@oh-my-pi/pi-utils 18.4.0 → 18.4.1

package/CHANGELOG.md

@@ -2,6 +2,13 @@
 
 ## [Unreleased]
 
+## [18.4.1] - 2026-09-28
+
+### Fixed
+
+- Fixed SQLite stores opened with `recoverCorruption` crashing on a corrupt file instead of being preserved and recreated when the corruption surfaced as a different initialization error such as `no such table` ([#13530](https://github.com/can1357/oh-my-pi/pull/13530) by [@Hunter-124](https://github.com/Hunter-124))
+- Fixed raw stderr output staying on the previous day's log file after the log sink rotates at local midnight ([#13003](https://github.com/can1357/oh-my-pi/issues/13003)).
+
 ## [18.3.1] - 2026-09-25
 
 ### Fixed

package/dist/types/dirs.d.ts

@@ -275,8 +275,8 @@ export declare function getModelDbPath(agentDir?: string): string;
 export declare function getTinyModelsCacheDir(agentDir?: string): string;
 /** Get the document conversion cache directory (~/.omp/agent/cache/document-conversions; XDG default: $XDG_CACHE_HOME/omp/cache/document-conversions). */
 export declare function getDocumentConversionCacheDir(agentDir?: string): string;
-/** Get the per-project composer speculative cache directory (~/.omp/agent/cache/composer; XDG default: $XDG_CACHE_HOME/omp/cache/composer). */
-export declare function getComposerCacheDir(agentDir?: string): string;
+/** Get the composer speculative cache database (~/.omp/agent/cache/composer.db; XDG default: $XDG_CACHE_HOME/omp/cache/composer.db). */
+export declare function getComposerCacheDbPath(agentDir?: string): string;
 /** Get the sessions directory (~/.omp/agent/sessions). */
 export declare function getSessionsDir(agentDir?: string): string;
 /** Get the content-addressed blob store directory (~/.omp/agent/blobs). */

package/dist/types/logger/rotating-file.d.ts

@@ -6,6 +6,15 @@ export interface RotatingFileOptions {
     readonly auditFile: string;
     readonly maxBytes: number;
     readonly maxFiles: number;
+    /**
+     * Called with the new active file path whenever the sink opens a different
+     * file — construction, local-day rotation, and size rotation alike.
+     *
+     * Consumers that hold their own descriptor on the active log (the macOS
+     * stderr guard dup2s it onto fd 2) use this to follow the sink instead of
+     * staying pinned to a file the sink later prunes.
+     */
+    readonly onRotate?: (filePath: string) => void;
 }
 /** Synchronous append sink with local-day and size rotation plus bounded retention. */
 export declare class RotatingFileSink {

package/dist/types/stderr-guard.d.ts

@@ -1,16 +1,35 @@
 export interface SuppressTerminalStderrOptions {
-    /** Redirect target path; defaults to today's omp log file, then /dev/null. */
+    /**
+     * Redirect target path; defaults to the log file the rotating sink last
+     * reported (see {@link setStderrRedirectTarget}), then today's omp log
+     * file, then /dev/null.
+     */
     redirectPath?: string;
-    /** Bypass the macOS + same-terminal gate. Tests only. */
+    /** Bypass the same-terminal gate. Tests only. */
     force?: boolean;
 }
 /**
  * Redirect fd 2 away from the terminal while the TUI owns the viewport.
  * Returns true when suppression is (already) active. No-op — returning
- * false — off macOS, when stderr does not target the stdout terminal, or
- * when the libc fd ops are unavailable.
+ * false — when stderr does not target the stdout terminal or when libc fd
+ * operations are unavailable.
  */
 export declare function suppressTerminalStderr(options?: SuppressTerminalStderrOptions): boolean;
+/**
+ * Point fd 2 at `logPath`, the log file the rotating sink is currently
+ * writing.
+ *
+ * The logger calls this on every sink rotation. Without it fd 2 keeps the
+ * descriptor opened at TUI start, so after local midnight raw stderr — this
+ * process's and every child that inherited fd 2 — keeps landing in the
+ * previous day's file, which the sink eventually prunes out from under it.
+ *
+ * The path is recorded even while suppression is inactive, so a later
+ * {@link suppressTerminalStderr} redirects to the live file instead of
+ * re-deriving a dated name. Best-effort: if the new file cannot be opened,
+ * fd 2 keeps its current target.
+ */
+export declare function setStderrRedirectTarget(logPath: string): void;
 /**
  * Re-point fd 2 at the saved terminal stderr. Safe to call unconditionally:
  * no-op when suppression is not active. Called at every terminal-ownership

package/package.json

@@ -1,6 +1,6 @@
 {
 	"name": "@oh-my-pi/pi-utils",
-	"version": "18.4.0",
+	"version": "18.4.1",
 	"description": "Shared utilities for pi packages",
 	"keywords": [
 		"cli",
@@ -57,7 +57,7 @@
 		"fmt": "oxfmt --no-error-on-unmatched-pattern 'src/**/*.{ts,tsx}' '{test,bench,examples,scripts}/**/*.ts' '*.ts'"
 	},
 	"dependencies": {
-		"@oh-my-pi/pi-natives": "18.4.0"
+		"@oh-my-pi/pi-natives": "18.4.1"
 	},
 	"devDependencies": {
 		"@types/bun": "^1.3.14"

package/src/dirs.ts

@@ -911,9 +911,9 @@ export function getTinyModelsCacheDir(agentDir?: string): string {
 export function getDocumentConversionCacheDir(agentDir?: string): string {
 	return dirs.agentSubdir(agentDir, path.join("cache", "document-conversions"), "cache");
 }
-/** Get the per-project composer speculative cache directory (~/.omp/agent/cache/composer; XDG default: $XDG_CACHE_HOME/omp/cache/composer). */
-export function getComposerCacheDir(agentDir?: string): string {
-	return dirs.agentSubdir(agentDir, path.join("cache", "composer"), "cache");
+/** Get the composer speculative cache database (~/.omp/agent/cache/composer.db; XDG default: $XDG_CACHE_HOME/omp/cache/composer.db). */
+export function getComposerCacheDbPath(agentDir?: string): string {
+	return dirs.agentSubdir(agentDir, path.join("cache", "composer.db"), "cache");
 }
 
 /** Get the sessions directory (~/.omp/agent/sessions). */

package/src/logger/rotating-file.ts

@@ -26,6 +26,15 @@ export interface RotatingFileOptions {
 	readonly auditFile: string;
 	readonly maxBytes: number;
 	readonly maxFiles: number;
+	/**
+	 * Called with the new active file path whenever the sink opens a different
+	 * file — construction, local-day rotation, and size rotation alike.
+	 *
+	 * Consumers that hold their own descriptor on the active log (the macOS
+	 * stderr guard dup2s it onto fd 2) use this to follow the sink instead of
+	 * staying pinned to a file the sink later prunes.
+	 */
+	readonly onRotate?: (filePath: string) => void;
 }
 
 function isAuditEntry(value: unknown): value is AuditEntry {
@@ -42,6 +51,7 @@ export class RotatingFileSink {
 	readonly #auditFile: string;
 	readonly #maxBytes: number;
 	readonly #maxFiles: number;
+	readonly #onRotate: ((filePath: string) => void) | undefined;
 	#files: AuditEntry[];
 	#activeDay: string | undefined;
 	#activeIndex = 0;
@@ -62,6 +72,7 @@ export class RotatingFileSink {
 		this.#auditFile = options.auditFile;
 		this.#maxBytes = options.maxBytes;
 		this.#maxFiles = options.maxFiles;
+		this.#onRotate = options.onRotate;
 		this.#files = this.#readAudit();
 		const now = new Date();
 		this.#selectFile(localDay(now));
@@ -75,6 +86,11 @@ export class RotatingFileSink {
 	#openFd(filePath: string): void {
 		this.#closeFd();
 		this.#fd = openCloexecSync(filePath, fs.constants.O_WRONLY | fs.constants.O_CREAT | fs.constants.O_APPEND);
+		try {
+			this.#onRotate?.(filePath);
+		} catch {
+			// A rotation observer must never break logging.
+		}
 	}
 
 	#closeFd(): void {

package/src/logger.ts

@@ -14,8 +14,9 @@ import * as fs from "node:fs";
 import * as os from "node:os";
 import * as path from "node:path";
 import { isPromise } from "node:util/types";
-import { getLogsDir } from "./dirs";
+import { getLogsDir, localDay } from "./dirs";
 import { RotatingFileSink } from "./logger/rotating-file";
+import { setStderrRedirectTarget } from "./stderr-guard";
 import { drainModuleLoadEvents } from "./timing-buffer";
 /** Severity names accepted by the centralized logger. */
 export type LogLevel = "error" | "warn" | "info" | "debug";
@@ -82,14 +83,10 @@ function pruneStaleProcessLogs(dir: string): void {
 		return;
 	}
 	const current = new Date();
-	const currentDate =
-		`${current.getFullYear()}-${String(current.getMonth() + 1).padStart(2, "0")}-` +
-		String(current.getDate()).padStart(2, "0");
+	const currentDate = localDay(current);
 	const cutoff = new Date(current);
 	cutoff.setDate(cutoff.getDate() - (RETAINED_STALE_LOG_DAYS - 1));
-	const cutoffDate =
-		`${cutoff.getFullYear()}-${String(cutoff.getMonth() + 1).padStart(2, "0")}-` +
-		String(cutoff.getDate()).padStart(2, "0");
+	const cutoffDate = localDay(cutoff);
 
 	const staleLogsByProcessDay = new Map<string, Array<{ path: string; rollover: number }>>();
 	for (const entry of entries) {
@@ -258,6 +255,8 @@ function makeFileTransport(dir?: string): RotatingFileSink {
 		maxBytes: 10 * 1024 * 1024,
 		maxFiles: 5,
 		auditFile: path.join(logsDir, `.omp.${process.pid}-audit.json`),
+		// Keep the stderr guard's fd 2 on the file this sink is writing.
+		onRotate: setStderrRedirectTarget,
 	});
 }
 

package/src/sqlite.ts

@@ -58,6 +58,31 @@ export interface SqliteOpenOptions {
 	onCorruptionPreserved?: (backupPath: string, error: unknown) => void;
 }
 
+/**
+ * Bun's multi-statement `db.run()` reports only the final statement's step
+ * error (oven-sh/bun#37415), so a corrupt page hit mid-script can resurface as
+ * an unrelated failure such as "no such table". When an initializer fails for
+ * any other reason, a `quick_check` on the still-open handle decides whether
+ * the store itself is damaged. Runs only on the failure path.
+ */
+function revealHiddenCorruption(db: Database | undefined, error: unknown): unknown {
+	if (!db || isSqliteCorruptionError(error) || isSqliteBusyError(error)) return error;
+	let detail: string;
+	let code: unknown = "SQLITE_CORRUPT";
+	let errno: unknown = 11;
+	try {
+		const rows = db.query<{ quick_check: string }, []>("PRAGMA quick_check(1)").all();
+		if (rows[0]?.quick_check === "ok") return error;
+		detail = `database disk image is malformed (${rows[0]?.quick_check})`;
+	} catch (probeError) {
+		if (!isSqliteCorruptionError(probeError)) return error;
+		detail = probeError instanceof Error ? probeError.message : String(probeError);
+		({ code, errno } = probeError as { code: unknown; errno?: unknown });
+	}
+	const original = error instanceof Error ? error.message : String(error);
+	return Object.assign(new Error(`${detail}; initialization failed: ${original}`, { cause: error }), { code, errno });
+}
+
 async function openWithBusyRetries<T>(
 	dbPath: string,
 	initialize: (db: Database) => T | Promise<T>,
@@ -71,7 +96,8 @@ async function openWithBusyRetries<T>(
 			// WAL recovery can bypass the busy handler; both it and retries are needed (#2421).
 			db.run(`PRAGMA busy_timeout = ${getDbBusyTimeoutMs()}`);
 			return await initialize(db);
-		} catch (error) {
+		} catch (caught) {
+			const error = options.recoverCorruption ? revealHiddenCorruption(db, caught) : caught;
 			if (options.recoverCorruption && isSqliteCorruptionError(error)) {
 				throw new SqliteAttemptFailure(error, identity, { db });
 			}
@@ -91,7 +117,8 @@ function openOnce<T>(dbPath: string, initialize: (db: Database) => T, options: S
 		db = new Database(dbPath);
 		db.run(`PRAGMA busy_timeout = ${getDbBusyTimeoutMs()}`);
 		return initialize(db);
-	} catch (error) {
+	} catch (caught) {
+		const error = options.recoverCorruption ? revealHiddenCorruption(db, caught) : caught;
 		if (options.recoverCorruption && isSqliteCorruptionError(error)) {
 			throw new SqliteAttemptFailure(error, identity, { db });
 		}

package/src/stderr-guard.ts

@@ -2,20 +2,17 @@
  * Terminal stderr guard: keeps unmanaged fd-2 writes off the terminal while a
  * TUI owns the viewport.
  *
- * On macOS, runtime diagnostics are written by the platform directly to file
- * descriptor 2 at arbitrary times — e.g. libmalloc's "MallocStackLogging:
- * can't turn off malloc stack logging because it was not enabled" when the OS
- * broadcasts a memory-diagnostic event to long-lived processes. Those bytes
- * bypass the renderer and paint straight into the viewport. Stripping the
- * MallocStackLogging* env vars (cli.ts) only protects child processes; it
- * cannot stop libmalloc inside THIS process from logging.
+ * Native runtimes and libraries can write directly to file descriptor 2 at
+ * arbitrary times. Examples include macOS libmalloc diagnostics and Bun HTTP
+ * decompression diagnostics on Linux. Those bytes bypass the renderer and
+ * paint straight into the viewport.
  *
- * Fix (mirrors openai/codex#24459): while the TUI owns the terminal, dup fd 2
- * aside and dup2 a redirect target over it; restore the saved fd whenever
- * terminal ownership is released (external editor, Ctrl+Z suspend, shutdown,
- * crash restore). Unlike codex we redirect to the omp log file — not
- * /dev/null — so the diagnostics stay greppable and Bun native-crash reports
- * (which abort before any JS cleanup can restore fd 2) are preserved.
+ * While the TUI owns the terminal, dup fd 2 aside and dup2 a redirect target
+ * over it; restore the saved fd whenever terminal ownership is released
+ * (external editor, Ctrl+Z suspend, shutdown, crash restore). This mirrors
+ * openai/codex#24459, but redirects to the omp log file instead of /dev/null
+ * so diagnostics stay greppable and Bun native-crash reports (which abort
+ * before any JS cleanup can restore fd 2) are preserved.
  *
  * Only dup/dup2 go through bun:ffi. fcntl is deliberately avoided: it is
  * variadic, and the arm64-darwin ABI passes variadic arguments on the stack,
@@ -79,35 +76,41 @@ function stderrSharesStdoutTerminal(): boolean {
 /** Saved dup of the real stderr while suppression is active, else null. */
 let savedStderrFd: number | null = null;
 
+/** Newest log file the guard knows about; see {@link setStderrRedirectTarget}. */
+let redirectTarget: string | null = null;
+
 export interface SuppressTerminalStderrOptions {
-	/** Redirect target path; defaults to today's omp log file, then /dev/null. */
+	/**
+	 * Redirect target path; defaults to the log file the rotating sink last
+	 * reported (see {@link setStderrRedirectTarget}), then today's omp log
+	 * file, then /dev/null.
+	 */
 	redirectPath?: string;
-	/** Bypass the macOS + same-terminal gate. Tests only. */
+	/** Bypass the same-terminal gate. Tests only. */
 	force?: boolean;
 }
 
 /**
  * Redirect fd 2 away from the terminal while the TUI owns the viewport.
  * Returns true when suppression is (already) active. No-op — returning
- * false — off macOS, when stderr does not target the stdout terminal, or
- * when the libc fd ops are unavailable.
+ * false — when stderr does not target the stdout terminal or when libc fd
+ * operations are unavailable.
  */
 export function suppressTerminalStderr(options?: SuppressTerminalStderrOptions): boolean {
 	if (savedStderrFd !== null) return true;
-	if (!options?.force && (process.platform !== "darwin" || !stderrSharesStdoutTerminal())) {
-		return false;
-	}
+	if (!options?.force && !stderrSharesStdoutTerminal()) return false;
 	const libc = libcFdOps();
 	if (!libc) return false;
 
 	let redirectFd: number;
 	try {
-		const redirectPath = options?.redirectPath ?? getLogPath();
+		const redirectPath = options?.redirectPath ?? redirectTarget ?? getLogPath();
 		// getLogsDir() only computes the path; the logger creates it lazily, so
 		// on a fresh profile ~/.omp/logs may not exist yet. Create it here so
 		// diagnostics land in the log instead of falling through to /dev/null.
 		fs.mkdirSync(path.dirname(redirectPath), { recursive: true });
 		redirectFd = fs.openSync(redirectPath, "a");
+		redirectTarget = redirectPath;
 	} catch {
 		try {
 			redirectFd = fs.openSync("/dev/null", "w");
@@ -131,6 +134,35 @@ export function suppressTerminalStderr(options?: SuppressTerminalStderrOptions):
 	return true;
 }
 
+/**
+ * Point fd 2 at `logPath`, the log file the rotating sink is currently
+ * writing.
+ *
+ * The logger calls this on every sink rotation. Without it fd 2 keeps the
+ * descriptor opened at TUI start, so after local midnight raw stderr — this
+ * process's and every child that inherited fd 2 — keeps landing in the
+ * previous day's file, which the sink eventually prunes out from under it.
+ *
+ * The path is recorded even while suppression is inactive, so a later
+ * {@link suppressTerminalStderr} redirects to the live file instead of
+ * re-deriving a dated name. Best-effort: if the new file cannot be opened,
+ * fd 2 keeps its current target.
+ */
+export function setStderrRedirectTarget(logPath: string): void {
+	redirectTarget = logPath;
+	if (savedStderrFd === null) return;
+	const libc = libcFdOps();
+	if (!libc) return;
+	let redirectFd: number;
+	try {
+		redirectFd = fs.openSync(logPath, "a");
+	} catch {
+		return;
+	}
+	libc.dup2(redirectFd, STDERR_FILENO);
+	fs.closeSync(redirectFd);
+}
+
 /**
  * Re-point fd 2 at the saved terminal stderr. Safe to call unconditionally:
  * no-op when suppression is not active. Called at every terminal-ownership