@oh-my-pi/pi-utils 18.12.5 → 18.13.0

package/CHANGELOG.md

@@ -2,6 +2,29 @@
 
 ## [Unreleased]
 
+## [18.13.0] - 2026-10-26
+
+### Added
+
+- Added `parseHeifImageMimeType()`, which identifies HEIC, HEIF and AVIF images from a file header ([#16612](https://github.com/can1357/oh-my-pi/pull/16612) by [@will-bogusz](https://github.com/will-bogusz))
+- Added `$whichAll()`, which returns every PATH match for a command in PATH order ([#16824](https://github.com/can1357/oh-my-pi/issues/16824))
+
+### Changed
+
+- Faster lenient JSONL session parsing when recovering past malformed lines ([#16995](https://github.com/can1357/oh-my-pi/pull/16995) by [@GTanger](https://github.com/GTanger))
+
+### Fixed
+
+- `setProcessName()` no longer assigns `process.title` on Windows, where it overwrites the shared console title ([#16842](https://github.com/can1357/oh-my-pi/issues/16842))
+- `setProcessName()` no longer assigns `process.title` on Windows, where it overwrites the shared console title ([#16842](https://github.com/can1357/oh-my-pi/issues/16842))
+- Fixed inline code spans rendering flush against the surrounding text when a backslash preceded the closing backtick ([#16972](https://github.com/can1357/oh-my-pi/pull/16972) by [@akainth015](https://github.com/akainth015))
+
+## [18.12.6] - 2026-10-21
+
+### Added
+
+- Added `RpcConnection.requestCancellable()` and `Client.requestPermission(params, { signal })`; client connections abort a handler and answer `-32800` when the peer sends `$/cancel_request`, while agent connections keep running the request and return its real result ([#15885](https://github.com/can1357/oh-my-pi/pull/15885) by [@marcintustin](https://github.com/marcintustin))
+
 ## [18.12.4] - 2026-10-20
 
 ### Breaking Changes

package/dist/types/acp/connection.d.ts

@@ -7,7 +7,15 @@ export interface CreateTerminalResponse {
 }
 /** Client callbacks handled by a client-side connection. */
 export interface Client {
-    requestPermission(params: RequestPermissionRequest): MaybePromise<RequestPermissionResponse>;
+    /**
+     * Serve a permission elicit. `options.signal` aborts when the agent
+     * cancels the request (`$/cancel_request`) — e.g. user steering superseded
+     * the dialog — so a held handler can end instead of stranding the
+     * connection's clean-EOF drain.
+     */
+    requestPermission(params: RequestPermissionRequest, options?: {
+        signal?: AbortSignal;
+    }): MaybePromise<RequestPermissionResponse>;
     sessionUpdate(params: SessionNotification): MaybePromise<void>;
     readTextFile?(params: ReadTextFileRequest): MaybePromise<ReadTextFileResponse>;
     writeTextFile?(params: WriteTextFileRequest): MaybePromise<WriteTextFileResponse | void>;
@@ -45,6 +53,15 @@ export declare class AgentSideConnection {
     sessionUpdate(params: SessionNotification): Promise<void>;
     /** Requests permission from the client. */
     requestPermission(params: RequestPermissionRequest): Promise<RequestPermissionResponse>;
+    /**
+     * Requests permission from the client, returning a handle that cancels the
+     * pending wire request (`$/cancel_request`) — used when user steering
+     * supersedes an open permission dialog instead of waiting behind it.
+     */
+    requestPermissionWithCancel(params: RequestPermissionRequest): {
+        promise: Promise<RequestPermissionResponse>;
+        cancel(): void;
+    };
     /** Reads a client-side text file. */
     readTextFile(params: ReadTextFileRequest): Promise<ReadTextFileResponse>;
     /** Writes a client-side text file. */

package/dist/types/acp/transport.d.ts

@@ -69,17 +69,41 @@ export declare class RequestError extends Error {
     /** Converts this error into a JSON-RPC error payload. */
     toErrorResponse(): ErrorResponse;
 }
-type Dispatcher = (method: string, params: unknown, notification: boolean) => MaybePromise<unknown>;
+type Dispatcher = (method: string, params: unknown, notification: boolean, 
+/** Abort signal for an inbound *request*: fires when the peer cancels it via `$/cancel_request`. */
+signal?: AbortSignal) => MaybePromise<unknown>;
+/** Options for {@link RpcConnection}. */
+export interface RpcConnectionOptions {
+    /**
+     * The dispatcher honors the abort signal it receives for inbound requests.
+     * Only then does a peer `$/cancel_request` abort the handler and answer the
+     * request `-32800` immediately; otherwise the handler runs to completion and
+     * its real result is the response, since answering "cancelled" while the
+     * work keeps going would hide its outcome from the peer.
+     */
+    honorsInboundCancellation?: boolean;
+}
 /** Correlated bidirectional JSON-RPC connection. */
 export declare class RpcConnection {
     #private;
-    constructor(stream: Stream, dispatcher: Dispatcher);
+    constructor(stream: Stream, dispatcher: Dispatcher, options?: RpcConnectionOptions);
     /** Signal aborted when the stream closes. */
     get signal(): AbortSignal;
     /** Promise resolved when the stream closes. */
     get closed(): Promise<void>;
     /** Sends a correlated JSON-RPC request. */
     request<Response>(method: string, params?: unknown): Promise<Response>;
+    /**
+     * Sends a JSON-RPC request whose pending entry can be cancelled locally:
+     * `cancel()` rejects the promise with a request-cancelled error, notifies
+     * the peer via `$/cancel_request`, and drops the pending entry so a late
+     * response is ignored. Used for agent→client requests a mid-turn event can
+     * supersede (e.g. a permission elicit cancelled when user steering arrives).
+     */
+    requestCancellable<Response>(method: string, params?: unknown): {
+        promise: Promise<Response>;
+        cancel(): void;
+    };
     /** Sends a JSON-RPC notification. */
     notify(method: string, params?: unknown): Promise<void>;
     /** Closes the connection and rejects outstanding requests. */

package/dist/types/fs-open.d.ts

@@ -2,7 +2,8 @@
  * `fs.openSync` with close-on-exec, matching Node's default.
  *
  * libuv adds `O_CLOEXEC` inside `uv__fs_open`, so on Node every `fs` descriptor
- * dies at `exec`. Bun's `fs.open*` does not, and descriptors it returns survive
+ * dies at `exec`. Bun's `fs.open*` did not before 1.4.3 (still allowed by the
+ * `bun@>=1.4` pin), and descriptors it returns survive
  * into any child spawned through a path that does not close strays itself — the
  * bash tool's shell `fork`/`exec`s user commands and hands them the lot. Use
  * this for every descriptor kept open past such a spawn (session transcripts,

package/dist/types/marked/inline-closers.d.ts

@@ -45,15 +45,23 @@ declare class EmphasisDelimiters {
 }
 /**
  * The runs of backticks in the root source, for the code span rule. A span opened by `width` backticks closes at the
- * first `width` backticks after its opening run that no backslash escapes: the start of a later run of at least
- * `width`, or, in a run whose first backtick a backslash escapes, the backticks from its `width`th on, since the
- * search for a closer goes on `width` past an escaped one.
+ * next run of exactly `width` backticks: a run of any other length is no closer, and the one that closes is the first
+ * run of that width at or after the opener. Backslash escapes do not apply inside a code span, so a backslash just
+ * before that closing backtick is content and still closes the span.
  */
 declare class CodeRuns {
     #private;
     constructor(src: string);
     /** Where the run of backticks holding the backtick at `at` ends. */
     endOf(at: number): number;
+    /**
+     * Whether a backtick string starts at `at` for a scan that walked to `at`: a string is a whole run, so it starts at
+     * the run's first backtick and nowhere else. A retry deeper inside a run is not a string, which keeps a run whose
+     * opener found no closer from opening a narrower span one backtick later. A position a tokenizer's raw resumed at,
+     * or the suffix an escape token left behind, is not a walked position — `codeOpenerWidth` admits those on its own,
+     * because it is told the scan resumed there rather than inferring it from the source text.
+     */
+    startsStringAt(at: number): boolean;
     /** Where the closer of a code span opened by `width` backticks that end at `from` starts, or -1. */
     closerAfter(from: number, width: number): number;
 }
@@ -102,8 +110,13 @@ export declare class InlineClosers {
     escapeWithin(rest: string, from: number, to: number): boolean;
     /** Where the emphasis opened by the `width` markers at the start of `rest` closes, or -1. */
     closeEmphasis(rest: string, marker: string, width: number): number;
-    /** How many backticks start `rest`, which starts with one. */
-    codeOpenerWidth(rest: string): number;
+    /**
+     * How many backticks start `rest`, which starts with one, or 0 where no code span opens because no backtick string
+     * starts there: the opener is a whole string, so the rest of a run whose opener found no closer is text, while the
+     * backticks left after a backslash escaped the run's first one do open a span. `resumed` says the scan resumed at
+     * `rest` after a tokenizer consumed a raw that ended here, where the backticks are a string wherever they sit.
+     */
+    codeOpenerWidth(rest: string, resumed?: boolean): number;
     /** Where the code span opened by the `width` backticks at the start of `rest` closes, or -1. */
     closeCode(rest: string, width: number): number;
     /**

package/dist/types/mime.d.ts

@@ -26,6 +26,13 @@ export type ImageMetadata = {
     hasAlpha?: boolean;
 };
 export declare function parseImageMetadata(header: Uint8Array): ImageMetadata | null;
+/** Still images in a HEIF (ISO BMFF) container, which the image pipeline cannot decode itself. */
+export type HeifImageMimeType = "image/heic" | "image/heif" | "image/avif";
+/**
+ * MIME type of a HEIC, AVIF or other HEIF image from the brands of its leading `ftyp` box:
+ * the major brand, then the compatible brands, with the generic `mif1`/`msf1` brands last.
+ */
+export declare function parseHeifImageMimeType(header: Uint8Array): HeifImageMimeType | null;
 /** Why base64 image data is unusable; `undefined` when it is canonical and non-empty. */
 export type Base64ImageDataFailure = "invalid base64 image data" | "empty image data";
 /**

package/dist/types/process-name.d.ts

@@ -1,5 +1,6 @@
 /**
- * Set both the JS `process.title` and — on Linux — the kernel `comm` name.
+ * Set the JS `process.title` (except on Windows, see above) and — on Linux —
+ * the kernel `comm` name.
  *
  * Never throws: `bun:ffi` unavailability or a failed syscall degrades silently
  * to the `process.title`-only behavior, so it is safe to call at startup.

package/dist/types/which.d.ts

@@ -42,4 +42,17 @@ export declare const whichFresh: typeof darwinWhich;
  * @returns Filesystem path if found, else null
  */
 export declare function $which(command: string, options?: WhichOptions): string | null;
+/**
+ * Locate every match for `command` on PATH, in PATH order, uncached.
+ *
+ * Callers that probe candidates (e.g. the Python eval backend) use this so a broken
+ * first hit — a version-manager shim with no version selected, a Windows Store alias —
+ * does not hide a working binary further down PATH. On macOS the Xcode/CLT toolchain
+ * match is appended last, mirroring {@link $which}'s fallback.
+ *
+ * @param command - Binary name to resolve
+ * @param options - `PATH` (defaults to `process.env.PATH`) and `cwd` for relative entries
+ * @returns Distinct filesystem paths; empty when nothing matches
+ */
+export declare function $whichAll(command: string, options?: Bun.WhichOptions): string[];
 export {};

package/package.json

@@ -1,6 +1,6 @@
 {
 	"name": "@oh-my-pi/pi-utils",
-	"version": "18.12.5",
+	"version": "18.13.0",
 	"description": "Shared utilities for pi packages",
 	"keywords": [
 		"cli",
@@ -57,7 +57,7 @@
 		"fmt": "oxfmt --no-error-on-unmatched-pattern 'src/**/*.{ts,tsx}' '{test,bench,examples,scripts}/**/*.ts' '*.ts'"
 	},
 	"dependencies": {
-		"@oh-my-pi/pi-natives": "18.12.5"
+		"@oh-my-pi/pi-natives": "18.13.0"
 	},
 	"devDependencies": {
 		"@types/bun": "^1.3.14"

package/src/acp/connection.ts

@@ -47,7 +47,16 @@ export interface CreateTerminalResponse {
 }
 /** Client callbacks handled by a client-side connection. */
 export interface Client {
-	requestPermission(params: RequestPermissionRequest): MaybePromise<RequestPermissionResponse>;
+	/**
+	 * Serve a permission elicit. `options.signal` aborts when the agent
+	 * cancels the request (`$/cancel_request`) — e.g. user steering superseded
+	 * the dialog — so a held handler can end instead of stranding the
+	 * connection's clean-EOF drain.
+	 */
+	requestPermission(
+		params: RequestPermissionRequest,
+		options?: { signal?: AbortSignal },
+	): MaybePromise<RequestPermissionResponse>;
 	sessionUpdate(params: SessionNotification): MaybePromise<void>;
 	readTextFile?(params: ReadTextFileRequest): MaybePromise<ReadTextFileResponse>;
 	writeTextFile?(params: WriteTextFileRequest): MaybePromise<WriteTextFileResponse | void>;
@@ -90,6 +99,17 @@ export class AgentSideConnection {
 	requestPermission(params: RequestPermissionRequest): Promise<RequestPermissionResponse> {
 		return this.#connection.request("session/request_permission", params);
 	}
+	/**
+	 * Requests permission from the client, returning a handle that cancels the
+	 * pending wire request (`$/cancel_request`) — used when user steering
+	 * supersedes an open permission dialog instead of waiting behind it.
+	 */
+	requestPermissionWithCancel(params: RequestPermissionRequest): {
+		promise: Promise<RequestPermissionResponse>;
+		cancel(): void;
+	} {
+		return this.#connection.requestCancellable<RequestPermissionResponse>("session/request_permission", params);
+	}
 	/** Reads a client-side text file. */
 	readTextFile(params: ReadTextFileRequest): Promise<ReadTextFileResponse> {
 		return this.#connection.request("fs/read_text_file", params);
@@ -168,10 +188,18 @@ export class ClientSideConnection {
 	#connection: RpcConnection;
 
 	constructor(toClient: (connection: ClientSideConnection) => Client, stream: Stream) {
-		this.#connection = new RpcConnection(stream, async (method, params, notification) => {
-			if (!client) throw RequestError.internalError(undefined, "Client is not initialized");
-			return dispatchClient(client, method, params, notification);
-		});
+		// Client handlers receive the cancel signal (`requestPermission`'s
+		// `options.signal`), so a peer `$/cancel_request` may answer `-32800`
+		// at once. The agent side keeps the default: its handlers ignore the
+		// signal, and `session/cancel` is ACP's cancellation path for prompts.
+		this.#connection = new RpcConnection(
+			stream,
+			async (method, params, notification, signal) => {
+				if (!client) throw RequestError.internalError(undefined, "Client is not initialized");
+				return dispatchClient(client, method, params, notification, signal);
+			},
+			{ honorsInboundCancellation: true },
+		);
 		const client = toClient(this);
 	}
 	/** Signal aborted when the transport closes. */
@@ -272,10 +300,11 @@ async function dispatchClient(
 	method: string,
 	params: unknown,
 	notification: boolean,
+	signal?: AbortSignal,
 ): Promise<unknown> {
 	switch (method) {
 		case "session/request_permission":
-			return client.requestPermission(params as RequestPermissionRequest);
+			return client.requestPermission(params as RequestPermissionRequest, { signal });
 		case "session/update":
 			return client.sessionUpdate(params as SessionNotification);
 		case "fs/read_text_file":
@@ -322,6 +351,9 @@ async function dispatchClient(
 				params as CompleteElicitationNotification,
 			);
 		default:
+			// The transport already aborted the matching inbound handler;
+			// like the agent side, the notification itself carries no work.
+			if (method === "$/cancel_request") return;
 			if (notification && client.extNotification)
 				return client.extNotification(method, params as Record<string, unknown>);
 			if (!notification && client.extMethod) return client.extMethod(method, params as Record<string, unknown>);

package/src/acp/transport.ts

@@ -105,9 +105,27 @@ function createStandardError(
 	return new RequestError(code, additionalMessage ? `${message}: ${additionalMessage}` : message, data);
 }
 
-type Dispatcher = (method: string, params: unknown, notification: boolean) => MaybePromise<unknown>;
+type Dispatcher = (
+	method: string,
+	params: unknown,
+	notification: boolean,
+	/** Abort signal for an inbound *request*: fires when the peer cancels it via `$/cancel_request`. */
+	signal?: AbortSignal,
+) => MaybePromise<unknown>;
 type Pending = { resolve(value: unknown): void; reject(reason: unknown): void };
 
+/** Options for {@link RpcConnection}. */
+export interface RpcConnectionOptions {
+	/**
+	 * The dispatcher honors the abort signal it receives for inbound requests.
+	 * Only then does a peer `$/cancel_request` abort the handler and answer the
+	 * request `-32800` immediately; otherwise the handler runs to completion and
+	 * its real result is the response, since answering "cancelled" while the
+	 * work keeps going would hide its outcome from the peer.
+	 */
+	honorsInboundCancellation?: boolean;
+}
+
 /** Bound on clean-EOF inbound drain so `closed` cannot hang if a handler never settles. */
 const INBOUND_DRAIN_TIMEOUT_MS = 30_000;
 
@@ -117,15 +135,18 @@ export class RpcConnection {
 	#pending = new Map<JsonRpcId, Pending>();
 	#inbound = new Set<Promise<void>>();
 	#openInboundIds = new Set<JsonRpcId>();
+	/** Abort controller per inbound request, fired by a peer `$/cancel_request` (opt-in). */
+	#inboundCancellers: Map<JsonRpcId, AbortController> | undefined;
 	#writable: WritableStream<AnyMessage>;
 	#writeTail: Promise<void> = Promise.resolve();
 	#abort = new AbortController();
 	#closed = Promise.withResolvers<void>();
 	#dispatcher: Dispatcher;
 
-	constructor(stream: Stream, dispatcher: Dispatcher) {
+	constructor(stream: Stream, dispatcher: Dispatcher, options?: RpcConnectionOptions) {
 		this.#writable = stream.writable;
 		this.#dispatcher = dispatcher;
+		this.#inboundCancellers = options?.honorsInboundCancellation ? new Map() : undefined;
 		void this.#read(stream.readable);
 	}
 
@@ -141,6 +162,48 @@ export class RpcConnection {
 	/** Sends a correlated JSON-RPC request. */
 	request<Response>(method: string, params?: unknown): Promise<Response> {
 		if (this.signal.aborted) return Promise.reject(new Error("Connection closed"));
+		return this.#beginRequest(method, params).deferred.promise as Promise<Response>;
+	}
+
+	/**
+	 * Sends a JSON-RPC request whose pending entry can be cancelled locally:
+	 * `cancel()` rejects the promise with a request-cancelled error, notifies
+	 * the peer via `$/cancel_request`, and drops the pending entry so a late
+	 * response is ignored. Used for agent→client requests a mid-turn event can
+	 * supersede (e.g. a permission elicit cancelled when user steering arrives).
+	 */
+	requestCancellable<Response>(
+		method: string,
+		params?: unknown,
+	): {
+		promise: Promise<Response>;
+		cancel(): void;
+	} {
+		if (this.signal.aborted) {
+			return {
+				promise: Promise.reject(new Error("Connection closed")),
+				cancel: () => {},
+			};
+		}
+		const { id, deferred } = this.#beginRequest(method, params);
+		return {
+			promise: deferred.promise as Promise<Response>,
+			cancel: () => {
+				if (!this.#pending.delete(id)) return;
+				deferred.reject(RequestError.requestCancelled({ requestId: id, method }));
+				void this.notify("$/cancel_request", { requestId: id }).catch(() => undefined);
+			},
+		};
+	}
+
+	/** Shared request plumbing: allocate an id, register the pending entry, write the frame. */
+	#beginRequest(
+		method: string,
+		params: unknown,
+	): {
+		id: number;
+		deferred: { promise: Promise<unknown>; resolve: (value?: unknown) => void; reject: (reason?: unknown) => void };
+	} {
 		const id = this.#nextId++;
 		const deferred = Promise.withResolvers<unknown>();
 		this.#pending.set(id, deferred);
@@ -148,7 +211,7 @@ export class RpcConnection {
 			this.#pending.delete(id);
 			deferred.reject(error);
 		});
-		return deferred.promise as Promise<Response>;
+		return { id, deferred };
 	}
 
 	/** Sends a JSON-RPC notification. */
@@ -235,6 +298,18 @@ export class RpcConnection {
 		}
 		if (!("method" in message)) return;
 		if (!("id" in message)) {
+			// ACP v1 names the cancelled request `requestId`. A cancelled
+			// inbound request must still be answered (spec: result or
+			// `-32800`): the handler is aborted and the error response is
+			// written here, so a late-settling handler lands in `#respond`'s
+			// closed-id no-op instead of answering a request the peer gave
+			// up on.
+			if (message.method === "$/cancel_request" && this.#inboundCancellers) {
+				this.#cancelInbound(
+					this.#inboundCancellers,
+					(message.params as { requestId?: JsonRpcId } | undefined)?.requestId,
+				);
+			}
 			try {
 				await this.#dispatcher(message.method, message.params, true);
 			} catch {
@@ -242,8 +317,11 @@ export class RpcConnection {
 			}
 			return;
 		}
+		const cancellers = this.#inboundCancellers;
+		const canceller = cancellers ? new AbortController() : undefined;
+		if (canceller) cancellers?.set(message.id, canceller);
 		try {
-			const result = await this.#dispatcher(message.method, message.params, false);
+			const result = await this.#dispatcher(message.method, message.params, false, canceller?.signal);
 			await this.#respond(message.id, { result: result ?? {} });
 		} catch (error) {
 			const protocolError =
@@ -251,6 +329,25 @@ export class RpcConnection {
 					? error
 					: RequestError.internalError({ details: error instanceof Error ? error.message : String(error) });
 			await this.#respond(message.id, { error: protocolError.toErrorResponse() });
+		} finally {
+			cancellers?.delete(message.id);
 		}
 	}
+
+	#cancelInbound(cancellers: Map<JsonRpcId, AbortController>, id: JsonRpcId | undefined): void {
+		if (id === undefined) return;
+		const canceller = cancellers.get(id);
+		if (canceller) {
+			cancellers.delete(id);
+			canceller.abort(RequestError.requestCancelled({ requestId: id }));
+		}
+		// Spec: a cancelled request still gets a response. Answer `-32800`
+		// here — synchronously with the notification — so the peer is never
+		// left waiting on a handler that may never settle. `#respond` closes
+		// the id, so a late handler result (a handler that ignored its abort
+		// signal) lands in the closed-id no-op instead of answering twice.
+		void this.#respond(id, { error: RequestError.requestCancelled({ requestId: id }).toErrorResponse() }).catch(
+			() => undefined,
+		);
+	}
 }

package/src/fs-open.ts

@@ -15,7 +15,8 @@ const O_CLOEXEC = process.platform === "linux" ? 0o2000000 : process.platform ==
  * `fs.openSync` with close-on-exec, matching Node's default.
  *
  * libuv adds `O_CLOEXEC` inside `uv__fs_open`, so on Node every `fs` descriptor
- * dies at `exec`. Bun's `fs.open*` does not, and descriptors it returns survive
+ * dies at `exec`. Bun's `fs.open*` did not before 1.4.3 (still allowed by the
+ * `bun@>=1.4` pin), and descriptors it returns survive
  * into any child spawned through a path that does not close strays itself — the
  * bash tool's shell `fork`/`exec`s user commands and hands them the lot. Use
  * this for every descriptor kept open past such a spawn (session transcripts,

package/src/marked/core.ts

@@ -655,39 +655,48 @@ function lexToNested(lex: InlineLex): NestedMatch | undefined {
 	// The context is shared with the sources nested in this one, which move its end while they are lexed.
 	context.end = closers.end;
 	let rest = lex.rest;
+	// A token the lexer consumed ends the walk, so the backticks left where the next token starts are a string of their
+	// own even when the run they belong to began earlier: an extension, an override or an escape token may leave the
+	// scan inside a run, and a code span opens there. Only the text step's own advance leaves the scan inside a run
+	// without consuming a token, and no span opens at such a position.
+	let resumed = false;
+	/** Pushes `token` and moves past its raw, which is where the next token starts. */
+	const consumeToken = (token: Token): void => {
+		output.push(token);
+		rest = rest.slice(token.raw.length);
+		resumed = true;
+	};
 	while (rest !== "") {
+		const resumedHere = resumed;
+		resumed = false;
 		let custom: Tokens.Generic | undefined;
 		for (const extension of lexer.extensions.inline) {
 			custom = extension.tokenizer.call(context, rest, output);
 			if (custom?.raw) break;
 		}
 		if (custom?.raw) {
-			output.push(custom);
-			rest = rest.slice(custom.raw.length);
+			consumeToken(custom);
 			continue;
 		}
 
 		const escaped = /^\\([!"#$%&'()*+,\-./:;<=>?@[\\\]^_`{|}~])/.exec(rest);
 		if (escaped) {
-			output.push({ type: "escape", raw: escaped[0], text: escaped[1]! });
-			rest = rest.slice(2);
+			consumeToken({ type: "escape", raw: escaped[0], text: escaped[1]! });
 			continue;
 		}
 		const br = lexer.options.breaks ? /^(?: {2,}|\\)?\n/.exec(rest) : /^(?: {2,}|\\)\n/.exec(rest);
 		if (br) {
-			output.push({ type: "br", raw: br[0] });
-			rest = rest.slice(br[0].length);
+			consumeToken({ type: "br", raw: br[0] });
 			continue;
 		}
 		if (rest[0] === "`") {
-			const width = closers.codeOpenerWidth(rest);
+			const width = closers.codeOpenerWidth(rest, resumedHere);
 			const end = closers.closeCode(rest, width);
 			if (end !== -1) {
 				const raw = rest.slice(0, end + width);
 				let text = rest.slice(width, end).replace(/\n/g, " ");
 				if (/^ .* $/.test(text) && text.trim() !== "") text = text.slice(1, -1);
-				output.push({ type: "codespan", raw, text });
-				rest = rest.slice(raw.length);
+				consumeToken({ type: "codespan", raw, text });
 				continue;
 			}
 		}
@@ -695,14 +704,12 @@ function lexToNested(lex: InlineLex): NestedMatch | undefined {
 		if (auto) {
 			const text = auto.slice(1, -1);
 			const href = text.includes("@") && !/^[a-z][a-z+.-]*:\/\//i.test(text) ? `mailto:${text}` : text;
-			output.push({ type: "link", raw: auto, text, href, tokens: [{ type: "text", raw: text, text }] });
-			rest = rest.slice(auto.length);
+			consumeToken({ type: "link", raw: auto, text, href, tokens: [{ type: "text", raw: text, text }] });
 			continue;
 		}
 		const html = inlineHtmlPrefix(rest, closers);
 		if (html) {
-			output.push({ type: "html", raw: html, inLink: false, inRawBlock: false, block: false, text: html });
-			rest = rest.slice(html.length);
+			consumeToken({ type: "html", raw: html, inLink: false, inRawBlock: false, block: false, text: html });
 			continue;
 		}
 		const nested = matchLink(rest, lexer, closers) ?? matchEmphasis(rest, output, closers);
@@ -716,8 +723,7 @@ function lexToNested(lex: InlineLex): NestedMatch | undefined {
 			if (override) del = override.call(lexer.tokenizer, rest, rest);
 			if (del === false || !override) del = lexer.tokenizer.del(rest);
 			if (del) {
-				output.push(del);
-				rest = rest.slice(del.raw.length);
+				consumeToken(del);
 				continue;
 			}
 		}
@@ -744,8 +750,7 @@ function lexToNested(lex: InlineLex): NestedMatch | undefined {
 			}
 		}
 		if (url) {
-			output.push(url);
-			rest = rest.slice(url.raw.length);
+			consumeToken(url);
 			continue;
 		}
 

package/src/marked/inline-closers.ts

@@ -170,38 +170,30 @@ class EmphasisDelimiters {
 
 /**
  * The runs of backticks in the root source, for the code span rule. A span opened by `width` backticks closes at the
- * first `width` backticks after its opening run that no backslash escapes: the start of a later run of at least
- * `width`, or, in a run whose first backtick a backslash escapes, the backticks from its `width`th on, since the
- * search for a closer goes on `width` past an escaped one.
+ * next run of exactly `width` backticks: a run of any other length is no closer, and the one that closes is the first
+ * run of that width at or after the opener. Backslash escapes do not apply inside a code span, so a backslash just
+ * before that closing backtick is content and still closes the span.
  */
 class CodeRuns {
-	// Per run, in order: where it starts and ends, and whether a backslash escapes it.
+	// Per run, in order: where it starts and ends; the starts are the binary search `endOf` and `startsStringAt` need.
 	readonly #starts: number[] = [];
 	readonly #ends: number[] = [];
-	readonly #escaped: boolean[] = [];
-	// A segment tree over the runs of the widest closer each run holds: its length, or half of it when escaped.
-	readonly #widest: Int32Array;
-	readonly #leaves: number;
+	// Run starts by width, each list ascending: a closer must have the opener's exact width, so finding one is a
+	// binary search in the list for that width and no scan of the runs between.
+	readonly #byWidth = new Map<number, number[]>();
 
 	constructor(src: string) {
-		const widths: number[] = [];
 		for (let at = src.indexOf("`"); at !== -1;) {
 			let end = at + 1;
 			while (src.charCodeAt(end) === 0x60 /* ` */) end++;
-			const escaped = escapedAt(src, at);
 			this.#starts.push(at);
 			this.#ends.push(end);
-			this.#escaped.push(escaped);
-			widths.push(escaped ? (end - at) >> 1 : end - at);
+			const width = end - at;
+			const starts = this.#byWidth.get(width);
+			if (starts === undefined) this.#byWidth.set(width, [at]);
+			else starts.push(at);
 			at = src.indexOf("`", end);
 		}
-		let leaves = 1;
-		while (leaves < widths.length) leaves <<= 1;
-		const widest = new Int32Array(2 * leaves);
-		for (let run = 0; run < widths.length; run++) widest[leaves + run] = widths[run]!;
-		for (let node = leaves - 1; node >= 1; node--) widest[node] = Math.max(widest[2 * node]!, widest[2 * node + 1]!);
-		this.#widest = widest;
-		this.#leaves = leaves;
 	}
 
 	/** Where the run of backticks holding the backtick at `at` ends. */
@@ -209,28 +201,24 @@ class CodeRuns {
 		return this.#ends[lowerBound(this.#starts, at + 1) - 1]!;
 	}
 
+	/**
+	 * Whether a backtick string starts at `at` for a scan that walked to `at`: a string is a whole run, so it starts at
+	 * the run's first backtick and nowhere else. A retry deeper inside a run is not a string, which keeps a run whose
+	 * opener found no closer from opening a narrower span one backtick later. A position a tokenizer's raw resumed at,
+	 * or the suffix an escape token left behind, is not a walked position — `codeOpenerWidth` admits those on its own,
+	 * because it is told the scan resumed there rather than inferring it from the source text.
+	 */
+	startsStringAt(at: number): boolean {
+		const run = lowerBound(this.#starts, at + 1) - 1;
+		return this.#starts[run] === at;
+	}
+
 	/** Where the closer of a code span opened by `width` backticks that end at `from` starts, or -1. */
 	closerAfter(from: number, width: number): number {
-		const run = this.#firstHolding(lowerBound(this.#starts, from), width);
-		return run === -1 ? -1 : this.#starts[run]! + (this.#escaped[run] ? width : 0);
-	}
-
-	/** The first run at or after `first` that holds a closer of `width` backticks, or -1. */
-	#firstHolding(first: number, width: number): number {
-		if (first >= this.#starts.length) return -1;
-		const widest = this.#widest;
-		const leaves = this.#leaves;
-		let node = leaves + first;
-		if (widest[node]! >= width) return first;
-		// Up to the nearest subtree on the right that holds one, then down to its first run that does.
-		for (;;) {
-			if (node === 1) return -1;
-			if ((node & 1) === 0 && widest[node + 1]! >= width) break;
-			node >>= 1;
-		}
-		node++;
-		while (node < leaves) node = widest[2 * node]! >= width ? 2 * node : 2 * node + 1;
-		return node - leaves;
+		const starts = this.#byWidth.get(width);
+		if (starts === undefined) return -1;
+		const run = lowerBound(starts, from);
+		return run < starts.length ? starts[run]! : -1;
 	}
 }
 
@@ -388,10 +376,17 @@ export class InlineClosers {
 		return close === -1 ? -1 : close - pos;
 	}
 
-	/** How many backticks start `rest`, which starts with one. */
-	codeOpenerWidth(rest: string): number {
+	/**
+	 * How many backticks start `rest`, which starts with one, or 0 where no code span opens because no backtick string
+	 * starts there: the opener is a whole string, so the rest of a run whose opener found no closer is text, while the
+	 * backticks left after a backslash escaped the run's first one do open a span. `resumed` says the scan resumed at
+	 * `rest` after a tokenizer consumed a raw that ended here, where the backticks are a string wherever they sit.
+	 */
+	codeOpenerWidth(rest: string, resumed = false): number {
 		const pos = this.end - rest.length;
-		return Math.min(this.#indexes.codeRuns.endOf(pos), this.end) - pos;
+		const runs = this.#indexes.codeRuns;
+		if (!resumed && !runs.startsStringAt(pos)) return 0;
+		return Math.min(runs.endOf(pos), this.end) - pos;
 	}
 
 	/** Where the code span opened by the `width` backticks at the start of `rest` closes, or -1. */

package/src/mime.ts

@@ -11,6 +11,7 @@ const GIF89A = Buffer.from("GIF89a");
 const WEBP_VP8X = Buffer.from("VP8X");
 const WEBP_VP8L = Buffer.from("VP8L");
 const WEBP_VP8 = Buffer.from("VP8 ");
+const FTYP = Buffer.from("ftyp");
 
 export const SUPPORTED_IMAGE_MIME_TYPES = new Set(["image/png", "image/jpeg", "image/gif", "image/webp"]);
 
@@ -143,6 +144,40 @@ export function parseImageMetadata(header: Uint8Array): ImageMetadata | null {
 	);
 }
 
+/** Still images in a HEIF (ISO BMFF) container, which the image pipeline cannot decode itself. */
+export type HeifImageMimeType = "image/heic" | "image/heif" | "image/avif";
+
+const HEIF_BRAND_MIME_TYPES: Readonly<Record<string, HeifImageMimeType>> = {
+	heic: "image/heic",
+	heix: "image/heic",
+	heim: "image/heic",
+	heis: "image/heic",
+	hevc: "image/heic",
+	hevx: "image/heic",
+	avif: "image/avif",
+	avis: "image/avif",
+	mif1: "image/heif",
+	msf1: "image/heif",
+};
+
+/**
+ * MIME type of a HEIC, AVIF or other HEIF image from the brands of its leading `ftyp` box:
+ * the major brand, then the compatible brands, with the generic `mif1`/`msf1` brands last.
+ */
+export function parseHeifImageMimeType(header: Uint8Array): HeifImageMimeType | null {
+	if (!magicEquals(header, 4, FTYP)) return null;
+	const view = new DataView(header.buffer, header.byteOffset, header.byteLength);
+	const boxEnd = Math.min(view.getUint32(0, false), header.length);
+	let generic: HeifImageMimeType | null = null;
+	// The major brand sits at 8 and the compatible brands start at 16, after the minor version.
+	for (let offset = 8; offset + 4 <= boxEnd; offset += offset === 8 ? 8 : 4) {
+		const mimeType = HEIF_BRAND_MIME_TYPES[String.fromCharCode(...header.subarray(offset, offset + 4))];
+		if (mimeType === "image/heif") generic ??= mimeType;
+		else if (mimeType) return mimeType;
+	}
+	return generic;
+}
+
 /** Why base64 image data is unusable; `undefined` when it is canonical and non-empty. */
 export type Base64ImageDataFailure = "invalid base64 image data" | "empty image data";
 

package/src/process-name.ts

@@ -10,9 +10,11 @@
  * setter) and additionally drive `prctl` via `bun:ffi` on Linux, mirroring the
  * libc-FFI pattern in `ttyid.ts` / `stderr-guard.ts`.
  *
- * macOS has no clean userspace equivalent for the shebang-run path, and on
- * Windows / compiled binaries the kernel derives the name from the exec'd file,
- * so those paths already report correctly; there we only set `process.title`.
+ * macOS has no clean userspace equivalent for the shebang-run path, so there
+ * we only set `process.title`. Windows derives the name from the exec'd file,
+ * and there Bun's `process.title` setter is libuv's `SetConsoleTitleW`: every
+ * omp child attached to a pane's console (workers, `browser-relay`, servers)
+ * would overwrite that pane's tab title, so Windows skips it entirely.
  */
 import { dlopen, FFIType, ptr } from "bun:ffi";
 import * as os from "node:os";
@@ -21,17 +23,20 @@ import * as os from "node:os";
 const PR_SET_NAME = 15;
 
 /**
- * Set both the JS `process.title` and — on Linux — the kernel `comm` name.
+ * Set the JS `process.title` (except on Windows, see above) and — on Linux —
+ * the kernel `comm` name.
  *
  * Never throws: `bun:ffi` unavailability or a failed syscall degrades silently
  * to the `process.title`-only behavior, so it is safe to call at startup.
  */
 export function setProcessName(name: string): void {
+	const platform = os.platform();
+	if (platform === "win32") return;
 	try {
 		process.title = name;
 	} catch {}
 
-	if (os.platform() !== "linux") return;
+	if (platform !== "linux") return;
 
 	// glibc first, then the generic soname for musl-style layouts (see stderr-guard.ts).
 	for (const soname of ["libc.so.6", "libc.so"]) {

package/src/stream.ts

@@ -2,6 +2,7 @@ const trailingEvents = new WeakSet<ServerSentEvent>();
 
 import { abortableSource } from "./abortable";
 import { parseStreamingJson } from "./json-parse";
+import { isWhitespace } from "./json-lexer";
 
 const LF = 0x0a;
 const CR = 0x0d;
@@ -613,9 +614,11 @@ export async function* readSseEvents(
  */
 export function parseJsonlLenient<T>(buffer: string, options: { onMalformedRecord?: () => void } = {}): T[] {
 	let entries: T[] | undefined;
+	let cursor = 0;
+	const len = buffer.length;
 
-	while (buffer.length > 0) {
-		const { values, error, read, done } = Bun.JSONL.parseChunk(buffer);
+	while (cursor < len) {
+		const { values, error, read, done } = Bun.JSONL.parseChunk(buffer, cursor);
 		if (values.length > 0) {
 			const ext = values as T[];
 			if (!entries) {
@@ -625,18 +628,22 @@ export function parseJsonlLenient<T>(buffer: string, options: { onMalformedRecor
 			}
 		}
 		if (error) {
-			const nextNewline = buffer.indexOf("\n", read);
-			const malformedEnd = nextNewline === -1 ? buffer.length : nextNewline;
-			if (buffer.substring(read, malformedEnd).trim().length > 0) options.onMalformedRecord?.();
+			let malformedStart = read;
+			while (malformedStart < len && isWhitespace(buffer.charCodeAt(malformedStart))) {
+				malformedStart++;
+			}
+			const nextNewline = buffer.indexOf("\n", malformedStart);
+			const malformedEnd = nextNewline === -1 ? len : nextNewline;
+			if (buffer.substring(malformedStart, malformedEnd).trim().length > 0) options.onMalformedRecord?.();
 			if (nextNewline === -1) break;
-			buffer = buffer.substring(nextNewline + 1);
+			cursor = nextNewline + 1;
 			continue;
 		}
-		if (read === 0) {
-			if (buffer.trim().length > 0) options.onMalformedRecord?.();
+		if (read === cursor) {
+			if (buffer.substring(cursor).trim().length > 0) options.onMalformedRecord?.();
 			break;
 		}
-		buffer = buffer.substring(read);
+		cursor = read;
 		if (done) break;
 	}
 	return entries ?? [];

package/src/which.ts

@@ -261,3 +261,30 @@ export function $which(command: string, options?: WhichOptions): string | null {
 	}
 	return result;
 }
+
+/**
+ * Locate every match for `command` on PATH, in PATH order, uncached.
+ *
+ * Callers that probe candidates (e.g. the Python eval backend) use this so a broken
+ * first hit — a version-manager shim with no version selected, a Windows Store alias —
+ * does not hide a working binary further down PATH. On macOS the Xcode/CLT toolchain
+ * match is appended last, mirroring {@link $which}'s fallback.
+ *
+ * @param command - Binary name to resolve
+ * @param options - `PATH` (defaults to `process.env.PATH`) and `cwd` for relative entries
+ * @returns Distinct filesystem paths; empty when nothing matches
+ */
+export function $whichAll(command: string, options?: Bun.WhichOptions): string[] {
+	const searchPath = options?.PATH ?? process.env.PATH ?? "";
+	const matches: string[] = [];
+	for (const dir of searchPath.split(path.delimiter)) {
+		if (!dir) continue;
+		const match = Bun.which(command, { cwd: options?.cwd, PATH: dir });
+		if (match && !matches.includes(match)) matches.push(match);
+	}
+	if (os.platform() === "darwin" && isXcodeBin(command)) {
+		const toolchainMatch = getMacosToolPaths().get(command);
+		if (toolchainMatch && !matches.includes(toolchainMatch)) matches.push(toolchainMatch);
+	}
+	return matches;
+}