@linxiraos/pi-utils 1.0.9 → 1.1.0

package/src/binary.ts

@@ -14,8 +14,12 @@
  */
 import { peekFile, peekFileSync } from "./peek-file";
 
-/** Header window sniffed for the binary heuristic; mirrors git's 8000-byte scan. */
-const BINARY_SNIFF_BYTES = 8192;
+/**
+ * Header window sniffed for the binary heuristic; mirrors git's 8000-byte scan.
+ * Exported so callers that already hold the whole file in memory can sniff the
+ * identical prefix through {@link isProbablyBinaryHeader} instead of reopening.
+ */
+export const BINARY_SNIFF_BYTES = 8192;
 
 /**
  * Classify an in-memory byte header as binary (non-UTF-8-text).

package/src/browsers.ts

@@ -4,17 +4,10 @@ import type * as fs from "node:fs";
 import * as fsp from "node:fs/promises";
 import * as os from "node:os";
 import * as path from "node:path";
-import * as zlib from "node:zlib";
+import { extractArchive } from "./ar";
 
 const CHROME_FOR_TESTING_BASE_URL = "https://storage.googleapis.com/chrome-for-testing-public";
 const CHROME_METADATA_BASE_URL = "https://googlechromelabs.github.io/chrome-for-testing";
-const ZIP_LOCAL_FILE_HEADER = 0x04034b50;
-const ZIP_CENTRAL_DIRECTORY_HEADER = 0x02014b50;
-const ZIP_END_OF_CENTRAL_DIRECTORY = 0x06054b50;
-const ZIP_DIRECTORY_MODE = 0o040000;
-const ZIP_REGULAR_FILE_MODE = 0o100000;
-const ZIP_SYMLINK_MODE = 0o120000;
-const ZIP_FILE_TYPE_MASK = 0o170000;
 
 /** Supported browser products. */
 export enum Browser {
@@ -104,16 +97,6 @@ interface PatchVersions {
 	builds: Record<string, { version: string }>;
 }
 
-interface ZipEntry {
-	name: string;
-	method: number;
-	crc: number;
-	compressedSize: number;
-	uncompressedSize: number;
-	externalAttributes: number;
-	localHeaderOffset: number;
-}
-
 /** Detect the current host's Puppeteer browser platform. */
 export function detectBrowserPlatform(): BrowserPlatform | undefined {
 	const platform = os.platform();
@@ -259,7 +242,7 @@ export async function install(options: InstallOptions): Promise<InstalledBrowser
 			archivePath,
 			options.downloadProgressCallback,
 		);
-		await extractZipArchive(archivePath, stagingPath);
+		await extractArchive(archivePath, stagingPath);
 		await fsp.mkdir(path.dirname(installPath), { recursive: true });
 		await fsp.rm(installPath, { recursive: true, force: true });
 		await fsp.rename(stagingPath, installPath);
@@ -369,133 +352,3 @@ async function downloadArchive(
 		await file.close();
 	}
 }
-
-async function extractZipArchive(archivePath: string, destination: string): Promise<void> {
-	const archive = await fsp.readFile(archivePath);
-	const entries = readCentralDirectory(archive);
-	await fsp.mkdir(destination, { recursive: true });
-	const root = path.resolve(destination);
-	for (const entry of entries) {
-		const outputPath = safeArchivePath(root, entry.name);
-		const mode = entry.externalAttributes >>> 16;
-		const type = mode & ZIP_FILE_TYPE_MASK;
-		if (entry.name.endsWith("/") || type === ZIP_DIRECTORY_MODE) {
-			await fsp.mkdir(outputPath, { recursive: true });
-			if (mode & 0o777) await fsp.chmod(outputPath, mode & 0o777);
-			continue;
-		}
-
-		const contents = readZipEntry(archive, entry);
-		await fsp.mkdir(path.dirname(outputPath), { recursive: true });
-		if (type === ZIP_SYMLINK_MODE) {
-			const target = contents.toString("utf8");
-			validateSymlinkTarget(root, outputPath, target);
-			await fsp.symlink(target, outputPath);
-			continue;
-		}
-		await fsp.writeFile(outputPath, contents, { mode: mode & 0o777 ? mode & 0o777 : 0o644 });
-		if ((mode & ZIP_FILE_TYPE_MASK) === ZIP_REGULAR_FILE_MODE && mode & 0o777)
-			await fsp.chmod(outputPath, mode & 0o777);
-	}
-}
-
-function readCentralDirectory(archive: Buffer): ZipEntry[] {
-	const minimumOffset = Math.max(0, archive.length - 65_557);
-	let endOffset = -1;
-	for (let offset = archive.length - 22; offset >= minimumOffset; offset--) {
-		if (archive.readUInt32LE(offset) === ZIP_END_OF_CENTRAL_DIRECTORY) {
-			endOffset = offset;
-			break;
-		}
-	}
-	if (endOffset < 0) throw new Error("Invalid ZIP archive: central directory was not found");
-	const disk = archive.readUInt16LE(endOffset + 4);
-	const centralDisk = archive.readUInt16LE(endOffset + 6);
-	const entryCount = archive.readUInt16LE(endOffset + 10);
-	const centralSize = archive.readUInt32LE(endOffset + 12);
-	const centralOffset = archive.readUInt32LE(endOffset + 16);
-	if (disk !== 0 || centralDisk !== 0) throw new Error("Multi-disk ZIP archives are not supported");
-	if (entryCount === 0xffff || centralSize === 0xffffffff || centralOffset === 0xffffffff) {
-		throw new Error("ZIP64 archives are not supported");
-	}
-	if (centralOffset + centralSize > endOffset)
-		throw new Error("Invalid ZIP archive: central directory is out of bounds");
-
-	const entries: ZipEntry[] = [];
-	let offset = centralOffset;
-	for (let index = 0; index < entryCount; index++) {
-		if (offset + 46 > archive.length || archive.readUInt32LE(offset) !== ZIP_CENTRAL_DIRECTORY_HEADER) {
-			throw new Error("Invalid ZIP archive: malformed central directory entry");
-		}
-		const flags = archive.readUInt16LE(offset + 8);
-		if (flags & 1) throw new Error("Encrypted ZIP entries are not supported");
-		const nameLength = archive.readUInt16LE(offset + 28);
-		const extraLength = archive.readUInt16LE(offset + 30);
-		const commentLength = archive.readUInt16LE(offset + 32);
-		const end = offset + 46 + nameLength + extraLength + commentLength;
-		if (end > archive.length) throw new Error("Invalid ZIP archive: truncated central directory entry");
-		entries.push({
-			name: archive.subarray(offset + 46, offset + 46 + nameLength).toString("utf8"),
-			method: archive.readUInt16LE(offset + 10),
-			crc: archive.readUInt32LE(offset + 16),
-			compressedSize: archive.readUInt32LE(offset + 20),
-			uncompressedSize: archive.readUInt32LE(offset + 24),
-			externalAttributes: archive.readUInt32LE(offset + 38),
-			localHeaderOffset: archive.readUInt32LE(offset + 42),
-		});
-		offset = end;
-	}
-	return entries;
-}
-
-function readZipEntry(archive: Buffer, entry: ZipEntry): Buffer {
-	const offset = entry.localHeaderOffset;
-	if (offset + 30 > archive.length || archive.readUInt32LE(offset) !== ZIP_LOCAL_FILE_HEADER) {
-		throw new Error(`Invalid ZIP archive: malformed local header for ${entry.name}`);
-	}
-	const nameLength = archive.readUInt16LE(offset + 26);
-	const extraLength = archive.readUInt16LE(offset + 28);
-	const start = offset + 30 + nameLength + extraLength;
-	const end = start + entry.compressedSize;
-	if (end > archive.length) throw new Error(`Invalid ZIP archive: truncated data for ${entry.name}`);
-	const compressed = archive.subarray(start, end);
-	let contents: Buffer;
-	if (entry.method === 0) contents = Buffer.from(compressed);
-	else if (entry.method === 8) contents = zlib.inflateRawSync(compressed);
-	else throw new Error(`Unsupported ZIP compression method ${entry.method} for ${entry.name}`);
-	if (contents.length !== entry.uncompressedSize)
-		throw new Error(`Invalid uncompressed size for ZIP entry ${entry.name}`);
-	if (crc32(contents) !== entry.crc) throw new Error(`CRC mismatch for ZIP entry ${entry.name}`);
-	return contents;
-}
-
-function safeArchivePath(root: string, name: string): string {
-	if (!name || name.includes("\0") || name.startsWith("/") || name.startsWith("\\") || /^[A-Za-z]:/.test(name)) {
-		throw new Error(`Unsafe path in ZIP archive: ${name}`);
-	}
-	const segments = name.replaceAll("\\", "/").split("/");
-	if (segments.some(segment => segment === "..")) throw new Error(`Unsafe path in ZIP archive: ${name}`);
-	const target = path.resolve(root, ...segments.filter(Boolean));
-	if (target !== root && !target.startsWith(`${root}${path.sep}`))
-		throw new Error(`Unsafe path in ZIP archive: ${name}`);
-	return target;
-}
-
-function validateSymlinkTarget(root: string, linkPath: string, target: string): void {
-	if (!target || target.includes("\0") || path.isAbsolute(target) || /^[A-Za-z]:/.test(target)) {
-		throw new Error(`Unsafe symlink target in ZIP archive: ${target}`);
-	}
-	const resolved = path.resolve(path.dirname(linkPath), target);
-	if (resolved !== root && !resolved.startsWith(`${root}${path.sep}`)) {
-		throw new Error(`Unsafe symlink target in ZIP archive: ${target}`);
-	}
-}
-
-function crc32(contents: Uint8Array): number {
-	let crc = 0xffffffff;
-	for (const byte of contents) {
-		crc ^= byte;
-		for (let bit = 0; bit < 8; bit++) crc = (crc >>> 1) ^ (crc & 1 ? 0xedb88320 : 0);
-	}
-	return (crc ^ 0xffffffff) >>> 0;
-}

package/src/dirs.ts

@@ -28,8 +28,8 @@ export const MAIN_CONFIG_FILENAMES = ["config.yml", "config.yaml"] as const;
 /** Version (e.g. "1.0.0") */
 export const VERSION: string = version;
 
-/** Default User-Agent header string (e.g. "omp/17.2.12") */
-export const USER_AGENT = `omp/${VERSION}`;
+/** Default User-Agent header string (e.g. "zeta/1.0.10") */
+export const USER_AGENT = `zeta/${VERSION}`;
 
 /** Minimum Bun version */
 export const MIN_BUN_VERSION: string = engines.bun.replace(/[^0-9.]/g, "");
@@ -700,6 +700,11 @@ export function getGithubCacheDbPath(): string {
 	return dirs.rootSubdir(path.join("cache", "github-cache.db"), "cache");
 }
 
+/** Get the legacy Pi extension parse cache database path. */
+export function getLegacyPiExtensionCacheDbPath(): string {
+	return dirs.rootSubdir(path.join("cache", "legacy-pi-extension-cache.db"), "cache");
+}
+
 /**
  * Get the encrypted auth-broker snapshot cache path (~/.zeta/cache/auth-broker-snapshot.enc).
  * Honors the `OMP_AUTH_BROKER_SNAPSHOT_CACHE` env var when set so tests and
@@ -712,6 +717,11 @@ export function getAuthBrokerSnapshotCachePath(): string {
 }
 
 /** Get the local FastEmbed model cache directory (~/.zeta/cache/fastembed). */
+/** Get the commit-author avatar cache directory (~/.omp/cache/avatars). */
+export function getAvatarCacheDir(): string {
+	return dirs.rootSubdir(path.join("cache", "avatars"), "cache");
+}
+/** Get the local FastEmbed model cache directory (~/.omp/cache/fastembed). */
 export function getFastembedCacheDir(): string {
 	return dirs.rootSubdir(path.join("cache", "fastembed"), "cache");
 }
@@ -876,10 +886,20 @@ export function getSecretPlaceholderKeyPath(): string {
 	return keyPath;
 }
 
+/** Root directory containing every per-project daemon runtime scope (~/.zeta/run/daemons; XDG default: $XDG_STATE_HOME/zeta/run/daemons). */
+export function getDaemonRuntimeRoot(): string {
+	return dirs.rootSubdir(path.join("run", "daemons"), "state");
+}
+
 /** Get the daemon runtime directory for a project (~/.zeta/run/daemons/<hash>; XDG default: $XDG_STATE_HOME/zeta/run/daemons/<hash>). */
 export function getDaemonRuntimeDir(projectDir: string): string {
 	const key = Bun.hash.wyhash(path.resolve(projectDir)).toString(16).padStart(16, "0");
-	return dirs.rootSubdir(path.join("run", "daemons", key), "state");
+	return path.join(getDaemonRuntimeRoot(), key);
+}
+
+/** Root directory containing every machine-global daemon service scope. */
+export function getGlobalDaemonRuntimeRoot(): string {
+	return path.join(getBaseConfigRoot(), "run", "daemons", "global");
 }
 
 /** Get a profile-independent runtime directory for a machine-global daemon service. */
@@ -887,7 +907,7 @@ export function getGlobalDaemonRuntimeDir(service: string): string {
 	if (!/^[a-z0-9][a-z0-9._-]*$/i.test(service)) {
 		throw new Error(`Invalid global daemon service name: ${JSON.stringify(service)}`);
 	}
-	return path.join(getBaseConfigRoot(), "run", "daemons", "global", service);
+	return path.join(getGlobalDaemonRuntimeRoot(), service);
 }
 
 /** Get the provider in-flight root directory (~/.zeta/run/provider-inflight; XDG default: $XDG_STATE_HOME/zeta/run/provider-inflight). */

package/src/docx/converter.ts

@@ -1,7 +1,7 @@
 import * as fs from "node:fs/promises";
 import * as path from "node:path";
+import { archiveEntryText, readArchiveEntries } from "../ar";
 import { attribute, childElements, descendants, firstChild, localName, parseXml, type XmlElement } from "./xml";
-import { readZip, readZipText, type ZipEntries } from "./zip";
 
 /** A mammoth-compatible diagnostic emitted while converting a document. */
 export interface DocxMessage {
@@ -119,7 +119,7 @@ interface NumberingLevel {
 }
 
 interface ConversionContext {
-	readonly entries: ZipEntries;
+	readonly entries: ReadonlyMap<string, Uint8Array>;
 	readonly relationships: ReadonlyMap<string, Relationship>;
 	readonly contentTypes: ReadonlyMap<string, string>;
 	readonly styles: ReadonlyMap<string, Style>;
@@ -655,21 +655,21 @@ function defaultImageConverter(): ImageConverter {
 /** Convert a DOCX buffer or path to mammoth-compatible HTML. */
 export async function convertToHtml(input: DocxInput, options: ConvertToHtmlOptions = {}): Promise<DocxResult> {
 	const bytes = "buffer" in input && input.buffer ? input.buffer : await fs.readFile(input.path);
-	const entries = readZip(bytes);
-	const documentXml = readZipText(entries, "word/document.xml");
+	const entries = await readArchiveEntries({ bytes, format: "zip" });
+	const documentXml = archiveEntryText(entries, "word/document.xml");
 	if (!documentXml) throw new Error("Invalid DOCX: missing word/document.xml");
 	const context: ConversionContext = {
 		entries,
-		relationships: parseRelationships(readZipText(entries, "word/_rels/document.xml.rels")),
-		contentTypes: parseContentTypes(readZipText(entries, "[Content_Types].xml")),
-		styles: parseStyles(readZipText(entries, "word/styles.xml")),
-		numbering: parseNumbering(readZipText(entries, "word/numbering.xml")),
+		relationships: parseRelationships(archiveEntryText(entries, "word/_rels/document.xml.rels")),
+		contentTypes: parseContentTypes(archiveEntryText(entries, "[Content_Types].xml")),
+		styles: parseStyles(archiveEntryText(entries, "word/styles.xml")),
+		numbering: parseNumbering(archiveEntryText(entries, "word/numbering.xml")),
 		messages: [],
 		warnedStyles: new Set(),
 		customStyles: parseCustomStyles(options.styleMap),
 		includeDefaultStyleMap: options.includeDefaultStyleMap !== false,
 		convertImage: options.convertImage ?? defaultImageConverter(),
-		footnotes: parseFootnotes(readZipText(entries, "word/footnotes.xml")),
+		footnotes: parseFootnotes(archiveEntryText(entries, "word/footnotes.xml")),
 		usedFootnotes: [],
 		footnoteOrdinals: new Map(),
 	};

package/src/env.ts

@@ -102,16 +102,39 @@ export function filterChildShellEnv(
 ): Record<string, string> {
 	const result = filterProcessEnv(env);
 	const projectEnv = parseEnvFile(path.join(cwd, ".env"));
-	const nodeEnvName = `.env.${env.NODE_ENV || "development"}`;
+	const launchNodeEnv = launchEnvValues ? launchEnvValues.get("NODE_ENV") : env.NODE_ENV;
+	const nodeEnvName = `.env.${launchNodeEnv || "development"}`;
 	const modeEnv = parseEnvFile(path.join(cwd, nodeEnvName));
 	const localEnv = parseEnvFile(path.join(cwd, ".env.local"));
-	const launchEnv = { ...projectEnv, ...modeEnv, ...localEnv };
+	const modeLocalEnv = parseEnvFile(path.join(cwd, `${nodeEnvName}.local`));
+	const launchEnv = { ...projectEnv, ...modeEnv, ...localEnv, ...modeLocalEnv };
 	const expandedLaunchEnv = {
 		...expandDotenvValues(projectEnv, result),
 		...expandDotenvValues(modeEnv, result),
 		...expandDotenvValues(localEnv, result),
+		...expandDotenvValues(modeLocalEnv, result),
 	};
-	for (const key in launchEnv) {
+	let fallbackLaunchEnv: Record<string, string> | undefined;
+	let expandedFallbackLaunchEnv: Record<string, string> | undefined;
+	if (!launchEnvValues && nodeEnvName !== ".env.development") {
+		const fallbackModeEnv = parseEnvFile(path.join(cwd, ".env.development"));
+		const fallbackModeLocalEnv = parseEnvFile(path.join(cwd, ".env.development.local"));
+		const candidate = { ...projectEnv, ...fallbackModeEnv, ...localEnv, ...fallbackModeLocalEnv };
+		const expandedCandidate = {
+			...expandDotenvValues(projectEnv, result),
+			...expandDotenvValues(fallbackModeEnv, result),
+			...expandDotenvValues(localEnv, result),
+			...expandDotenvValues(fallbackModeLocalEnv, result),
+		};
+		if (candidate.NODE_ENV === env.NODE_ENV || expandedCandidate.NODE_ENV === env.NODE_ENV) {
+			// Without a launch snapshot, NODE_ENV may itself have come from dotenv.
+			// Bun chose the default mode before loading it, so retain both candidates.
+			fallbackLaunchEnv = candidate;
+			expandedFallbackLaunchEnv = expandedCandidate;
+		}
+	}
+	const allLaunchEnv = fallbackLaunchEnv ? { ...launchEnv, ...fallbackLaunchEnv } : launchEnv;
+	for (const key in allLaunchEnv) {
 		const launchValue = launchEnvValues?.get(key);
 		if (launchValue !== undefined) {
 			// Launcher-owned name: it keeps the launcher's own value. Bun overwrites
@@ -119,7 +142,10 @@ export function filterChildShellEnv(
 			// value whenever what survived is exactly what the dotenv file defines.
 			if (
 				result[key] !== launchValue &&
-				(result[key] === launchEnv[key] || result[key] === expandedLaunchEnv[key])
+				(result[key] === launchEnv[key] ||
+					result[key] === expandedLaunchEnv[key] ||
+					result[key] === fallbackLaunchEnv?.[key] ||
+					result[key] === expandedFallbackLaunchEnv?.[key])
 			) {
 				result[key] = launchValue;
 			}
@@ -130,7 +156,12 @@ export function filterChildShellEnv(
 			// absent from it, or OMP itself injected the value — either way it came
 			// from a project dotenv file, not the parent shell.
 			delete result[key];
-		} else if (result[key] === launchEnv[key] || result[key] === expandedLaunchEnv[key]) {
+		} else if (
+			result[key] === launchEnv[key] ||
+			result[key] === expandedLaunchEnv[key] ||
+			result[key] === fallbackLaunchEnv?.[key] ||
+			result[key] === expandedFallbackLaunchEnv?.[key]
+		) {
 			// No launch-env snapshot (dotenv autoloaded without procfs): best-effort
 			// value match against the Bun-parsed dotenv.
 			delete result[key];

package/src/index.ts

@@ -28,6 +28,7 @@ export { AbortError, ChildProcess, Exception, NonZeroExitError } from "./ptree";
 export * from "./runtime-install";
 export * from "./sanitize-text";
 export * from "./snowflake";
+export * from "./sqlite";
 export * from "./stderr-guard";
 export * from "./stream";
 export * from "./tab-spacing";

package/src/logger.ts

@@ -91,7 +91,7 @@ function pruneStaleProcessLogs(dir: string): void {
 		`${cutoff.getFullYear()}-${String(cutoff.getMonth() + 1).padStart(2, "0")}-` +
 		String(cutoff.getDate()).padStart(2, "0");
 
-	const staleLogsByProcessDay = new Map<string, Array<{ path: string; mtimeMs: number; rollover: number }>>();
+	const staleLogsByProcessDay = new Map<string, Array<{ path: string; rollover: number }>>();
 	for (const entry of entries) {
 		if (!entry.isFile()) continue;
 		const logMatch = PROCESS_LOG_PATTERN.exec(entry.name);
@@ -120,25 +120,29 @@ function pruneStaleProcessLogs(dir: string): void {
 			continue;
 		}
 
-		try {
-			const key = `${pidText}:${logMatch[1]}`;
-			const staleLogs = staleLogsByProcessDay.get(key) ?? [];
-			staleLogs.push({
-				path: entryPath,
-				mtimeMs: fs.statSync(entryPath).mtimeMs,
-				rollover: Number(logMatch[3] ?? 0),
-			});
-			staleLogsByProcessDay.set(key, staleLogs);
-		} catch {
-			// Another process may have pruned the same stale namespace.
-		}
+		const key = `${pidText}:${logMatch[1]}`;
+		const staleLogs = staleLogsByProcessDay.get(key) ?? [];
+		staleLogs.push({
+			path: entryPath,
+			rollover: Number(logMatch[3] ?? 0),
+		});
+		staleLogsByProcessDay.set(key, staleLogs);
 	}
 
 	for (const staleLogs of staleLogsByProcessDay.values()) {
-		staleLogs.sort(
+		if (staleLogs.length <= RETAINED_STALE_LOGS_PER_PROCESS_DAY) continue;
+		const ranked: Array<{ path: string; mtimeMs: number; rollover: number }> = [];
+		for (const stale of staleLogs) {
+			try {
+				ranked.push({ ...stale, mtimeMs: fs.statSync(stale.path).mtimeMs });
+			} catch {
+				// Another process may have pruned the same stale namespace.
+			}
+		}
+		ranked.sort(
 			(a, b) => b.mtimeMs - a.mtimeMs || b.rollover - a.rollover || (a.path < b.path ? -1 : a.path > b.path ? 1 : 0),
 		);
-		for (const stale of staleLogs.slice(RETAINED_STALE_LOGS_PER_PROCESS_DAY)) {
+		for (const stale of ranked.slice(RETAINED_STALE_LOGS_PER_PROCESS_DAY)) {
 			try {
 				fs.rmSync(stale.path, { force: true });
 			} catch {

package/src/postmortem.ts

@@ -146,6 +146,66 @@ export function isIpcSendEpipe(err: Error): boolean {
 	return classifyBrokenPipe(err) === "ipc-send";
 }
 
+/**
+ * Detect Bun's advanced-serialization (structured-clone) IPC decode failure.
+ *
+ * When a worker subprocess spawned with `serialization: "advanced"` sends a
+ * malformed or truncated frame, Bun raises the decode failure as a
+ * process-level `uncaughtException` in the *parent* rather than routing it to
+ * the channel's `ipc()` callback (oven-sh/bun#37287). The error is a bare
+ * `TypeError: Unable to deserialize data.` whose only own property is `message`
+ * — it carries no `code`, no `syscall`, and no `stack`. Matching all four traits
+ * keeps unrelated application `TypeError`s (which always carry a populated
+ * multi-frame stack) on the fatal path, so a genuine bug is never silently
+ * swallowed.
+ *
+ * Every advanced-serialization channel in this process is an optional worker
+ * subsystem (TTS, STT, tiny-title, mnemopi embeddings, JS eval), so one
+ * worker's bad frame must fault only that worker — via its own `onExit`/error
+ * path — never tear down the whole session. Callers log-and-continue instead of
+ * taking the fatal path. Mirrors {@link classifyBrokenPipe} for the send side
+ * (#2997, #9158).
+ */
+export function isWorkerIpcDeserializeError(err: unknown): boolean {
+	return (
+		err instanceof TypeError &&
+		err.message === "Unable to deserialize data." &&
+		!err.stack &&
+		!("code" in err) &&
+		!("syscall" in err)
+	);
+}
+
+/** Recycle callbacks for the active advanced-serialization worker IPC channels. */
+const workerIpcFaultHandlers = new Set<(err: Error) => void>();
+
+/**
+ * Register a fault/recycle callback for an active advanced-serialization worker
+ * IPC channel.
+ *
+ * Bun surfaces a malformed frame as a process-global `uncaughtException`
+ * ({@link isWorkerIpcDeserializeError}) with no way to attribute it to a
+ * specific channel, so when one fires every registered handler is invoked to
+ * conservatively fault its worker — reject in-flight requests and recycle the
+ * subprocess — instead of leaving pending work to await forever. Returns an
+ * unregister function; callers MUST unregister when the worker exits.
+ */
+export function registerWorkerIpcFaultHandler(handler: (err: Error) => void): () => void {
+	workerIpcFaultHandlers.add(handler);
+	return () => workerIpcFaultHandlers.delete(handler);
+}
+
+/** Invoke every registered worker IPC fault handler, isolating handler throws. */
+function faultWorkerIpcChannels(err: Error): void {
+	for (const handler of workerIpcFaultHandlers) {
+		try {
+			handler(err);
+		} catch (handlerErr) {
+			logger.warn("Worker IPC fault handler threw", { err: handlerErr });
+		}
+	}
+}
+
 /**
  * Treat unhandled stdout EPIPE rejections as a graceful peer disconnect.
  *
@@ -283,6 +343,20 @@ if (isMainThread) {
 				logger.warn("Ignoring expected cleanup exception", { err });
 				return;
 			}
+			// A malformed advanced-serialization frame from a worker subprocess
+			// surfaces here as a process-level uncaughtException (oven-sh/bun#37287)
+			// rather than in the channel's ipc() callback, and Bun gives no way to
+			// tell which channel produced it. Contain it to the worker layer: keep
+			// the session alive and conservatively fault every active advanced-IPC
+			// worker so its owning client rejects in-flight requests and recycles
+			// the subprocess — a worker that sent a bad frame but stays alive would
+			// otherwise never fire onExit and leave callers awaiting forever.
+			// Mirrors the ipc-send EPIPE containment below (#9158, #2997).
+			if (isWorkerIpcDeserializeError(err)) {
+				logger.warn("Malformed worker IPC frame; faulting active worker subsystems", { err });
+				faultWorkerIpcChannels(err);
+				return;
+			}
 			await exitAfterFatal("Uncaught Exception", "Uncaught exception", err, Reason.UNCAUGHT_EXCEPTION);
 		})
 		.on("unhandledRejection", async reason => {

package/src/sqlite.ts

@@ -0,0 +1,33 @@
+/**
+ * Shared classifiers for `bun:sqlite` error result codes.
+ *
+ * Every omp SQLite store (`agent.db` credential/usage store, `models.db` model
+ * cache, `history.db`) needs the same two distinctions: a transient BUSY that
+ * clears by retrying, and an unrecoverable corruption that never does. Keeping
+ * one implementation here prevents the classifiers from drifting between the
+ * credential store and the model cache.
+ */
+
+/**
+ * SQLite's busy result-code family — base `SQLITE_BUSY` plus the extended
+ * variants `SQLITE_BUSY_RECOVERY` (concurrent WAL recovery), `SQLITE_BUSY_SNAPSHOT`,
+ * and `SQLITE_BUSY_TIMEOUT`. All warrant the same backoff-and-retry treatment.
+ */
+export function isSqliteBusyError(err: unknown): boolean {
+	if (err === null || typeof err !== "object" || !("code" in err)) return false;
+	const code = err.code;
+	return typeof code === "string" && code.startsWith("SQLITE_BUSY");
+}
+
+/**
+ * SQLite's unrecoverable-corruption result codes — the `SQLITE_CORRUPT` family
+ * (base plus extended variants like `SQLITE_CORRUPT_VTAB` / `SQLITE_CORRUPT_INDEX`)
+ * and `SQLITE_NOTADB` (the file header is not a database). Unlike
+ * {@link isSqliteBusyError}, these never clear by retrying: the store must be
+ * repaired or replaced, so callers latch, quarantine, or recreate the file.
+ */
+export function isSqliteCorruptionError(err: unknown): boolean {
+	if (err === null || typeof err !== "object" || !("code" in err)) return false;
+	const code = err.code;
+	return typeof code === "string" && (code.startsWith("SQLITE_CORRUPT") || code === "SQLITE_NOTADB");
+}

package/src/stream.ts

@@ -4,25 +4,6 @@ import { abortableSource } from "./abortable";
 import { parseStreamingJson } from "./json-parse";
 
 const LF = 0x0a;
-type JsonlChunkResult = {
-	values: unknown[];
-	error: unknown;
-	read: number;
-	done: boolean;
-};
-
-function parseJsonlChunkCompat(input: Uint8Array, beg?: number, end?: number): JsonlChunkResult;
-function parseJsonlChunkCompat(input: string): JsonlChunkResult;
-function parseJsonlChunkCompat(input: Uint8Array | string, beg?: number, end?: number): JsonlChunkResult {
-	if (typeof input === "string") {
-		const { values, error, read, done } = Bun.JSONL.parseChunk(input);
-		return { values, error, read, done };
-	}
-	const start = beg ?? 0;
-	const stop = end ?? input.length;
-	const { values, error, read, done } = Bun.JSONL.parseChunk(input, start, stop);
-	return { values, error, read, done };
-}
 
 export async function* readLines(stream: ReadableStream<Uint8Array>, signal?: AbortSignal): AsyncGenerator<Uint8Array> {
 	const buffer = new ConcatSink();
@@ -58,7 +39,7 @@ export async function* readJsonl<T>(stream: ReadableStream<Uint8Array>, signal?:
 			const tail = buffer.flush();
 			if (tail) {
 				buffer.clear();
-				const { values, error, done } = parseJsonlChunkCompat(tail, 0, tail.length);
+				const { values, error, done } = Bun.JSONL.parseChunk(tail, 0, tail.length);
 				if (values.length > 0) {
 					yield* values as T[];
 				}
@@ -174,8 +155,15 @@ class ConcatSink {
 		return text;
 	}
 	*pullJSONL<T>(chunk: Uint8Array, beg: number, end: number) {
+		const newline = chunk.indexOf(LF, beg);
+		if (newline === -1 || newline >= end) {
+			if (this.isEmpty) this.reset(chunk.subarray(beg, end));
+			else this.append(chunk.subarray(beg, end));
+			return;
+		}
+
 		if (this.isEmpty) {
-			const { values, error, read, done } = parseJsonlChunkCompat(chunk, beg, end);
+			const { values, error, read, done } = Bun.JSONL.parseChunk(chunk, beg, end);
 			if (values.length > 0) {
 				yield* values as T[];
 			}
@@ -192,7 +180,7 @@ class ConcatSink {
 		space.set(chunk.subarray(beg, end), offset);
 		this.#length = total;
 
-		const { values, error, read, done } = parseJsonlChunkCompat(space.subarray(0, total), 0, total);
+		const { values, error, read, done } = Bun.JSONL.parseChunk(space, 0, total);
 		if (values.length > 0) {
 			yield* values as T[];
 		}
@@ -456,7 +444,7 @@ export function parseJsonlLenient<T>(buffer: string, options: { onMalformedRecor
 	let entries: T[] | undefined;
 
 	while (buffer.length > 0) {
-		const { values, error, read, done } = parseJsonlChunkCompat(buffer);
+		const { values, error, read, done } = Bun.JSONL.parseChunk(buffer);
 		if (values.length > 0) {
 			const ext = values as T[];
 			if (!entries) {

package/src/vendor/mermaid-ascii/ascii/grid.ts

@@ -11,7 +11,14 @@ import type {
   GridCoord, DrawingCoord, Direction, AsciiGraph, AsciiNode, AsciiSubgraph,
 } from './types'
 import { gridKey } from './types'
-import { mkCanvas, setCanvasSizeToGrid, setRoleCanvasSizeToGrid } from './canvas'
+import {
+  getCanvasSize,
+  increaseRoleCanvasSize,
+  increaseSize,
+  mkCanvas,
+  setCanvasSizeToGrid,
+  setRoleCanvasSizeToGrid,
+} from './canvas'
 import { determinePath, determineLabelLine } from './edge-routing'
 import { analyzeEdgeBundles, processBundles } from './edge-bundling'
 import { drawBox } from './draw'
@@ -374,6 +381,14 @@ export function offsetDrawingForSubgraphs(graph: AsciiGraph): void {
       node.drawingCoord.y += offsetY
     }
   }
+
+  // The canvas was sized from the pre-shift grid extents, but every drawing
+  // coordinate — including edge path endpoints, which gridToDrawingCoord
+  // offsets on read — now sits `offset` cells further out. Grow it to match,
+  // or drawing the rightmost/bottom-most edges writes past the allocation.
+  const [maxX, maxY] = getCanvasSize(graph.canvas)
+  increaseSize(graph.canvas, maxX + offsetX, maxY + offsetY)
+  increaseRoleCanvasSize(graph.roleCanvas, maxX + offsetX, maxY + offsetY)
 }
 
 // ============================================================================

package/dist/types/docx/zip.d.ts

@@ -1,6 +0,0 @@
-/** The decompressed members of a DOCX ZIP package. */
-export type ZipEntries = ReadonlyMap<string, Uint8Array>;
-/** Decode a ZIP package by walking its central directory. */
-export declare function readZip(bytes: Uint8Array): ZipEntries;
-/** Decode a ZIP member as UTF-8 text. */
-export declare function readZipText(entries: ZipEntries, name: string): string | undefined;