@linxiraos/pi-utils 1.2.1 → 1.3.1

package/CHANGELOG.md

@@ -1,5 +1,28 @@
 ## [Unreleased]
 
+## [1.3.1] - 2026-10-19
+
+### Added
+
+- Added `readSalvageableRows()` to read the rows of a damaged SQLite table that are still readable, skipping only the damaged pages ([#15751](https://github.com/can1357/oh-my-pi/pull/15751) by [@Shadorain](https://github.com/Shadorain))
+
+## [1.3.0] - 2026-10-18
+
+### Added
+
+- Added `sanitizeTextDeep()`, which applies `sanitizeText()` to every string in a JSON-shaped value without mutating it ([#15963](https://github.com/can1357/oh-my-pi/issues/15963))
+- Exported `sqliteFileIdentity()`, so a caller holding a long-lived SQLite connection can tell when its path now names a different file (e.g. after a corrupt store was quarantined and replaced) ([#14361](https://github.com/can1357/oh-my-pi/pull/14361) by [@F0Rextasy](https://github.com/F0Rextasy))
+- Added `slugify()`, the shared lowercase ASCII kebab-case helper with an optional `maxLength` ([#14283](https://github.com/can1357/oh-my-pi/pull/14283) by [@jaredlyon](https://github.com/jaredlyon))
+- Added `getMnemopiEmbedRuntimeDir()` for the shared mnemopi embedding server endpoints and logs.
+
+### Fixed
+
+- Fixed Windows archive extraction overwriting existing files or following existing symlinks when copying a symlink entry without symlink privileges ([#15931](https://github.com/can1357/oh-my-pi/pull/15931) by [@jchanghong023](https://github.com/jchanghong023)).
+- Fixed Markdown fence info-string parsing to keep backtick-containing backtick openers as paragraph text while accepting backticks in tilde info strings and Unicode line separators in either fence's info string ([#15928](https://github.com/can1357/oh-my-pi/pull/15928) by [@jchanghong023](https://github.com/jchanghong023)).
+- Fixed `parseHTML` treating `<link>` in RSS/Atom documents as an HTML void element, which dropped the URL text of RSS `<link>…</link>` ([#15954](https://github.com/can1357/oh-my-pi/issues/15954))
+- Fixed an unhandled rejection when a subprocess is spawned with an already-aborted signal ([#15750](https://github.com/can1357/oh-my-pi/pull/15750) by [@harshaygadekar](https://github.com/harshaygadekar))
+- Fixed `ChildProcess.kill()` silently leaving the child running when the native process handle could not be resolved or used; it now signals the child directly and escalates to SIGKILL after the grace period.
+
 ## [1.2.0] - 2026-10-12
 
 - Added `getNativeGrammarsDir()`, where the native addon loads downloaded tree-sitter grammars from (`~/.zeta/natives/grammars`).

package/THIRD-PARTY-NOTICES.txt

@@ -8,8 +8,8 @@ no rights in third-party code, fonts, data, or marks identified below.
 PYTHON DEPENDENCY DISTRIBUTION ROLE
 ===================================
 
-omp-rpc has no third-party runtime dependencies. robomp declares FastAPI,
-Uvicorn, HTTPX, Pydantic, pydantic-settings, python-dotenv, Click, and omp-rpc
+zeta-rpc has no third-party runtime dependencies. robomp declares FastAPI,
+Uvicorn, HTTPX, Pydantic, pydantic-settings, python-dotenv, Click, and zeta-rpc
 as ordinary installer-resolved dependencies. The Python wheels do not vendor
 those projects; each dependency remains a separately installed distribution
 carrying its own license metadata and files. Container/system assemblers must
@@ -79,9 +79,9 @@ uutils coreutils (https://github.com/uutils/coreutils), MIT
 --------------------------------------------------------------------------------
 Covers: base32, base64, basename, cat, cksum (shared checksum machinery),
 b2sum, md5sum, sha1sum, sha224sum, sha256sum, sha384sum, sha512sum, comm, cp,
-cut, date, dirname, head, hostname, ln, ls, mkdir, mktemp, mv, nproc, paste,
-printenv, readlink, realpath, rm, seq, sort, stat, tac, tail, tee, touch, tr,
-truncate, uname, uniq, wc, whoami, yes.
+cut, date, dirname, head, hostname, ln, ls, mkdir, mktemp, mv, nl, nproc,
+paste, printenv, readlink, realpath, rm, seq, sort, stat, tac, tail, tee,
+touch, tr, truncate, uname, uniq, wc, whoami, yes.
 
   Copyright (c) uutils developers
 
@@ -824,6 +824,56 @@ public licenses.
 
 Creative Commons may be contacted at creativecommons.org.
 
+-------------------------------------------------------------------------------
+scripts/brand/fonts/ANSI Shadow.flf, scripts/brand/fonts/mini.flf
+
+Two FIGlet font files from the standard FIGlet font distribution — the
+figlet.org font set shipped by figlet.js
+(https://github.com/patorjk/figlet.js/tree/master/fonts), fetched from
+figlet.js 1.8.0 — vendored so the welcome/splash brand art
+(`packages/tui/src/prompt/welcome.ts`) is generated reproducibly and offline
+by `bun scripts/brand/generate-logo-art.ts`. Both files are unmodified and
+retain their original FIGlet headers. They are build-time inputs only: no font
+file or font data is compiled into, or shipped with, a Zeta release artifact.
+The fonts' own headers carry their terms:
+
+- `ANSI Shadow.flf` — "ANSI Shadow". Author unknown ("Font Author: ?" in the
+  header); a TheDraw-archive font converted with the FIGlet font editor
+  (http://patorjk.com/figfont-editor). Distributed under the FIGlet font
+  license as carried by the standard FIGlet font set: free to use and
+  redistribute with the header intact.
+- `mini.flf` — "mini" by Glenn Chappell (4/93), from figlet release 2.1
+  (12 Aug 1994), "Includes ISO Latin-1"; modified by Paul Burton
+  <solution@earthlink.net> 12/96. Header grant: "Permission is hereby given to
+  modify this font, as long as the modifier's name is placed on a comment
+  line."
+
+FIGlet renderer — `figlet` 1.8.0 (https://github.com/patorjk/figlet.js), a
+root devDependency used only to generate the art at build time; it is not
+imported by any runtime bundle or shipped artifact.
+
+  MIT License
+
+  Copyright (C) 2014-present Patrick Gillespie and other contributors
+
+  Permission is hereby granted, free of charge, to any person obtaining a copy
+  of this software and associated documentation files (the "Software"), to deal
+  in the Software without restriction, including without limitation the rights
+  to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+  copies of the Software, and to permit persons to whom the Software is
+  furnished to do so, subject to the following conditions:
+
+  The above copyright notice and this permission notice shall be included in
+  all copies or substantial portions of the Software.
+
+  THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+  IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+  FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+  AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+  LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+  OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+  SOFTWARE.
+
 BUN / NPM DEPENDENCY INVENTORY
 ==============================
 This inventory is traversed from bun.lock, not from the host node_modules tree.

package/dist/types/dirs.d.ts

@@ -14,10 +14,11 @@
 /** App name (e.g. "zeta") — product-level identity: config-dir root, log file
  * names, provider attribution headers, splash wordmark. NOT the CLI command. */
 export declare const APP_NAME: string;
-/** CLI binary name (`npm i -g @linxiraos/zeta` installs `zetacode`, with
- * `zetacode` and `zeta-cli` as compatibility aliases). Every user-facing "run
- * this command" string and process title uses this; the bare `zeta` name
- * belongs to the @linxiraos/main workspace product, not this package. */
+/** CLI binary name (`npm i -g @linxiraos/zeta` installs exactly one bin,
+ * `zetacode` — the retired `zeta-c`/`zeta-cli` aliases are gone). Every
+ * user-facing "run this command" string and process title uses this; the
+ * bare `zeta` name belongs to the @linxiraos/main workbench product, where it
+ * prints the suite index, not this package. */
 export declare const CLI_BIN_NAME: string;
 /** Public homepage that inference gateways (OpenRouter, Vercel AI Gateway) credit our traffic to. */
 export declare const APP_URL: string;
@@ -168,20 +169,35 @@ export declare function getPluginsNodeModules(home?: string): string;
 /** Plugin manifest (~/.zeta/plugins/package.json). */
 export declare function getPluginsPackageJson(home?: string): string;
 /**
- * Plugin lock file (~/.zeta/plugins/omp-plugins.lock.json).
- *
- * The on-disk filename stays upstream-compatible: it carries per-plugin runtime
- * state (enabled flag, version), so renaming it would reset every existing
- * install's plugins on upgrade. That is the reason for the compat, not a
- * general rule — see `document/brand-surface-rules.md`, which classifies this
- * surface as DUAL (read both spellings, write the Zeta one) rather than
- * permanently frozen.
+ * Zeta-named lockfile, written going forward; `PLUGINS_LOCKFILE_LEGACY` stays
+ * readable so a pre-rename install keeps its state (see
+ * `document/brand-surface-rules.md`, DUAL: read both spellings, write the Zeta
+ * one). Every lockfile name in the tree comes from the two constants below —
+ * a writer on one spelling and a reader on the other is what emptied
+ * `zetacode plugin list` after the loader migrated the file.
  */
-export declare function getPluginsLockfile(home?: string): string;
-/** Zeta-named lockfile, written going forward; `getPluginsLockfile` is read first. */
 export declare const PLUGINS_LOCKFILE_CANONICAL = "zeta-plugins.lock.json";
 /** Pre-rename lockfile name still produced by earlier installs. */
 export declare const PLUGINS_LOCKFILE_LEGACY = "omp-plugins.lock.json";
+/**
+ * Plugin lock file (~/.zeta/plugins/zeta-plugins.lock.json) — the path every
+ * writer targets and every reader asks for first.
+ *
+ * It carries per-plugin runtime state (enabled flag, enabled features,
+ * version), so the rename is a migration rather than a reset: a lockfile left
+ * under the pre-rename name is still read (see
+ * {@link pluginsLockfileReadOrder}) and moved to this path on first load.
+ */
+export declare function getPluginsLockfile(home?: string): string;
+/**
+ * Read order for a lockfile path whose directory is a plugins root: the
+ * canonical name first, then the pre-rename one. Returned as absolute paths so
+ * a caller can hand each to `Bun.file` without re-deriving the directory.
+ *
+ * A path that is not one of the two names (a caller- or test-supplied path) is
+ * returned as-is and reads nothing else.
+ */
+export declare function pluginsLockfileReadOrder(lockfilePath: string): string[];
 /**
  * Normalize a plugin id into a safe single path segment (spec §4.2): lowercased,
  * every character outside `[a-z0-9._-]` (including `/` and `\`, so scoped npm
@@ -368,6 +384,8 @@ export declare function getDebugLogPath(agentDir?: string): string;
 export declare function getSecretPlaceholderKeyPath(): string;
 /** Directory holding the per-model tiny-worker sockets and logs (~/.zeta/run/tiny; XDG default: $XDG_STATE_HOME/zeta/run/tiny). */
 export declare function getTinyWorkerRuntimeDir(): string;
+/** Directory holding the per-model mnemopi embedding server endpoints and logs (~/.zeta/run/mnemopi; XDG default: $XDG_STATE_HOME/zeta/run/mnemopi). */
+export declare function getMnemopiEmbedRuntimeDir(): string;
 /** Root directory containing every per-project daemon runtime scope (~/.zeta/run/daemons; XDG default: $XDG_STATE_HOME/zeta/run/daemons). */
 export declare function getDaemonRuntimeRoot(): string;
 /** Get the daemon runtime directory for a project (~/.zeta/run/daemons/<hash>; XDG default: $XDG_STATE_HOME/zeta/run/daemons/<hash>). */

package/dist/types/incoming-json.d.ts

@@ -48,6 +48,18 @@
  * await args.key("path").value<string>(); // "a.ts"
  * ```
  */
+/**
+ * @internal exported for tests — monotonic count of members re-lexed by
+ * selecting scans: one per object member or array element a scan walked over
+ * on the way to the member it was asked for.
+ *
+ * Cursor resumption (see {@link ContainerIndex}) is what keeps a full
+ * traversal linear in the document instead of quadratic, and losing it
+ * changes nothing about the pulled values — only how many members get
+ * re-lexed. Read the live binding before and after a traversal to measure
+ * exactly that.
+ */
+export declare let rescannedMembers: number;
 /** Location component in a pulled JSON path: an object member name or an array index. */
 export type PullPathSegment = string | number;
 /** JSON shape observed by a started pull. */

package/dist/types/index.d.ts

@@ -32,6 +32,7 @@ export { AbortError, ChildProcess, Exception, NonZeroExitError } from "./ptree.j
 export * from "./release-assets.js";
 export * from "./runtime-install.js";
 export * from "./sanitize-text.js";
+export * from "./slugify.js";
 export * from "./snowflake.js";
 export * from "./sqlite.js";
 export * from "./stderr-guard.js";

package/dist/types/mime.d.ts

@@ -26,5 +26,26 @@ export type ImageMetadata = {
     hasAlpha?: boolean;
 };
 export declare function parseImageMetadata(header: Uint8Array): ImageMetadata | null;
+/** Why base64 image data is unusable; `undefined` when it is canonical and non-empty. */
+export type Base64ImageDataFailure = "invalid base64 image data" | "empty image data";
+/**
+ * Non-empty decoded bytes on success, or a validation failure reason, never both.
+ * Check `reason` before using `bytes`; successful base64 decoding does not establish
+ * that the bytes represent a supported or decodable image.
+ */
+export type Base64ImageDecodeResult = {
+    bytes: Buffer;
+    reason?: never;
+} | {
+    bytes?: never;
+    reason: Base64ImageDataFailure;
+};
+/**
+ * Validate standard base64 image data without decoding it. Padding may be omitted, but
+ * present padding must be canonical, the trailing bits must be zero, and the data non-empty.
+ */
+export declare function base64ImageDataFailureReason(data: string): Base64ImageDataFailure | undefined;
+/** Decode standard base64 image data under the {@link base64ImageDataFailureReason} rules. */
+export declare function decodeBase64ImageData(data: string): Base64ImageDecodeResult;
 export declare function readImageMetadataSync(filePath: string, maxBytes?: number): ImageMetadata | null;
 export declare function readImageMetadata(filePath: string, maxBytes?: number): Promise<ImageMetadata | null>;

package/dist/types/sanitize-text.d.ts

@@ -12,6 +12,17 @@
  * string after the control probe.
  */
 export declare function sanitizeText(text: string): string;
+/**
+ * Apply {@link sanitizeText} to every string value inside a JSON-shaped value.
+ * Only plain objects and arrays are walked; class instances, typed arrays, and
+ * cyclic back-references pass through untouched. Object keys are kept as-is.
+ *
+ * Returns the input reference when nothing changed, so reference-keyed caches
+ * stay warm; changed containers are copied and the input is never mutated.
+ * The iterative walk also handles arbitrarily deep tool-result `details`
+ * without exhausting the TUI's call stack.
+ */
+export declare function sanitizeTextDeep(value: unknown): unknown;
 /**
  * Escape the three XML-significant characters (`&`, `<`, `>`) in text destined
  * for an XML/markup element body. Allocation-conscious: returns the input

package/dist/types/slugify.d.ts

@@ -0,0 +1,4 @@
+/** Lowercase ASCII kebab slug: [^a-z0-9]+ → "-", edge dashes trimmed; optional maxLength truncates then re-trims trailing dashes; throws RangeError unless maxLength is a non-negative integer. Returns "" when nothing survives. */
+export declare function slugify(input: string, options?: {
+    maxLength?: number;
+}): string;

package/dist/types/sqlite.d.ts

@@ -1,5 +1,17 @@
 /** Shared SQLite opening, error attribution, and result-code classification for persistent stores. */
 import { Database } from "bun:sqlite";
+/**
+ * A store's identity as `dev:ino:birthtimeMs`, `null` when the path holds no
+ * file, or `undefined` when the stat itself failed and no conclusion is safe.
+ */
+export type SqliteFileIdentity = string | null | undefined;
+/**
+ * Identity of the file currently at `dbPath`. Quarantine moves a corrupt store
+ * aside and recreates one at the same path, so a connection cached on the path
+ * alone keeps writing to the unlinked inode: callers that hold a long-lived
+ * handle compare this before reusing it.
+ */
+export declare function sqliteFileIdentity(dbPath: string): SqliteFileIdentity;
 /** Controls opt-in replacement of an unrecoverably corrupt SQLite store. */
 export interface SqliteOpenOptions {
     /**
@@ -30,6 +42,17 @@ export declare function openSqliteDatabaseSync<T>(dbPath: string, initialize: (d
 export declare function annotateSqliteError(error: unknown, dbPath: string): Error;
 /** Checkpoints committed WAL frames without waiting for concurrent readers. */
 export declare function checkpointWal(db: Database): void;
+/**
+ * Reads every row of a rowid table that SQLite can still decode, to salvage a
+ * damaged store. A full scan aborts at the first unreadable page, so this walks
+ * rowids with indexed seeks instead: when a seek hits damage it doubles its
+ * stride past it, then bisects back to the first rowid from which seeking
+ * works again, losing only rows on the damaged pages. Cross-linked pages can
+ * still decode rows with foreign column types, so callers validate types;
+ * rows returned out of rowid order count as damage. Only corruption errors are
+ * treated as damage; anything else is thrown.
+ */
+export declare function readSalvageableRows<T extends object>(db: Database, table: string, columns: string): T[];
 /**
  * SQLite's busy result-code family — base `SQLITE_BUSY` plus the extended
  * variants `SQLITE_BUSY_RECOVERY` (concurrent WAL recovery), `SQLITE_BUSY_SNAPSHOT`,

package/package.json

@@ -1,6 +1,6 @@
 {
 	"name": "@linxiraos/pi-utils",
-	"version": "1.2.1",
+	"version": "1.3.1",
 	"description": "Shared utilities for pi packages",
 	"keywords": [
 		"utilities",
@@ -47,14 +47,14 @@
 	},
 	"scripts": {
 		"check": "oxlint . && oxfmt --check --no-error-on-unmatched-pattern 'src/**/*.{ts,tsx}' '{test,bench,examples,scripts}/**/*.ts' '*.ts' && bun run check:types",
-		"check:types": "tsgo -p tsconfig.json --noEmit",
+		"check:types": "tsc -p tsconfig.json --noEmit",
 		"lint": "oxlint .",
 		"test": "bun test --parallel",
 		"fix": "oxlint --fix --fix-suggestions . && bun run fmt",
 		"fmt": "oxfmt --no-error-on-unmatched-pattern 'src/**/*.{ts,tsx}' '{test,bench,examples,scripts}/**/*.ts' '*.ts'"
 	},
 	"dependencies": {
-		"@linxiraos/pi-natives": "1.2.1"
+		"@linxiraos/pi-natives": "1.3.1"
 	},
 	"devDependencies": {
 		"@types/bun": "1.4.3"

package/src/ar/open.ts

@@ -234,7 +234,8 @@ export async function extractArchive(
 				// privilege; skip the entry so the rest still extracts.
 				const extracted = await archive.readFile(link.path).catch(() => undefined);
 				if (!extracted) continue;
-				await Bun.write(outputPath, extracted.bytes);
+				// Keep symlink creation's exclusive destination semantics.
+				await fs.writeFile(outputPath, extracted.bytes, { flag: "wx" });
 				const permissions = (extracted.mode ?? 0) & 0o777;
 				if (permissions) await fs.chmod(outputPath, permissions);
 			}

package/src/dirs.ts

@@ -23,10 +23,11 @@ import { isEnoent, isEnotdir } from "./fs-error";
  * names, provider attribution headers, splash wordmark. NOT the CLI command. */
 export const APP_NAME: string = "zeta";
 
-/** CLI binary name (`npm i -g @linxiraos/zeta` installs `zetacode`, with
- * `zetacode` and `zeta-cli` as compatibility aliases). Every user-facing "run
- * this command" string and process title uses this; the bare `zeta` name
- * belongs to the @linxiraos/main workspace product, not this package. */
+/** CLI binary name (`npm i -g @linxiraos/zeta` installs exactly one bin,
+ * `zetacode` — the retired `zeta-c`/`zeta-cli` aliases are gone). Every
+ * user-facing "run this command" string and process title uses this; the
+ * bare `zeta` name belongs to the @linxiraos/main workbench product, where it
+ * prints the suite index, not this package. */
 export const CLI_BIN_NAME: string = "zetacode";
 
 /** Public homepage that inference gateways (OpenRouter, Vercel AI Gateway) credit our traffic to. */
@@ -701,25 +702,46 @@ export function getPluginsPackageJson(home?: string): string {
 }
 
 /**
- * Plugin lock file (~/.zeta/plugins/omp-plugins.lock.json).
- *
- * The on-disk filename stays upstream-compatible: it carries per-plugin runtime
- * state (enabled flag, version), so renaming it would reset every existing
- * install's plugins on upgrade. That is the reason for the compat, not a
- * general rule — see `document/brand-surface-rules.md`, which classifies this
- * surface as DUAL (read both spellings, write the Zeta one) rather than
- * permanently frozen.
+ * Zeta-named lockfile, written going forward; `PLUGINS_LOCKFILE_LEGACY` stays
+ * readable so a pre-rename install keeps its state (see
+ * `document/brand-surface-rules.md`, DUAL: read both spellings, write the Zeta
+ * one). Every lockfile name in the tree comes from the two constants below —
+ * a writer on one spelling and a reader on the other is what emptied
+ * `zetacode plugin list` after the loader migrated the file.
  */
-export function getPluginsLockfile(home?: string): string {
-	return path.join(getPluginsDir(home), "omp-plugins.lock.json");
-}
-
-/** Zeta-named lockfile, written going forward; `getPluginsLockfile` is read first. */
 export const PLUGINS_LOCKFILE_CANONICAL = "zeta-plugins.lock.json";
 
 /** Pre-rename lockfile name still produced by earlier installs. */
 export const PLUGINS_LOCKFILE_LEGACY = "omp-plugins.lock.json";
 
+/**
+ * Plugin lock file (~/.zeta/plugins/zeta-plugins.lock.json) — the path every
+ * writer targets and every reader asks for first.
+ *
+ * It carries per-plugin runtime state (enabled flag, enabled features,
+ * version), so the rename is a migration rather than a reset: a lockfile left
+ * under the pre-rename name is still read (see
+ * {@link pluginsLockfileReadOrder}) and moved to this path on first load.
+ */
+export function getPluginsLockfile(home?: string): string {
+	return path.join(getPluginsDir(home), PLUGINS_LOCKFILE_CANONICAL);
+}
+
+/**
+ * Read order for a lockfile path whose directory is a plugins root: the
+ * canonical name first, then the pre-rename one. Returned as absolute paths so
+ * a caller can hand each to `Bun.file` without re-deriving the directory.
+ *
+ * A path that is not one of the two names (a caller- or test-supplied path) is
+ * returned as-is and reads nothing else.
+ */
+export function pluginsLockfileReadOrder(lockfilePath: string): string[] {
+	const dir = path.dirname(lockfilePath);
+	const base = path.basename(lockfilePath);
+	if (base !== PLUGINS_LOCKFILE_CANONICAL && base !== PLUGINS_LOCKFILE_LEGACY) return [lockfilePath];
+	return [path.join(dir, PLUGINS_LOCKFILE_CANONICAL), path.join(dir, PLUGINS_LOCKFILE_LEGACY)];
+}
+
 /**
  * Normalize a plugin id into a safe single path segment (spec §4.2): lowercased,
  * every character outside `[a-z0-9._-]` (including `/` and `\`, so scoped npm
@@ -1195,6 +1217,11 @@ export function getTinyWorkerRuntimeDir(): string {
 	return dirs.rootSubdir(path.join("run", "tiny"), "state");
 }
 
+/** Directory holding the per-model mnemopi embedding server endpoints and logs (~/.zeta/run/mnemopi; XDG default: $XDG_STATE_HOME/zeta/run/mnemopi). */
+export function getMnemopiEmbedRuntimeDir(): string {
+	return dirs.rootSubdir(path.join("run", "mnemopi"), "state");
+}
+
 /** Root directory containing every per-project daemon runtime scope (~/.zeta/run/daemons; XDG default: $XDG_STATE_HOME/zeta/run/daemons). */
 export function getDaemonRuntimeRoot(): string {
 	return dirs.rootSubdir(path.join("run", "daemons"), "state");

package/src/dom/parser.ts

@@ -366,7 +366,12 @@ export function parseInto(html: string, document: Document, root: Document | Doc
 			index = match ? closePattern.lastIndex : html.length;
 			continue;
 		}
-		if (!VOID_ELEMENTS[parsed.name] && !(namespace === SVG_NAMESPACE && parsed.selfClosing)) {
+		// Feed documents follow XML rules: only an explicit `/>` closes immediately, so RSS `<link>url</link>`
+		// keeps its text instead of being treated as an HTML void element.
+		const isVoid = xmlLike
+			? parsed.selfClosing
+			: VOID_ELEMENTS[parsed.name] || (namespace === SVG_NAMESPACE && parsed.selfClosing);
+		if (!isVoid) {
 			stack.push(element);
 			parent = element;
 		}

package/src/fetch-retry.ts

@@ -416,7 +416,11 @@ function wrapNetworkError(error: unknown): Error {
 			return new Error("Request was aborted");
 		}
 		if (error.message === "fetch failed" && error.cause instanceof Error) {
-			return new Error(`Network error: ${error.cause.message}`);
+			// Keep the original rejection as `cause`: undici nests the errno under
+			// `fetch failed` (often through an AggregateError), and
+			// classifyNetworkCause (packages/ai/src/error/network-cause.ts) walks
+			// `cause`/`errors` off this error. Flattening to text alone loses it.
+			return new Error(`Network error: ${error.cause.message}`, { cause: error });
 		}
 		return error;
 	}

package/src/incoming-json.ts

@@ -67,6 +67,19 @@ import { parseJsonWithRepair } from "./json-parse";
 /** Maximum container nesting before a scan reports the value as pending forever. */
 const MAX_DEPTH = 128;
 
+/**
+ * @internal exported for tests — monotonic count of members re-lexed by
+ * selecting scans: one per object member or array element a scan walked over
+ * on the way to the member it was asked for.
+ *
+ * Cursor resumption (see {@link ContainerIndex}) is what keeps a full
+ * traversal linear in the document instead of quadratic, and losing it
+ * changes nothing about the pulled values — only how many members get
+ * re-lexed. Read the live binding before and after a traversal to measure
+ * exactly that.
+ */
+export let rescannedMembers = 0;
+
 /** Location component in a pulled JSON path: an object member name or an array index. */
 export type PullPathSegment = string | number;
 
@@ -326,6 +339,7 @@ function selectKey(
 		lex.ws();
 		if (lex.atEnd) return PENDING;
 		if (key === wanted) return selectValue(lex, path, at, ended, depth + 1, slot);
+		rescannedMembers++;
 		const skipped = scanValue(lex, ended, depth + 1);
 		if (skipped.tag !== "located" || skipped.end === undefined) return PENDING;
 		lex.ws();
@@ -372,6 +386,7 @@ function selectIndex(
 		// biome-ignore lint/suspicious/noAssignInExpressions: parser state machine relies on the inline memoized slot
 		const slot = index.elements[element] ?? (index.tail ??= { offset: lex.pos });
 		if (element === wanted) return selectValue(lex, path, at, ended, depth + 1, slot);
+		rescannedMembers++;
 		const skipped = scanValue(lex, ended, depth + 1);
 		if (skipped.tag !== "located" || skipped.end === undefined) return PENDING;
 		if (element === index.elements.length) {

package/src/index.ts

@@ -32,6 +32,7 @@ export { AbortError, ChildProcess, Exception, NonZeroExitError } from "./ptree";
 export * from "./release-assets";
 export * from "./runtime-install";
 export * from "./sanitize-text";
+export * from "./slugify";
 export * from "./snowflake";
 export * from "./sqlite";
 export * from "./stderr-guard";

package/src/marked/core.ts

@@ -775,7 +775,10 @@ function splitTableRow(line: string): string[] {
 }
 
 function isFence(line: string): RegExpExecArray | null {
-	return /^ {0,3}(`{3,}|~{3,})(.*?)(?:\n|$)$/.exec(line);
+	// Unicode line separators may occur in the info string.
+	const match = /^ {0,3}(`{3,}|~{3,})([^\n]*?)(?:\n|$)$/.exec(line);
+	// Backtick fences cannot contain backticks in their info string.
+	return match && match[1]!.startsWith("`") && match[2]!.includes("`") ? null : match;
 }
 function isHeading(line: string): boolean {
 	return /^ {0,3}#{1,6}(?:\s|$)/.test(line);

package/src/mime.ts

@@ -143,6 +143,50 @@ export function parseImageMetadata(header: Uint8Array): ImageMetadata | null {
 	);
 }
 
+/** Why base64 image data is unusable; `undefined` when it is canonical and non-empty. */
+export type Base64ImageDataFailure = "invalid base64 image data" | "empty image data";
+
+/**
+ * Non-empty decoded bytes on success, or a validation failure reason, never both.
+ * Check `reason` before using `bytes`; successful base64 decoding does not establish
+ * that the bytes represent a supported or decodable image.
+ */
+export type Base64ImageDecodeResult =
+	| { bytes: Buffer; reason?: never }
+	| { bytes?: never; reason: Base64ImageDataFailure };
+
+const BASE64_ALPHABET = "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/";
+
+/**
+ * Validate standard base64 image data without decoding it. Padding may be omitted, but
+ * present padding must be canonical, the trailing bits must be zero, and the data non-empty.
+ */
+export function base64ImageDataFailureReason(data: string): Base64ImageDataFailure | undefined {
+	if (data.length === 0) return "empty image data";
+
+	const match = /^([A-Za-z0-9+/]+)(={0,2})$/.exec(data);
+	if (!match) return "invalid base64 image data";
+	const encoded = match[1];
+	const paddingLength = match[2].length;
+	const remainder = encoded.length % 4;
+	if (remainder === 1 || (paddingLength === 1 && remainder !== 3) || (paddingLength === 2 && remainder !== 2)) {
+		return "invalid base64 image data";
+	}
+
+	const lastSextet = BASE64_ALPHABET.indexOf(encoded[encoded.length - 1]);
+	if ((remainder === 2 && (lastSextet & 0b1111) !== 0) || (remainder === 3 && (lastSextet & 0b11) !== 0)) {
+		return "invalid base64 image data";
+	}
+	return undefined;
+}
+
+/** Decode standard base64 image data under the {@link base64ImageDataFailureReason} rules. */
+export function decodeBase64ImageData(data: string): Base64ImageDecodeResult {
+	const reason = base64ImageDataFailureReason(data);
+	if (reason) return { reason };
+	return { bytes: Buffer.from(data, "base64") };
+}
+
 export function readImageMetadataSync(filePath: string, maxBytes = IMAGE_METADATA_HEADER_BYTES): ImageMetadata | null {
 	return peekFileSync(filePath, maxBytes, parseImageMetadata);
 }

package/src/ptree.ts

@@ -7,7 +7,7 @@
  * - Convenience helpers: captureText / execText, AbortSignal, timeouts.
  */
 
-import { Process } from "@linxiraos/pi-natives";
+import { Process, type ProcessTerminateOptions } from "@linxiraos/pi-natives";
 import type { Spawn, Subprocess } from "bun";
 
 type InMask = "pipe" | "ignore" | Buffer | Uint8Array | null;
@@ -387,12 +387,40 @@ export class ChildProcess<In extends InMask = InMask> {
 						? { group: true }
 						: undefined
 					: { gracefulMs, group: this.#terminateGroup };
-			this.#terminating = (this.#windowsRootProcess ?? Process.fromPid(this.proc.pid))
-				?.terminate(options)
-				?.catch(e => void e);
+			this.#terminating = this.#terminateTree(options);
 		}
 	}
 
+	/**
+	 * Native tree termination. A native handle that cannot be resolved or used
+	 * — the PID left the process table, or a `bun test --isolate` realm whose
+	 * napi classes another realm superseded ("Value is not an instance of class
+	 * `Process`") — must not leave the child running, so signal it directly.
+	 */
+	#terminateTree(options: ProcessTerminateOptions | undefined): Promise<boolean | void> {
+		const gracefulMs = options?.gracefulMs ?? 1000;
+		try {
+			const root = this.#windowsRootProcess ?? Process.fromPid(this.proc.pid);
+			if (root) return root.terminate(options).catch(() => this.#signalChild(gracefulMs));
+		} catch {}
+		return this.#signalChild(gracefulMs);
+	}
+
+	/** SIGTERM the child (its group when it leads one), then SIGKILL if it outlives `gracefulMs`. */
+	async #signalChild(gracefulMs: number): Promise<void> {
+		const signal = (name: NodeJS.Signals) => {
+			try {
+				if (this.#terminateGroup && process.platform !== "win32") process.kill(-this.proc.pid, name);
+				else this.proc.kill(name);
+			} catch {}
+		};
+		if (gracefulMs >= 0) {
+			signal("SIGTERM");
+			await Promise.race([this.proc.exited, Bun.sleep(gracefulMs)]);
+		}
+		if (this.proc.exitCode === null && this.proc.signalCode === null) signal("SIGKILL");
+	}
+
 	async #hardKillSubreaperTree(root: Process): Promise<void> {
 		try {
 			const deadline = Date.now() + SUBREAPER_KILL_WINDOW_MS;
@@ -415,7 +443,9 @@ export class ChildProcess<In extends InMask = InMask> {
 	// ── Output helpers ───────────────────────────────────────────────────
 
 	async #throwIfAborted(): Promise<void> {
-		const exitReason = this.exitReason;
+		// A kill() issued before Bun reports the root's exit only records the
+		// reason as pending; output readers that do not wait for exit must still see it.
+		const exitReason = this.#exitReason ?? this.#exitReasonPending;
 		if (!exitReason?.aborted) return;
 		if (this.#terminating) await this.#terminating;
 		throw exitReason;
@@ -561,10 +591,11 @@ export class ChildProcess<In extends InMask = InMask> {
 	// ── Signal / timeout ─────────────────────────────────────────────────
 
 	attachSignal(signal: AbortSignal): void {
+		const cleanup = this.#exited.catch(() => {});
 		const onAbort = () => this.kill(new AbortError(signal.reason, "<cancelled>"));
 		if (signal.aborted) return void onAbort();
 		signal.addEventListener("abort", onAbort, { once: true });
-		this.#exited.catch(() => {}).finally(() => signal.removeEventListener("abort", onAbort));
+		cleanup.finally(() => signal.removeEventListener("abort", onAbort));
 	}
 
 	#clearTimeout(): void {

package/src/sanitize-text.ts

@@ -12,6 +12,8 @@
  * string after the control probe.
  */
 
+import { isRecord } from "./type-guards";
+
 const ESC_CHAR = "\x1b";
 
 // Well-formed strings only need control/ANSI detection: C0 (excl. \t \n),
@@ -37,6 +39,74 @@ function sanitizeWellFormedText(text: string): string {
 	return stripped.replace(CONTROL_RE, "");
 }
 
+/**
+ * Apply {@link sanitizeText} to every string value inside a JSON-shaped value.
+ * Only plain objects and arrays are walked; class instances, typed arrays, and
+ * cyclic back-references pass through untouched. Object keys are kept as-is.
+ *
+ * Returns the input reference when nothing changed, so reference-keyed caches
+ * stay warm; changed containers are copied and the input is never mutated.
+ * The iterative walk also handles arbitrarily deep tool-result `details`
+ * without exhausting the TUI's call stack.
+ */
+export function sanitizeTextDeep(value: unknown): unknown {
+	if (typeof value === "string") return sanitizeText(value);
+	const root = sanitizerFrame(value);
+	if (!root) return value;
+	const stack: SanitizerFrame[] = [root];
+	const ancestors = new Set<object>([root.value]);
+	while (true) {
+		const frame = stack[stack.length - 1]!;
+		const length = frame.kind === "array" ? frame.value.length : frame.keys.length;
+		if (frame.index === length) {
+			const clean = frame.copy ?? frame.value;
+			ancestors.delete(frame.value);
+			stack.pop();
+			if (stack.length === 0) return clean;
+			acceptSanitizedValue(stack[stack.length - 1]!, clean);
+			continue;
+		}
+		const child = frame.kind === "array" ? frame.value[frame.index++] : frame.value[frame.keys[frame.index++]!];
+		if (typeof child === "string") {
+			acceptSanitizedValue(frame, sanitizeText(child));
+			continue;
+		}
+		if (child === null || typeof child !== "object" || ancestors.has(child)) continue;
+		const next = sanitizerFrame(child);
+		if (!next) continue;
+		ancestors.add(child);
+		stack.push(next);
+	}
+}
+
+type SanitizerFrame =
+	| { kind: "array"; value: unknown[]; index: number; copy?: unknown[] }
+	| { kind: "record"; value: Record<string, unknown>; keys: string[]; index: number; copy?: Record<string, unknown> };
+
+function sanitizerFrame(value: unknown): SanitizerFrame | undefined {
+	if (Array.isArray(value)) return { kind: "array", value, index: 0 };
+	if (!isRecord(value)) return undefined;
+	const proto: unknown = Object.getPrototypeOf(value);
+	if (proto !== Object.prototype && proto !== null) return undefined;
+	return { kind: "record", value, keys: Object.keys(value), index: 0 };
+}
+
+function acceptSanitizedValue(frame: SanitizerFrame, clean: unknown): void {
+	if (frame.kind === "array") {
+		const index = frame.index - 1;
+		if (clean !== frame.value[index]) (frame.copy ??= frame.value.slice())[index] = clean;
+		return;
+	}
+	const key = frame.keys[frame.index - 1]!;
+	if (clean === frame.value[key]) return;
+	const copy = (frame.copy ??= { ...frame.value });
+	if (key === "__proto__") {
+		Object.defineProperty(copy, key, { value: clean, writable: true, enumerable: true, configurable: true });
+	} else {
+		copy[key] = clean;
+	}
+}
+
 /**
  * Escape the three XML-significant characters (`&`, `<`, `>`) in text destined
  * for an XML/markup element body. Allocation-conscious: returns the input

package/src/slugify.ts

@@ -0,0 +1,11 @@
+/** Lowercase ASCII kebab slug: [^a-z0-9]+ → "-", edge dashes trimmed; optional maxLength truncates then re-trims trailing dashes; throws RangeError unless maxLength is a non-negative integer. Returns "" when nothing survives. */
+export function slugify(input: string, options?: { maxLength?: number }): string {
+	if (options?.maxLength !== undefined && !(Number.isInteger(options.maxLength) && options.maxLength >= 0)) {
+		throw new RangeError(`slugify maxLength must be a non-negative integer, got ${options.maxLength}`);
+	}
+	const slug = input
+		.toLowerCase()
+		.replace(/[^a-z0-9]+/g, "-")
+		.replace(/^-+|-+$/g, "");
+	return options?.maxLength === undefined ? slug : slug.slice(0, options.maxLength).replace(/-+$/g, "");
+}

package/src/sqlite.ts

@@ -11,7 +11,11 @@ const BUSY_MAX_ATTEMPTS = 4;
 const BUSY_BASE_DELAY_MS = 100;
 const SQLITE_STORE_SUFFIXES = ["-wal", "-shm", "-journal", ""];
 
-type SqliteFileIdentity = string | null | undefined;
+/**
+ * A store's identity as `dev:ino:birthtimeMs`, `null` when the path holds no
+ * file, or `undefined` when the stat itself failed and no conclusion is safe.
+ */
+export type SqliteFileIdentity = string | null | undefined;
 
 /**
  * Corrupt handles held open by in-process openers awaiting recovery, keyed by
@@ -77,7 +81,13 @@ class SqliteAttemptFailure extends Error {
 	}
 }
 
-function sqliteFileIdentity(dbPath: string): SqliteFileIdentity {
+/**
+ * Identity of the file currently at `dbPath`. Quarantine moves a corrupt store
+ * aside and recreates one at the same path, so a connection cached on the path
+ * alone keeps writing to the unlinked inode: callers that hold a long-lived
+ * handle compare this before reusing it.
+ */
+export function sqliteFileIdentity(dbPath: string): SqliteFileIdentity {
 	try {
 		const stat = fs.statSync(dbPath);
 		return `${stat.dev}:${stat.ino}:${stat.birthtimeMs}`;
@@ -333,6 +343,75 @@ export function checkpointWal(db: Database): void {
 	db.run("PRAGMA wal_checkpoint(PASSIVE)");
 }
 
+/** Damaged regions one {@link readSalvageableRows} scan skips before abandoning the rest of the table. */
+const SALVAGE_MAX_DAMAGED_REGIONS = 1000;
+
+/**
+ * Reads every row of a rowid table that SQLite can still decode, to salvage a
+ * damaged store. A full scan aborts at the first unreadable page, so this walks
+ * rowids with indexed seeks instead: when a seek hits damage it doubles its
+ * stride past it, then bisects back to the first rowid from which seeking
+ * works again, losing only rows on the damaged pages. Cross-linked pages can
+ * still decode rows with foreign column types, so callers validate types;
+ * rows returned out of rowid order count as damage. Only corruption errors are
+ * treated as damage; anything else is thrown.
+ */
+export function readSalvageableRows<T extends object>(db: Database, table: string, columns: string): T[] {
+	type Row = T & { salvage_rowid: number };
+	using seek = db.prepare<Row, [number]>(
+		`SELECT rowid AS salvage_rowid, ${columns} FROM ${table} WHERE rowid > ? ORDER BY rowid LIMIT 1`,
+	);
+	using exact = db.prepare<Row, [number]>(`SELECT rowid AS salvage_rowid, ${columns} FROM ${table} WHERE rowid = ?`);
+	// The row found, null when there is none, or undefined when the read hit damage.
+	const probe = (after: number, at?: number): Row | null | undefined => {
+		try {
+			const row = at === undefined ? seek.get(after) : exact.get(at);
+			if (!row) return null;
+			const valid = Number.isSafeInteger(row.salvage_rowid) && row.salvage_rowid === (at ?? row.salvage_rowid);
+			return valid && row.salvage_rowid > after ? row : undefined;
+		} catch (error) {
+			if (isSqliteCorruptionError(error)) return undefined;
+			throw error;
+		}
+	};
+
+	const rows: T[] = [];
+	const keep = (row: Row): void => {
+		const { salvage_rowid: _, ...values } = row;
+		rows.push(values as unknown as T);
+	};
+	let after = Number.MIN_SAFE_INTEGER;
+	let damaged = 0;
+	while (after < Number.MAX_SAFE_INTEGER) {
+		const row = probe(after);
+		if (row === null) break;
+		if (row) {
+			keep(row);
+			after = row.salvage_rowid;
+			continue;
+		}
+		if (++damaged > SALVAGE_MAX_DAMAGED_REGIONS) break;
+		// An end-of-table result counts as clear: the gap below it may still hold readable rows.
+		let bad = after;
+		let clear = Number.MAX_SAFE_INTEGER;
+		for (let step = 1; after + step < clear; step *= 2) {
+			if (probe(after + step) !== undefined) clear = after + step;
+			else bad = after + step;
+		}
+		while (clear - bad > 1) {
+			const mid = bad + Math.floor((clear - bad) / 2);
+			if (probe(mid) === undefined) bad = mid;
+			else clear = mid;
+		}
+		// An interior key bounds its left subtree inclusively, so seeking past the last
+		// damaged rowid descends into the damage again and `clear` itself is skipped.
+		const boundary = probe(bad, clear);
+		if (boundary) keep(boundary);
+		after = clear;
+	}
+	return rows;
+}
+
 /**
  * SQLite's busy result-code family — base `SQLITE_BUSY` plus the extended
  * variants `SQLITE_BUSY_RECOVERY` (concurrent WAL recovery), `SQLITE_BUSY_SNAPSHOT`,