@linxiraos/pi-utils 1.1.15 → 1.1.16

package/src/fetch-retry.ts

@@ -11,17 +11,41 @@ const RETRY_DELAY_FIELD_PATTERN = /"retryDelay":\s*"([0-9.]+)(ms|s)"/i;
 // "try again in 90 minutes" / "try again in 1 hour"
 const TRY_AGAIN_PATTERN = /try again in\s+~?\s*([0-9.]+)\s*(ms|sec|s|minutes?|mins?|m|hours?|hrs?|h)\b/i;
 // "Your limit will reset in 13 minutes" / "reset in 13 minutes" / "will reset in 2h"
-const WILL_RESET_IN_PATTERN = /(?:will\s+)?reset in\s+~?\s*([0-9.]+)\s*(ms|sec|s|minutes?|mins?|m|hours?|hrs?|h)\b/i;
+// OpenCode Go quota errors use "Resets in …" with day units and compound
+// remainders ("Resets in 3 days", "Resets in 2hr 15min", "Resets in 45min").
+const WILL_RESET_IN_PATTERN =
+	/(?:will\s+)?resets?\s+in\s+~?\s*([0-9.]+)\s*(ms|sec|s|minutes?|mins?|m|hours?|hrs?|h|days?|d)\b/i;
+// OpenCode Go compound remainder: "Resets in 2hr 15min".
+const RESET_IN_HR_MIN_PATTERN = /resets?\s+in\s+~?\s*(\d+(?:\.\d+)?)\s*hr\s*(\d+(?:\.\d+)?)\s*min\b/i;
 // "Your limit will reset at 2026-09-01 09:44:51" / "reset at 2026-09-01T09:44:51Z"
 const WILL_RESET_AT_PATTERN =
 	/(?:will\s+)?reset at\s+([0-9]{4}-[0-9]{2}-[0-9]{2}[ T][0-9]{2}:[0-9]{2}:[0-9]{2}(?:\.[0-9]+)?(?:Z|[+-][0-9]{2}:?[0-9]{2})?)/i;
+// Both grammars carry a timezone-naive wall clock. The default reading is UTC;
+// a provider-specific offset (Z.AI/Zhipu Beijing time) is applied only through
+// `RetryHintOptions.naiveResetTimezoneOffset`, never inferred from the language.
 const CN_RESET_AT_PATTERN = /将在\s*([0-9]{4}-[0-9]{2}-[0-9]{2}\s+[0-9]{2}:[0-9]{2}:[0-9]{2})\s*重置/;
+const RESET_AT_PATTERNS: readonly RegExp[] = [WILL_RESET_AT_PATTERN, CN_RESET_AT_PATTERN];
 // "retry-after-ms=98497000" / "retry-after-ms: 7200000" / "retry-after-ms = 7200000"
 const RETRY_AFTER_MS_BODY_PATTERN = /\bretry-after-ms\s*[:=]\s*([0-9]+)\b/i;
 
+// A timezone-naive `reset at` stamp (no `Z`/offset) is the provider's
+// wall clock in an unknown zone: it cannot be converted to a delay without
+// guessing the zone, so it resolves only as a fallback when the body
+// carries no unambiguous relative signal.
+
+// A conflict probe needs no new signal: when a naive `reset at` wall stamp
+// disagrees with the merged relative wait, the merged wait (which already
+// ignores the naive stamp) sleeps first, and the retry after it is the
+// probe — success proves skew, a fresh 429 re-anchors with live timing.
+
+/** Provider-specific interpretation for timezone-naive retry timestamps. */
+export interface RetryHintOptions {
+	/** UTC offset appended to an absolute reset stamp that omits its timezone. */
+	naiveResetTimezoneOffset?: string;
+}
+
 /**
  * Server-suggested retry delay extraction. Merges the patterns historically used
- * by the OpenAI Codex and Google Gemini retry helpers.
  *
  * Header sources (checked in order):
  *  - `retry-after-ms` (milliseconds)
@@ -37,12 +61,18 @@ const RETRY_AFTER_MS_BODY_PATTERN = /\bretry-after-ms\s*[:=]\s*([0-9]+)\b/i;
  *  - `try again in 250ms` / `try again in 12s` / `try again in 5 min` / `try again in ~158 min`
  *  - `retry-after-ms=98497000` / `retry-after-ms: 7200000` / `retry-after-ms = 7200000`
  *  - `Your limit will reset at 2026-09-01 09:44:51` / `将在 2026-09-01 09:44:51 重置`
+ *    (a provider offset makes a naive wall clock authoritative; otherwise it
+ *    resolves only when no relative signal is present)
  *
  * Returns `undefined` if no signal is found, or `0` when the provider
  * explicitly asks for an immediate retry (`retry-after…=0`, or an absolute
  * reset timestamp that has already elapsed).
  */
-export function extractRetryHint(source: Response | Headers | null | undefined, body?: string): number | undefined {
+export function extractRetryHint(
+	source: Response | Headers | null | undefined,
+	body?: string,
+	options?: RetryHintOptions,
+): number | undefined {
 	const headers = source instanceof Headers ? source : (source?.headers ?? undefined);
 	if (headers) {
 		const retryAfterMs = headers.get("retry-after-ms");
@@ -98,6 +128,15 @@ export function extractRetryHint(source: Response | Headers | null | undefined,
 	// when the parse returns undefined, which would sleep a session the
 	// provider told to retry immediately.
 	let retryNow = false;
+
+	// Timezone-naive `reset at` stamps (no `Z`/offset) are the provider's
+	// wall clock in an unknown zone — converting them to a delay requires
+	// guessing the zone. They resolve AFTER every unambiguous signal below,
+	// and only as a fallback when none was found.
+	let longestNaiveMs: number | undefined;
+	const considerNaive = (ms: number | undefined): void => {
+		if (ms !== undefined && ms > 0 && (longestNaiveMs === undefined || ms > longestNaiveMs)) longestNaiveMs = ms;
+	};
 	const consider = (ms: number | undefined): void => {
 		if (ms !== undefined && ms > 0 && (longestMs === undefined || ms > longestMs)) longestMs = ms;
 	};
@@ -117,16 +156,30 @@ export function extractRetryHint(source: Response | Headers | null | undefined,
 			consider(totalMs > 0 ? totalMs : undefined);
 		}
 	}
-	for (const pattern of [WILL_RESET_AT_PATTERN, CN_RESET_AT_PATTERN]) {
+	for (const pattern of RESET_AT_PATTERNS) {
 		const match = pattern.exec(body);
-		if (match?.[1]) {
-			// Provider timestamps without an explicit offset are interpreted as UTC.
-			const normalized = match[1].replace(" ", "T");
-			const hasOffset = /(?:Z|[+-][0-9]{2}:?[0-9]{2})$/i.test(normalized);
-			const parsed = Date.parse(hasOffset ? normalized : `${normalized}Z`);
-			if (!Number.isNaN(parsed) && parsed > Date.now()) {
-				consider(parsed - Date.now());
-			}
+		if (!match?.[1]) continue;
+		// Offset-bearing stamps are unambiguous and compete by longest-wins.
+		// A configured provider offset makes an otherwise naive wall clock
+		// unambiguous too. Without one, preserve the relative-signal-first
+		// fallback and interpret the wall clock as UTC only when it stands alone.
+		const normalized = match[1].replace(" ", "T");
+		const hasOffset = /(?:Z|[+-][0-9]{2}:?[0-9]{2})$/i.test(normalized);
+		const configuredOffset = options?.naiveResetTimezoneOffset;
+		const parsed = Date.parse(hasOffset ? normalized : `${normalized}${configuredOffset ?? "Z"}`);
+		if (!Number.isNaN(parsed) && parsed > Date.now()) {
+			if (hasOffset || configuredOffset !== undefined) consider(parsed - Date.now());
+			else considerNaive(parsed - Date.now());
+		}
+	}
+	// OpenCode Go compound remainder ("Resets in 2hr 15min"): the generic
+	// pattern only captures the leading "2hr", so add the trailing minutes.
+	const compoundResetMatch = RESET_IN_HR_MIN_PATTERN.exec(body);
+	if (compoundResetMatch?.[1] && compoundResetMatch[2]) {
+		const hours = Number.parseFloat(compoundResetMatch[1]);
+		const minutes = Number.parseFloat(compoundResetMatch[2]);
+		if (Number.isFinite(hours) && Number.isFinite(minutes) && hours >= 0 && minutes > 0) {
+			consider(hours * 60 * 60_000 + minutes * 60_000);
 		}
 	}
 	const accountResetMatch = WILL_RESET_IN_PATTERN.exec(body);
@@ -188,7 +241,9 @@ export function extractRetryHint(source: Response | Headers | null | undefined,
 			considerClamped(resetSeconds > 1_000_000_000 ? resetSeconds * 1000 - Date.now() : resetSeconds * 1000);
 		}
 	}
-	return longestMs ?? (retryNow ? 0 : undefined);
+	// Elapsed naive stamps were ignored before this change and stay ignored:
+	// only an explicit zero/expired relative signal is authoritative retry-now.
+	return longestMs ?? longestNaiveMs ?? (retryNow ? 0 : undefined);
 }
 
 function unitToMs(unit: string): number | undefined {
@@ -210,6 +265,10 @@ function unitToMs(unit: string): number | undefined {
 		case "hour":
 		case "hours":
 			return 60 * 60_000;
+		case "d":
+		case "day":
+		case "days":
+			return 24 * 60 * 60_000;
 		default:
 			return undefined;
 	}

package/src/file-lock.ts

@@ -22,6 +22,11 @@ export interface FileLockHandle {
 	release(): void;
 }
 
+/** An exclusive OS-backed lease. Releasing an already released handle is safe. */
+export interface FileLockHandle {
+	release(): void;
+}
+
 const DEFAULT_OPTIONS: Required<FileLockOptions> = {
 	retries: 50,
 	retryDelayMs: 100,
@@ -51,6 +56,19 @@ export async function acquireFileLock(filePath: string, options: FileLockOptions
 	throw new Error(`Failed to acquire lock for ${filePath} after ${opts.retries} attempts`);
 }
 
+function acquireLockSync(filePath: string, options: FileLockOptions = {}): NativeFileLock {
+	const opts = { ...DEFAULT_OPTIONS, ...options };
+	const lockPath = getLockPath(filePath);
+
+	for (let attempt = 0; attempt < opts.retries; attempt++) {
+		const lock = tryAcquireLock(lockPath);
+		if (lock) return lock;
+		if (attempt + 1 < opts.retries && opts.retryDelayMs > 0) Bun.sleepSync(opts.retryDelayMs);
+	}
+
+	throw new Error(`Failed to acquire lock for ${filePath} after ${opts.retries} attempts`);
+}
+
 /** Run `fn` while holding an OS-backed exclusive lock for `filePath`. */
 export async function withFileLock<T>(
 	filePath: string,
@@ -65,6 +83,16 @@ export async function withFileLock<T>(
 	}
 }
 
+/** Run synchronous `fn` while holding an OS-backed exclusive lock for `filePath`. */
+export function withFileLockSync<T>(filePath: string, fn: () => T, options: FileLockOptions = {}): T {
+	const lock = acquireLockSync(filePath, options);
+	try {
+		return fn();
+	} finally {
+		lock.release();
+	}
+}
+
 /**
  * Test-only acquisition handle for forcing ownership handoffs. This is not
  * part of the supported package API.

package/src/format.ts

@@ -58,6 +58,22 @@ export function formatBytes(bytes: number): string {
 	return `${(bytes / (1024 * 1024 * 1024)).toFixed(1)}GB`;
 }
 
+/**
+ * Count `\n` code units via native `indexOf` — no split array, roughly an
+ * order of magnitude cheaper than a per-code-unit loop on multi-MiB text.
+ * Line-count semantics are the caller's (empty text is 0 or 1 lines
+ * depending on the contract).
+ */
+export function countNewlines(text: string): number {
+	let count = 0;
+	let pos = text.indexOf("\n");
+	while (pos !== -1) {
+		count++;
+		pos = text.indexOf("\n", pos + 1);
+	}
+	return count;
+}
+
 /**
  * Truncate a string to maxLen characters, appending an ellipsis if truncated.
  * For display-width-aware truncation (terminals), use truncateToWidth from @linxiraos/pi-tui.

package/src/index.ts

@@ -4,12 +4,12 @@ export * from "./binary";
 export * from "./color";
 export * from "./dirs";
 export * from "./env";
+export * from "./executable";
 export * from "./fetch-retry";
 export * from "./file-lock";
 export * from "./format";
 export * from "./frontmatter";
 export * from "./fs-error";
-export * from "./glob";
 export * from "./incoming-json";
 export * from "./json";
 export * from "./json-parse";
@@ -40,6 +40,7 @@ export * from "./tls-fetch";
 export * from "./type-guards";
 export * from "./version";
 export * from "./which";
+export * from "./yaml-config";
 
 function isPlainObject(val: object): val is Record<string, unknown> {
 	return Object.getPrototypeOf(val) === Object.prototype || Array.isArray(val);

package/src/json.ts

@@ -19,7 +19,18 @@ export function tryParseJson<T = unknown>(content: string): T | null {
  * only lossless JSON representation.
  */
 export function stringifyJson(value: unknown, space?: string | number): string | undefined {
-	return JSON.stringify(value, (_key, item) => (typeof item === "bigint" ? item.toString() : item), space);
+	// Fast path: a replacer forces the slow stringify on every call, but
+	// bigint payloads are vanishingly rare. Try plain stringify first and
+	// retry with the coercing replacer only on TypeError (the only error a
+	// bigint raises). A TypeError from elsewhere (circular value, throwing
+	// toJSON) recurs on the retry and surfaces from that second walk, so
+	// stateful serializers ahead of a bigint run twice on that path.
+	try {
+		return JSON.stringify(value, undefined, space);
+	} catch (error) {
+		if (!(error instanceof TypeError)) throw error;
+		return JSON.stringify(value, (_key, item) => (typeof item === "bigint" ? item.toString() : item), space);
+	}
 }
 
 function stableJsonClone(value: unknown): unknown {

package/src/logger/rotating-file.ts

@@ -47,6 +47,12 @@ export class RotatingFileSink {
 	#activePath: string | undefined;
 	#activeBytes = 0;
 	#closed = false;
+	// Held append fd: the old code did open+write+close per line
+	// (appendFileSync) plus a throwaway open in the constructor. A single fd
+	// per active file removes two syscalls per log line; it is reopened on
+	// rotation and closed on close()/rotation (required for Windows
+	// delete-on-prune semantics).
+	#fd: number | undefined;
 
 	constructor(options: RotatingFileOptions) {
 		this.#directory = options.directory;
@@ -61,26 +67,57 @@ export class RotatingFileSink {
 		const activePath = this.#activePath;
 		if (activePath) {
 			this.#registerFile(activePath, now.getTime());
-			fs.closeSync(fs.openSync(activePath, "a"));
+			this.#openFd(activePath);
+		}
+	}
+
+	#openFd(filePath: string): void {
+		this.#closeFd();
+		this.#fd = fs.openSync(filePath, "a");
+	}
+
+	#closeFd(): void {
+		if (this.#fd !== undefined) {
+			try {
+				fs.closeSync(this.#fd);
+			} catch {
+				// Best-effort: the fd may already be invalid after rotation.
+			}
+			this.#fd = undefined;
 		}
 	}
 
 	/** Append one already-formatted log record. */
 	write(line: string): void {
 		if (this.#closed) return;
+		const prevPath = this.#activePath;
 		const now = new Date();
 		this.#selectFile(this.#localDay(now));
 		const activePath = this.#activePath;
 		if (!activePath) return;
+		// Rotation moved the active path: close the old descriptor BEFORE
+		// registering the new path, because registration prunes beyond
+		// maxFiles — on Windows the pruned predecessor cannot be deleted
+		// while still open, which would leak it (audit entry removed, file
+		// left on disk, retention unbounded).
+		if (activePath !== prevPath) this.#closeFd();
 		this.#registerFile(activePath, now.getTime());
+		if (this.#fd === undefined) this.#openFd(activePath);
 		const record = `${line}${os.EOL}`;
-		fs.appendFileSync(activePath, record, "utf8");
-		this.#activeBytes += Buffer.byteLength(record);
+		const buf = Buffer.from(record, "utf8");
+		let off = 0;
+		while (off < buf.length) {
+			const written = fs.writeSync(this.#fd!, buf, off);
+			if (written <= 0) break;
+			off += written;
+		}
+		this.#activeBytes += buf.length;
 	}
 
 	/** Stop accepting records. Synchronous writes require no drain phase. */
 	close(): void {
 		this.#closed = true;
+		this.#closeFd();
 	}
 
 	#localDay(date: Date): string {

package/src/logger.ts

@@ -152,6 +152,19 @@ function pruneStaleProcessLogs(dir: string): void {
 	}
 }
 
+const scheduledPruneDirs = new Set<string>();
+
+/** Run shared retention only after logger construction has returned to the event loop. */
+function schedulePruneStaleProcessLogs(dir: string): void {
+	if (scheduledPruneDirs.has(dir)) return;
+	scheduledPruneDirs.add(dir);
+	const immediate = setImmediate(() => {
+		scheduledPruneDirs.delete(dir);
+		pruneStaleProcessLogs(dir);
+	});
+	immediate.unref();
+}
+
 /** Ensure a logs directory exists; return the resolved path. */
 function ensureDir(dir: string): string {
 	if (!fs.existsSync(dir)) {
@@ -237,7 +250,7 @@ function formatLogInfo(info: NormalizedLogInfo): string {
 /** Build a rotating file sink with process-local rotation and shared retention. */
 function makeFileTransport(dir?: string): RotatingFileSink {
 	const logsDir = ensureDir(dir ?? getLogsDir());
-	pruneStaleProcessLogs(logsDir);
+	schedulePruneStaleProcessLogs(logsDir);
 	return new RotatingFileSink({
 		directory: logsDir,
 		filenamePrefix: "zeta",
@@ -276,12 +289,11 @@ function getLocalTransports(): LocalTransports {
 
 function emitLocally(level: LogLevel, message: string, context: Record<string, unknown> | undefined): void {
 	const transports = getLocalTransports();
-	const info = normalizeLogInfo(level, message, context);
 	if (!transports.file && !transports.console) return;
-
+	const info = normalizeLogInfo(level, message, context);
 	const line = formatLogInfo(info);
 	if (transports.file) transports.file.write(line);
-	if (transports.console) fs.writeSync(1, `${formatLogInfo(info)}${os.EOL}`);
+	if (transports.console) fs.writeSync(1, `${line}${os.EOL}`);
 }
 
 /**

package/src/mime.ts

@@ -1,7 +1,6 @@
 import { peekFile, peekFileSync } from "./peek-file";
 
-const DEFAULT_IMAGE_METADATA_HEADER_BYTES = 256 * 1024;
-
+export const IMAGE_METADATA_HEADER_BYTES = 256 * 1024;
 const PNG_MAGIC = Buffer.from([0x89, 0x50, 0x4e, 0x47, 0x0d, 0x0a, 0x1a, 0x0a]);
 const JPEG_MAGIC = Buffer.from([0xff, 0xd8, 0xff]);
 const WEBP_RIFF_MAGIC = Buffer.from([0x52, 0x49, 0x46, 0x46]);
@@ -144,16 +143,13 @@ export function parseImageMetadata(header: Uint8Array): ImageMetadata | null {
 	);
 }
 
-export function readImageMetadataSync(
-	filePath: string,
-	maxBytes = DEFAULT_IMAGE_METADATA_HEADER_BYTES,
-): ImageMetadata | null {
+export function readImageMetadataSync(filePath: string, maxBytes = IMAGE_METADATA_HEADER_BYTES): ImageMetadata | null {
 	return peekFileSync(filePath, maxBytes, parseImageMetadata);
 }
 
 export function readImageMetadata(
 	filePath: string,
-	maxBytes = DEFAULT_IMAGE_METADATA_HEADER_BYTES,
+	maxBytes = IMAGE_METADATA_HEADER_BYTES,
 ): Promise<ImageMetadata | null> {
 	return peekFile(filePath, maxBytes, parseImageMetadata);
 }

package/src/path.ts

@@ -40,3 +40,17 @@ export function stripWindowsExtendedLengthPathPrefix(
 
 	return filePath;
 }
+
+/**
+ * Test whether a path is fully qualified and drive-independent.
+ * On Windows, requires a drive letter with separator (e.g. `C:\`) or UNC (`\\server\share` or `//server/share`).
+ * On POSIX, requires an absolute path.
+ */
+export function isFullyQualifiedPath(filePath: string, platform: NodeJS.Platform = process.platform): boolean {
+	const p = platform === "win32" ? path.win32 : path.posix;
+	if (!p.isAbsolute(filePath)) return false;
+	if (platform === "win32") {
+		return /^[a-zA-Z]:[/\\]/.test(filePath) || /^[\\/]{2}[^\\/]/.test(filePath);
+	}
+	return true;
+}

package/src/peek-file.ts

@@ -1,67 +1,20 @@
 /**
  * Read the first `maxBytes` of a file (offset 0) and pass that slice to `op`.
  *
- * Buffers are reused to avoid allocating on every peek: sync uses one growable
- * `Uint8Array`; async uses a small fixed pool of `Buffer`s with a bounded wait
- * queue, falling back to a fresh allocation when the pool and queue are saturated
- * or when `maxBytes` exceeds the pool slot size.
+ * Synchronous peeks reuse one growable `Uint8Array`; asynchronous peeks allocate
+ * their result window so callback-retained slices cannot be changed by a later read.
  */
 import * as fs from "node:fs";
 
-/** Async pool slot size; larger peeks allocate ad hoc. */
-const POOLED_BUFFER_SIZE = 512;
-const ASYNC_POOL_SIZE = 10;
-/** Cap waiter queue so heavy concurrency does not queue unbounded; overflow uses alloc. */
-const MAX_ASYNC_WAITERS = 4;
 const INITIAL_SYNC_BUFFER_SIZE = 1024;
-const EMPTY_BUFFER = Buffer.alloc(0);
+const EMPTY_BUFFER = new Uint8Array(0);
 
-const asyncPool = Array.from({ length: ASYNC_POOL_SIZE }, () => Buffer.allocUnsafe(POOLED_BUFFER_SIZE));
-const availableAsyncPoolIndexes = Array.from({ length: ASYNC_POOL_SIZE }, (_, index) => index);
-const asyncPoolWaiters: Array<(index: number) => void> = [];
 let syncPool = new Uint8Array(INITIAL_SYNC_BUFFER_SIZE);
 
-/** Returns a pool slot index, or `-1` when the caller should use a standalone buffer. */
-function acquireAsyncPoolIndex(): Promise<number> | number {
-	const index = availableAsyncPoolIndexes.pop();
-	if (index !== undefined) {
-		return index;
-	}
-	if (asyncPoolWaiters.length >= MAX_ASYNC_WAITERS) {
-		return -1;
-	}
-	const { promise, resolve } = Promise.withResolvers<number>();
-	asyncPoolWaiters.push(resolve);
-	return promise;
-}
-
-function releaseAsyncPoolIndex(index: number): void {
-	if (index < 0) {
-		return;
-	}
-	const waiter = asyncPoolWaiters.shift();
-	if (waiter) {
-		waiter(index);
-		return;
-	}
-	availableAsyncPoolIndexes.push(index);
-}
-
-async function withAsyncPoolBuffer<T>(maxBytes: number, op: (buffer: Buffer) => Promise<T>): Promise<T> {
-	if (maxBytes <= 0) {
-		return op(EMPTY_BUFFER);
-	}
-	if (maxBytes > POOLED_BUFFER_SIZE) {
-		return op(Buffer.allocUnsafe(maxBytes));
-	}
-
-	const poolIndex = await acquireAsyncPoolIndex();
-	const buffer = poolIndex >= 0 ? asyncPool[poolIndex] : Buffer.allocUnsafe(maxBytes);
-	try {
-		return await op(buffer.subarray(0, maxBytes));
-	} finally {
-		releaseAsyncPoolIndex(poolIndex);
-	}
+function allocateWindow(length: number): Uint8Array {
+	const buffer = Buffer.allocUnsafe(length);
+	// A plain view preserves Uint8Array.slice semantics without zeroing bytes the read replaces.
+	return new Uint8Array(buffer.buffer, buffer.byteOffset, buffer.byteLength);
 }
 
 function withSyncPoolBuffer<T>(maxBytes: number, op: (buffer: Uint8Array) => T): T {
@@ -104,10 +57,9 @@ export async function peekFile<T>(filePath: string, maxBytes: number, op: (heade
 
 	const fileHandle = await fs.promises.open(filePath, "r");
 	try {
-		return await withAsyncPoolBuffer(maxBytes, async buffer => {
-			const { bytesRead } = await fileHandle.read(buffer, 0, buffer.byteLength, 0);
-			return op(buffer.subarray(0, bytesRead));
-		});
+		const buffer = allocateWindow(maxBytes);
+		const { bytesRead } = await fileHandle.read(buffer, 0, buffer.byteLength, 0);
+		return op(buffer.subarray(0, bytesRead));
 	} finally {
 		await fileHandle.close();
 	}
@@ -116,9 +68,8 @@ export async function peekFile<T>(filePath: string, maxBytes: number, op: (heade
 /**
  * Read up to the last `maxBytes` of `filePath` and pass that slice to `op`.
  *
- * The tail mirror of {@link peekFile}: same pooled-buffer strategy (no per-call
- * allocation for small reads), but the read is positioned at `size - len` so the
- * window ends at EOF. When the file is shorter than `maxBytes`, the whole file is
+ * The tail mirror of {@link peekFile}: the read is positioned at `size - len` so
+ * the window ends at EOF. When the file is shorter than `maxBytes`, the whole file is
  * returned. A multi-byte codepoint straddling the leading cut decodes to a
  * replacement char — callers that parse line-oriented tails drop the partial
  * leading line anyway.
@@ -135,10 +86,9 @@ export async function peekFileTail<T>(filePath: string, maxBytes: number, op: (t
 		if (len <= 0) {
 			return op(EMPTY_BUFFER);
 		}
-		return await withAsyncPoolBuffer(len, async buffer => {
-			const { bytesRead } = await fileHandle.read(buffer, 0, buffer.byteLength, size - len);
-			return op(buffer.subarray(0, bytesRead));
-		});
+		const buffer = allocateWindow(len);
+		const { bytesRead } = await fileHandle.read(buffer, 0, buffer.byteLength, size - len);
+		return op(buffer.subarray(0, bytesRead));
 	} finally {
 		await fileHandle.close();
 	}
@@ -168,7 +118,7 @@ export async function peekFileEnds<T>(
 		const headLen = prefixBytes > 0 ? Math.min(prefixBytes, size) : 0;
 		const tailLen = suffixBytes > 0 ? Math.min(suffixBytes, size) : 0;
 
-		const head = headLen > 0 ? Buffer.allocUnsafe(headLen) : EMPTY_BUFFER;
+		const head = headLen > 0 ? allocateWindow(headLen) : EMPTY_BUFFER;
 		const headBytesRead = headLen > 0 ? (await fileHandle.read(head, 0, head.byteLength, 0)).bytesRead : 0;
 		const headSlice = head.subarray(0, headBytesRead);
 
@@ -179,7 +129,7 @@ export async function peekFileEnds<T>(
 			return op(headSlice, headSlice.subarray(Math.max(0, headBytesRead - tailLen)));
 		}
 
-		const tail = Buffer.allocUnsafe(tailLen);
+		const tail = allocateWindow(tailLen);
 		const { bytesRead: tailBytesRead } = await fileHandle.read(tail, 0, tail.byteLength, size - tailLen);
 		return op(headSlice, tail.subarray(0, tailBytesRead));
 	} finally {