@oh-my-pi/pi-utils 16.2.2 → 16.2.3

package/CHANGELOG.md

@@ -2,6 +2,16 @@
 
 ## [Unreleased]
 
+## [16.2.3] - 2026-06-28
+
+### Added
+
+- Added `escapeXmlAttribute` utility function for safe XML attribute value encoding.
+
+### Fixed
+
+- Fixed a crash in `ptree.ChildProcess.bytes()` and the `ssh://` read path when handling large subprocess outputs (over 128 KB) under Bun by ensuring it consistently returns a `Uint8Array`.
+
 ## [16.2.0] - 2026-06-27
 
 ### Added

package/dist/types/sanitize-text.d.ts

@@ -19,3 +19,11 @@ export declare function sanitizeText(text: string): string;
  * — use it for element text, not attribute values.
  */
 export declare function escapeXmlText(input: string): string;
+/**
+ * Escape XML-significant characters for an attribute VALUE: the three body
+ * characters (`&`, `<`, `>`) plus the double quote (`"` → `&quot;`) that would
+ * otherwise close the attribute. Allocation-conscious: returns the input
+ * unchanged (same reference) when nothing needs escaping. Use it for attribute
+ * values; {@link escapeXmlText} is for element bodies and leaves `"` intact.
+ */
+export declare function escapeXmlAttribute(input: string): string;

package/package.json

@@ -1,7 +1,7 @@
 {
 	"type": "module",
 	"name": "@oh-my-pi/pi-utils",
-	"version": "16.2.2",
+	"version": "16.2.3",
 	"description": "Shared utilities for pi packages",
 	"homepage": "https://omp.sh",
 	"author": "Can Boluk",
@@ -31,7 +31,7 @@
 		"fmt": "biome format --write ."
 	},
 	"dependencies": {
-		"@oh-my-pi/pi-natives": "16.2.2",
+		"@oh-my-pi/pi-natives": "16.2.3",
 		"handlebars": "^4.7.9",
 		"winston": "^3.19.0",
 		"winston-daily-rotate-file": "^5.0.0"

package/src/ptree.ts

@@ -247,7 +247,12 @@ export class ChildProcess<In extends InMask = InMask> {
 	}
 
 	async bytes(): Promise<Uint8Array> {
-		return new Response(this.stdout).bytes();
+		// Bun's `Response(stream).bytes()` returns the raw `ArrayBuffer` once the
+		// stream emits more than one chunk (subprocess stdout chunks past ~128 KB).
+		// Normalize at the contract boundary so every caller — SSH read,
+		// `decodeUtf8Text`, callers slicing with `.subarray` — sees a `Uint8Array`.
+		const body = (await new Response(this.stdout).bytes()) as Uint8Array | ArrayBuffer;
+		return body instanceof Uint8Array ? body : new Uint8Array(body);
 	}
 
 	// ── Wait ─────────────────────────────────────────────────────────────

package/src/sanitize-text.ts

@@ -64,3 +64,33 @@ export function escapeXmlText(input: string): string {
 	}
 	return output;
 }
+
+/**
+ * Escape XML-significant characters for an attribute VALUE: the three body
+ * characters (`&`, `<`, `>`) plus the double quote (`"` → `&quot;`) that would
+ * otherwise close the attribute. Allocation-conscious: returns the input
+ * unchanged (same reference) when nothing needs escaping. Use it for attribute
+ * values; {@link escapeXmlText} is for element bodies and leaves `"` intact.
+ */
+export function escapeXmlAttribute(input: string): string {
+	let firstEscapable = -1;
+	for (let index = 0; index < input.length; index++) {
+		const char = input.charCodeAt(index);
+		if (char === 38 || char === 60 || char === 62 || char === 34) {
+			firstEscapable = index;
+			break;
+		}
+	}
+	if (firstEscapable === -1) return input;
+
+	let output = input.slice(0, firstEscapable);
+	for (let index = firstEscapable; index < input.length; index++) {
+		const char = input[index];
+		if (char === "&") output += "&amp;";
+		else if (char === "<") output += "&lt;";
+		else if (char === ">") output += "&gt;";
+		else if (char === '"') output += "&quot;";
+		else output += char;
+	}
+	return output;
+}