arisa 5.1.68 → 5.2.7

package/src/core/tools/daemon-worker.js

@@ -0,0 +1,310 @@
+import net from "node:net";
+import { chmod, mkdir, readdir, rename, rm, unlink } from "node:fs/promises";
+import {
+  ensureDaemonCapability,
+  readJson,
+  writeDaemonStatus,
+  writeJson
+} from "./daemon-processes.js";
+import { loadDaemonPolicy } from "./daemon-policy.js";
+import {
+  DAEMON_CONTROL_FIELD,
+  DAEMON_PROTOCOL_VERSION,
+  daemonFrame,
+  daemonJobPaths,
+  writeDaemonSocketFrame
+} from "./daemon-protocol.js";
+
+async function withTimeout(work, timeoutMs, message) {
+  let timer;
+  try {
+    return await Promise.race([
+      Promise.resolve().then(work),
+      new Promise((_, reject) => {
+        timer = setTimeout(() => {
+          const error = new Error(message);
+          error.code = "DAEMON_OPERATION_TIMEOUT";
+          reject(error);
+        }, timeoutMs);
+      })
+    ]);
+  } finally {
+    clearTimeout(timer);
+  }
+}
+
+export function createDaemonWorker({ toolName, paths }) {
+  let statusWrite = Promise.resolve();
+
+  async function ensure() {
+    await mkdir(paths.commandsDir, { recursive: true });
+  }
+
+  async function getPid() {
+    return (await readJson(paths.pidFile, {})).pid;
+  }
+
+  async function writeStatus(patch) {
+    statusWrite = statusWrite.catch(() => {}).then(() => writeDaemonStatus(paths, patch));
+    return statusWrite;
+  }
+
+  async function claimNext() {
+    await ensure();
+    const files = await readdir(paths.commandsDir);
+    const pending = files
+      .filter((file) => file.endsWith(".request.json") || file.endsWith(".processing.json"))
+      .sort((a, b) => {
+        const aControl = a.startsWith("control-") ? 0 : 1;
+        const bControl = b.startsWith("control-") ? 0 : 1;
+        return aControl - bControl || a.localeCompare(b);
+      });
+    for (const file of pending) {
+      const id = file.replace(/\.(?:request|processing)\.json$/, "");
+      const item = daemonJobPaths(paths, id);
+      if (await readJson(item.result, null)) {
+        await Promise.all([unlink(item.request).catch(() => {}), unlink(item.processing).catch(() => {})]);
+        continue;
+      }
+      try {
+        if (file.endsWith(".request.json")) await rename(item.request, item.processing);
+        const record = await readJson(item.processing, null);
+        if (!record) continue;
+        const accepted = {
+          ...record,
+          status: "accepted",
+          acceptedAt: record.acceptedAt || new Date().toISOString()
+        };
+        await writeJson(item.processing, accepted);
+        return { id, ...item, payload: accepted.payload };
+      } catch {}
+    }
+    return null;
+  }
+
+  async function workLoop({
+    processJob,
+    healthCheck,
+    recover = null,
+    beforeExit = null,
+    idleTimeoutMs = 0
+  }) {
+    if (typeof healthCheck !== "function") throw new Error(`${toolName} daemon must declare healthCheck`);
+    const policy = await loadDaemonPolicy();
+    const ipcLimits = {
+      maxFrameBytes: policy.ipcFrameBytes || 1_048_576,
+      streamBufferBytes: policy.streamBufferBytes || 1_048_576
+    };
+    const subscribers = new Map();
+    const activeJobs = new Map();
+    const cancelledJobs = new Set();
+    let lastActivity = Date.now();
+    let processing = false;
+    let exiting = false;
+    let acceptingWork = true;
+    let processRequested = false;
+
+    await ensure();
+    const capabilityToken = process.env.ARISA_DAEMON_CAPABILITY || await ensureDaemonCapability(paths);
+    await writeStatus({
+      state: "starting",
+      pid: process.pid,
+      heartbeatAt: new Date().toISOString(),
+      supportsRecovery: typeof recover === "function",
+      message: "Daemon work loop started; waiting for health check"
+    });
+
+    async function publish(frame) {
+      const sockets = [...(subscribers.get(frame.jobId) || [])];
+      for (const socket of sockets) {
+        if (!(await writeDaemonSocketFrame(socket, frame, ipcLimits))) subscribers.get(frame.jobId)?.delete(socket);
+      }
+    }
+
+    async function persistTerminal(job, frame) {
+      await writeJson(job.result, {
+        id: job.id,
+        status: frame.type,
+        completedAt: new Date().toISOString(),
+        terminal: frame
+      });
+      await unlink(job.processing).catch(() => {});
+      await publish(frame);
+    }
+
+    async function execute(job) {
+      let sequence = 1;
+      const controller = new AbortController();
+      activeJobs.set(job.id, controller);
+      if (cancelledJobs.delete(job.id)) controller.abort();
+      await publish(daemonFrame(job.id, "accepted", sequence, {}));
+      const emit = async (type, payload = {}) => {
+        if (!["progress", "chunk"].includes(type)) throw new Error(`Invalid non-terminal daemon event type: ${type}`);
+        sequence += 1;
+        await publish(daemonFrame(job.id, type, sequence, payload));
+      };
+      const operation = job.payload?.[DAEMON_CONTROL_FIELD]?.operation;
+      try {
+        let output;
+        if (operation === "health") {
+          const checkedAt = new Date().toISOString();
+          await writeStatus({ lastHealthCheckAt: checkedAt });
+          output = await withTimeout(
+            healthCheck,
+            policy.healthTimeoutMs,
+            `${toolName} health check timed out after ${policy.healthTimeoutMs}ms`
+          );
+          await writeStatus({
+            state: "ready",
+            lastHealthSuccessAt: new Date().toISOString(),
+            consecutiveHealthFailures: 0,
+            restartAttempts: 0,
+            restartRequested: false,
+            nextRestartAt: null,
+            message: output?.message || "Daemon health check passed"
+          });
+          output ||= { ok: true };
+        } else if (operation === "recover") {
+          const recovered = typeof recover === "function"
+            ? await withTimeout(recover, policy.healthTimeoutMs, `${toolName} recovery timed out after ${policy.healthTimeoutMs}ms`)
+            : false;
+          output = { recovered: recovered !== false };
+        } else {
+          lastActivity = Date.now();
+          if (controller.signal.aborted) {
+            throw Object.assign(new Error(`Daemon job cancelled: ${job.id}`), { code: "DAEMON_JOB_CANCELLED" });
+          }
+          output = await processJob(job.payload, { emit, jobId: job.id, signal: controller.signal });
+          await writeStatus({ lastSuccessfulJobAt: new Date().toISOString() });
+          lastActivity = Date.now();
+        }
+        sequence += 1;
+        await persistTerminal(job, daemonFrame(job.id, "completed", sequence, { output }));
+      } catch (error) {
+        if (error?.code === "DAEMON_OPERATION_TIMEOUT") acceptingWork = false;
+        const current = await readJson(paths.statusFile, {});
+        await writeStatus({
+          ...(operation === "health" ? {
+            state: error?.code === "DAEMON_OPERATION_TIMEOUT" ? "unhealthy" : "degraded",
+            consecutiveHealthFailures: Number(current.consecutiveHealthFailures || 0) + 1
+          } : {}),
+          lastError: {
+            at: new Date().toISOString(),
+            phase: operation || "job",
+            message: error?.message || String(error),
+            ...(error?.code ? { code: error.code } : {})
+          },
+          message: error?.message || String(error)
+        });
+        sequence += 1;
+        await persistTerminal(job, daemonFrame(job.id, "failed", sequence, {
+          error: error?.message || String(error),
+          code: error?.code || null
+        }));
+      } finally {
+        activeJobs.delete(job.id);
+        cancelledJobs.delete(job.id);
+      }
+    }
+
+    async function processQueue() {
+      if (processing || exiting || !acceptingWork) {
+        processRequested = true;
+        return;
+      }
+      processing = true;
+      try {
+        do {
+          processRequested = false;
+          const job = await claimNext();
+          if (!job) break;
+          await execute(job);
+        } while (!exiting && acceptingWork);
+      } catch (error) {
+        await writeStatus({
+          state: "degraded",
+          lastError: { at: new Date().toISOString(), phase: "work-loop", message: error?.message || String(error), ...(error?.code ? { code: error.code } : {}) },
+          message: error?.message || String(error)
+        });
+      } finally {
+        processing = false;
+        if (processRequested && !exiting && acceptingWork) queueMicrotask(() => processQueue().catch(() => {}));
+      }
+    }
+
+    if (process.platform !== "win32") await rm(paths.socketFile, { force: true });
+    const server = net.createServer((socket) => {
+      socket.setEncoding("utf8");
+      let buffer = "";
+      const subscribedJobs = new Set();
+      const removeSocket = () => {
+        for (const jobId of subscribedJobs) subscribers.get(jobId)?.delete(socket);
+      };
+      socket.on("data", (chunk) => {
+        buffer += chunk;
+        if (Buffer.byteLength(buffer, "utf8") > ipcLimits.maxFrameBytes && !buffer.includes("\n")) {
+          socket.destroy();
+          return;
+        }
+        let newlineIndex = buffer.indexOf("\n");
+        while (newlineIndex !== -1) {
+          const line = buffer.slice(0, newlineIndex).trim();
+          buffer = buffer.slice(newlineIndex + 1);
+          newlineIndex = buffer.indexOf("\n");
+          if (!line) continue;
+          let notification;
+          try {
+            notification = JSON.parse(line);
+          } catch {
+            socket.destroy();
+            return;
+          }
+          if (notification.version !== DAEMON_PROTOCOL_VERSION
+            || !["submit", "cancel"].includes(notification.type)
+            || typeof notification.jobId !== "string"
+            || notification.capabilityToken !== capabilityToken) {
+            socket.destroy();
+            return;
+          }
+          const { jobId } = notification;
+          if (notification.type === "cancel") {
+            cancelledJobs.add(jobId);
+            activeJobs.get(jobId)?.abort();
+            continue;
+          }
+          if (!subscribers.has(jobId)) subscribers.set(jobId, new Set());
+          subscribers.get(jobId).add(socket);
+          subscribedJobs.add(jobId);
+          readJson(daemonJobPaths(paths, jobId).result, null).then((result) => {
+            if (result?.terminal) return writeDaemonSocketFrame(socket, result.terminal, ipcLimits);
+            return processQueue();
+          }).catch(() => socket.destroy());
+        }
+      });
+      socket.once("close", removeSocket);
+      socket.once("error", removeSocket);
+    });
+    await new Promise((resolve, reject) => {
+      server.once("error", reject);
+      server.listen(paths.socketFile, resolve);
+    });
+    if (process.platform !== "win32") await chmod(paths.socketFile, 0o600);
+
+    const heartbeatTimer = setInterval(() => {
+      writeStatus({ heartbeatAt: new Date().toISOString() }).catch(() => {});
+    }, policy.heartbeatIntervalMs);
+    const idleTimer = idleTimeoutMs > 0 ? setInterval(async () => {
+      if (processing || exiting || Date.now() - lastActivity <= idleTimeoutMs) return;
+      exiting = true;
+      clearInterval(heartbeatTimer);
+      clearInterval(idleTimer);
+      await beforeExit?.();
+      await writeStatus({ state: "stopped", restartRequested: false, nextRestartAt: null, message: "Idle timeout reached" });
+      server.close(() => process.exit(0));
+    }, Math.min(idleTimeoutMs, 1_000)) : null;
+
+    processQueue().catch(() => {});
+  }
+
+  return { ensure, getPid, writeStatus, claimNext, workLoop };
+}

package/src/core/tools/ipc-client.js

@@ -1,6 +1,6 @@
 import crypto from "node:crypto";
 import net from "node:net";
-import { arisaIpcSocketFile } from "../../runtime/paths.js";
+import { arisaIpcSocketFile } from "../../platform/paths.js";
 
 const DEFAULT_TIMEOUT_MS = 10_000;
 
@@ -91,7 +91,7 @@ export function createArisaClient({
       enqueueEvent: (params) => call("agent.enqueueEvent", params)
     },
     tools: {
-      list: () => call("tools.list"),
+      list: (params = {}) => call("tools.list", params),
       help: (params) => call("tools.help", params),
       skills: (params) => call("tools.skills", params),
       setConfig: (params) => call("tools.setConfig", params),

package/src/core/tools/memory-pressure.js

@@ -0,0 +1,56 @@
+import os from "node:os";
+import { readFile } from "node:fs/promises";
+
+function linuxMemoryValues(text) {
+  const values = new Map();
+  for (const line of String(text || "").split(/\r?\n/)) {
+    const match = line.match(/^([A-Za-z_]+):\s+(\d+)\s+kB$/);
+    if (match) values.set(match[1], Number(match[2]) * 1024);
+  }
+  return values;
+}
+
+export async function readMemoryPressure({
+  platform = process.platform,
+  readMemInfo = () => readFile("/proc/meminfo", "utf8"),
+  freeMemory = () => os.freemem(),
+  totalMemory = () => os.totalmem(),
+  processMemory = () => process.memoryUsage()
+} = {}) {
+  let availableBytes = Number(freeMemory()) || 0;
+  let totalBytes = Number(totalMemory()) || 0;
+  let swapTotalBytes = 0;
+  let swapFreeBytes = 0;
+  if (platform === "linux") {
+    try {
+      const values = linuxMemoryValues(await readMemInfo());
+      availableBytes = values.get("MemAvailable") || availableBytes;
+      totalBytes = values.get("MemTotal") || totalBytes;
+      swapTotalBytes = values.get("SwapTotal") || 0;
+      swapFreeBytes = values.get("SwapFree") || 0;
+    } catch {}
+  }
+  const swapUsedPercent = swapTotalBytes > 0
+    ? ((swapTotalBytes - swapFreeBytes) / swapTotalBytes) * 100
+    : 0;
+  return {
+    availableBytes,
+    totalBytes,
+    swapTotalBytes,
+    swapFreeBytes,
+    swapUsedPercent,
+    workerRssBytes: Number(processMemory()?.rss) || 0
+  };
+}
+
+export function memoryPressureReason(snapshot, policy) {
+  const mebibyte = 1024 * 1024;
+  const workerRssMb = snapshot.workerRssBytes / mebibyte;
+  if (workerRssMb > policy.maxWorkerRssMb) {
+    return `worker RSS ${Math.ceil(workerRssMb)} MiB exceeds the ${policy.maxWorkerRssMb} MiB limit`;
+  }
+  if (snapshot.swapTotalBytes > 0 && snapshot.swapUsedPercent > policy.maxSwapUsedPercent) {
+    return `swap use ${Math.ceil(snapshot.swapUsedPercent)}% exceeds the ${policy.maxSwapUsedPercent}% limit`;
+  }
+  return "";
+}

package/src/core/tools/official-tool-installer.js

@@ -12,7 +12,7 @@ import {
   rm
 } from "node:fs/promises";
 import path from "node:path";
-import { getToolDir } from "../../runtime/paths.js";
+import { getToolDir } from "../../platform/paths.js";
 import { normalizeToolDependencies, resolveToolDependencyPlan, satisfiesToolVersion } from "./tool-dependencies.js";
 
 const bundledLockFile = new URL("../../official-tools.lock.json", import.meta.url);

package/src/core/tools/tool-config.js

@@ -1,6 +1,6 @@
 import { mkdir, readFile, writeFile } from "node:fs/promises";
 import path from "node:path";
-import { getToolConfigPath, getChatToolConfigPath } from "../../runtime/paths.js";
+import { getToolConfigPath, getChatToolConfigPath } from "../../platform/paths.js";
 
 export function parseConfigModule(source) {
   const normalized = source.replace(/^export\s+default/, "return");

package/src/core/tools/tool-process-output.js

@@ -0,0 +1,100 @@
+import { DAEMON_EVENT_TYPES, DAEMON_PROTOCOL_VERSION } from "./daemon-protocol.js";
+
+export function createToolOutputParser(name, {
+  onEvent,
+  maxFrameBytes = 1_048_576,
+  maxOutputBytes = maxFrameBytes
+} = {}) {
+  let buffer = "";
+  let mode = "unknown";
+  let rawOutput = "";
+  let rawOutputBytes = 0;
+  let terminalResult = null;
+  let activeJobId = null;
+  let sequence = 0;
+  let terminalSeen = false;
+
+  async function parseEvent(line) {
+    let event;
+    try {
+      event = JSON.parse(line);
+    } catch {
+      throw new Error(`Invalid NDJSON from ${name}`);
+    }
+    if (event?.version !== DAEMON_PROTOCOL_VERSION || !DAEMON_EVENT_TYPES.includes(event?.type)) {
+      throw new Error(`Invalid versioned tool event from ${name}`);
+    }
+    if (typeof event.jobId !== "string" || !event.jobId) throw new Error(`Tool event from ${name} is missing jobId`);
+    if (activeJobId == null) activeJobId = event.jobId;
+    if (event.jobId !== activeJobId) throw new Error(`Tool ${name} multiplexed an unexpected jobId`);
+    if (!Number.isSafeInteger(event.sequence) || event.sequence !== sequence + 1) {
+      throw new Error(`Invalid tool event sequence from ${name}: ${event.sequence}`);
+    }
+    if (terminalSeen) throw new Error(`Tool ${name} emitted more than one terminal event`);
+    sequence = event.sequence;
+    terminalSeen = event.type === "completed" || event.type === "failed";
+    await onEvent?.(event);
+    if (terminalSeen) {
+      terminalResult = event.type === "completed"
+        ? event.payload?.result ?? event.payload?.output ?? event.payload
+        : { ok: false, error: event.payload?.error || `Tool failed: ${name}`, ...(event.payload?.code ? { code: event.payload.code } : {}) };
+    }
+  }
+
+  async function consumeLine(line) {
+    if (Buffer.byteLength(line, "utf8") > maxFrameBytes) throw new Error(`Tool event from ${name} exceeds ${maxFrameBytes} bytes`);
+    if (mode === "unknown") {
+      let candidate;
+      try {
+        candidate = JSON.parse(line);
+      } catch {
+        mode = "legacy";
+        return;
+      }
+      if (candidate?.version === DAEMON_PROTOCOL_VERSION && DAEMON_EVENT_TYPES.includes(candidate?.type)) {
+        mode = "ndjson";
+        rawOutput = "";
+        return parseEvent(line);
+      }
+      mode = "legacy";
+      return;
+    }
+    if (mode === "legacy") return;
+    return parseEvent(line);
+  }
+
+  return {
+    async push(chunk) {
+      const text = chunk.toString("utf8");
+      if (mode !== "ndjson") {
+        rawOutputBytes += Buffer.byteLength(text, "utf8");
+        if (rawOutputBytes > maxOutputBytes) {
+          const error = new Error(`Tool output from ${name} exceeds ${maxOutputBytes} bytes`);
+          error.code = "TOOL_OUTPUT_LIMIT";
+          throw error;
+        }
+        rawOutput += text;
+      }
+      if (mode === "legacy") return;
+      buffer += text;
+      if (Buffer.byteLength(buffer, "utf8") > maxFrameBytes && !buffer.includes("\n")) {
+        throw new Error(`Tool event from ${name} exceeds ${maxFrameBytes} bytes`);
+      }
+      let newlineIndex = buffer.indexOf("\n");
+      while (newlineIndex !== -1) {
+        const line = buffer.slice(0, newlineIndex).trim();
+        buffer = buffer.slice(newlineIndex + 1);
+        if (line) await consumeLine(line);
+        newlineIndex = buffer.indexOf("\n");
+      }
+    },
+    async finish() {
+      const tail = buffer.trim();
+      buffer = "";
+      if (tail) await consumeLine(tail);
+      if (mode !== "ndjson") return { mode: "legacy", output: rawOutput };
+      if (!terminalSeen) throw new Error(`Tool ${name} ended without a terminal event`);
+      return { mode: "ndjson", result: terminalResult };
+    }
+  };
+}

package/src/core/tools/tool-process-runner.js

@@ -0,0 +1,175 @@
+import { existsSync } from "node:fs";
+import path from "node:path";
+import { spawn } from "node:child_process";
+import { arisaIpcSocketFile, arisaPackageDir } from "../../platform/paths.js";
+import { daemonConfigDefaults } from "../config/config-defaults.js";
+import { createToolOutputParser } from "./tool-process-output.js";
+
+export function toolProcessEnv() {
+  return { ...process.env, ARISA_PACKAGE_DIR: arisaPackageDir, ARISA_IPC_SOCKET: arisaIpcSocketFile };
+}
+
+export function isolatedToolProcessInvocation(nodeArgs, execution, {
+  platform = process.platform,
+  systemdAvailable = existsSync("/run/systemd/system"),
+  oomAdjustAvailable = existsSync("/usr/bin/choom")
+} = {}) {
+  if (!execution?.maxMemoryMb || platform !== "linux" || !systemdAvailable) {
+    return { command: "node", args: nodeArgs, isolated: false };
+  }
+  const memoryHighPercent = Number.isSafeInteger(execution.memoryHighPercent)
+    ? execution.memoryHighPercent
+    : 85;
+  const memoryHighMb = Math.max(1, Math.floor(execution.maxMemoryMb * memoryHighPercent / 100));
+  const swapMaxMb = Number.isSafeInteger(execution.swapMaxMb) ? execution.swapMaxMb : 128;
+  return {
+    command: "systemd-run",
+    args: [
+      "--scope",
+      "--quiet",
+      "--collect",
+      "--slice=arisa-tools.slice",
+      "-p", `MemoryHigh=${memoryHighMb}M`,
+      "-p", `MemoryMax=${execution.maxMemoryMb}M`,
+      "-p", `MemorySwapMax=${swapMaxMb}M`,
+      "--",
+      ...(oomAdjustAvailable ? ["choom", "-n", "500", "--"] : []),
+      "node",
+      ...nodeArgs
+    ],
+    isolated: true
+  };
+}
+
+function terminateToolProcess(child, signal) {
+  if (process.platform !== "win32" && Number.isInteger(child.pid)) {
+    try {
+      process.kill(-child.pid, signal);
+      return;
+    } catch {}
+  }
+  child.kill(signal);
+}
+
+function waitForToolProcess(child, { timeoutMs, killGraceMs, label }) {
+  return new Promise((resolve, reject) => {
+    let timedOut = false;
+    let forceTimer = null;
+    const timeout = setTimeout(() => {
+      timedOut = true;
+      terminateToolProcess(child, "SIGTERM");
+      forceTimer = setTimeout(() => terminateToolProcess(child, "SIGKILL"), killGraceMs);
+    }, timeoutMs);
+
+    const finish = (callback, value) => {
+      clearTimeout(timeout);
+      clearTimeout(forceTimer);
+      callback(value);
+    };
+
+    child.once("error", (error) => finish(reject, error));
+    child.once("close", (code) => {
+      if (!timedOut) {
+        finish(resolve, code);
+        return;
+      }
+      const error = new Error(`${label} timed out after ${timeoutMs}ms`);
+      error.code = "TOOL_PROCESS_TIMEOUT";
+      finish(reject, error);
+    });
+  });
+}
+
+export async function runToolHelpProcess(command, args, {
+  timeoutMs,
+  killGraceMs,
+  label,
+  maxOutputBytes = daemonConfigDefaults.ipcFrameBytes,
+  ...options
+} = {}) {
+  const child = spawn(command, args, {
+    detached: process.platform !== "win32",
+    ...options,
+    stdio: ["ignore", "pipe", "pipe"]
+  });
+  let stdout = "";
+  let stderr = "";
+  let outputBytes = 0;
+  let outputError = null;
+  let forceTimer = null;
+  const append = (current, chunk) => {
+    if (outputError) return current;
+    outputBytes += chunk.length;
+    if (outputBytes > maxOutputBytes) {
+      outputError = new Error(`${label} output exceeds ${maxOutputBytes} bytes`);
+      outputError.code = "TOOL_OUTPUT_LIMIT";
+      terminateToolProcess(child, "SIGTERM");
+      forceTimer = setTimeout(() => terminateToolProcess(child, "SIGKILL"), killGraceMs);
+      forceTimer.unref?.();
+      return current;
+    }
+    return current + chunk.toString("utf8");
+  };
+  child.stdout.on("data", (chunk) => { stdout = append(stdout, chunk); });
+  child.stderr.on("data", (chunk) => { stderr = append(stderr, chunk); });
+  const code = await waitForToolProcess(child, { timeoutMs, killGraceMs, label });
+  clearTimeout(forceTimer);
+  if (outputError) throw outputError;
+  return { code, stdout, stderr };
+}
+
+export async function runToolProcess(command, args, {
+  onEvent,
+  maxFrameBytes,
+  maxOutputBytes,
+  parserName,
+  timeoutMs,
+  killGraceMs,
+  label,
+  ...options
+} = {}) {
+  const child = spawn(command, args, {
+    detached: process.platform !== "win32",
+    ...options,
+    stdio: ["ignore", "pipe", "pipe"]
+  });
+  const parser = createToolOutputParser(parserName || path.basename(args[0] || command), { onEvent, maxFrameBytes, maxOutputBytes });
+  const stderrChunks = [];
+  let stderrBytes = 0;
+  let stdoutError = null;
+  let outputForceTimer = null;
+  const stdoutTask = (async () => {
+    try {
+      for await (const chunk of child.stdout) await parser.push(chunk);
+      return parser.finish();
+    } catch (error) {
+      stdoutError = error;
+      terminateToolProcess(child, "SIGTERM");
+      outputForceTimer = setTimeout(() => terminateToolProcess(child, "SIGKILL"), killGraceMs);
+      outputForceTimer.unref?.();
+      return null;
+    }
+  })();
+  const stderrTask = (async () => {
+    for await (const chunk of child.stderr) {
+      if (stderrBytes >= maxFrameBytes) continue;
+      const accepted = chunk.subarray(0, maxFrameBytes - stderrBytes);
+      stderrChunks.push(accepted);
+      stderrBytes += accepted.length;
+    }
+    return Buffer.concat(stderrChunks).toString("utf8");
+  })();
+  child.stdout.resume();
+  child.stderr.resume();
+  let code;
+  try {
+    code = await waitForToolProcess(child, { timeoutMs, killGraceMs, label });
+  } catch (error) {
+    await Promise.allSettled([stdoutTask, stderrTask]);
+    throw error;
+  }
+  const [parsed, stderr] = await Promise.all([stdoutTask, stderrTask]);
+  clearTimeout(outputForceTimer);
+  if (stdoutError) throw stdoutError;
+  return { code, parsed, stderr };
+}