@hienlh/ppm 0.23.21 → 0.23.23

package/src/server/routes/design-preview.ts

@@ -51,8 +51,8 @@ export function createDesignPreviewRoutes(now: () => number = Date.now) {
   const api = new Hono();
   const content = new Hono();
 
-  // The app's global `cors()` answers `*`, and Hono copies headers set before a handler over
-  // the handler's own response, so the value set below would be lost. Re-assert it after.
+  // Every response here must say `null`, error pages included; asserted after the handler so
+  // it holds whatever an inner layer set. The app's CORS layer leaves an existing value alone.
   content.use("*", async (c, next) => {
     await next();
     c.res.headers.set("Access-Control-Allow-Origin", "null");

package/src/server/routes/settings.ts

@@ -314,6 +314,22 @@ settingsRoutes.get("/ai/providers/:id/models", async (c) => {
   }
 });
 
+/**
+ * GET /settings/ai/providers/:id/effort-status — what overrides the default effort outside PPM for
+ * every project: the user settings and the environment PPM runs in. A project's own settings can
+ * add more, which the chat's picker reports. `status` is null for a provider nothing overrides.
+ */
+settingsRoutes.get("/ai/providers/:id/effort-status", (c) => {
+  const id = c.req.param("id");
+  const provider = providerRegistry.get(id);
+  if (!provider) return c.json(err(`Provider "${id}" not found`), 404);
+  try {
+    return c.json(ok({ status: provider.estimateEffortStatus?.(undefined, c.req.query("model") || undefined) ?? null }));
+  } catch (e) {
+    return c.json(err((e as Error).message), 500);
+  }
+});
+
 // ── Keybindings ──────────────────────────────────────────────────────
 
 const KEYBINDINGS_KEY = "keybindings";

package/src/server/ws/chat-effort-status.ts

@@ -0,0 +1,73 @@
+/**
+ * The effort a chat's turns really run at, kept beside the pick.
+ *
+ * PPM starts the CLI with the picked `--effort`, but `CLAUDE_CODE_EFFORT_LEVEL` (in the
+ * environment or a settings file's `env`), a `maxEffortLevel` cap, an organization limit and the
+ * model itself all outrank it there. So the session's CLI is asked at the start of every turn —
+ * a settings file edited since the last one shows up there too — and its answer goes to the
+ * clients. Before any turn has asked, what the settings files say stands in.
+ */
+import { effortInEffect, effortSettingPlace, type EffortStatus } from "../../shared/effort-status.ts";
+
+export interface EffortStatusSession {
+  providerId: string;
+  projectPath?: string;
+  /** The CLI's last answer for this session. */
+  effortStatus?: EffortStatus;
+}
+
+export interface EffortStatusProvider {
+  readEffortStatus?(sessionId: string): Promise<EffortStatus | null>;
+  estimateEffortStatus?(projectPath: string | undefined, model?: string): EffortStatus;
+}
+
+/** What a greeting carries: the CLI's answer, else the settings files; null for a provider nothing overrides. */
+export function sessionEffortStatus(
+  provider: EffortStatusProvider | undefined,
+  session: EffortStatusSession,
+  model: string | undefined,
+): EffortStatus | null {
+  return session.effortStatus ?? provider?.estimateEffortStatus?.(session.projectPath, model) ?? null;
+}
+
+/** The session log's line for a turn whose effort is not the one it was started with. */
+export function effortOverrideLogLine(status: EffortStatus): string | null {
+  const { observed } = status;
+  if (!observed?.requested) return null;
+  const { level, reason } = effortInEffect(observed.requested, status);
+  if (!reason) return null;
+  const by = reason === "env" && status.env
+    ? `CLAUDE_CODE_EFFORT_LEVEL=${status.env.value} in ${effortSettingPlace(status.env)}`
+    : reason === "cap" && status.cap
+      ? `maxEffortLevel ${status.cap.value} in ${effortSettingPlace(status.cap)}`
+      : `what ${observed.model ?? "the model"} allows`;
+  return `Effort ${observed.requested} was picked; Claude Code sends ${level ?? "no effort"} (${by})`;
+}
+
+/**
+ * Ask the session's CLI at a turn's start, and tell the clients when its answer changed. Never
+ * rejects: it runs unawaited beside the turn, where a rejection would reach the server's
+ * fatal-error handler for what is only a label.
+ */
+export async function refreshEffortStatus(p: {
+  sessionId: string;
+  session: EffortStatusSession;
+  provider: EffortStatusProvider | undefined;
+  /** False once the session's entry was replaced while the CLI was answering. */
+  isCurrent: () => boolean;
+  broadcast: (event: unknown) => void;
+  log: (line: string) => void;
+}): Promise<void> {
+  try {
+    const status = await p.provider?.readEffortStatus?.(p.sessionId);
+    if (!status || !p.isCurrent()) return;
+    const before = p.session.effortStatus;
+    p.session.effortStatus = status;
+    if (before && JSON.stringify(before) === JSON.stringify(status)) return;
+    p.broadcast({ type: "effort_status", status });
+    const line = effortOverrideLogLine(status);
+    if (line) p.log(line);
+  } catch {
+    // The status stays as it was; the next turn asks again.
+  }
+}

package/src/server/ws/chat.ts

@@ -24,6 +24,8 @@ import { isAsyncAgentLaunchAck, isTerminalAgentStatus } from "../../shared/backg
 import { cacheReleaseDelayMs, selectWarmIdleEvictions } from "../../services/subprocess-retention.ts";
 import { needsAuthServerNames } from "../../services/mcp-oauth/mcp-oauth-redirect.ts";
 import { mcpStatusEvent, registerMcpSignInSync } from "./chat-mcp-sign-in-sync.ts";
+import { refreshEffortStatus, sessionEffortStatus } from "./chat-effort-status.ts";
+import type { EffortStatus } from "../../shared/effort-status.ts";
 import { claudeTranscriptExists } from "../../services/claude-transcript-exists.ts";
 import { registerMemoryGauge } from "../../services/memory-diagnostics.ts";
 import { setTabOpenDelivery, tabOpenBroker } from "../../services/tab-tools-mcp/tab-open-broker.ts";
@@ -114,6 +116,11 @@ function resolveSessionEffort(sessionId: string): string | undefined {
   return getSessionEffort(sessionId) ?? sessionProviderConfig(sessionId)?.effort;
 }
 
+/** What overrides the effort shown in session_state, if anything does. */
+function resolveEffortStatus(sessionId: string, entry: SessionEntry): EffortStatus | null {
+  return sessionEffortStatus(providerRegistry.get(entry.providerId), entry, resolveSessionModel(sessionId));
+}
+
 /** Whether thinking is effectively ON: per-session override wins, else provider config, else SDK default. */
 function resolveSessionThinkingEnabled(sessionId: string): boolean {
   return isThinkingEnabled(
@@ -196,6 +203,8 @@ interface SessionEntry {
   compactStatus?: "compacting" | null;
   /** MCP servers the subprocess reported as `needs-auth` at init — drives the chat's sign-in bar */
   mcpNeedsAuth?: string[];
+  /** What the subprocess said at the last turn's start about the effort it sends — see chat-effort-status.ts */
+  effortStatus?: EffortStatus;
   /** toolUseIds of Bash/Agent calls launched with run_in_background — their spy outlives the tool_result */
   backgroundToolUseIds?: Set<string>;
   /** Nested-agent children buffered into turnEvents this turn (see MAX_NESTED_TURN_EVENTS) */
@@ -957,9 +966,20 @@ async function startSessionConsumer(sessionId: string, providerId: string, conte
       // System events → transition connecting → thinking, forward compact events
       if (evType === "system") {
         const sub = (ev as any).subtype;
-        if (sub === "init" && Array.isArray(ev.mcpServers)) {
-          entry.mcpNeedsAuth = needsAuthServerNames(ev.mcpServers);
-          broadcast(sessionId, mcpStatusEvent(entry.mcpNeedsAuth));
+        if (sub === "init") {
+          if (Array.isArray(ev.mcpServers)) {
+            entry.mcpNeedsAuth = needsAuthServerNames(ev.mcpServers);
+            broadcast(sessionId, mcpStatusEvent(entry.mcpNeedsAuth));
+          }
+          // Not awaited: the turn goes on while the CLI answers.
+          void refreshEffortStatus({
+            sessionId,
+            session: entry,
+            provider: providerRegistry.get(entry.providerId),
+            isCurrent: () => activeSessions.get(sessionId) === entry,
+            broadcast: (event) => broadcast(sessionId, event),
+            log: (line) => logSessionEvent(sessionId, "INFO", line),
+          });
         } else if (sub === "compacting") {
           entry.compactStatus = "compacting";
           log.debug(`session=${sessionId} compact_status=compacting (persisted on entry)`);
@@ -1196,6 +1216,9 @@ async function startSessionConsumer(sessionId: string, providerId: string, conte
         const stopped = turnStop ? describeTurnStop(turnStop) : null;
 
         const finalText = entry.finalText;
+        // The consumer outlives the turn (Claude pushes a follow-up into the same stream), so
+        // the next turn's answer must not start with this one's.
+        entry.finalText = undefined;
         import("../../services/notification.service.ts").then(({ notificationService }) => {
           const project = entry.projectName || "Project";
           const session = chatService.getSession(sessionId);
@@ -1385,6 +1408,7 @@ export const chatWebSocket = {
         mcpNeedsAuth: existing.mcpNeedsAuth ?? [],
         model: resolveSessionModel(sessionId),
         effort: resolveSessionEffort(sessionId),
+        effortStatus: resolveEffortStatus(sessionId, existing),
         thinking: resolveSessionThinkingEnabled(sessionId),
         promptCache: promptCacheSnapshot(sessionId, existing),
         turnStop: existing.phase === "idle" ? lastTurnStop(sessionId) : null,
@@ -1554,6 +1578,7 @@ export const chatWebSocket = {
         mcpNeedsAuth: entry.mcpNeedsAuth ?? [],
         model: resolveSessionModel(sessionId),
         effort: resolveSessionEffort(sessionId),
+        effortStatus: resolveEffortStatus(sessionId, entry),
         thinking: resolveSessionThinkingEnabled(sessionId),
         promptCache: promptCacheSnapshot(sessionId, entry),
         turnStop: entry.phase === "idle" ? lastTurnStop(sessionId) : null,
@@ -1776,6 +1801,8 @@ export const chatWebSocket = {
       }
       entry.model = parsed.model;
       setSessionModel(sessionId, parsed.model);
+      // Its levels and limits were the old model's; the settings files stand in until the next turn asks.
+      entry.effortStatus = undefined;
       const provider = providerRegistry.get(providerId);
       const hasLiveStream = provider?.hasStreamingSession?.(sessionId) ?? false;
       // Only abort when idle between turns — never interrupt an active turn.
@@ -1795,6 +1822,7 @@ export const chatWebSocket = {
         mcpNeedsAuth: entry.mcpNeedsAuth ?? [],
         model: resolveSessionModel(sessionId),
         effort: resolveSessionEffort(sessionId),
+        effortStatus: resolveEffortStatus(sessionId, entry),
         thinking: resolveSessionThinkingEnabled(sessionId),
       }));
     } else if (parsed.type === "set_effort") {
@@ -1822,6 +1850,7 @@ export const chatWebSocket = {
         mcpNeedsAuth: entry.mcpNeedsAuth ?? [],
         model: resolveSessionModel(sessionId),
         effort: resolveSessionEffort(sessionId),
+        effortStatus: resolveEffortStatus(sessionId, entry),
         thinking: resolveSessionThinkingEnabled(sessionId),
       }));
     } else if (parsed.type === "set_thinking") {
@@ -1843,6 +1872,7 @@ export const chatWebSocket = {
         mcpNeedsAuth: entry.mcpNeedsAuth ?? [],
         model: resolveSessionModel(sessionId),
         effort: resolveSessionEffort(sessionId),
+        effortStatus: resolveEffortStatus(sessionId, entry),
         thinking: resolveSessionThinkingEnabled(sessionId),
       }));
     } else if (parsed.type === "cancel") {

package/src/services/compact-segment.ts

@@ -19,6 +19,7 @@
 import { statSync } from "node:fs";
 import type { ChatMessage } from "../types/chat.ts";
 import { parseJsonlTranscript } from "./jsonl-transcript-parser.ts";
+import { readFileChunks } from "./file-chunks.ts";
 
 /**
  * How many bytes one expand may parse.
@@ -90,26 +91,20 @@ export async function compactSegmentWindow(filePath: string, beforeUuid?: string
   // instead would copy a long record once per chunk it spans.
   const pending: Uint8Array[] = [];
   let at = 0; // file offset of the first pending byte
-  const reader = Bun.file(filePath).stream().getReader();
-  try {
-    for (;;) {
-      const { done, value } = await reader.read();
-      if (done) break;
-      const lastNewline = value.lastIndexOf(NEWLINE);
-      if (lastNewline === -1) {
-        pending.push(value);
-        continue;
-      }
-      const lines = Buffer.concat([...pending, value.subarray(0, lastNewline + 1)]);
-      const stop = scan(lines, at);
-      if (stop !== undefined) return window(stop);
-      at += lines.length;
-      pending.length = 0;
-      pending.push(value.subarray(lastNewline + 1));
+  // Not `Bun.file().stream()`, which keeps about the file's size in native memory per read
+  // (see `file-chunks.ts`). Returning mid-loop closes the file.
+  for await (const value of readFileChunks(filePath)) {
+    const lastNewline = value.lastIndexOf(NEWLINE);
+    if (lastNewline === -1) {
+      pending.push(value);
+      continue;
     }
-  } finally {
-    // Not only `releaseLock`: a stream let go of before its end keeps the file open.
-    await reader.cancel().catch(() => {});
+    const lines = Buffer.concat([...pending, value.subarray(0, lastNewline + 1)]);
+    const stop = scan(lines, at);
+    if (stop !== undefined) return window(stop);
+    at += lines.length;
+    pending.length = 0;
+    pending.push(value.subarray(lastNewline + 1));
   }
   // A last line with no newline yet is still a record the full parse would read.
   const stop = scan(Buffer.concat(pending), at);

package/src/services/database/grid-export-tickets.ts

@@ -15,8 +15,12 @@ import { GRID_EXPORT_TICKET_TTL_MS } from "../../shared/db-grid-export.ts";
 export interface ExportDownload {
   fileName: string;
   contentType: string;
-  /** The file, read from the database as it is sent. */
-  open(): ReadableStream<Uint8Array>;
+  /**
+   * The file, read from the database as it is sent — or, for a file already on disk, the file
+   * itself: a `Bun.file` body is sent by Bun directly, where `Bun.file().stream()` keeps about the
+   * file's size in native memory per download (see `file-chunks.ts`).
+   */
+  open(): ReadableStream<Uint8Array> | Blob;
   /** Lets go of the rows and the connection, when the download never starts. */
   abandon(): void;
 }

package/src/services/database/impexp/readers/file-text.ts

@@ -3,6 +3,7 @@
  * order mark, or UTF-16 with one — what PPM's "CSV for Excel" writes. Bytes that are not text in
  * that encoding fail the read: turned into "�" they would be imported as a different value.
  */
+import { readFileChunks } from "../../../file-chunks.ts";
 
 /** The encoding the first bytes name, and how many of them the mark takes. */
 function encodingOf(head: Uint8Array): { encoding: "utf-8" | "utf-16le" | "utf-16be"; skip: number } {
@@ -30,7 +31,9 @@ function notText(encoding: string): FileTextError {
 
 /** The text of the file at `path`, in pieces as it is read. Stop ends it between two pieces. */
 export async function* fileText(path: string, signal?: AbortSignal): AsyncGenerator<string> {
-  const reader = Bun.file(path).stream().getReader();
+  // Not `Bun.file().stream()`, which keeps about the file's size in native memory per read
+  // (see `file-chunks.ts`) — an import file can be hundreds of MB.
+  const chunks = readFileChunks(path);
   let decoder: TextDecoder | null = null;
   let encoding = "utf-8";
   let head: Uint8Array = new Uint8Array(0);
@@ -55,7 +58,7 @@ export async function* fileText(path: string, signal?: AbortSignal): AsyncGenera
         sliceStart = performance.now();
       }
       signal?.throwIfAborted();
-      const { done, value } = await reader.read();
+      const { done, value } = await chunks.next();
       if (done) break;
       let bytes: Uint8Array = value;
       if (!decoder) {
@@ -75,6 +78,6 @@ export async function* fileText(path: string, signal?: AbortSignal): AsyncGenera
     if (rest) yield rest;
   } finally {
     // Read to its end or not, the file is closed.
-    await reader.cancel().catch(() => {});
+    await chunks.return(undefined).catch(() => {});
   }
 }

package/src/services/edge-forwarder.ts

@@ -21,6 +21,7 @@
 import net from "node:net";
 import { resolveTargetPort, _resetTargetCache } from "./edge-target-resolver.ts";
 import { createLogger, installFileLogSink } from "./logger.ts";
+import { registerMemoryGauge, startMemoryDiagnostics } from "./memory-diagnostics.ts";
 
 const log = createLogger("edge");
 
@@ -42,6 +43,12 @@ const CONNECT_WINDOW_MS = 5000;
 
 const sleep = (ms: number) => new Promise((r) => setTimeout(r, ms));
 
+/** Client connections open right now, and ever: the memory watchdog's view of the edge's load. */
+let openConnections = 0;
+let totalConnections = 0;
+registerMemoryGauge("edge.openConnections", () => openConnections);
+registerMemoryGauge("edge.totalConnections", () => totalConnections);
+
 /** At most one warning a minute about connections dropped for want of a server. */
 const DROP_WARN_INTERVAL_MS = 60_000;
 let droppedSinceWarning = 0;
@@ -201,6 +208,9 @@ export function startEdgeForwarder(
     // allowHalfOpen keeps the other direction alive when one side sends FIN —
     // long-lived chat WS and SSE streams depend on it.
     const server = net.createServer({ allowHalfOpen: true }, (client) => {
+      openConnections++;
+      totalConnections++;
+      client.once("close", () => { openConnections--; });
       void handleConnection(client, connectWindowMs);
     });
     server.once("error", reject);
@@ -218,6 +228,8 @@ if (process.argv.includes("__edge__")) {
   // Lines go to ppm.log with a timestamp and level like every other process's. The
   // supervisor hands the log over as stderr, so the stderr echo is skipped (see logger.ts).
   installFileLogSink({ echo: "stderr" });
+  // Reads memory through the OS only: it spawns nothing, so the invariant above holds.
+  startMemoryDiagnostics({ role: "edge" });
   const idx = process.argv.indexOf("__edge__");
   const publicPort = parseInt(process.argv[idx + 1] ?? "", 10);
   const host = process.argv[idx + 2] ?? "0.0.0.0";

package/src/services/file-chunks.ts

@@ -0,0 +1,39 @@
+import { open } from "node:fs/promises";
+
+/**
+ * A file's bytes, a piece at a time, through `node:fs/promises` — never `Bun.file().stream()`.
+ *
+ * On Bun 1.3.10 (Windows), every full read through `Bun.file(path).stream()` keeps roughly the
+ * file's size in native memory that is never handed back: a 30 MB transcript read 40 times took
+ * a process from 377 MB to 1,949 MB private, 38 MB a read, with the JS heap back at 18 MB. A
+ * chat tab opening reads the whole transcript this way (`readCompactions`), so a server whose
+ * tabs reconnected all day reached 25 GB committed and the machine ran out of memory. The same
+ * 40 reads through a `FileHandle` stayed flat (0.1 MB a read); so did `createReadStream` and
+ * `readSync`. Measured as private bytes (commit charge), which RSS and the heap both hide.
+ *
+ * Each chunk is a fresh buffer, so a caller may keep it after asking for the next one. Breaking
+ * out of the loop closes the file (the generator's `finally`), so an early stop leaks no handle.
+ *
+ * `fromByte` is inclusive, `toByte` exclusive; both are absolute offsets.
+ */
+export async function* readFileChunks(
+  filePath: string,
+  opts: { fromByte?: number; toByte?: number; chunkBytes?: number } = {},
+): AsyncGenerator<Uint8Array> {
+  const chunkBytes = opts.chunkBytes ?? 512 * 1024;
+  let position = Math.max(0, opts.fromByte ?? 0);
+  const end = opts.toByte ?? Infinity;
+  const handle = await open(filePath, "r");
+  try {
+    while (position < end) {
+      const want = Math.min(chunkBytes, end - position);
+      const buf = new Uint8Array(want);
+      const { bytesRead } = await handle.read(buf, 0, want, position);
+      if (bytesRead === 0) break;
+      position += bytesRead;
+      yield bytesRead === want ? buf : buf.subarray(0, bytesRead);
+    }
+  } finally {
+    await handle.close().catch(() => {});
+  }
+}

package/src/services/file-lines.ts

@@ -15,6 +15,7 @@
  * Neither cost was bounded: both grow with the file, and both were paid on the
  * one thread that also serves every other request.
  */
+import { readFileChunks } from "./file-chunks.ts";
 
 /** How much of the end of a file is read to find the last few lines. */
 export const DEFAULT_TAIL_BYTES = 64 * 1024;
@@ -89,24 +90,16 @@ export async function countLines(filePath: string): Promise<number> {
   let count = 0;
   let lastByte = -1;
   let sinceYield = 0;
-  // `getReader()` rather than `for await`: Bun's ReadableStream is async
-  // iterable at runtime, but the DOM typings it is declared against do not say
-  // so, and a cast to paper over that would outlive the reason for it.
-  const reader = Bun.file(filePath).stream().getReader();
-  try {
-    for (;;) {
-      const { done, value } = await reader.read();
-      if (done || !value) break;
-      for (let i = 0; i < value.length; i++) if (value[i] === 0x0a) count++;
-      if (value.length > 0) lastByte = value[value.length - 1]!;
-      sinceYield += value.length;
-      if (sinceYield >= YIELD_EVERY_BYTES) {
-        sinceYield = 0;
-        await new Promise<void>((r) => setTimeout(r, 0));
-      }
+  // Not `Bun.file().stream()`, which keeps about the file's size in native
+  // memory per read and never returns it (see `file-chunks.ts`).
+  for await (const value of readFileChunks(filePath)) {
+    for (let i = 0; i < value.length; i++) if (value[i] === 0x0a) count++;
+    if (value.length > 0) lastByte = value[value.length - 1]!;
+    sinceYield += value.length;
+    if (sinceYield >= YIELD_EVERY_BYTES) {
+      sinceYield = 0;
+      await new Promise<void>((r) => setTimeout(r, 0));
     }
-  } finally {
-    reader.releaseLock();
   }
   if (lastByte === -1) return 0;              // empty file
   if (lastByte !== 0x0a) count++;             // last line carries no newline

package/src/services/lsp/lsp-manager.ts

@@ -20,6 +20,7 @@ import { resolveBunPath } from "../autostart-generator.ts";
 import { createLogger } from "../logger.ts";
 import { canInstall, lspInstallDir, rustupServerPath } from "./lsp-install.ts";
 import { LspSession, type LspSessionState } from "./lsp-session.ts";
+import { registerMemoryGauge } from "../memory-diagnostics.ts";
 import {
   LANGUAGE_SERVERS,
   ancestorDirs,
@@ -595,3 +596,5 @@ export class LspManager {
 }
 
 export const lspManager = new LspManager();
+
+registerMemoryGauge("lsp.servers", () => lspManager["entries"].size);

package/src/services/memory-diagnostics-native.ts

@@ -0,0 +1,110 @@
+import { readdirSync, readFileSync } from "node:fs";
+
+/**
+ * What the OS says this process holds, beyond what `process.memoryUsage()` reports.
+ *
+ * `rss` is only what is resident right now. A leak of *committed* memory — an allocator
+ * segment reserved and never handed back, a pipe buffer per child — can sit at 30 GB of
+ * private bytes while RSS reads 1–2 GB, because Windows trims the working set and pages
+ * the rest out. That is exactly how the server's leak looked on 20/10/2026: mem-diag said
+ * 1 GB, Windows' low-memory detector named the same pid at 32 GB, and every new child
+ * process died of memory exhaustion. Private bytes are the number that runs the machine
+ * out of commit, so that is the one recorded here.
+ *
+ * Every field is `undefined` when this platform cannot measure it, never `0`.
+ */
+export interface NativeMemory {
+  /** Windows `PrivateUsage` (commit charge); Linux `RssAnon + VmSwap`. */
+  privateMB?: number;
+  /** Windows `PeakWorkingSetSize`; Linux `VmHWM`. */
+  peakRssMB?: number;
+  /** Linux `VmSize` — address space, mostly reservations. */
+  virtualMB?: number;
+  /** Windows kernel handles; Linux open file descriptors. Climbs with leaked pipes and children. */
+  handles?: number;
+  /** Linux only: `Threads` in `/proc/self/status`. */
+  threads?: number;
+}
+
+const MB = 1024 * 1024;
+
+type Win32 = {
+  K32GetProcessMemoryInfo: (process: bigint, counters: number, size: number) => number;
+  GetProcessHandleCount: (process: bigint, count: number) => number;
+};
+
+/** `(HANDLE)-1`, the pseudo handle for the calling process. A bigint, so it crosses FFI unrounded. */
+const CURRENT_PROCESS = -1n;
+/** `sizeof(PROCESS_MEMORY_COUNTERS_EX)` on 64-bit Windows: two DWORDs then nine SIZE_Ts. */
+const COUNTERS_SIZE = 80;
+const OFFSET_PEAK_WORKING_SET = 8;
+const OFFSET_PRIVATE_USAGE = 72;
+
+let win32: Win32 | null | undefined;
+
+async function loadWin32(): Promise<Win32 | null> {
+  if (win32 !== undefined) return win32;
+  try {
+    const { dlopen, FFIType } = await import("bun:ffi");
+    win32 = dlopen("kernel32.dll", {
+      K32GetProcessMemoryInfo: { args: [FFIType.i64, FFIType.ptr, FFIType.u32], returns: FFIType.i32 },
+      GetProcessHandleCount: { args: [FFIType.i64, FFIType.ptr], returns: FFIType.i32 },
+    }).symbols as unknown as Win32;
+  } catch {
+    win32 = null;
+  }
+  return win32;
+}
+
+async function readWindows(): Promise<NativeMemory> {
+  const lib = await loadWin32();
+  if (!lib) return {};
+  const { ptr } = await import("bun:ffi");
+  const out: NativeMemory = {};
+
+  const counters = new Uint8Array(COUNTERS_SIZE);
+  const view = new DataView(counters.buffer);
+  view.setUint32(0, COUNTERS_SIZE, true);
+  if (lib.K32GetProcessMemoryInfo(CURRENT_PROCESS, ptr(counters), COUNTERS_SIZE) !== 0) {
+    out.privateMB = Math.round(Number(view.getBigUint64(OFFSET_PRIVATE_USAGE, true)) / MB);
+    out.peakRssMB = Math.round(Number(view.getBigUint64(OFFSET_PEAK_WORKING_SET, true)) / MB);
+  }
+
+  const handleCount = new Uint32Array(1);
+  if (lib.GetProcessHandleCount(CURRENT_PROCESS, ptr(handleCount)) !== 0) out.handles = handleCount[0];
+  return out;
+}
+
+/** Parse the `kB` lines of `/proc/self/status` that matter here. Exported for tests. */
+export function parseProcStatus(text: string): NativeMemory {
+  const kb = (key: string): number | undefined => {
+    const m = text.match(new RegExp(`^${key}:\\s+(\\d+)\\s+kB`, "m"));
+    return m ? Number(m[1]) : undefined;
+  };
+  const anon = kb("RssAnon");
+  const swap = kb("VmSwap");
+  const hwm = kb("VmHWM");
+  const size = kb("VmSize");
+  const threads = text.match(/^Threads:\s+(\d+)/m);
+  return {
+    privateMB: anon === undefined ? undefined : Math.round((anon + (swap ?? 0)) / 1024),
+    peakRssMB: hwm === undefined ? undefined : Math.round(hwm / 1024),
+    virtualMB: size === undefined ? undefined : Math.round(size / 1024),
+    threads: threads ? Number(threads[1]) : undefined,
+  };
+}
+
+function readLinux(): NativeMemory {
+  const out = parseProcStatus(readFileSync("/proc/self/status", "utf8"));
+  try { out.handles = readdirSync("/proc/self/fd").length; } catch { /* fd count is optional */ }
+  return out;
+}
+
+/** One reading of this process's native memory. Never throws; an unreadable field is left out. */
+export async function readNativeMemory(platform: NodeJS.Platform = process.platform): Promise<NativeMemory> {
+  try {
+    if (platform === "win32") return await readWindows();
+    if (platform === "linux") return readLinux();
+  } catch { /* fall through: no native reading this tick */ }
+  return {};
+}