for normal-sized prompts.
+ *
+ * Returns the chunks that will be written (useful for assertions/logging).
+ */
+export interface PacedWin32WriteOptions {
+    write: (chunk: string) => void;
+    onChunkWritten?: () => void;
+    onDone?: () => void;
+    /** Schedule the next chunk; must return a handle the caller can clear.
+     *  Defaults to setTimeout. */
+    setTimer?: (fn: () => void, delayMs: number) => ReturnType<typeof setTimeout>;
+    /** Store the pending timer handle so the caller can clear it on shutdown. */
+    onTimer?: (handle: ReturnType<typeof setTimeout> | null) => void;
+    chunkChars?: number;
+    gapMs?: number;
+}
+
+export function writeWin32Paced(text: string, opts: PacedWin32WriteOptions): string[] {
+    const chunkChars = opts.chunkChars ?? WIN32_PTY_WRITE_CHUNK_CHARS;
+    const gapMs = opts.gapMs ?? WIN32_PTY_WRITE_CHUNK_GAP_MS;
+    const setTimer = opts.setTimer ?? ((fn, delayMs) => setTimeout(fn, delayMs));
+
+    if (text.length <= chunkChars) {
+        opts.onTimer?.(null);
+        opts.write(text);
+        opts.onChunkWritten?.();
+        opts.onDone?.();
+        return [text];
+    }
+
+    const chunks = chunkPreservingSurrogates(text, chunkChars);
+    let idx = 0;
+    const writeNext = (): void => {
+        opts.onTimer?.(null);
+        if (idx >= chunks.length) { opts.onDone?.(); return; }
+        opts.write(chunks[idx]);
+        opts.onChunkWritten?.();
+        idx += 1;
+        if (idx < chunks.length) {
+            const handle = setTimer(writeNext, gapMs);
+            opts.onTimer?.(handle);
+        } else {
+            opts.onDone?.();
+        }
+    };
+    writeNext();
+    return chunks;
+}

package/src/commands/med-family/mesh-crud.ts

@@ -314,8 +314,18 @@ export const meshCrudHandlers: Record<string, MedFamilyHandler> = {
                 }
             }
 
+            // Default worktree session cleanup ON: when the caller OMITS a mode and the
+            // node is a local worktree, default to 'stop_and_delete' instead of the mesh
+            // policy ('preserve' by default). A worktree's chat session has no reason to
+            // outlive the worktree's node + directory + branch, and leaving it on
+            // 'preserve' is what orphaned chats after a worktree remove. An explicit mode
+            // (including an explicit 'preserve') is always honored — only the OMITTED case
+            // changes, and only for worktrees. Base nodes keep arg ?? policy ?? preserve.
+            const explicitCleanupMode = args?.sessionCleanupMode ?? args?.session_cleanup_mode;
             const sessionCleanupMode = ctx.normalizeMeshSessionCleanupMode(
-                args?.sessionCleanupMode ?? args?.session_cleanup_mode ?? mesh?.policy?.sessionCleanupOnNodeRemove,
+                explicitCleanupMode
+                ?? (node?.isLocalWorktree === true ? 'stop_and_delete' : undefined)
+                ?? mesh?.policy?.sessionCleanupOnNodeRemove,
             );
             // Explicit sessionIds (e.g. supplied by refine auto-cleanup) bypass the
             // workspace-only-match guard so a delegate session that lacks a
@@ -423,12 +433,29 @@ export const meshCrudHandlers: Record<string, MedFamilyHandler> = {
             const residueWarning = worktreeCleanup?.residue === true && typeof worktreeCleanup?.residueWarning === 'string'
                 ? worktreeCleanup.residueWarning
                 : undefined;
+
+            // Orphan guard: if the session cleanup still left any LIVE session skipped
+            // (e.g. a future skip reason, or a workspace-only session on a base node),
+            // surface it at the top level so the caller knows a manual mesh_cleanup_sessions
+            // is still required for those sessionIds. Without this, a skipped-live session
+            // silently outlives a removed node (the very NODE-REMOVE-SESSION-ORPHAN bug).
+            const skippedLiveSessionIds = Array.isArray(sessionCleanup?.skippedLiveSessionIds)
+                ? (sessionCleanup!.skippedLiveSessionIds as unknown[]).filter((v): v is string => typeof v === 'string')
+                : [];
+            const orphanedSessionsRemaining = skippedLiveSessionIds.length > 0;
+            const orphanNextAction = orphanedSessionsRemaining
+                ? `Live session(s) [${skippedLiveSessionIds.join(', ')}] were skipped and still survive this node removal. `
+                    + `Run mesh_cleanup_sessions with mode:'stop_and_delete' and sessionIds:[${skippedLiveSessionIds.map(id => `'${id}'`).join(', ')}] to release them.`
+                : undefined;
             return {
                 success: true,
                 removed,
                 ...(residueWarning ? { residueWarning } : {}),
                 ...(sessionCleanup ? { sessionCleanup } : {}),
                 ...(worktreeCleanup ? { worktreeCleanup } : {}),
+                ...(orphanedSessionsRemaining
+                    ? { orphanedSessionsRemaining: true, nextAction: orphanNextAction }
+                    : {}),
             };
         } catch (e: any) {
             return { success: false, error: e.message };

package/src/commands/router.ts

@@ -1221,10 +1221,24 @@ export class DaemonCommandRouter {
             // Only the conservative shared-daemon guard for live sessions that are NOT a delegate
             // explicitly bound to this node. Delegate-bound live sessions fall through and are
             // stopped/deleted by the mode handlers below (which already record an intentional stop).
-            if (!hasExplicitSessionIds && liveRuntime && !delegateBoundToThisNode) {
+            //
+            // Worktree-removal exception: when a WORKTREE node is being removed
+            // (source === 'mesh_remove_node' AND node.isLocalWorktree === true), its
+            // node-binding is already gone, so a still-live session in that workspace
+            // matches by workspace ALONE (recordNodeId is empty). The shared-daemon
+            // concern does not apply — a worktree has a private workspace path that is
+            // not shared with the base/other nodes — so leaving it skipped orphans the
+            // chat after the node + worktree dir + branch are gone. Clean it instead.
+            // This narrowly covers ONLY the pure workspace-only-no-binding case; a
+            // session bound to ANOTHER node (recordNodeId set and != this node) is still
+            // skipped (live_delegate_bound_to_other_node), and the coordinator session is
+            // already protected unconditionally above.
+            const matchedByWorkspaceOnly = !recordNodeId;
+            const isWorktreeNodeRemoval = cleanupSource === 'mesh_remove_node' && args.node?.isLocalWorktree === true;
+            const cleanWorkspaceOnlyForWorktree = isWorktreeNodeRemoval && matchedByWorkspaceOnly;
+            if (!hasExplicitSessionIds && liveRuntime && !delegateBoundToThisNode && !cleanWorkspaceOnlyForWorktree) {
                 skippedSessionIds.push(sessionId);
                 skippedLiveSessionIds.push(sessionId);
-                const matchedByWorkspaceOnly = !recordNodeId;
                 const reason = recordNodeId && recordNodeId !== args.nodeId
                     ? `live_delegate_bound_to_other_node:${recordNodeId}`
                     : matchedByWorkspaceOnly
@@ -1233,6 +1247,11 @@ export class DaemonCommandRouter {
                 skippedLiveSessionReasons.push({ sessionId, reason });
                 continue;
             }
+            if (cleanWorkspaceOnlyForWorktree && !delegateBoundToThisNode) {
+                // A workspace-only live session on a worktree being removed is treated
+                // like a bound delegate for accounting (so callers can see it was acted on).
+                actedLiveDelegateSessionIds.push(sessionId);
+            }
             if (!hasExplicitSessionIds && liveRuntime && delegateBoundToThisNode && args.mode === 'delete_stopped') {
                 // delete_stopped never stops live runtimes by contract — even bound delegates.
                 // Surface a clear reason instead of an unexplained skip so callers know to use

package/src/mesh/mesh-queue-assignment.ts

@@ -133,6 +133,30 @@ interface DeliverTaskContext {
     sourceCoordinatorDaemonId?: string;
 }
 
+// Readiness barrier for the LOCAL auto-launch path. A just-spawned CLI session is
+// not interactive until its PTY prints the input prompt (the adapter flips
+// isReady() / settles to idle ~2-6s later). Poll the local adapter until it reports
+// ready (or idle), bounded by a generous timeout so a slow/contended boot still
+// lands, and a hard cap so a session that never becomes interactive doesn't block the
+// reconcile loop forever (the adapter's queue-until-ready path is the backstop then).
+const LOCAL_LAUNCH_READY_TIMEOUT_MS = 15_000;
+const LOCAL_LAUNCH_READY_POLL_MS = 100;
+
+async function waitForLocalSessionReady(components: DaemonComponents, sessionId: string): Promise<void> {
+    const adapter = components.cliManager?.adapters?.get(sessionId) as
+        | { isReady?: () => boolean; currentStatus?: string }
+        | undefined;
+    // No locally-resolvable adapter (e.g. a remote/forwarded session that somehow
+    // reached this branch) → nothing to wait on; let dispatch proceed.
+    if (!adapter || typeof adapter.isReady !== 'function') return;
+    const deadline = Date.now() + LOCAL_LAUNCH_READY_TIMEOUT_MS;
+    while (Date.now() < deadline) {
+        if (adapter.isReady() || adapter.currentStatus === 'idle') return;
+        await new Promise<void>(resolve => setTimeout(resolve, LOCAL_LAUNCH_READY_POLL_MS));
+    }
+    LOG.warn('MeshQueue', `Auto-launched session ${sessionId} not interactive after ${LOCAL_LAUNCH_READY_TIMEOUT_MS}ms; dispatching anyway (adapter queue-until-ready will buffer)`);
+}
+
 // CONS scope 3: the SINGLE source of truth for dispatching a claimed task to its
 // session. The remote (P2P dispatchMeshCommand) and local (cliManager.handleCliCommand)
 // branches differ ONLY in the transport call — the delivery record, the delivered/failed
@@ -1130,6 +1154,16 @@ async function maybeAutoLaunchOneQueueSession(components: DaemonComponents, mesh
                     return false;
                 }
                 markAutoLaunch(meshId, task.id, { status: 'completed', nodeId, providerType: resolved.providerType, sessionId });
+                // Readiness barrier: a freshly-spawned local CLI session is NOT yet
+                // interactive — its PTY prints the input prompt (and the adapter flips
+                // isReady()) only ~2-6s after launch. Dispatching the task immediately
+                // pushes the first (often large) message into a not-yet-ready PTY, which
+                // could throw "not ready" and bounce the task through requeue (on win32
+                // this raced the auto-launch cooldown and stranded the worker idle).
+                // Await interactive readiness before claiming/dispatching so the very
+                // first message lands cleanly. The adapter's queue-until-ready path is the
+                // backstop if readiness is reported late; this just avoids the churn.
+                await waitForLocalSessionReady(components, sessionId);
                 tryAssignQueueTask(components, meshId, nodeId, sessionId, resolved.providerType);
                 return true;
             } catch (e: any) {

package/src/providers/spec/fsm-driver.ts

@@ -38,6 +38,11 @@ import { loadFsmSpec } from './fsm-loader.js';
 import { applyPreLaunchTrust } from './pre-launch-trust.js';
 import type { Control, DelegateTrigger } from './types.js';
 import { LOG } from '../../logging/logger.js';
+import {
+    WIN32_PTY_WRITE_CHUNK_CHARS,
+    WIN32_PTY_WRITE_CHUNK_GAP_MS,
+    chunkPreservingSurrogates as chunkPreservingSurrogatesShared,
+} from '../../cli-adapters/pty-write-chunking.js';
 
 // ── Shared driver types (formerly in driver.ts) ───────────────────────────
 
@@ -169,12 +174,9 @@ const WIN32_SUBMIT_MAX_RESENDS = 14;
 // cadence while it waits for the body to echo.
 const WIN32_SUBMIT_SETTLE_MS = 500;
 const WIN32_SUBMIT_SETTLE_POLL_MS = 120;
-// Defensive paced PTY write. A single unbounded ConPTY write can overflow the
-// input pipe and drop leading bytes; split a large body into bounded chunks with a
-// short inter-chunk gap so the console input buffer keeps up. Small bodies still
-// write in one shot.
-const WIN32_PTY_WRITE_CHUNK_CHARS = 1024;
-const WIN32_PTY_WRITE_CHUNK_GAP_MS = 8;
+// Defensive paced PTY write tuning (WIN32_PTY_WRITE_CHUNK_CHARS / _GAP_MS) and the
+// surrogate-safe splitter now live in the shared pty-write-chunking module so this
+// driver and the legacy ProviderCliAdapter cannot drift apart — see the import above.
 // Echo-gate for the win32 FIRST submit CR (supersedes the bare output-quiet settle).
 // The body write can race claude-cli's boot — its stdin reader is not wired until the
 // composer renders (~5–7s in, later under load), so a too-early write is buffered and
@@ -202,26 +204,11 @@ export function resolveSubmitDelayMs(specBeforeSubmit: number | undefined, text:
     return Math.max(spec, SUBMIT_DELAY_FLOOR_MS + linesBonus);
 }
 
-/** Split `text` into chunks of at most `size` UTF-16 units without ever cutting
- *  between a high and low surrogate (which would corrupt an astral char — emoji,
- *  etc. — on the UTF-8 PTY write). */
-export function chunkPreservingSurrogates(text: string, size: number): string[] {
-    const chunks: string[] = [];
-    let offset = 0;
-    while (offset < text.length) {
-        let end = Math.min(text.length, offset + size);
-        if (end < text.length) {
-            const code = text.charCodeAt(end - 1);
-            // Boundary lands on a high surrogate → pull back one so the pair stays
-            // together in the next chunk.
-            if (code >= 0xd800 && code <= 0xdbff) end -= 1;
-        }
-        if (end <= offset) end = Math.min(text.length, offset + size); // size 1 on a lone surrogate
-        chunks.push(text.slice(offset, end));
-        offset = end;
-    }
-    return chunks;
-}
+/** Re-export of the shared surrogate-safe splitter so existing imports of
+ *  `chunkPreservingSurrogates` from this module keep working. The implementation
+ *  lives in ../../cli-adapters/pty-write-chunking so the spec driver and the
+ *  legacy adapter share one definition. */
+export const chunkPreservingSurrogates = chunkPreservingSurrogatesShared;
 
 export function guessExt(mime: string): string {
     if (/png/i.test(mime)) return '.png';