@oh-my-pi/pi-coding-agent 16.3.2 → 16.3.4

package/src/session/session-manager.ts

@@ -383,6 +383,17 @@ export class SessionManager {
 	#diskFailureLogged = false;
 	/** Bumped on every sync rewrite / chain reset so stale queued tasks become no-ops. */
 	#diskEpoch = 0;
+	/**
+	 * Epoch of the in-flight atomic rewrite, or `null` when no rewrite is running.
+	 * The fence in {@link #appendToSessionFile} only applies while this matches
+	 * `#diskEpoch`: once a synchronous rewrite (`flushSync` → `#rewriteSynchronously`)
+	 * bumps the epoch, the pending atomic publish is guaranteed to abandon via
+	 * its `commitGuard`, and appends can safely take the hot path against the
+	 * freshly-published file.
+	 */
+	#atomicRewriteFenceEpoch: number | null = null;
+	/** Set by synchronous appends that land while an atomic replacement is active. */
+	#atomicRewriteDirty = false;
 
 	#artifactManager: ArtifactManager | null = null;
 	#artifactManagerSessionFile: string | null = null;
@@ -555,27 +566,65 @@ export class SessionManager {
 
 	/**
 	 * Rewrite the whole file atomically (temp-write + rename, EPERM-safe) on the
-	 * disk chain. The body is serialized inside the task — after the writer is
-	 * closed — so entries appended before the task runs are included.
+	 * disk chain. The body is serialized after the writer is closed. The fence
+	 * is enabled BEFORE `#closeWriterHandle()` and stays active until the last
+	 * atomic publish returns, so a sync append landing in the close-yield window
+	 * cannot open a fresh writer that the pending replacement would then detach
+	 * from the current JSONL path. A `commitGuard` also prevents a superseding
+	 * synchronous rewrite from being overwritten by the stale body serialized
+	 * before it ran.
 	 */
 	async #rewriteAtomically(): Promise<void> {
 		if (!this.#persist || !this.#sessionFile) return;
 
-		const epoch = this.#diskEpoch;
+		const startEpoch = this.#diskEpoch;
 		await this.#scheduleDiskWork(
 			async () => {
-				await this.#closeWriterHandle();
-				const sessionFile = this.#sessionFile;
-				if (!sessionFile) return;
-				await this.#storage.writeTextAtomic(sessionFile, this.#fileBody());
-				this.#fileIsCurrent = true;
-				this.#rewriteRequired = false;
-				this.#hasTitleSlot = true;
+				if (await this.#runFencedAtomicRewrite(startEpoch)) {
+					this.#fileIsCurrent = true;
+					this.#rewriteRequired = false;
+					this.#hasTitleSlot = true;
+				}
 			},
-			{ epoch },
+			{ epoch: startEpoch },
 		);
 	}
 
+	/**
+	 * Shared fenced atomic-rewrite loop used by `#rewriteAtomically` and the
+	 * `#persistTitleChangeEntry` fallback. Holds `#atomicRewriteActive` across
+	 * the writer close and the full-file replace, and loops on
+	 * `#atomicRewriteDirty` so any fenced append that lands during the rewrite
+	 * is captured before the task resolves. Returns `false` when the disk epoch
+	 * moved (a superseding synchronous rewrite has taken over) so callers skip
+	 * their post-publish state updates.
+	 */
+	async #runFencedAtomicRewrite(epoch: number): Promise<boolean> {
+		this.#atomicRewriteFenceEpoch = epoch;
+		try {
+			do {
+				this.#atomicRewriteDirty = false;
+				await this.#closeWriterHandle();
+				const sessionFile = this.#sessionFile;
+				if (!sessionFile) return false;
+				if (this.#diskEpoch !== epoch) return false;
+				await this.#storage.writeTextAtomic(sessionFile, this.#fileBody(), {
+					commitGuard: () => this.#diskEpoch === epoch,
+				});
+				if (this.#diskEpoch !== epoch) return false;
+			} while (this.#atomicRewriteDirty);
+			return true;
+		} finally {
+			// Only relinquish the fence if we still own it. A superseding
+			// synchronous rewrite (`flushSync` → `#rewriteSynchronously`) may
+			// have reset `#diskTail`, scheduled a fresh atomic task at the new
+			// epoch, and that task may have taken ownership of the fence while
+			// this stale rewrite was still awaiting storage. Clearing it here
+			// unconditionally would strand appends during the newer publish.
+			if (this.#atomicRewriteFenceEpoch === epoch) this.#atomicRewriteFenceEpoch = null;
+		}
+	}
+
 	#appendToSessionFile(entry: SessionEntry): void {
 		if (!this.#persist || !this.#sessionFile) return;
 		if (this.#diskFailure) throw this.#diskFailure;
@@ -588,6 +637,19 @@ export class SessionManager {
 			return;
 		}
 
+		// Atomic replacement window: the old path may be moved aside underneath
+		// any newly-opened append handle (Windows EPERM fallback). Do not open a
+		// writer here; the active rewrite loops and serializes a fresh full body.
+		// A superseding synchronous rewrite bumps `#diskEpoch`, at which point
+		// the pending atomic publish is guaranteed to abandon via its
+		// `commitGuard`, so appends can (and must) take the hot path so they
+		// don't strand in memory while `close()` returns without a rewrite.
+		if (this.#atomicRewriteFenceEpoch !== null && this.#atomicRewriteFenceEpoch === this.#diskEpoch) {
+			this.#fileIsCurrent = false;
+			this.#rewriteRequired = true;
+			this.#atomicRewriteDirty = true;
+			return;
+		}
 		// Cold/divergent: not on disk yet, or in-memory entries diverged from the
 		// file → rewrite the whole file synchronously and keep going.
 		if (!this.#fileIsCurrent || this.#rewriteRequired) {
@@ -637,10 +699,9 @@ export class SessionManager {
 				try {
 					await this.#appendWriter().append(line);
 					await this.#storage.updateSessionTitle(sessionFile, update);
-					this.#fileIsCurrent = true;
+					if (this.#diskEpoch === epoch) this.#fileIsCurrent = true;
 				} catch {
-					await this.#closeWriterHandle();
-					await this.#storage.writeTextAtomic(sessionFile, this.#fileBody());
+					if (!(await this.#runFencedAtomicRewrite(epoch))) return;
 					this.#clearDiskError();
 					this.#fileIsCurrent = true;
 					this.#rewriteRequired = false;
@@ -1049,6 +1110,10 @@ export class SessionManager {
 		await this.#scheduleDiskWork(async () => {
 			if (this.#writer?.isOpen()) await this.#writer.flush();
 		});
+		// Drain any fire-and-forget backing writes (e.g. `writeTextSync` queued
+		// on IndexedSessionStorage during `flushSync`) so callers relying on
+		// flush() see the write durably visible to readers.
+		await this.#storage.drain();
 		if (this.#diskFailure) throw this.#diskFailure;
 	}
 
@@ -1078,6 +1143,10 @@ export class SessionManager {
 			if (hadWriter || (this.#sessionFile && this.#storage.existsSync(this.#sessionFile)))
 				this.#fileIsCurrent = true;
 		});
+		// Wait for any queued backing writes (IndexedSessionStorage per-path
+		// tail) to become durable so a graceful shutdown does not exit while
+		// a fire-and-forget publish is still on the wire.
+		await this.#storage.drain();
 		if (this.#diskFailure) throw this.#diskFailure;
 	}
 

package/src/session/session-storage.ts

@@ -28,6 +28,18 @@ export interface SessionStorageWriter {
 	getError(): Error | undefined;
 }
 
+/**
+ * Optional guard applied by {@link SessionStorage.writeTextAtomic}. The
+ * backend MUST call `commitGuard()` synchronously immediately before it makes
+ * the staged content visible at `path`. If it returns `false`, the staged
+ * write is discarded and the target is left untouched. Backends MUST NOT
+ * yield between calling the guard and publishing the write, so a concurrent
+ * synchronous rewrite that took over cannot be overwritten by a stale body.
+ */
+export interface WriteTextAtomicOptions {
+	commitGuard?: () => boolean;
+}
+
 export interface SessionStorage {
 	ensureDirSync(dir: string): void;
 	existsSync(path: string): boolean;
@@ -48,11 +60,20 @@ export interface SessionStorage {
 	/** Read the requested UTF-8 byte windows from the head and tail of the file. */
 	readTextSlices(path: string, prefixBytes: number, suffixBytes: number): Promise<[string, string]>;
 	writeText(path: string, content: string): Promise<void>;
-	writeTextAtomic(path: string, content: string): Promise<void>;
+	writeTextAtomic(path: string, content: string, options?: WriteTextAtomicOptions): Promise<void>;
 	rename(path: string, nextPath: string): Promise<void>;
 	unlink(path: string): Promise<void>;
 	deleteSessionWithArtifacts(sessionPath: string): Promise<void>;
 	openWriter(path: string, options?: { flags?: "a" | "w"; onError?: (err: Error) => void }): SessionStorageWriter;
+	/**
+	 * Wait for every backing write scheduled by this storage to become durably
+	 * visible. Sync backends (file, memory) return immediately because their
+	 * writes complete in-body; async backends (Redis/SQL via
+	 * {@link IndexedSessionStorage}) await their per-path queues so a caller
+	 * driving a graceful shutdown does not exit while a fire-and-forget
+	 * `writeTextSync` publish is still on the wire.
+	 */
+	drain(): Promise<void>;
 }
 
 // FinalizationRegistry to clean up leaked file descriptors
@@ -229,53 +250,107 @@ export class FileSessionStorage implements SessionStorage {
 		await Bun.write(path, content, { createPath: true });
 	}
 
-	async writeTextAtomic(fpath: string, content: string): Promise<void> {
+	async writeTextAtomic(fpath: string, content: string, options?: WriteTextAtomicOptions): Promise<void> {
 		const dir = path.resolve(fpath, "..");
 		const tempPath = path.join(dir, `.${path.basename(fpath)}.${Snowflake.next()}.tmp`);
 		await fs.promises.mkdir(dir, { recursive: true });
 		try {
 			await fs.promises.writeFile(tempPath, content);
+		} catch (err) {
+			this.#discardTemp(tempPath, fpath);
+			throw toError(err);
+		}
+		// Guard-check + rename MUST NOT be separated by an await. A concurrent
+		// synchronous rewrite (flushSync -> #rewriteSynchronously) can otherwise
+		// publish a fresh body between the check and the rename, and this stale
+		// staged body would overwrite it. Sync rename closes that window.
+		if (options?.commitGuard && !options.commitGuard()) {
+			this.#discardTemp(tempPath, fpath);
+			return;
+		}
+		try {
+			this.renameSync(tempPath, fpath);
+			return;
+		} catch (err) {
+			if (!hasFsCode(err, "EPERM")) {
+				this.#discardTemp(tempPath, fpath);
+				throw toError(err);
+			}
 			try {
-				await this.rename(tempPath, fpath);
-				return;
-			} catch (err) {
-				if (!hasFsCode(err, "EPERM")) throw toError(err);
-				await this.#replaceSessionFileAfterEperm(tempPath, fpath, err);
-				return;
+				this.#replaceSessionFileAfterEpermSync(tempPath, fpath, err, options?.commitGuard);
+			} catch (fallbackErr) {
+				this.#discardTemp(tempPath, fpath);
+				throw fallbackErr;
 			}
+		}
+	}
+
+	/**
+	 * Sync rename hook. Split from `rename` so `writeTextAtomic` can perform its
+	 * guard-then-publish step without a yield, and so tests can inject
+	 * Windows-style EPERM at the sync layer used by the atomic path.
+	 */
+	renameSync(source: string, target: string): void {
+		fs.renameSync(source, target);
+	}
+
+	#discardTemp(tempPath: string, targetPath: string): void {
+		try {
+			fs.unlinkSync(tempPath);
 		} catch (err) {
-			try {
-				await this.unlink(tempPath);
-			} catch (cleanupErr) {
-				if (!isEnoent(cleanupErr)) {
-					logger.warn("Failed to remove session rewrite temp file", {
-						sessionFile: fpath,
-						tempPath,
-						error: toError(cleanupErr).message,
-					});
-				}
+			if (!isEnoent(err)) {
+				logger.warn("Failed to remove session rewrite temp file", {
+					sessionFile: targetPath,
+					tempPath,
+					error: toError(err).message,
+				});
 			}
-			throw toError(err);
 		}
 	}
 
-	async #replaceSessionFileAfterEperm(tempPath: string, targetPath: string, renameError: unknown): Promise<void> {
+	#replaceSessionFileAfterEpermSync(
+		tempPath: string,
+		targetPath: string,
+		renameError: unknown,
+		commitGuard?: () => boolean,
+	): void {
 		const dir = path.resolve(targetPath, "..");
 		const backupPath = path.join(dir, `${path.basename(targetPath)}.${Snowflake.next()}.bak`);
 		try {
-			await this.rename(targetPath, backupPath);
+			this.renameSync(targetPath, backupPath);
 		} catch (moveAsideError) {
 			if (isEnoent(moveAsideError)) {
-				await this.rename(tempPath, targetPath);
+				if (commitGuard && !commitGuard()) {
+					this.#discardTemp(tempPath, targetPath);
+					return;
+				}
+				this.renameSync(tempPath, targetPath);
 				return;
 			}
 			throw toError(renameError);
 		}
+		if (commitGuard && !commitGuard()) {
+			// A concurrent synchronous rewrite published a fresh body between the
+			// move-aside and this point. Restore the moved-aside file so we do
+			// not overwrite it with our staged (stale) body, and drop the temp
+			// so `writeTextAtomic`'s "discard on abandon" contract holds.
+			try {
+				this.renameSync(backupPath, targetPath);
+			} catch (restoreErr) {
+				logger.warn("Failed to restore backup after commitGuard rejection", {
+					sessionFile: targetPath,
+					backupPath,
+					error: toError(restoreErr).message,
+				});
+			}
+			this.#discardTemp(tempPath, targetPath);
+			return;
+		}
 		try {
-			await this.rename(tempPath, targetPath);
+			this.renameSync(tempPath, targetPath);
 		} catch (replaceError) {
 			try {
-				await this.rename(backupPath, targetPath);
+				this.renameSync(backupPath, targetPath);
 			} catch (rollbackErr) {
 				const rollbackError = toError(rollbackErr);
 				throw new Error(
@@ -288,7 +363,7 @@ export class FileSessionStorage implements SessionStorage {
 			throw toError(replaceError);
 		}
 		try {
-			await this.unlink(backupPath);
+			fs.unlinkSync(backupPath);
 		} catch (err) {
 			if (!isEnoent(err)) {
 				logger.warn("Failed to remove session rewrite backup", {
@@ -312,6 +387,12 @@ export class FileSessionStorage implements SessionStorage {
 		return fs.promises.unlink(path);
 	}
 
+	drain(): Promise<void> {
+		// File writes complete synchronously in-body via fs.writeFileSync /
+		// fs.renameSync, so there is no queued work to await.
+		return Promise.resolve();
+	}
+
 	openWriter(path: string, options?: { flags?: "a" | "w"; onError?: (err: Error) => void }): SessionStorageWriter {
 		return new FileSessionStorageWriter(path, options);
 	}
@@ -621,7 +702,8 @@ export class MemorySessionStorage implements SessionStorage {
 		return Promise.resolve();
 	}
 
-	writeTextAtomic(path: string, content: string): Promise<void> {
+	writeTextAtomic(path: string, content: string, options?: WriteTextAtomicOptions): Promise<void> {
+		if (options?.commitGuard && !options.commitGuard()) return Promise.resolve();
 		this.writeTextSync(path, content);
 		return Promise.resolve();
 	}
@@ -642,6 +724,10 @@ export class MemorySessionStorage implements SessionStorage {
 		return Promise.resolve();
 	}
 
+	drain(): Promise<void> {
+		return Promise.resolve();
+	}
+
 	openWriter(path: string, options?: { flags?: "a" | "w"; onError?: (err: Error) => void }): SessionStorageWriter {
 		return new MemorySessionStorageWriter(this, path, options);
 	}

package/src/slash-commands/helpers/usage-report.ts

@@ -100,7 +100,12 @@ function renderUsageReports(
 			for (let index = 0; index < report.limits.length; index++) {
 				const limit = report.limits[index]!;
 				const window = limit.window?.label ?? limit.scope.windowId;
-				const tier = limit.scope.tier ? ` (${limit.scope.tier})` : "";
+				// Skip the tier suffix when the label already names it (e.g. Anthropic's
+				// "Claude 7 Day (Fable)" with scope.tier "fable") — mirrors limitTitle in usage-cli.
+				const tier =
+					limit.scope.tier && !limit.label.toLowerCase().includes(limit.scope.tier.toLowerCase())
+						? ` (${limit.scope.tier})`
+						: "";
 				lines.push(`- ${limit.label}${tier}${window ? ` — ${window}` : ""}`);
 				lines.push(
 					`  ${formatUsageReportAccount(report, limit, index)}: ${formatUsageAmount(limit)}${inUse ? "  ← in use by this session" : ""}`,

package/src/ssh/__tests__/connection-manager-timeout.test.ts

@@ -0,0 +1,61 @@
+/**
+ * Regression for #4232: `runSshSync` / `runSshCaptureSync` sit on the
+ * `ensureHostInfo` → `probeHostInfo` / `ensureConnection` path that runs before
+ * `SshTool.execute` applies the user's command timeout. Previously they invoked
+ * `ssh` through `$`ssh ${args}`.quiet().nothrow()` with no timeout and no
+ * abort signal, so an unreachable host or wedged control-master hung forever.
+ *
+ * The contract now is: each helper is bounded by `timeoutMs`, aborts a stalled
+ * child, and returns a failure result (`exitCode !== 0`, non-empty
+ * `stderr`) instead of throwing or blocking.
+ */
+import { afterAll, beforeAll, describe, expect, it } from "bun:test";
+import * as fs from "node:fs/promises";
+import * as os from "node:os";
+import * as path from "node:path";
+import { _sshHelpersForTests } from "../connection-manager";
+
+const { runSshSync, runSshCaptureSync } = _sshHelpersForTests;
+
+let binDir: string;
+let originalPath: string | undefined;
+
+beforeAll(async () => {
+	binDir = await fs.mkdtemp(path.join(os.tmpdir(), "omp-ssh-timeout-"));
+	// Fake `ssh` that traps SIGTERM and sleeps far past any test bound.
+	// Simulates a wedged control-master / unreachable host.
+	const fake = path.join(binDir, "ssh");
+	await fs.writeFile(fake, "#!/usr/bin/env bash\ntrap '' TERM\nsleep 300\n", { mode: 0o755 });
+	originalPath = process.env.PATH;
+	process.env.PATH = `${binDir}${path.delimiter}${originalPath ?? ""}`;
+});
+
+afterAll(async () => {
+	if (originalPath === undefined) delete process.env.PATH;
+	else process.env.PATH = originalPath;
+	await fs.rm(binDir, { recursive: true, force: true });
+});
+
+describe("SSH pre-command helpers bound their own runtime (#4232)", () => {
+	it("runSshSync returns a failure result within the timeout on a wedged host", async () => {
+		const timeoutMs = 200;
+		const started = Date.now();
+		const result = await runSshSync(["-o", "BatchMode=yes", "unreachable", "true"], timeoutMs);
+		const elapsed = Date.now() - started;
+
+		expect(elapsed).toBeLessThan(5_000);
+		// timeout → aborted child, so exit code is null (aborted) or non-zero.
+		expect(result.exitCode).not.toBe(0);
+	}, 10_000);
+
+	it("runSshCaptureSync returns a failure result within the timeout on a wedged host", async () => {
+		const timeoutMs = 200;
+		const started = Date.now();
+		const result = await runSshCaptureSync(["-o", "BatchMode=yes", "unreachable", "true"], timeoutMs);
+		const elapsed = Date.now() - started;
+
+		expect(elapsed).toBeLessThan(5_000);
+		expect(result.exitCode).not.toBe(0);
+		expect(result.stdout).toBe("");
+	}, 10_000);
+});

package/src/ssh/__tests__/sshfs-mount.test.ts

@@ -0,0 +1,13 @@
+import { describe, expect, it } from "bun:test";
+import * as path from "node:path";
+import { isMounted } from "../sshfs-mount";
+
+describe("isMounted", () => {
+	it("detects a macOS mount point when mountpoint is unavailable", async () => {
+		const parentPath = import.meta.dir;
+		const mountPath = path.join(parentPath, "mounted");
+		const stat = async (filePath: string) => ({ dev: filePath === mountPath ? 2 : 1 });
+
+		await expect(isMounted(mountPath, { platform: "darwin", stat, which: () => null })).resolves.toBe(true);
+	});
+});

package/src/ssh/connection-manager.ts

@@ -1,7 +1,6 @@
 import * as fs from "node:fs";
 import * as path from "node:path";
-import { $which, getRemoteHostDir, getSshControlDir, isEnoent, logger, postmortem } from "@oh-my-pi/pi-utils";
-import { $ } from "bun";
+import { $which, getRemoteHostDir, getSshControlDir, isEnoent, logger, postmortem, ptree } from "@oh-my-pi/pi-utils";
 import { buildSshTarget, sanitizeHostName } from "./utils";
 
 export interface SSHConnectionTarget {
@@ -116,20 +115,54 @@ function buildCommonArgs(host: SSHConnectionTarget, options?: SSHArgsOptions): s
 	return args;
 }
 
-async function runSshSync(args: string[]): Promise<{ exitCode: number | null; stderr: string }> {
-	const result = await $`ssh ${args}`.quiet().nothrow();
-	return { exitCode: result.exitCode, stderr: result.stderr.toString().trim() };
-}
-
-async function runSshCaptureSync(args: string[]): Promise<{ exitCode: number | null; stdout: string; stderr: string }> {
-	const result = await $`ssh ${args}`.quiet().nothrow();
+/**
+ * Per-call timeout for the pre-command SSH setup/probe helpers. These sit on
+ * the `ensureHostInfo` → `probeHostInfo` / `ensureConnection` path that runs
+ * *before* `SshTool.execute` applies the user-provided command timeout, so an
+ * unreachable host or wedged control-master would otherwise hang forever
+ * (#4232). `allowNonZero`/`allowAbort` keep the "return a failure result"
+ * contract that these helpers had under `.quiet().nothrow()`.
+ */
+const SSH_HELPER_TIMEOUT_MS = 30_000;
+
+async function runSshSync(
+	args: string[],
+	timeoutMs = SSH_HELPER_TIMEOUT_MS,
+): Promise<{ exitCode: number | null; stderr: string }> {
+	const result = await ptree.exec(["ssh", ...args], {
+		timeout: timeoutMs,
+		allowNonZero: true,
+		allowAbort: true,
+		stderr: "full",
+	});
+	return { exitCode: result.exitCode, stderr: result.stderr.trim() };
+}
+
+async function runSshCaptureSync(
+	args: string[],
+	timeoutMs = SSH_HELPER_TIMEOUT_MS,
+): Promise<{ exitCode: number | null; stdout: string; stderr: string }> {
+	const result = await ptree.exec(["ssh", ...args], {
+		timeout: timeoutMs,
+		allowNonZero: true,
+		allowAbort: true,
+		stderr: "full",
+	});
 	return {
 		exitCode: result.exitCode,
-		stdout: result.stdout.toString().trim(),
-		stderr: result.stderr.toString().trim(),
+		stdout: result.stdout.trim(),
+		stderr: result.stderr.trim(),
 	};
 }
 
+/**
+ * Test-only surface for exercising the pre-command SSH helpers against a
+ * fake `ssh` binary with a shortened timeout. External code MUST NOT depend
+ * on this — call `ensureConnection` / `ensureHostInfo` instead.
+ * @internal
+ */
+export const _sshHelpersForTests = { runSshSync, runSshCaptureSync };
+
 function ensureSshBinary(): void {
 	if (!$which("ssh")) {
 		throw new Error("ssh binary not found on PATH");

package/src/ssh/sshfs-mount.ts

@@ -16,6 +16,16 @@ const CONTROL_PATH = getControlPathTemplate();
 
 const mountedPaths = new Set<string>();
 
+type MountPointStatReader = (filePath: string) => Promise<{ dev: number }>;
+
+interface MountCheckOptions {
+	platform?: NodeJS.Platform;
+	stat?: MountPointStatReader;
+	which?: (command: string) => string | null;
+}
+
+const readMountPointStats: MountPointStatReader = async filePath => fs.promises.stat(filePath);
+
 async function ensureDir(path: string, mode = 0o700): Promise<void> {
 	try {
 		await fs.promises.mkdir(path, { recursive: true, mode });
@@ -79,10 +89,23 @@ export function hasSshfs(): boolean {
 	return $which("sshfs") !== null;
 }
 
-export async function isMounted(path: string): Promise<boolean> {
-	const mountpoint = $which("mountpoint");
-	if (!mountpoint) return false;
-	const result = await $`${mountpoint} -q ${path}`.quiet().nothrow();
+async function isMountedByDeviceBoundary(mountPath: string, stat = readMountPointStats): Promise<boolean> {
+	try {
+		const [mountStats, parentStats] = await Promise.all([stat(mountPath), stat(path.dirname(mountPath))]);
+		return mountStats.dev !== parentStats.dev;
+	} catch {
+		return false;
+	}
+}
+
+export async function isMounted(mountPath: string, options: MountCheckOptions = {}): Promise<boolean> {
+	const which = options.which ?? $which;
+	const mountpoint = which("mountpoint");
+	if (!mountpoint) {
+		const platform = options.platform ?? process.platform;
+		return platform === "darwin" ? isMountedByDeviceBoundary(mountPath, options.stat) : false;
+	}
+	const result = await $`${mountpoint} -q ${mountPath}`.quiet().nothrow();
 	return result.exitCode === 0;
 }