@oh-my-pi/pi-coding-agent 16.1.2 → 16.1.3

package/src/mnemopi/embed-worker.ts

@@ -0,0 +1,113 @@
+/**
+ * Mnemopi local-embeddings worker. Loaded inside the dedicated subprocess
+ * spawned by `embed-client.ts` (re-entered through the agent CLI's hidden
+ * `__omp_worker_mnemopi_embed` selector). The whole point of this module is
+ * that `loadFastembed()` — and therefore `onnxruntime-node`'s NAPI
+ * constructor + finalizer — only ever runs in this child address space. The
+ * parent `SIGKILL`s us on shutdown so the destructor that crashes Bun on
+ * Windows shutdown (issue #3031, mnemopi sibling of #1606/#1607) never runs
+ * in either process.
+ */
+
+import type { StandardEmbeddingModel } from "@oh-my-pi/pi-mnemopi/core";
+import { loadFastembed } from "@oh-my-pi/pi-mnemopi/core/fastembed-runtime";
+import type { MnemopiEmbedModelId, MnemopiEmbedTransport, MnemopiEmbedWorkerInbound } from "./embed-protocol";
+
+interface LoadedModel {
+	model: MnemopiEmbedModelId;
+	cacheDir: string | undefined;
+	instance: {
+		embed(texts: string[], batchSize?: number): AsyncIterable<number[][]> | Iterable<number[][]>;
+	};
+}
+
+let loaded: Promise<LoadedModel> | null = null;
+let loadedKey = "";
+
+async function loadModel(model: MnemopiEmbedModelId, cacheDir: string | undefined): Promise<LoadedModel> {
+	const { FlagEmbedding } = await loadFastembed();
+	// Cast: `model` arrives as a string from the parent (resolved by
+	// mnemopi's `fastembedModelName`). Cast to the non-CUSTOM overload's
+	// argument so TypeScript picks the standard-model branch — the parent
+	// only ever passes pre-vetted fast-* identifiers.
+	const instance = await FlagEmbedding.init({
+		model: model as StandardEmbeddingModel,
+		cacheDir,
+		showDownloadProgress: false,
+	});
+	return { model, cacheDir, instance };
+}
+
+function ensureLoaded(model: MnemopiEmbedModelId, cacheDir: string | undefined): Promise<LoadedModel> {
+	const key = `${model}\u0000${cacheDir ?? ""}`;
+	if (loaded !== null && loadedKey === key) return loaded;
+	const loading = loadModel(model, cacheDir).catch(error => {
+		// Failed loads must not poison the cache — a retry with the same key
+		// should re-attempt the load.
+		if (loaded === loading) {
+			loaded = null;
+			loadedKey = "";
+		}
+		throw error;
+	});
+	loaded = loading;
+	loadedKey = key;
+	return loading;
+}
+async function handleEmbed(
+	transport: MnemopiEmbedTransport,
+	message: Extract<MnemopiEmbedWorkerInbound, { type: "embed" }>,
+): Promise<void> {
+	try {
+		// Each `embed` carries the model + cacheDir the wrapper was bound to.
+		// `ensureLoaded` is idempotent for the same key, so this is a no-op
+		// once the model is in memory — and it transparently re-loads after
+		// the parent SIGKILLed the previous subprocess but mnemopi still
+		// holds the cached `LocalEmbeddingModel` wrapper from before.
+		const { instance } = await ensureLoaded(message.model, message.cacheDir);
+		const vectors: number[][] = [];
+		const batches = instance.embed([...message.texts], message.batchSize);
+		for await (const batch of batches) {
+			for (const row of batch) vectors.push(row);
+		}
+		transport.send({ type: "vectors", id: message.id, vectors });
+	} catch (error) {
+		transport.send({
+			type: "error",
+			id: message.id,
+			error: error instanceof Error ? error.message : String(error),
+		});
+	}
+}
+
+async function handleInit(
+	transport: MnemopiEmbedTransport,
+	message: Extract<MnemopiEmbedWorkerInbound, { type: "init" }>,
+): Promise<void> {
+	try {
+		await ensureLoaded(message.model, message.cacheDir);
+		transport.send({ type: "ready", id: message.id });
+	} catch (error) {
+		transport.send({
+			type: "error",
+			id: message.id,
+			error: error instanceof Error ? error.message : String(error),
+		});
+	}
+}
+
+export function startMnemopiEmbedWorker(transport: MnemopiEmbedTransport): void {
+	transport.onMessage(message => {
+		switch (message.type) {
+			case "ping":
+				transport.send({ type: "pong", id: message.id });
+				return;
+			case "init":
+				void handleInit(transport, message);
+				return;
+			case "embed":
+				void handleEmbed(transport, message);
+				return;
+		}
+	});
+}

package/src/mnemopi/state.ts

@@ -3,6 +3,7 @@ import type { AgentMessage } from "@oh-my-pi/pi-agent-core";
 import type * as MnemopiNs from "@oh-my-pi/pi-mnemopi";
 import type { Mnemopi, RecallResult } from "@oh-my-pi/pi-mnemopi";
 import type * as MnemopiCoreNs from "@oh-my-pi/pi-mnemopi/core";
+import type { LocalModelInitializer } from "@oh-my-pi/pi-mnemopi/core";
 import { logger } from "@oh-my-pi/pi-utils";
 import {
 	composeRecallQuery,
@@ -13,16 +14,42 @@ import {
 import { extractMessages } from "../hindsight/transcript";
 import type { AgentSession, AgentSessionEvent } from "../session/agent-session";
 import type { MnemopiBackendConfig, MnemopiScoping } from "./config";
+import { mnemopiEmbedClient } from "./embed-client";
 
 // The mnemopi package pulls the embeddings stack; keep it off the CLI startup
 // module graph by loading it lazily at the async boundaries that need it.
 let mnemopiMod: typeof MnemopiNs | undefined;
 let mnemopiCoreMod: typeof MnemopiCoreNs | undefined;
 
-/** Lazily load `@oh-my-pi/pi-mnemopi` (memoized). */
+// `setLocalModelInitializer` writes a single module-level slot shared by
+// both the root and `/core` re-exports, so install at most once across both
+// loaders. Either entry point is enough to wire up the override.
+let localModelInitializerInstalled = false;
+
+function installLocalModelInitializer(setInitializer: (initializer: LocalModelInitializer) => void): void {
+	if (localModelInitializerInstalled) return;
+	localModelInitializerInstalled = true;
+	setInitializer(({ model, cacheDir }) =>
+		mnemopiEmbedClient.initialize(model, cacheDir).then(handle => {
+			if (handle) return handle;
+			throw new Error("mnemopi embed subprocess unavailable");
+		}),
+	);
+}
+
+/**
+ * Lazily load `@oh-my-pi/pi-mnemopi` (memoized) and route fastembed loads
+ * through the dedicated embeddings subprocess. The override is installed once
+ * — before any consumer gets the chance to call `embed()` — so
+ * `onnxruntime-node`'s NAPI constructor + finalizer never run inside the
+ * agent's address space (issue #3031). Test seams that swap the initializer
+ * with `setLocalModelInitializerForTests` still win because both go through
+ * the same module-level slot.
+ */
 export async function loadMnemopi(): Promise<typeof MnemopiNs> {
 	if (!mnemopiMod) {
 		mnemopiMod = await import("@oh-my-pi/pi-mnemopi");
+		installLocalModelInitializer(mnemopiMod.setLocalModelInitializer);
 	}
 	return mnemopiMod;
 }
@@ -31,6 +58,7 @@ export async function loadMnemopi(): Promise<typeof MnemopiNs> {
 export async function loadMnemopiCore(): Promise<typeof MnemopiCoreNs> {
 	if (!mnemopiCoreMod) {
 		mnemopiCoreMod = await import("@oh-my-pi/pi-mnemopi/core");
+		installLocalModelInitializer(mnemopiCoreMod.setLocalModelInitializer);
 	}
 	return mnemopiCoreMod;
 }

package/src/modes/components/custom-editor.ts

@@ -177,7 +177,7 @@ export class CustomEditor extends Editor {
 	/** Per-render scratch flag: did any layout line in this render contain a magic
 	 *  keyword that should shimmer? Reset by {@link #scheduleShimmerIfNeeded} each
 	 *  time a frame is queued. */
-	#shimmerTimer: ReturnType<typeof setTimeout> | undefined;
+	#shimmerTimer: Timer | undefined;
 	/** Repaint hook the host wires once at construction. Called from the shimmer
 	 *  timer to request the next animation frame. Undefined when nobody is
 	 *  listening (tests, headless callers); the timer chain still self-cleans. */

package/src/modes/components/model-selector.ts

@@ -179,9 +179,9 @@ export class ModelSelectorComponent extends Container {
 	#providers: ProviderTabState[] = STATIC_PROVIDER_TABS;
 	#activeTabIndex: number = 0;
 	#refreshingProviders: Set<string> = new Set();
-	#scheduledProviderRefreshes: Map<string, ReturnType<typeof setTimeout>> = new Map();
+	#scheduledProviderRefreshes: Map<string, Timer> = new Map();
 	#refreshSpinnerFrame: number = 0;
-	#refreshSpinnerInterval?: NodeJS.Timeout;
+	#refreshSpinnerInterval?: Timer;
 
 	// Context menu state
 	#isMenuOpen: boolean = false;

package/src/modes/components/welcome.ts

@@ -142,7 +142,7 @@ export interface LspServerInfo {
  */
 export class WelcomeComponent implements Component {
 	#animStart: number | null = null;
-	#animTimer: ReturnType<typeof setInterval> | null = null;
+	#animTimer: Timer | null = null;
 	#selectedTip: string | undefined;
 	// Render cache: the welcome box is the first transcript-area component, so
 	// returning a stable array reference keeps the whole frame prefix stable.

package/src/modes/controllers/event-controller.ts

@@ -1,4 +1,5 @@
 import type { ImageContent } from "@oh-my-pi/pi-ai";
+import { THINKING_LOOP_ERROR_MARKER } from "@oh-my-pi/pi-ai/utils/thinking-loop";
 import { type Component, Loader, TERMINAL } from "@oh-my-pi/pi-tui";
 import { INTENT_FIELD } from "@oh-my-pi/pi-wire";
 import { extractTextContent } from "../../commit/utils";
@@ -1014,6 +1015,13 @@ export class EventController {
 	async #handleAutoRetryStart(event: Extract<AgentSessionEvent, { type: "auto_retry_start" }>): Promise<void> {
 		this.#stopWorkingLoader();
 		this.ctx.statusContainer.clear();
+		if (event.errorMessage?.includes(THINKING_LOOP_ERROR_MARKER)) {
+			// The retry path drops the failed assistant from runtime context. Do not
+			// restore its inline Error row; just unpin the fixed-region banner so the
+			// retry UI is the visible state.
+			this.#pinnedErrorComponent = undefined;
+			this.ctx.clearPinnedError();
+		}
 		const delaySeconds = Math.round(event.delayMs / 1000);
 		this.ctx.retryLoader = new Loader(
 			this.ctx.ui,

package/src/modes/controllers/selector-controller.ts

@@ -27,7 +27,7 @@ import {
 	theme,
 } from "../../modes/theme/theme";
 import type { InteractiveModeContext } from "../../modes/types";
-import type { ResetCreditRedeemOutcome } from "../../session/auth-storage";
+import type { ResetCreditAccountStatus, ResetCreditRedeemOutcome } from "../../session/auth-storage";
 import type { SessionInfo } from "../../session/session-listing";
 import { SessionManager } from "../../session/session-manager";
 import { FileSessionStorage } from "../../session/session-storage";
@@ -1161,7 +1161,7 @@ export class SelectorController {
 	async showResetUsageSelector(): Promise<void> {
 		const session = this.ctx.session;
 		this.ctx.showStatus("Checking saved rate-limit resets…", { dim: true });
-		let statuses: Awaited<ReturnType<typeof session.listResetCredits>>;
+		let statuses: ResetCreditAccountStatus[];
 		try {
 			statuses = await session.listResetCredits();
 		} catch (error) {

package/src/modes/theme/theme.ts

@@ -2743,6 +2743,35 @@ export function highlightCode(code: string, lang?: string, highlightTheme: Theme
 }
 
 export function getSymbolTheme(): SymbolTheme {
+	// Guard against `theme` being undefined (pre-init or cross-module-instance
+	// plugin calls). Fall back to the ASCII preset so the returned symbols are
+	// usable instead of crashing. See #2998.
+	if (typeof theme === "undefined") {
+		const box = {
+			topLeft: "+",
+			topRight: "+",
+			bottomLeft: "+",
+			bottomRight: "+",
+			horizontal: "-",
+			vertical: "|",
+			cross: "+",
+			teeDown: "+",
+			teeUp: "+",
+			teeLeft: "+",
+			teeRight: "+",
+		};
+		return {
+			cursor: ">",
+			inputCursor: "|",
+			boxRound: box,
+			boxSharp: box,
+			table: box,
+			quoteBorder: "|",
+			hrChar: "-",
+			colorSwatch: "[]",
+			spinnerFrames: ["-", "\\", "|", "/"],
+		};
+	}
 	const preset = theme.getSymbolPreset();
 
 	return {
@@ -2808,6 +2837,19 @@ export function getMarkdownTheme(): MarkdownTheme {
 }
 
 export function getSelectListTheme(): SelectListTheme {
+	// Guard against `theme` being undefined (pre-init or cross-module-instance
+	// plugin calls). See #2998.
+	if (typeof theme === "undefined") {
+		return {
+			selectedPrefix: (text: string) => text,
+			selectedText: (text: string) => text,
+			description: (text: string) => text,
+			scrollInfo: (text: string) => text,
+			noMatch: (text: string) => text,
+			symbols: getSymbolTheme(),
+			hovered: (text: string) => text,
+		};
+	}
 	return {
 		selectedPrefix: (text: string) => theme.fg("accent", text),
 		selectedText: (text: string) => theme.fg("accent", text),
@@ -2820,6 +2862,16 @@ export function getSelectListTheme(): SelectListTheme {
 }
 
 export function getEditorTheme(): EditorTheme {
+	// Guard against `theme` being undefined (pre-init or cross-module-instance
+	// plugin calls). See #2998.
+	if (typeof theme === "undefined") {
+		return {
+			borderColor: (text: string) => text,
+			selectList: getSelectListTheme(),
+			symbols: getSymbolTheme(),
+			hintStyle: (text: string) => text,
+		};
+	}
 	return {
 		borderColor: (text: string) => theme.fg("borderMuted", text),
 		selectList: getSelectListTheme(),
@@ -2829,6 +2881,23 @@ export function getEditorTheme(): EditorTheme {
 }
 
 export function getSettingsListTheme(): SettingsListTheme {
+	// Plugins (e.g. pi-rtk-optimizer) may call this before `initTheme()` assigns
+	// the global `theme`, or from a separate module instance under npm-global
+	// installs where the live binding was never initialized. Fall back to plain
+	// text so the call returns a usable (unstyled) theme instead of crashing with
+	// "undefined is not an object (evaluating 'theme.fg')". See #2998.
+	if (typeof theme === "undefined") {
+		return {
+			label: (text: string) => text,
+			value: (text: string) => text,
+			description: (text: string) => text,
+			cursor: "> ",
+			hint: (text: string) => text,
+			heading: (text: string) => text,
+			section: (text: string) => text,
+			hovered: (text: string) => text,
+		};
+	}
 	return {
 		label: (text: string, selected: boolean, changed: boolean) =>
 			changed ? theme.fg("statusLineGitDirty", text) : selected ? theme.fg("accent", text) : text,

package/src/sdk.ts

@@ -1051,6 +1051,9 @@ export async function createAgentSession(options: CreateAgentSessionOptions = {}
 	const modelRegistry =
 		options.modelRegistry ??
 		new ModelRegistry(options.authStorage ?? (await logger.time("discoverModels", discoverAuthStorage, agentDir)));
+	// Track whether we internally created the authStorage so we can close it
+	// if construction fails before the session takes ownership.
+	const ownsAuthStorage = !options.authStorage && !options.modelRegistry;
 	const authStorage = modelRegistry.authStorage;
 	if (options.authStorage && options.authStorage !== authStorage) {
 		throw new Error(
@@ -2854,6 +2857,7 @@ export async function createAgentSession(options: CreateAgentSessionOptions = {}
 					await asyncJobManager.dispose({ timeoutMs: 3_000 });
 				}
 				await disposeKernelSessionsByOwner(evalKernelOwnerId);
+				if (ownsAuthStorage) authStorage.close();
 			}
 		} catch (cleanupError) {
 			logger.warn("Failed to clean up createAgentSession resources after startup error", {

package/src/session/agent-session.ts

@@ -104,6 +104,7 @@ import {
 	streamSimple,
 } from "@oh-my-pi/pi-ai";
 import { stripToolDescriptions } from "@oh-my-pi/pi-ai/utils/schema";
+import { THINKING_LOOP_ERROR_MARKER } from "@oh-my-pi/pi-ai/utils/thinking-loop";
 import { getSupportedEfforts } from "@oh-my-pi/pi-catalog/model-thinking";
 import { modelsAreEqual } from "@oh-my-pi/pi-catalog/models";
 import { MacOSPowerAssertion } from "@oh-my-pi/pi-natives";
@@ -205,6 +206,7 @@ import type { HindsightSessionState } from "../hindsight/state";
 import { type LocalProtocolOptions, resolveLocalUrlToPath } from "../internal-urls";
 import { IrcBus, type IrcMessage } from "../irc/bus";
 import { resolveMemoryBackend } from "../memory-backend";
+import { shutdownMnemopiEmbedClient } from "../mnemopi/embed-client";
 import { getMnemopiSessionState, type MnemopiSessionState, setMnemopiSessionState } from "../mnemopi/state";
 import { containsOrchestrate, ORCHESTRATE_NOTICE } from "../modes/orchestrate";
 import { getCurrentThemeName, theme } from "../modes/theme/theme";
@@ -4208,6 +4210,11 @@ export class AgentSession {
 		hindsightState?.dispose();
 		const mnemopiState = setMnemopiSessionState(this, undefined);
 		await mnemopiState?.dispose();
+		// Tear down the embeddings subprocess AFTER mnemopi state.dispose:
+		// consolidate-on-dispose may still call `embed()` to store the final
+		// memories, and that round-trips through the worker we are about to
+		// hard-kill (issue #3031).
+		await shutdownMnemopiEmbedClient();
 		this.#disconnectFromAgent();
 		if (this.#unsubscribeAppendOnly) {
 			this.#unsubscribeAppendOnly();
@@ -9977,6 +9984,7 @@ export class AgentSession {
 		if (this.#isProviderErrorFinishReasonBeforeToolUse(message)) return true;
 		if (this.#isMalformedFunctionCallError(message)) return true;
 		if (this.#hasReplayUnsafeToolOutput(message)) return false;
+		if (message.errorMessage.includes(THINKING_LOOP_ERROR_MARKER)) return true;
 		if (this.#isStaleOpenAIResponsesReplayError(message)) return true;
 
 		const err = message.errorMessage;

package/src/session/agent-storage.ts

@@ -247,6 +247,20 @@ FROM model_usage_legacy
 			{ cause: lastError },
 		);
 	}
+	/** @internal Reset all singletons and close their databases — test-only. */
+	static resetInstance(): void {
+		for (const storage of instances.values()) storage.#close();
+		instances.clear();
+	}
+
+	#close(): void {
+		this.#listSettingsStmt.finalize();
+		this.#upsertModelUsageStmt.finalize();
+		this.#listModelUsageStmt.finalize();
+		// SqliteAuthCredentialStore.close() finalizes its own statements and
+		// closes the shared #db handle — must run after our statements finalize.
+		this.#authStore.close();
+	}
 
 	/**
 	 * Reads legacy settings persisted in the agent.db `settings` table.

package/src/session/auth-broker-config.ts

@@ -30,6 +30,7 @@ import {
 } from "@oh-my-pi/pi-ai/auth-broker/discover";
 import { getAgentDir } from "@oh-my-pi/pi-utils";
 import { resolveConfigValue } from "../config/resolve-config-value";
+import type { AuthStorage } from "./auth-storage";
 
 export { type AuthBrokerClientConfig, getAuthBrokerTokenFilePath };
 
@@ -82,7 +83,7 @@ export function resolveAuthBrokerConfig(): Promise<AuthBrokerClientConfig | null
 export function discoverAuthStorage(
 	agentDir: string = getAgentDir(),
 	options?: Omit<DiscoverAuthStorageOptions, "agentDir" | "configValueResolver">,
-): ReturnType<typeof discoverAuthStorageShared> {
+): Promise<AuthStorage> {
 	return discoverAuthStorageShared({
 		...options,
 		agentDir,

package/src/session/history-storage.ts

@@ -145,9 +145,21 @@ CREATE TRIGGER IF NOT EXISTS history_ai AFTER INSERT ON history BEGIN
 		return HistoryStorage.#instance;
 	}
 
-	/** @internal Reset the singleton — test-only. */
+	/** @internal Reset the singleton and close its database — test-only. */
 	static resetInstance(): void {
+		const instance = HistoryStorage.#instance;
 		HistoryStorage.#instance = undefined;
+		if (instance) instance.#close();
+	}
+
+	#close(): void {
+		for (const stmt of this.#substringStmts.values()) stmt.finalize();
+		this.#substringStmts.clear();
+		this.#insertRowStmt.finalize();
+		this.#recentStmt.finalize();
+		this.#searchStmt.finalize();
+		this.#lastPromptStmt.finalize();
+		this.#db.close();
 	}
 
 	#insertBatch(rows: Array<Pick<HistoryEntry, "prompt" | "cwd" | "sessionId">>): void {

package/src/stt/asr-client.ts

@@ -3,6 +3,7 @@ import { $env, isBunTestRuntime, isCompiledBinary, logger, workerHostEntry } fro
 import type { Subprocess } from "bun";
 import { settings } from "../config/settings";
 import { tinyWorkerEnvOverlay } from "../tiny/title-client";
+import { safeSend } from "../utils/ipc";
 import type { SttProgressEvent, SttWorkerInbound, SttWorkerOutbound } from "./asr-protocol";
 import type { SttModelKey } from "./models";
 
@@ -181,13 +182,7 @@ export function createSttSubprocess(): SpawnedSubprocess {
 function wrapSubprocess({ proc, inbound, errors, intentionalExit }: SpawnedSubprocess): WorkerHandle {
 	return {
 		send(message) {
-			try {
-				proc.send(message);
-			} catch (error) {
-				logger.debug("stt: send to subprocess failed", {
-					error: error instanceof Error ? error.message : String(error),
-				});
-			}
+			safeSend(proc, message, "stt");
 		},
 		onMessage(handler) {
 			inbound.add(handler);

package/src/tiny/title-client.ts

@@ -2,6 +2,7 @@ import * as path from "node:path";
 import { $env, isBunTestRuntime, isCompiledBinary, logger, workerHostEntry } from "@oh-my-pi/pi-utils";
 import type { Subprocess } from "bun";
 import { settings } from "../config/settings";
+import { safeSend } from "../utils/ipc";
 import { tinyModelDeviceSettingToEnv } from "./device";
 import { tinyModelDtypeSettingToEnv } from "./dtype";
 import {
@@ -216,13 +217,7 @@ export function createTinyTitleSubprocess(): SpawnedSubprocess {
 function wrapSubprocess({ proc, inbound, errors, intentionalExit }: SpawnedSubprocess): WorkerHandle {
 	return {
 		send(message) {
-			try {
-				proc.send(message);
-			} catch (error) {
-				logger.debug("tiny-title: send to subprocess failed", {
-					error: error instanceof Error ? error.message : String(error),
-				});
-			}
+			safeSend(proc, message, "tiny-title");
 		},
 		onMessage(handler) {
 			inbound.add(handler);

package/src/tools/image-gen.ts

@@ -1572,19 +1572,15 @@ export const imageGenTool: CustomTool<typeof imageGenSchema, ImageGenToolDetails
 };
 
 export async function getImageGenTools(
-	modelRegistry?: ModelRegistry,
-	activeModel?: Model,
+	_modelRegistry?: ModelRegistry,
+	_activeModel?: Model,
 ): Promise<Array<CustomTool<typeof imageGenSchema, ImageGenToolDetails>>> {
-	const apiKey = await findImageApiKey(modelRegistry, activeModel);
-	if (!apiKey) return [];
 	return [imageGenTool];
 }
 
 export async function getImageGenToolsWithRegistry(
-	modelRegistry: ModelRegistry,
-	activeModel?: Model,
+	_modelRegistry: ModelRegistry,
+	_activeModel?: Model,
 ): Promise<Array<CustomTool<typeof imageGenSchema, ImageGenToolDetails>>> {
-	const apiKey = await findImageApiKey(modelRegistry, activeModel);
-	if (!apiKey) return [];
 	return [imageGenTool];
 }

package/src/tools/render-utils.ts

@@ -657,7 +657,10 @@ export function truncateDiffByHunk(
 export function shortenPath(filePath: string, homeDir?: string): string {
 	const home = homeDir ?? os.homedir();
 	if (home && filePath.startsWith(home)) {
-		return `~${filePath.slice(home.length)}`;
+		const suffix = filePath.slice(home.length);
+		if (suffix === "" || suffix.startsWith(path.posix.sep) || suffix.startsWith(path.win32.sep)) {
+			return `~${suffix.replaceAll(path.win32.sep, path.posix.sep)}`;
+		}
 	}
 	return filePath;
 }

package/src/tts/tts-client.ts

@@ -3,6 +3,7 @@ import { $env, isBunTestRuntime, isCompiledBinary, logger, workerHostEntry } fro
 import type { Subprocess } from "bun";
 import { settings } from "../config/settings";
 import { tinyWorkerEnvOverlay } from "../tiny/title-client";
+import { safeSend } from "../utils/ipc";
 import { isTtsLocalModelKey, type TtsLocalModelKey } from "./models";
 import type { TtsProgressEvent, TtsWorkerInbound, TtsWorkerOutbound } from "./tts-protocol";
 
@@ -245,13 +246,7 @@ export function createTtsSubprocess(): SpawnedSubprocess {
 function wrapSubprocess({ proc, inbound, errors, intentionalExit }: SpawnedSubprocess): WorkerHandle {
 	return {
 		send(message) {
-			try {
-				proc.send(message);
-			} catch (error) {
-				logger.debug("tts: send to subprocess failed", {
-					error: error instanceof Error ? error.message : String(error),
-				});
-			}
+			safeSend(proc, message, "tts");
 		},
 		onMessage(handler) {
 			inbound.add(handler);

package/src/utils/image-loading.ts

@@ -13,9 +13,19 @@ export const SUPPORTED_INPUT_IMAGE_MIME_TYPES = SUPPORTED_IMAGE_MIME_TYPES;
  * with an opaque HTTP 400. Detect those models so the resize pipeline encodes
  * to PNG/JPEG instead — the automatic equivalent of `OMP_NO_WEBP=1`.
  */
-export function modelLacksWebpSupport(model: Pick<Model, "provider" | "api"> | undefined): boolean {
+export function modelLacksWebpSupport(
+	model: Pick<Model, "provider" | "api" | "imageInputDecoder"> | undefined,
+): boolean {
 	if (!model) return false;
-	return model.provider === "ollama" || model.provider === "ollama-cloud" || model.api === "ollama-chat";
+	return (
+		model.imageInputDecoder === "stb" ||
+		model.provider === "ollama" ||
+		model.provider === "ollama-cloud" ||
+		model.provider === "llama.cpp" ||
+		model.provider === "lm-studio" ||
+		model.provider === "local-server" ||
+		model.api === "ollama-chat"
+	);
 }
 
 /**

package/src/utils/ipc.ts

@@ -0,0 +1,38 @@
+import { logger } from "@oh-my-pi/pi-utils";
+
+/**
+ * Narrow a value to a thenable so a rejection handler can be attached.
+ *
+ * Mirrors the local helper in `mcp/transports/stdio.ts` (kept separate because
+ * that copy serves the FileSink stdin-write path and is battle-tested there).
+ * This shared copy is the home for the IPC `send()` sites.
+ */
+export function isThenable(value: unknown): value is PromiseLike<unknown> {
+	return (
+		value != null &&
+		(typeof value === "object" || typeof value === "function") &&
+		typeof (value as { then?: unknown }).then === "function"
+	);
+}
+
+/**
+ * Send a message to a Bun subprocess over IPC, neutralizing both the
+ * synchronous throw ("cannot be used after the process has exited") and any
+ * asynchronous rejection (EPIPE from a pipe that broke between exit being
+ * observed and the next `send()`). The dead worker is detected separately via
+ * `onExit`/`onError` and respawned or disabled by the owning client; an
+ * un-awaited EPIPE rejection must not escape as a fatal unhandled rejection
+ * that takes down the whole session. See issue #2997.
+ *
+ * `label` prefixes the debug log on synchronous failure (e.g. "tts").
+ */
+export function safeSend(proc: { send(message: unknown): unknown }, message: unknown, label: string): void {
+	try {
+		const result = proc.send(message);
+		if (isThenable(result)) result.then(undefined, () => {});
+	} catch (error) {
+		logger.debug(`${label}: send to subprocess failed`, {
+			error: error instanceof Error ? error.message : String(error),
+		});
+	}
+}