@linxiraos/pi-utils 1.4.4 → 1.4.7

package/CHANGELOG.md

@@ -1,5 +1,23 @@
 ## [Unreleased]
 
+## [1.4.7] - 2026-10-30
+
+- Synced with upstream OMP v18.14.0; no package-specific user-visible changes.
+
+## [1.4.6] - 2026-10-28
+
+### Added
+
+- Added `logger.withContext(fields, fn)` to attach contextual fields to all records produced during a function and its asynchronous work, plus `logger.withoutContext(fn)` for work that should not inherit caller context.
+
+### Fixed
+
+- Fixed `untilAborted` so promises passed to an already-aborted signal are still observed, preventing later rejections from being reported as unhandled.
+
+## [1.4.5] - 2026-10-28
+
+- Synced with upstream OMP v18.13.2 (shared utilities and runtime fixes); user-visible changes are in UPDATE-LOG.md under 1.4.5.
+
 ## [1.4.4] - 2026-10-26
 
 - Released as part of Zeta 1.4.4; no package-specific user-visible changes.

package/README.md

@@ -29,7 +29,7 @@ Import from the root barrel or per-module subpaths (`@linxiraos/pi-utils/<module
 bun add @linxiraos/pi-utils
 ```
 
-Ships TypeScript source directly (no build step); requires Bun ≥ 1.3.14.
+Ships TypeScript source directly (no build step); requires Bun ≥ 1.4.4.
 
 ## References
 

package/dist/types/abortable.d.ts

@@ -16,7 +16,8 @@ export declare class AbortError extends Error {
 export declare function abortableSource<T>(stream: ReadableStream<T>, signal?: AbortSignal): AsyncGenerator<T>;
 /**
  * Runs a promise-returning function (`pr`). If the given AbortSignal is aborted before or during
- * execution, the promise is rejected with a standard error.
+ * execution, the promise is rejected with a standard error. A promise passed directly stays
+ * observed, so its later rejection is never unhandled.
  *
  * @param signal - Optional AbortSignal to cancel the operation
  * @param pr - Function returning a promise to run

package/dist/types/acp/protocol.d.ts

@@ -93,6 +93,7 @@ export interface ToolCallLocation extends Meta {
 export interface ToolCall extends Meta {
     toolCallId: ToolCallId;
     title: string;
+    name?: string | null;
     kind?: ToolKind | null;
     status?: ToolCallStatus | null;
     content?: ToolCallContent[] | null;

package/dist/types/ar/tar.d.ts

@@ -6,7 +6,7 @@ export declare function readTarEntriesFromBuffer(buffer: Uint8Array, options: Fo
  * pass over `open()` walks the headers, and member reads open it again.
  */
 export declare function readTarEntriesFromStream(open: () => AsyncIterable<Uint8Array>, options: FormatReadOptions): Promise<ArchiveIndexEntry[]>;
-/** Read and index a tar source after one bounded whole-stream read. */
+/** Index a plain tar by ranging over headers and retaining lazy member offsets. */
 export declare const readTar: FormatReader;
 /** Detect a tar header, including legacy pre-ustar archives, by its checksum. */
 export declare function sniffTar(bytes: Uint8Array): boolean;

package/dist/types/ar/types.d.ts

@@ -8,7 +8,7 @@ export type WritableArchiveFormat = "zip" | "tar" | "tar.gz" | "tar.zst" | "asar
  * Where to read an archive from: an extension-inferred filesystem path, a
  * format-tagged filesystem path, in-memory bytes, or any caller-provided
  * {@link ByteSource} (e.g. `httpByteSource` for ranged remote reads).
- * File- and source-backed ZIP/ASAR/RAR/7z/ISO are read lazily.
+ * File- and source-backed TAR/ZIP/ASAR/RAR/7z/ISO are read lazily.
  */
 export type ArchiveSource = string | {
     bytes: Uint8Array;

package/dist/types/format.d.ts

@@ -6,9 +6,10 @@ export declare function formatDuration(ms: number): string;
 /**
  * Format a number with K/M/B suffix for compact display.
  * Uses 1 decimal for small leading digits when non-zero, rounded otherwise.
+ * Values below 1,000 print as-is unless `maxFractionDigits` caps their decimals.
  * Examples: "999", "1K", "1.5K", "25K", "1M", "1.5M", "25M", "1.5B"
  */
-export declare function formatNumber(n: number): string;
+export declare function formatNumber(n: number, maxFractionDigits?: number): string;
 /**
  * Format a byte count to a human-readable string.
  * Examples: "512B", "1.5KB", "2.3MB", "1.2GB"

package/dist/types/index.d.ts

@@ -10,7 +10,6 @@ export * from "./file-lock.js";
 export * from "./format.js";
 export * from "./frontmatter.js";
 export * from "./fs-error.js";
-export * from "./fs-open.js";
 export * from "./incoming-json.js";
 export * from "./json.js";
 export * from "./json-parse.js";

package/dist/types/json.d.ts

@@ -2,6 +2,13 @@
  * Try to parse JSON, returning null on failure.
  */
 export declare function tryParseJson<T = unknown>(content: string): T | null;
+/**
+ * Index just past the JSON object or array that opens at `text[start]`, or -1
+ * when it does not close within `text`. String literals are skipped, honoring
+ * escapes, so brackets inside values do not count. Malformed input yields some
+ * end that a parser then rejects.
+ */
+export declare function jsonContainerEnd(text: string, start: number): number;
 /**
  * Serialize JSON while preserving bigint precision as decimal strings.
  *

package/dist/types/logger.d.ts

@@ -11,6 +11,20 @@ export interface LogEvent {
 export type LogSink = (event: LogEvent) => void;
 /** Register an out-of-band log sink and return a disposer. */
 export declare function registerLogSink(sink: LogSink): () => void;
+/**
+ * Run `fn` with `context`'s fields on every record logged while it runs,
+ * including from the promises, timers and callbacks it starts. A nested call
+ * replaces the enclosing context, as a subagent's session replaces its
+ * parent's; a field passed to the log call itself wins. Fields are read as each
+ * record is written, so a getter stays current.
+ */
+export declare function withContext<T>(context: Readonly<Record<string, unknown>>, fn: () => T): T;
+/**
+ * Run `fn` outside any {@link withContext}: for process-wide work started on
+ * behalf of one caller, such as a shared server's read loop, whose later
+ * records belong to no single caller.
+ */
+export declare function withoutContext<T>(fn: () => T): T;
 /**
  * Write buffered file records to disk now. The file transport batches records
  * (one write per second or per 64 KiB) and writes `warn`/`error` records

package/dist/types/marked/inline-closers.d.ts

@@ -45,15 +45,23 @@ declare class EmphasisDelimiters {
 }
 /**
  * The runs of backticks in the root source, for the code span rule. A span opened by `width` backticks closes at the
- * first `width` backticks after its opening run that no backslash escapes: the start of a later run of at least
- * `width`, or, in a run whose first backtick a backslash escapes, the backticks from its `width`th on, since the
- * search for a closer goes on `width` past an escaped one.
+ * next run of exactly `width` backticks: a run of any other length is no closer, and the one that closes is the first
+ * run of that width at or after the opener. Backslash escapes do not apply inside a code span, so a backslash just
+ * before that closing backtick is content and still closes the span.
  */
 declare class CodeRuns {
     #private;
     constructor(src: string);
     /** Where the run of backticks holding the backtick at `at` ends. */
     endOf(at: number): number;
+    /**
+     * Whether a backtick string starts at `at` for a scan that walked to `at`: a string is a whole run, so it starts at
+     * the run's first backtick and nowhere else. A retry deeper inside a run is not a string, which keeps a run whose
+     * opener found no closer from opening a narrower span one backtick later. A position a tokenizer's raw resumed at,
+     * or the suffix an escape token left behind, is not a walked position — `codeOpenerWidth` admits those on its own,
+     * because it is told the scan resumed there rather than inferring it from the source text.
+     */
+    startsStringAt(at: number): boolean;
     /** Where the closer of a code span opened by `width` backticks that end at `from` starts, or -1. */
     closerAfter(from: number, width: number): number;
 }
@@ -102,8 +110,13 @@ export declare class InlineClosers {
     escapeWithin(rest: string, from: number, to: number): boolean;
     /** Where the emphasis opened by the `width` markers at the start of `rest` closes, or -1. */
     closeEmphasis(rest: string, marker: string, width: number): number;
-    /** How many backticks start `rest`, which starts with one. */
-    codeOpenerWidth(rest: string): number;
+    /**
+     * How many backticks start `rest`, which starts with one, or 0 where no code span opens because no backtick string
+     * starts there: the opener is a whole string, so the rest of a run whose opener found no closer is text, while the
+     * backticks left after a backslash escaped the run's first one do open a span. `resumed` says the scan resumed at
+     * `rest` after a tokenizer consumed a raw that ended here, where the backticks are a string wherever they sit.
+     */
+    codeOpenerWidth(rest: string, resumed?: boolean): number;
     /** Where the code span opened by the `width` backticks at the start of `rest` closes, or -1. */
     closeCode(rest: string, width: number): number;
     /**

package/dist/types/mime.d.ts

@@ -26,6 +26,13 @@ export type ImageMetadata = {
     hasAlpha?: boolean;
 };
 export declare function parseImageMetadata(header: Uint8Array): ImageMetadata | null;
+/** Still images in a HEIF (ISO BMFF) container, which the image pipeline cannot decode itself. */
+export type HeifImageMimeType = "image/heic" | "image/heif" | "image/avif";
+/**
+ * MIME type of a HEIC, AVIF or other HEIF image from the brands of its leading `ftyp` box:
+ * the major brand, then the compatible brands, with the generic `mif1`/`msf1` brands last.
+ */
+export declare function parseHeifImageMimeType(header: Uint8Array): HeifImageMimeType | null;
 /** Why base64 image data is unusable; `undefined` when it is canonical and non-empty. */
 export type Base64ImageDataFailure = "invalid base64 image data" | "empty image data";
 /**

package/dist/types/ports.d.ts

@@ -3,8 +3,9 @@
  *
  * OMP installs on the same machine use 30141/30142/3847, and common developer
  * tools squat on 3000/8080/8787/3847. Zeta therefore owns a dedicated block:
- * three uncommon ports, at least two apart, so a side-by-side OMP install and
- * unrelated services cannot take the gateway or the stats dashboard away.
+ * uncommon ports, at least two apart, so a side-by-side OMP install and
+ * unrelated services cannot take the gateway, stats dashboard, or browser
+ * relay away.
  *
  * Every default in the repository derives from these constants. The standalone
  * Electron shell (`desktop/src/main.ts`, not a Bun workspace package) carries
@@ -13,3 +14,4 @@
 export declare const ZETA_WEB_PORT = 43141;
 export declare const ZETA_GATEWAY_PORT = 43143;
 export declare const ZETA_STATS_PORT = 43147;
+export declare const ZETA_BROWSER_RELAY_PORT = 43153;

package/dist/types/postmortem.d.ts

@@ -52,7 +52,7 @@ export declare const NATIVE_PROCESS_EXIT: unique symbol;
  * signal and fatal exit.
  */
 export declare function exitProcess(code: number): never;
-/** User-facing command printed before fatal cleanup so interrupted work can be resumed. */
+/** User-facing command printed after fatal or SIGTERM cleanup so interrupted work can be resumed. */
 export interface FatalRecoveryHint {
     /** Stable label identifying the recoverable session or process. */
     label: string;
@@ -168,7 +168,10 @@ export declare function isExpectedCleanupError(reason: unknown): boolean;
 export declare function interceptUnhandledRejections(interceptor: (reason: unknown) => boolean): () => void;
 /**
  * Register a synchronous recovery command to print when the process exits
- * through an uncaught exception or unhandled rejection.
+ * through an uncaught exception, an unhandled rejection, or SIGTERM.
+ *
+ * Providers are read once cleanup finishes (or hits its deadline), so they
+ * report what teardown left behind: a session it saved or one it dropped.
  */
 export declare function registerFatalRecoveryHint(provider: FatalRecoveryHintProvider): () => void;
 /**
@@ -182,6 +185,20 @@ export interface CleanupRegistrationOptions {
      * The registration remains armed when a keep-alive pass skips it.
      */
     exitOnly?: boolean;
+    /**
+     * How long a pass waits for this callback, when that is longer than the
+     * default 10 s cleanup deadline. It extends the pass only while the callback
+     * is still pending: one that settles early ends its hold at once.
+     */
+    deadlineMs?: number;
+    /**
+     * With `deadlineMs`: a line printed to stderr, with the remaining wait
+     * appended, if exit is still waiting on this callback once every other
+     * callback has finished (a terminal owner has then released the screen), or
+     * at the default 10 s deadline when another callback is still running.
+     * Nothing is printed when the callback finishes first.
+     */
+    waitMessage?: string;
 }
 /**
  * Registers a cleanup callback for shutdown, signals, fatal errors, and

package/dist/types/process-name.d.ts

@@ -1,5 +1,6 @@
 /**
- * Set both the JS `process.title` and — on Linux — the kernel `comm` name.
+ * Set the JS `process.title` (except on Windows, see above) and — on Linux —
+ * the kernel `comm` name.
  *
  * Never throws: `bun:ffi` unavailability or a failed syscall degrades silently
  * to the `process.title`-only behavior, so it is safe to call at startup.

package/dist/types/which.d.ts

@@ -42,4 +42,17 @@ export declare const whichFresh: typeof darwinWhich;
  * @returns Filesystem path if found, else null
  */
 export declare function $which(command: string, options?: WhichOptions): string | null;
+/**
+ * Locate every match for `command` on PATH, in PATH order, uncached.
+ *
+ * Callers that probe candidates (e.g. the Python eval backend) use this so a broken
+ * first hit — a version-manager shim with no version selected, a Windows Store alias —
+ * does not hide a working binary further down PATH. On macOS the Xcode/CLT toolchain
+ * match is appended last, mirroring {@link $which}'s fallback.
+ *
+ * @param command - Binary name to resolve
+ * @param options - `PATH` (defaults to `process.env.PATH`) and `cwd` for relative entries
+ * @returns Distinct filesystem paths; empty when nothing matches
+ */
+export declare function $whichAll(command: string, options?: Bun.WhichOptions): string[];
 export {};

package/package.json

@@ -1,6 +1,6 @@
 {
 	"name": "@linxiraos/pi-utils",
-	"version": "1.4.4",
+	"version": "1.4.7",
 	"description": "Shared utilities for pi packages",
 	"keywords": [
 		"utilities",
@@ -54,12 +54,12 @@
 		"fmt": "oxfmt --no-error-on-unmatched-pattern 'src/**/*.{ts,tsx}' '{test,bench,examples,scripts}/**/*.ts' '*.ts'"
 	},
 	"dependencies": {
-		"@linxiraos/pi-natives": "1.4.4"
+		"@linxiraos/pi-natives": "1.4.7"
 	},
 	"devDependencies": {
-		"@types/bun": "1.4.3"
+		"@types/bun": "1.4.4"
 	},
 	"engines": {
-		"bun": ">=1.3.14"
+		"bun": ">=1.4.4"
 	}
 }

package/src/abortable.ts

@@ -60,7 +60,8 @@ export async function* abortableSource<T>(stream: ReadableStream<T>, signal?: Ab
 
 /**
  * Runs a promise-returning function (`pr`). If the given AbortSignal is aborted before or during
- * execution, the promise is rejected with a standard error.
+ * execution, the promise is rejected with a standard error. A promise passed directly stays
+ * observed, so its later rejection is never unhandled.
  *
  * @param signal - Optional AbortSignal to cancel the operation
  * @param pr - Function returning a promise to run
@@ -71,7 +72,10 @@ export function untilAborted<T>(
 	pr: Promise<T> | (() => Promise<T>),
 ): Promise<T> {
 	if (!signal) return typeof pr === "function" ? pr() : pr;
-	if (signal.aborted) return Promise.reject(new AbortError(signal));
+	if (signal.aborted) {
+		if (typeof pr !== "function") void pr.catch(() => {});
+		return Promise.reject(new AbortError(signal));
+	}
 
 	const { promise, resolve, reject } = Promise.withResolvers<T>();
 	const onAbort = () => reject(new AbortError(signal));

package/src/acp/protocol.ts

@@ -102,6 +102,7 @@ export interface ToolCallLocation extends Meta {
 export interface ToolCall extends Meta {
 	toolCallId: ToolCallId;
 	title: string;
+	name?: string | null;
 	kind?: ToolKind | null;
 	status?: ToolCallStatus | null;
 	content?: ToolCallContent[] | null;

package/src/ar/tar.ts

@@ -16,7 +16,7 @@ import {
 	normalizeArchiveEntryPath,
 	normalizeArchiveLookupPath,
 } from "./paths";
-import { readAllBytes } from "./source";
+import type { ByteSource } from "./source";
 import type { ArchiveIndexEntry, FormatReader, FormatReadOptions, MemberSource } from "./types";
 
 const BLOCK_SIZE = 512;
@@ -53,8 +53,44 @@ interface PendingTarLink {
 	targetPath: string;
 }
 
+interface TarCursor {
+	readonly position: number;
+	read(length: number): Promise<Uint8Array>;
+	skip(length: number): Promise<boolean>;
+}
+
+/** Seek over plain tar payloads without fetching their bytes. */
+class TarSourceCursor implements TarCursor {
+	readonly #source: ByteSource;
+	#position = 0;
+
+	constructor(source: ByteSource) {
+		this.#source = source;
+	}
+
+	get position(): number {
+		return this.#position;
+	}
+
+	async read(length: number): Promise<Uint8Array> {
+		const size = Math.min(length, this.#source.size - this.#position);
+		if (size === 0) return new Uint8Array(0);
+		const end = this.#position + size;
+		const bytes = await this.#source.read(this.#position, end);
+		if (bytes.byteLength !== size) throw new ArchiveError("Invalid archive: truncated data");
+		this.#position = end;
+		return bytes;
+	}
+
+	async skip(length: number): Promise<boolean> {
+		if (length > this.#source.size - this.#position) return false;
+		this.#position += length;
+		return true;
+	}
+}
+
 /** Forward-only reader over tar bytes that arrive in chunks: one buffer, or a decompressing stream. */
-class TarByteStream {
+class TarByteStream implements TarCursor {
 	readonly #chunks: AsyncIterator<Uint8Array> | Iterator<Uint8Array>;
 	#chunk: Uint8Array = new Uint8Array(0);
 	#position = 0;
@@ -119,6 +155,27 @@ interface TarPayload {
 	read(offset: number, size: number, memberPath: string): Promise<Uint8Array>;
 }
 
+class TarSourcePayload implements TarPayload {
+	readonly #source: ByteSource;
+
+	constructor(source: ByteSource) {
+		this.#source = source;
+	}
+
+	async read(offset: number, size: number, memberPath: string): Promise<Uint8Array> {
+		try {
+			const bytes = await this.#source.read(offset, offset + size);
+			if (bytes.byteLength !== size) {
+				throw new ArchiveError(`Archive member '${formatArchivePathForError(memberPath)}' is truncated`);
+			}
+			return bytes;
+		} catch (error) {
+			if (error instanceof ArchiveError) throw error;
+			throw new ArchiveError(error instanceof Error ? error.message : "Failed to read tar member");
+		}
+	}
+}
+
 class TarBufferPayload implements TarPayload {
 	readonly #buffer: Uint8Array;
 
@@ -533,7 +590,7 @@ function resolvePendingLinks(
 
 /** Read one metadata record's payload, bounded by `maxIndexSize`, and step over its padding. */
 async function readTarMetadata(
-	stream: TarByteStream,
+	stream: TarCursor,
 	size: number,
 	limits: ArchiveLimits,
 	what: string,
@@ -551,7 +608,7 @@ async function readTarMetadata(
  * stepped over, never held: entries point into `payload` by stream offset.
  */
 async function readTarEntries(
-	stream: TarByteStream,
+	stream: TarCursor,
 	payload: TarPayload,
 	options: FormatReadOptions,
 ): Promise<ArchiveIndexEntry[]> {
@@ -737,18 +794,17 @@ export async function readTarEntriesFromStream(
 	}
 }
 
-/** Read and index a tar source after one bounded whole-stream read. */
+/** Index a plain tar by ranging over headers and retaining lazy member offsets. */
 export const readTar: FormatReader = async (source, options) => {
-	assertInMemorySize(source.size, options.limits);
-	let bytes: Uint8Array;
+	if (!Number.isSafeInteger(source.size) || source.size < 0) {
+		throw new ArchiveError("Archive is too large to read safely");
+	}
 	try {
-		bytes = await readAllBytes(source);
+		return await readTarEntries(new TarSourceCursor(source), new TarSourcePayload(source), options);
 	} catch (error) {
 		if (error instanceof ArchiveError) throw error;
 		throw new ArchiveError(error instanceof Error ? error.message : "Failed to read tar archive");
 	}
-	if (bytes.byteLength !== source.size) throw new ArchiveError("Invalid archive: truncated data");
-	return readTarEntriesFromBuffer(bytes, options);
 };
 
 /** Detect a tar header, including legacy pre-ustar archives, by its checksum. */

package/src/ar/types.ts

@@ -37,7 +37,7 @@ export type WritableArchiveFormat = "zip" | "tar" | "tar.gz" | "tar.zst" | "asar
  * Where to read an archive from: an extension-inferred filesystem path, a
  * format-tagged filesystem path, in-memory bytes, or any caller-provided
  * {@link ByteSource} (e.g. `httpByteSource` for ranged remote reads).
- * File- and source-backed ZIP/ASAR/RAR/7z/ISO are read lazily.
+ * File- and source-backed TAR/ZIP/ASAR/RAR/7z/ISO are read lazily.
  */
 export type ArchiveSource =
 	| string

package/src/dirs.ts

@@ -333,7 +333,21 @@ export function getSafeProjectCwd(): string {
 
 /** Get the config directory name relative to home (e.g. ".zeta" or ZETA_CONFIG_DIR override). */
 export function getConfigDirName(): string {
-	return process.env.ZETA_CONFIG_DIR || CONFIG_DIR_NAME;
+	const configured = process.env.ZETA_CONFIG_DIR;
+	if (!configured) return CONFIG_DIR_NAME;
+	// This value is a directory *name* under the user's home, never a path to
+	// adopt directly. Absolute paths would be re-joined to home by every
+	// consumer (`getBaseConfigRoot`, project discovery, plugin roots) and
+	// produce inconsistent trees; `..` would escape home entirely. Reject
+	// both at the boundary instead of scattering files.
+	if (path.isAbsolute(configured) || path.parse(configured).root !== "") {
+		throw new Error("ZETA_CONFIG_DIR must be a relative directory name under the home directory");
+	}
+	const normalized = path.normalize(configured);
+	if (normalized === "." || normalized === ".." || normalized.startsWith(`..${path.sep}`)) {
+		throw new Error("ZETA_CONFIG_DIR must stay within the home directory");
+	}
+	return normalized;
 }
 
 /** Get the config agent directory name relative to home (e.g. ".zeta/agent" or PI_CONFIG_DIR + "/agent"). */

package/src/format.ts

@@ -33,10 +33,14 @@ export function formatDuration(ms: number): string {
 /**
  * Format a number with K/M/B suffix for compact display.
  * Uses 1 decimal for small leading digits when non-zero, rounded otherwise.
+ * Values below 1,000 print as-is unless `maxFractionDigits` caps their decimals.
  * Examples: "999", "1K", "1.5K", "25K", "1M", "1.5M", "25M", "1.5B"
  */
-export function formatNumber(n: number): string {
-	if (n < 1_000) return n.toString();
+export function formatNumber(n: number, maxFractionDigits?: number): string {
+	if (n < 1_000) {
+		if (maxFractionDigits === undefined || Number.isInteger(n)) return n.toString();
+		return Number(n.toFixed(maxFractionDigits)).toString();
+	}
 	if (n < 10_000) return `${trim1(n / 1_000)}K`;
 	if (n < 1_000_000) return `${Math.round(n / 1_000)}K`;
 	if (n < 10_000_000) return `${trim1(n / 1_000_000)}M`;

package/src/index.ts

@@ -10,7 +10,6 @@ export * from "./file-lock";
 export * from "./format";
 export * from "./frontmatter";
 export * from "./fs-error";
-export * from "./fs-open";
 export * from "./incoming-json";
 export * from "./json";
 export * from "./json-parse";

package/src/json.ts

@@ -9,6 +9,31 @@ export function tryParseJson<T = unknown>(content: string): T | null {
 	}
 }
 
+/**
+ * Index just past the JSON object or array that opens at `text[start]`, or -1
+ * when it does not close within `text`. String literals are skipped, honoring
+ * escapes, so brackets inside values do not count. Malformed input yields some
+ * end that a parser then rejects.
+ */
+export function jsonContainerEnd(text: string, start: number): number {
+	let depth = 0;
+	for (let index = start; index < text.length; index++) {
+		const code = text.charCodeAt(index);
+		if (code === 0x22) {
+			for (index++; index < text.length; index++) {
+				const inner = text.charCodeAt(index);
+				if (inner === 0x5c) index++;
+				else if (inner === 0x22) break;
+			}
+		} else if (code === 0x7b || code === 0x5b) {
+			depth++;
+		} else if ((code === 0x7d || code === 0x5d) && --depth === 0) {
+			return index + 1;
+		}
+	}
+	return -1;
+}
+
 /**
  * Serialize JSON while preserving bigint precision as decimal strings.
  *

package/src/logger/rotating-file.ts

@@ -3,7 +3,6 @@ import * as fs from "node:fs";
 import * as os from "node:os";
 import * as path from "node:path";
 import { localDay } from "../dirs";
-import { openCloexecSync } from "../fs-open";
 
 /** Write batching for {@link RotatingFileSink}. */
 export interface RotatingFileBatchOptions {
@@ -87,7 +86,7 @@ export class RotatingFileSink {
 
 	#openFd(filePath: string): void {
 		this.#closeFd();
-		this.#fd = openCloexecSync(filePath, fs.constants.O_WRONLY | fs.constants.O_CREAT | fs.constants.O_APPEND);
+		this.#fd = fs.openSync(filePath, fs.constants.O_WRONLY | fs.constants.O_CREAT | fs.constants.O_APPEND);
 		try {
 			this.#onRotate?.(filePath);
 		} catch {