@linxiraos/pi-utils 1.1.20 → 1.1.23

package/CHANGELOG.md

@@ -2,13 +2,11 @@
 
 ## [Unreleased]
 
-## [1.1.20] - 2026-09-23
+## [1.1.23] - 2026-10-01
 
-- 版本线推进;`set-version.ts` 保留 manifest 原有缩进与行尾(tab+CRLF),版本 bump 不再产生全文件 diff;prerelease 版本号(semver `x.y.z-rc.N`)校验支持,拒绝空标识符/前导零/build metadata。
+## [1.1.22] - 2026-09-30
 
-## [1.1.19] - 2026-09-22
-
-- 版本线推进;本版无独立用户可见变化。
+- **CLI bin 命名**:新增 `CLI_BIN_NAME`(zeta-c),Usage/进程标题/补全驱动统一;配置根 `.zeta`、`ZETA_*`、`APP_NAME` 不变。
 
 ## [1.1.18] - 2026-09-22
 
@@ -17,3 +15,7 @@
 ## [1.1.16] - 2026-09-19
 
 - 上游 v18.2.5 同步:JSON 与缓存逻辑流线化重构、which 缓存改字符串键重写。
+- Optimized model configuration command execution by deduplicating requests and adding failure backoff
+- Prevented unnecessary credential command execution when runtime API keys are configured
+- Retained `readLines()` results no longer change when later chunks reuse the internal buffer.
+- Long sleeps honor elapsed time and re-arm after premature timer wakes without overflowing native timer delays.

package/README.md

@@ -1,6 +1,6 @@
 # @linxiraos/pi-utils
 
-Shared utilities for Zeta packages. Zero ceremony, Bun-first.
+Shared utilities for [omp](https://github.com/can1357/oh-my-pi) packages. Zero ceremony, Bun-first.
 
 ## Notable modules
 

package/THIRD-PARTY-NOTICES.txt

@@ -78,8 +78,8 @@ below.
 uutils coreutils (https://github.com/uutils/coreutils), MIT
 --------------------------------------------------------------------------------
 Covers: base32, base64, basename, cat, cksum (shared checksum machinery),
-b2sum, md5sum, sha1sum, sha224sum, sha256sum, sha384sum, sha512sum, comm, cut,
-date, dirname, head, hostname, ln, ls, mkdir, mktemp, mv, nproc, paste,
+b2sum, md5sum, sha1sum, sha224sum, sha256sum, sha384sum, sha512sum, comm, cp,
+cut, date, dirname, head, hostname, ln, ls, mkdir, mktemp, mv, nproc, paste,
 printenv, readlink, realpath, rm, seq, sort, stat, tac, tail, tee, touch, tr,
 truncate, uname, uniq, wc, whoami, yes.
 
@@ -293,7 +293,7 @@ MIT License
 Copyright (c) 2026 Sander Land
   (measured tokenizer vocabulary data, reconstruction model, and reference
   implementation: https://github.com/sanderland/ctok)
-Copyright (c) 2026 Can Bölük and the Oh My Pi contributors
+Copyright (c) 2026 Can Bölük and the omp contributors
 Copyright (c) 2026 Stencil Labs, Inc.
   (Rust implementation and the compact binary vocabulary encoding in
   crates/pi-natives/src/utok/claude)
@@ -335,43 +335,6 @@ This license allows the work and adaptations of it to be shared and used
 commercially, as long as it is attributed to Poppy Works. The font is bundled
 here (crates/pi-natives/src/fonts/Silver.ttf) as a CJK/Unicode bitmap fallback.
 
--------------------------------------------------------------------------------
-packages/utils/src/vendor/mermaid-ascii/NOTICE
-
-This directory contains an in-house Mermaid-diagram-to-ASCII renderer adapted
-from beautiful-mermaid (https://github.com/lukilabs/beautiful-mermaid), used
-under the MIT License.
-
-  Copyright (c) 2026 Craft Docs
-
-Only the ASCII rendering pipeline is ported (flowchart/state, sequence, class,
-ER, and xychart diagrams); the SVG renderer and its `elkjs` graph-layout
-dependency, the browser entry point, and the SVG theme/style modules were
-dropped. Terminal display width is reimplemented on `Bun.stringWidth`, and
-inline label formatting (HTML tags, markdown emphasis) is reduced to plain text
-for ASCII output. Layout and edge-routing logic is preserved faithfully so
-ASCII output matches the upstream package.
-
-MIT License
-
-Permission is hereby granted, free of charge, to any person obtaining a copy
-of this software and associated documentation files (the "Software"), to deal
-in the Software without restriction, including without limitation the rights
-to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
-copies of the Software, and to permit persons to whom the Software is
-furnished to do so, subject to the following conditions:
-
-The above copyright notice and this permission notice shall be included in all
-copies or substantial portions of the Software.
-
-THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
-IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
-FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
-AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
-LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
-OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
-SOFTWARE.
-
 -------------------------------------------------------------------------------
 packages/coding-agent/src/markit/NOTICE
 

package/dist/types/dirs.d.ts

@@ -10,8 +10,16 @@
  * move data to the new locations. No filesystem existence checks are performed
  * — if the env var is set, zeta trusts that the migration has been done.
  */
-/** App name (e.g. "zeta") */
+/** App name (e.g. "zeta") — product-level identity: config-dir root, log file
+ * names, provider attribution headers, splash wordmark. NOT the CLI command. */
 export declare const APP_NAME: string;
+/** CLI binary name (`npm i -g @linxiraos/zeta` installs `zeta-c`, with
+ * `zeta-cli` and `zetacode` as aliases). Every user-facing "run this command"
+ * string and process title uses this; the bare `zeta` name belongs to the
+ * @linxiraos/main workspace product, not this package. */
+export declare const CLI_BIN_NAME: string;
+/** Public homepage that inference gateways (OpenRouter, Vercel AI Gateway) credit our traffic to. */
+export declare const APP_URL: string;
 /** Config directory name (e.g. ".zeta") */
 export declare const CONFIG_DIR_NAME: string;
 /** Ordered main settings filenames: canonical write target first, legacy-compatible YAML fallback second. */
@@ -131,7 +139,16 @@ export declare function getProjectAgentDir(cwd?: string): string;
 export declare function getReportsDir(): string;
 /** Get the logs directory (~/.zeta/logs). */
 export declare function getLogsDir(): string;
-/** Get this process's dated log path (~/.zeta/logs/zeta.YYYY-MM-DD.PID.log). */
+/**
+ * Local-timezone `YYYY-MM-DD` day key (zero-padded), formatted exactly like
+ * the rotating log sink's file naming: log files are named `omp.<day>.<pid>.log`
+ * with the LOCAL day, not the UTC day `toISOString()` yields. Anything that
+ * computes "today's" log path or matches same-day log files by name must use
+ * this key, or between local midnight and UTC midnight it points at files that
+ * do not exist (e.g. 00:00–08:00 in UTC+8).
+ */
+export declare function localDay(date: Date): string;
+/** Get this process's dated log path (~/.zeta/logs/zeta.YYYY-MM-DD.PID.log, local-day named like the rotating sink). */
 export declare function getLogPath(date?: Date, pid?: number): string;
 /**
  * Get the plugins directory (~/.zeta/plugins or its XDG equivalent).
@@ -202,8 +219,6 @@ export declare function getAutoQaDbPath(): string;
 export declare function hashPath(absPath: string): string;
 /** Get the path to a single worktree directory (~/.zeta/wt/<segment>). */
 export declare function getWorktreeDir(segment: string): string;
-/** Get the GPU cache path (~/.zeta/gpu_cache.json). */
-export declare function getGpuCachePath(): string;
 /**
  * Get the GitHub view cache database path (~/.zeta/cache/github-cache.db).
  * Honors the `OMP_GITHUB_CACHE_DB` env var when set so tests can isolate the
@@ -215,6 +230,11 @@ export declare function getGithubCacheDbPath(): string;
  * Honors `OMP_COMMIT_CACHE_DB` so tests and operators can isolate the cache.
  */
 export declare function getCommitCacheDbPath(): string;
+/**
+ * Get the judgment answer cache database path (~/.zeta/cache/judgment-cache.db).
+ * Honors `OMP_JUDGMENT_CACHE_DB` so tests and operators can isolate the cache.
+ */
+export declare function getJudgmentCacheDbPath(): string;
 /** Get the legacy Pi extension parse cache database path. */
 export declare function getLegacyPiExtensionCacheDbPath(): string;
 /**
@@ -259,6 +279,8 @@ export declare function getTinyModelsCacheDir(agentDir?: string): string;
 export declare function getDocumentConversionCacheDir(agentDir?: string): string;
 /** Get the per-project composer speculative cache directory (~/.zeta/agent/cache/composer; XDG default: $XDG_CACHE_HOME/zeta/cache/composer). */
 export declare function getComposerCacheDir(agentDir?: string): string;
+/** Get the composer speculative cache database (~/.zeta/agent/cache/composer.db; XDG default: $XDG_CACHE_HOME/zeta/cache/composer.db). */
+export declare function getComposerCacheDbPath(agentDir?: string): string;
 /** Get the sessions directory (~/.zeta/agent/sessions). */
 export declare function getSessionsDir(agentDir?: string): string;
 /** Get the content-addressed blob store directory (~/.zeta/agent/blobs). */

package/dist/types/file-lock.d.ts

@@ -5,12 +5,8 @@ export interface FileLockOptions {
     retries?: number;
     /** Delay between acquisition attempts. */
     retryDelayMs?: number;
-    /** Maximum age of the lock before it is considered stale and can be broken. */
-    staleMs?: number;
-}
-/** An exclusive OS-backed lease. Releasing an already released handle is safe. */
-export interface FileLockHandle {
-    release(): void;
+    /** Cancel acquisition while waiting for another process to release the resource. */
+    signal?: AbortSignal;
 }
 /** An exclusive OS-backed lease. Releasing an already released handle is safe. */
 export interface FileLockHandle {

package/dist/types/fs-open.d.ts

@@ -0,0 +1,16 @@
+/**
+ * `fs.openSync` with close-on-exec, matching Node's default.
+ *
+ * libuv adds `O_CLOEXEC` inside `uv__fs_open`, so on Node every `fs` descriptor
+ * dies at `exec`. Bun's `fs.open*` does not, and descriptors it returns survive
+ * into any child spawned through a path that does not close strays itself — the
+ * bash tool's shell `fork`/`exec`s user commands and hands them the lot. Use
+ * this for every descriptor kept open past such a spawn (session transcripts,
+ * logs, spools); a child must never hold a writable handle to them (#13224).
+ *
+ * Flags are numeric only: the bit cannot be OR-ed into `"a"`/`"w+"` strings.
+ *
+ * @example
+ * const fd = openCloexecSync(logPath, fs.constants.O_WRONLY | fs.constants.O_CREAT | fs.constants.O_APPEND);
+ */
+export declare function openCloexecSync(filePath: string, flags: number, mode?: number): number;

package/dist/types/index.d.ts

@@ -10,6 +10,7 @@ export * from "./file-lock.js";
 export * from "./format.js";
 export * from "./frontmatter.js";
 export * from "./fs-error.js";
+export * from "./fs-open.js";
 export * from "./incoming-json.js";
 export * from "./json.js";
 export * from "./json-parse.js";
@@ -42,3 +43,15 @@ export * from "./version.js";
 export * from "./which.js";
 export * from "./yaml-config.js";
 export declare function structuredCloneJSON<T>(value: T): T;
+/**
+ * Deep-copies a JSON-shaped tree (arrays and plain or null-prototype objects)
+ * so later mutation of the source can never reach the copy. Strings and other
+ * primitives are immutable and shared, so the cost is O(containers) instead of
+ * `structuredClone`'s O(bytes) — the difference matters for hot paths that
+ * re-copy large string payloads (e.g. streamed tool-call arguments) per delta.
+ *
+ * Copies own enumerable string keys only. Any other object (class instance,
+ * Date, Map, inherited-prototype object) is copied with {@link structuredCloneJSON}.
+ * Not cycle-safe: callers MUST pass acyclic data, as any JSON-serializable value is.
+ */
+export declare function cloneJsonTree<T>(value: T): T;

package/dist/types/logger/rotating-file.d.ts

@@ -6,6 +6,15 @@ export interface RotatingFileOptions {
     readonly auditFile: string;
     readonly maxBytes: number;
     readonly maxFiles: number;
+    /**
+     * Called with the new active file path whenever the sink opens a different
+     * file — construction, local-day rotation, and size rotation alike.
+     *
+     * Consumers that hold their own descriptor on the active log (the macOS
+     * stderr guard dup2s it onto fd 2) use this to follow the sink instead of
+     * staying pinned to a file the sink later prunes.
+     */
+    readonly onRotate?: (filePath: string) => void;
 }
 /** Synchronous append sink with local-day and size rotation plus bounded retention. */
 export declare class RotatingFileSink {

package/dist/types/mermaid-ascii.d.ts

@@ -1,7 +1,15 @@
-import { type AsciiRenderOptions } from "./vendor/mermaid-ascii/index.js";
-export type { AsciiRenderOptions as MermaidAsciiRenderOptions };
-export declare function renderMermaidAscii(source: string, options?: AsciiRenderOptions): string;
-export declare function renderMermaidAsciiSafe(source: string, options?: AsciiRenderOptions): string | null;
+import { type MermaidRenderOptions, renderMermaidAscii } from "@linxiraos/pi-natives";
+/**
+ * Native Mermaid → ASCII/Unicode renderer (flowchart, state, sequence, class,
+ * ER, xychart). Synchronous because callers render inside the compositor;
+ * throws on empty input, an unknown flowchart header, or an invalid
+ * `direction`/`colorMode` value.
+ */
+export { renderMermaidAscii };
+/** Options for {@link renderMermaidAscii}; every field optional. */
+export type MermaidAsciiRenderOptions = MermaidRenderOptions;
+/** {@link renderMermaidAscii}, returning `null` instead of throwing. */
+export declare function renderMermaidAsciiSafe(source: string, options?: MermaidAsciiRenderOptions): string | null;
 /**
  * Extract mermaid code blocks from markdown text.
  */

package/dist/types/postmortem.d.ts

@@ -119,6 +119,29 @@ export declare function registerWorkerIpcFaultHandler(handler: (err: Error) => v
  * when the last registrant unregisters.
  */
 export declare function registerStdioDisconnectHandling(): () => void;
+/**
+ * Fail a process entry whose event loop drains while `work` is still pending.
+ *
+ * The CLI starts from a floating `runCli()` call because top-level await breaks
+ * `--bytecode` builds. When a one-shot command awaits a promise that never
+ * settles and holds no live handle, the loop drains and Bun exits 0 without
+ * output: an unfinished command reported as success. `beforeExit` fires in
+ * that state; explicit exits (`process.exit`, {@link quit},
+ * {@link exitProcess}, the signal handlers) never emit it.
+ *
+ * `beforeExit` alone is not the verdict: on Windows Bun emits it while I/O is
+ * still in flight and then keeps running the loop, so a command that goes on
+ * to complete must keep its own exit code (#13470). The verdict is taken at
+ * `exit` instead, and only when the last `beforeExit` was final: an unref'd
+ * timer armed there runs only if the loop turns again, clearing the mark
+ * before a later explicit exit. Any later drain emits `beforeExit` again and
+ * re-arms it, so other `beforeExit` listeners (LSP shutdown) still run before
+ * the process exits 1.
+ *
+ * `describe` names what was running (e.g. the resolved subcommand) at report
+ * time; it must return only a command name, never user arguments.
+ */
+export declare function reportUnsettledEntry(work: Promise<unknown>, describe?: () => string | undefined): void;
 /**
  * Mark an error as expected cleanup fallout so the global fatal handlers
  * downgrade it to a log line instead of tearing down the process. Use for

package/dist/types/procmgr.d.ts

@@ -65,6 +65,9 @@ export declare function resolveWindowsShell(env?: Record<string, string | undefi
  *    {@link resolveWindowsShell}) — never fails
  * 3. On Unix: $SHELL if bash/zsh, then fallback paths
  * 4. Fallback: sh
+ *
+ * Custom and auto-resolved configs are cached separately, so clearing
+ * `shellPath` mid-process immediately falls back to the platform default.
  */
 export declare function getShellConfig(customShellPath?: string, options?: ShellConfigOptions): ShellConfig;
 /**

package/dist/types/stderr-guard.d.ts

@@ -1,16 +1,35 @@
 export interface SuppressTerminalStderrOptions {
-    /** Redirect target path; defaults to today's omp log file, then /dev/null. */
+    /**
+     * Redirect target path; defaults to the log file the rotating sink last
+     * reported (see {@link setStderrRedirectTarget}), then today's omp log
+     * file, then /dev/null.
+     */
     redirectPath?: string;
-    /** Bypass the macOS + same-terminal gate. Tests only. */
+    /** Bypass the same-terminal gate. Tests only. */
     force?: boolean;
 }
 /**
  * Redirect fd 2 away from the terminal while the TUI owns the viewport.
  * Returns true when suppression is (already) active. No-op — returning
- * false — off macOS, when stderr does not target the stdout terminal, or
- * when the libc fd ops are unavailable.
+ * false — when stderr does not target the stdout terminal or when libc fd
+ * operations are unavailable.
  */
 export declare function suppressTerminalStderr(options?: SuppressTerminalStderrOptions): boolean;
+/**
+ * Point fd 2 at `logPath`, the log file the rotating sink is currently
+ * writing.
+ *
+ * The logger calls this on every sink rotation. Without it fd 2 keeps the
+ * descriptor opened at TUI start, so after local midnight raw stderr — this
+ * process's and every child that inherited fd 2 — keeps landing in the
+ * previous day's file, which the sink eventually prunes out from under it.
+ *
+ * The path is recorded even while suppression is inactive, so a later
+ * {@link suppressTerminalStderr} redirects to the live file instead of
+ * re-deriving a dated name. Best-effort: if the new file cannot be opened,
+ * fd 2 keeps its current target.
+ */
+export declare function setStderrRedirectTarget(logPath: string): void;
 /**
  * Re-point fd 2 at the saved terminal stderr. Safe to call unconditionally:
  * no-op when suppression is not active. Called at every terminal-ownership

package/dist/types/stream.d.ts

@@ -74,7 +74,13 @@ export declare function readSseJson<T>(stream: ReadableStream<Uint8Array>, signa
  * which is the safe direction — each is classified as text rather than trusted as
  * an event object.
  */
-export declare function readSseJsonOrText<T>(stream: ReadableStream<Uint8Array>, signal?: AbortSignal, onEvent?: SseEventObserver): AsyncGenerator<T | string>;
+export declare function readSseJsonOrText<T>(stream: ReadableStream<Uint8Array>, signal?: AbortSignal, onEvent?: SseEventObserver, 
+/**
+ * Called when iteration ends on the OpenAI `[DONE]` sentinel. Lets a
+ * consumer tell a server-agreed end from a bare EOF without attaching an
+ * `onEvent` observer (which turns on per-line raw capture).
+ */
+onDone?: () => void): AsyncGenerator<T | string>;
 /**
  * A single Server-Sent Event dispatched on a blank-line boundary.
  *
@@ -95,12 +101,13 @@ export interface ServerSentEvent {
      * Decoded wire lines for this event (`event:`/`data:`/etc.), for the
      * diagnostic pipeline. Populated only when the reader opts in via
      * {@link ReadSseEventsOptions.captureRaw} (or attaches an `onSseEvent`
-     * observer to the JSON readers, which opt in automatically); otherwise
-     * `[]`. Direct `readSseEvents` callers that need wire text must pass
+     * observer to the JSON readers, which opt in automatically); otherwise a
+     * shared, frozen empty array — copy or reassign it, never mutate it in
+     * place. Direct `readSseEvents` callers that need wire text must pass
      * `{ captureRaw: true }` — the field is allocation-free by default so
      * the token path pays no per-frame array/slice cost.
      */
-    raw: string[];
+    raw: readonly string[];
     id?: string;
     retry?: number;
 }

package/package.json

@@ -1,6 +1,6 @@
 {
 	"name": "@linxiraos/pi-utils",
-	"version": "1.1.20",
+	"version": "1.1.23",
 	"description": "Shared utilities for pi packages",
 	"keywords": [
 		"utilities",
@@ -54,7 +54,7 @@
 		"fmt": "oxfmt --no-error-on-unmatched-pattern 'src/**/*.{ts,tsx}' '{test,bench,examples,scripts}/**/*.ts' '*.ts'"
 	},
 	"dependencies": {
-		"@linxiraos/pi-natives": "1.1.20"
+		"@linxiraos/pi-natives": "1.1.23"
 	},
 	"devDependencies": {
 		"@types/bun": "^1.3.14"

package/src/cli.ts

@@ -463,7 +463,7 @@ export async function run(opts: RunOptions): Promise<void> {
 	}
 
 	// Per-command help: load only the requested command. Loading the full
-	// command table here would make `omp <cmd> --help` hang or crash whenever
+	// command table here would make `zeta <cmd> --help` hang or crash whenever
 	// any *unrelated* command module misbehaves at import time.
 	if (commandArgv.includes("--help") || commandArgv.includes("-h")) {
 		const entry = findEntry(opts.commands, commandId);

package/src/dirs.ts

@@ -14,12 +14,23 @@
 import * as fs from "node:fs";
 import * as os from "node:os";
 import * as path from "node:path";
+import { expandWindowsLongPath } from "@linxiraos/pi-natives/path";
 import { engines, version } from "../package.json" with { type: "json" };
 import { isEnoent, isEnotdir } from "./fs-error";
 
-/** App name (e.g. "zeta") */
+/** App name (e.g. "zeta") — product-level identity: config-dir root, log file
+ * names, provider attribution headers, splash wordmark. NOT the CLI command. */
 export const APP_NAME: string = "zeta";
 
+/** CLI binary name (`npm i -g @linxiraos/zeta` installs `zeta-c`, with
+ * `zeta-cli` and `zetacode` as aliases). Every user-facing "run this command"
+ * string and process title uses this; the bare `zeta` name belongs to the
+ * @linxiraos/main workspace product, not this package. */
+export const CLI_BIN_NAME: string = "zeta-c";
+
+/** Public homepage that inference gateways (OpenRouter, Vercel AI Gateway) credit our traffic to. */
+export const APP_URL: string = "https://linxira-os.github.io/zeta/";
+
 /** Config directory name (e.g. ".zeta") */
 export const CONFIG_DIR_NAME: string = ".zeta";
 
@@ -140,6 +151,11 @@ function standardizeMacOSPath(p: string): string {
 	return p;
 }
 
+/** Keep the current directory's spelling while expanding Windows 8.3 aliases. */
+function standardizeProjectPath(p: string): string {
+	return process.platform === "win32" ? expandWindowsLongPath(p) : standardizeMacOSPath(p);
+}
+
 export function resolveEquivalentPath(inputPath: string): string {
 	const resolvedPath = path.resolve(inputPath);
 	try {
@@ -186,29 +202,33 @@ let projectDir: string | undefined;
 /** Get the project directory. */
 export function getProjectDir(): string {
 	if (projectDir === undefined) {
+		let cwd: string | undefined;
 		try {
-			projectDir = standardizeMacOSPath(process.cwd());
+			cwd = process.cwd();
 		} catch {
 			const candidates = [process.env.PWD, os.homedir(), os.tmpdir()];
 			for (const candidate of candidates) {
 				if (!candidate || !path.isAbsolute(candidate)) continue;
 				try {
 					process.chdir(candidate);
-					projectDir = standardizeMacOSPath(candidate);
+					cwd = candidate;
 					break;
 				} catch {}
 			}
-			if (projectDir === undefined) {
+			if (cwd === undefined) {
 				throw new Error("Unable to determine an accessible working directory");
 			}
 		}
+		// Normalize outside the fallback: a native-addon failure is not an inaccessible cwd,
+		// and must surface as itself instead of relocating the process.
+		projectDir = standardizeProjectPath(cwd);
 	}
 	return projectDir;
 }
 
 /** Set the project directory. */
 export function setProjectDir(dir: string): void {
-	const resolved = standardizeMacOSPath(path.resolve(dir));
+	const resolved = standardizeProjectPath(path.resolve(dir));
 	process.chdir(resolved);
 	projectDir = resolved;
 }
@@ -581,9 +601,21 @@ export function getLogsDir(): string {
 	return dirs.rootSubdir("logs", "state");
 }
 
-/** Get this process's dated log path (~/.zeta/logs/zeta.YYYY-MM-DD.PID.log). */
+/**
+ * Local-timezone `YYYY-MM-DD` day key (zero-padded), formatted exactly like
+ * the rotating log sink's file naming: log files are named `omp.<day>.<pid>.log`
+ * with the LOCAL day, not the UTC day `toISOString()` yields. Anything that
+ * computes "today's" log path or matches same-day log files by name must use
+ * this key, or between local midnight and UTC midnight it points at files that
+ * do not exist (e.g. 00:00–08:00 in UTC+8).
+ */
+export function localDay(date: Date): string {
+	return `${date.getFullYear()}-${String(date.getMonth() + 1).padStart(2, "0")}-${String(date.getDate()).padStart(2, "0")}`;
+}
+
+/** Get this process's dated log path (~/.zeta/logs/zeta.YYYY-MM-DD.PID.log, local-day named like the rotating sink). */
 export function getLogPath(date = new Date(), pid = process.pid): string {
-	return path.join(getLogsDir(), `${APP_NAME}.${date.toISOString().slice(0, 10)}.${pid}.log`);
+	return path.join(getLogsDir(), `${APP_NAME}.${localDay(date)}.${pid}.log`);
 }
 
 /**
@@ -732,11 +764,6 @@ export function getWorktreeDir(segment: string): string {
 	return path.join(getWorktreesDir(), segment);
 }
 
-/** Get the GPU cache path (~/.zeta/gpu_cache.json). */
-export function getGpuCachePath(): string {
-	return dirs.rootSubdir("gpu_cache.json", "cache");
-}
-
 /**
  * Get the GitHub view cache database path (~/.zeta/cache/github-cache.db).
  * Honors the `OMP_GITHUB_CACHE_DB` env var when set so tests can isolate the
@@ -757,6 +784,16 @@ export function getCommitCacheDbPath(): string {
 	return dirs.rootSubdir(path.join("cache", "commit-inference.db"), "cache");
 }
 
+/**
+ * Get the judgment answer cache database path (~/.zeta/cache/judgment-cache.db).
+ * Honors `OMP_JUDGMENT_CACHE_DB` so tests and operators can isolate the cache.
+ */
+export function getJudgmentCacheDbPath(): string {
+	const override = process.env.OMP_JUDGMENT_CACHE_DB;
+	if (override) return override;
+	return dirs.rootSubdir(path.join("cache", "judgment-cache.db"), "cache");
+}
+
 /** Get the legacy Pi extension parse cache database path. */
 export function getLegacyPiExtensionCacheDbPath(): string {
 	return dirs.rootSubdir(path.join("cache", "legacy-pi-extension-cache.db"), "cache");
@@ -866,6 +903,11 @@ export function getComposerCacheDir(agentDir?: string): string {
 	return dirs.agentSubdir(agentDir, path.join("cache", "composer"), "cache");
 }
 
+/** Get the composer speculative cache database (~/.zeta/agent/cache/composer.db; XDG default: $XDG_CACHE_HOME/zeta/cache/composer.db). */
+export function getComposerCacheDbPath(agentDir?: string): string {
+	return dirs.agentSubdir(agentDir, path.join("cache", "composer.db"), "cache");
+}
+
 /** Get the sessions directory (~/.zeta/agent/sessions). */
 export function getSessionsDir(agentDir?: string): string {
 	return dirs.agentSubdir(agentDir, "sessions", "data");

package/src/file-lock.ts

@@ -5,6 +5,7 @@
  * mutexes, and other Unix platforms use `flock(2)` on `${filePath}.lock`.
  */
 import * as path from "node:path";
+import { scheduler } from "node:timers/promises";
 import { FileLock as NativeFileLock } from "@linxiraos/pi-natives";
 
 /** Controls bounded waiting when an advisory file lock is contended. */
@@ -13,8 +14,8 @@ export interface FileLockOptions {
 	retries?: number;
 	/** Delay between acquisition attempts. */
 	retryDelayMs?: number;
-	/** Maximum age of the lock before it is considered stale and can be broken. */
-	staleMs?: number;
+	/** Cancel acquisition while waiting for another process to release the resource. */
+	signal?: AbortSignal;
 }
 
 /** An exclusive OS-backed lease. Releasing an already released handle is safe. */
@@ -22,12 +23,7 @@ export interface FileLockHandle {
 	release(): void;
 }
 
-/** An exclusive OS-backed lease. Releasing an already released handle is safe. */
-export interface FileLockHandle {
-	release(): void;
-}
-
-const DEFAULT_OPTIONS: Required<FileLockOptions> = {
+const DEFAULT_OPTIONS = {
 	retries: 50,
 	retryDelayMs: 100,
 	staleMs: 0,
@@ -48,9 +44,10 @@ export async function acquireFileLock(filePath: string, options: FileLockOptions
 	const lockPath = getLockPath(filePath);
 
 	for (let attempt = 0; attempt < opts.retries; attempt++) {
+		opts.signal?.throwIfAborted();
 		const lock = tryAcquireLock(lockPath);
 		if (lock) return lock;
-		if (attempt + 1 < opts.retries) await Bun.sleep(opts.retryDelayMs);
+		if (attempt + 1 < opts.retries) await scheduler.wait(opts.retryDelayMs, { signal: opts.signal });
 	}
 
 	throw new Error(`Failed to acquire lock for ${filePath} after ${opts.retries} attempts`);
@@ -61,6 +58,7 @@ function acquireLockSync(filePath: string, options: FileLockOptions = {}): Nativ
 	const lockPath = getLockPath(filePath);
 
 	for (let attempt = 0; attempt < opts.retries; attempt++) {
+		opts.signal?.throwIfAborted();
 		const lock = tryAcquireLock(lockPath);
 		if (lock) return lock;
 		if (attempt + 1 < opts.retries && opts.retryDelayMs > 0) Bun.sleepSync(opts.retryDelayMs);

package/src/fs-open.ts

@@ -0,0 +1,31 @@
+/** Close-on-exec file opens for descriptors held past a child spawn. */
+import * as fs from "node:fs";
+
+/**
+ * `O_CLOEXEC`, which neither Node nor Bun exposes in `fs.constants`.
+ *
+ * Kernel ABI values: `0o2000000` on Linux, `0x0100_0000` on Darwin. Windows has
+ * no `exec` and its CRT handles are inherited only when a spawn explicitly asks
+ * for it, so the bit is 0 there — as it is on any other platform, where adding
+ * an unknown flag bit would be worse than leaving the descriptor inheritable.
+ */
+const O_CLOEXEC = process.platform === "linux" ? 0o2000000 : process.platform === "darwin" ? 0x0100_0000 : 0;
+
+/**
+ * `fs.openSync` with close-on-exec, matching Node's default.
+ *
+ * libuv adds `O_CLOEXEC` inside `uv__fs_open`, so on Node every `fs` descriptor
+ * dies at `exec`. Bun's `fs.open*` does not, and descriptors it returns survive
+ * into any child spawned through a path that does not close strays itself — the
+ * bash tool's shell `fork`/`exec`s user commands and hands them the lot. Use
+ * this for every descriptor kept open past such a spawn (session transcripts,
+ * logs, spools); a child must never hold a writable handle to them (#13224).
+ *
+ * Flags are numeric only: the bit cannot be OR-ed into `"a"`/`"w+"` strings.
+ *
+ * @example
+ * const fd = openCloexecSync(logPath, fs.constants.O_WRONLY | fs.constants.O_CREAT | fs.constants.O_APPEND);
+ */
+export function openCloexecSync(filePath: string, flags: number, mode?: number): number {
+	return fs.openSync(filePath, flags | O_CLOEXEC, mode);
+}