buninu-linux 0.17.60 → 0.18.62

package/initramfs/buninu/apps/jsgotty/gotty.js

@@ -16,6 +16,7 @@ const { TerminalModeTracker } = require("./terminal-modes.js");
 const { WebSocketServer } = WebSocket;
 const { ClipboardHost, handleOSC52 } = require("./clipboard.js");
 const clipboardHost = new ClipboardHost();
+const { KittyFrameFlow } = require("./kitty-flow.js");
 
 const MSG_INPUT = "1";
 const MSG_PING = "2";
@@ -1856,7 +1857,8 @@ class PtySession {
       remoteAddr,
       encoding: "null",
       readOnly,
-      sendQueue: Promise.resolve()
+      sendQueue: Promise.resolve(),
+      kittyFlow: new KittyFrameFlow(graphic => this.queueSend(ws, MSG_KITTY_GRAPHICS + JSON.stringify(graphic)))
     });
     if (this.permitWrite && !readOnly && !this.writerWs) {
       this.writerWs = ws;
@@ -1919,6 +1921,7 @@ class PtySession {
       const writable = this.isWriter(ws);
       this.send(MSG_SET_ROLE, JSON.stringify({
         role: writable ? "writer" : "viewer",
+        kittyFrameFlow: 1,
         writable
       }), ws);
     }
@@ -2452,6 +2455,9 @@ class PtySession {
     }
 
     switch (type) {
+      case "G":
+        try { client.kittyFlow.control(JSON.parse(payload)); } catch {}
+        break;
       case "C":
         handleOSC52(this, ws, payload, clipboardHost);
         break;
@@ -2580,6 +2586,13 @@ class PtySession {
       return;
     }
 
+    // Negotiate browser-only image credits; never throttle terminal byte output.
+    if (!binary && client.kittyFlow.enabled && payload[0] === MSG_KITTY_GRAPHICS) {
+      const graphic = JSON.parse(payload.slice(1));
+      if (!graphic.frameSequence && client.kittyFlow.graphic(graphic)) return;
+    }
+    if (!binary && payload[0] === MSG_OUTPUT) client.kittyFlow.output(payload.slice(1));
+
     const sendOne = async () => {
       await new Promise((resolve, reject) => {
         try {

package/initramfs/buninu/apps/jsgotty/kitty-flow.js

@@ -0,0 +1,40 @@
+// Per browser connection. Only replaceable C=1 placements use frame credits;
+// ordinary terminal output, scrolling placements and CLI clients stay ordered.
+class KittyFrameFlow {
+  constructor(send) { this.send=send;this.enabled=false;this.visible=true;this.sequence=0;this.inFlight=new Set();this.pending=new Map();this.tail=''; }
+  control(message) {
+    if(message?.version!==1)return;
+    this.enabled=true;
+    if(typeof message.visible==='boolean')this.visible=message.visible;
+    if(Number.isSafeInteger(message.ack))this.inFlight.delete(message.ack);
+    this.flush();
+  }
+  graphic(graphic) {
+    if(!this.enabled)return false;
+    if(graphic.kind==='delete'){
+      const d=graphic.delete||{};
+      for(const [key,g] of this.pending)if(d.scope==='a'||d.scope==='A'||String(g.image.id)===String(d.imageId))this.pending.delete(key);
+      return false;
+    }
+    const c=graphic.control||{},id=c.i||c.I||graphic.image?.id;
+    if(graphic.kind!=='placement'||!graphic.image||!id)return false;
+    if(String(c.C)!=='1'){this.pending.delete(`${id}:${c.p||'0'}`);return false;}
+    const key=`${id}:${c.p||'0'}`;
+    // Preserve ordering among different placements when replacing an update.
+    this.pending.delete(key);this.pending.set(key,graphic);this.flush();return true;
+  }
+  output(payload) {
+    if(!this.enabled)return;
+    const text=this.tail+Buffer.from(payload,'base64').toString('utf8');
+    if(text.includes('\x1bc')||text.includes('\f')||/\x1b\[\?(?:1049|1047|47)[hl]/.test(text))this.pending.clear();
+    this.tail=text.slice(-32);
+  }
+  flush() {
+    while(this.enabled&&this.visible&&this.inFlight.size<2&&this.pending.size){
+      const [key,graphic]=this.pending.entries().next().value;this.pending.delete(key);
+      const sequence=++this.sequence;this.inFlight.add(sequence);
+      this.send({...graphic,frameSequence:sequence});
+    }
+  }
+}
+module.exports={KittyFrameFlow};

package/initramfs/buninu/apps/jsgotty/package-lock.json

@@ -1,12 +1,12 @@
 {
   "name": "jsgotty",
-  "version": "1.4.0",
+  "version": "1.4.1",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "jsgotty",
-      "version": "1.4.0",
+      "version": "1.4.1",
       "dependencies": {
         "node-addon-api": "^7.1.1",
         "ws": "^8.18.3"

package/initramfs/buninu/apps/jsgotty/package.json

@@ -1,6 +1,6 @@
 {
   "name": "jsgotty",
-  "version": "1.4.0",
+  "version": "1.4.1",
   "description": "Share your terminal as a web application: A JavaScript rewrite of GoTTY",
   "license": "MIT",
   "bin": {

package/initramfs/buninu/apps/jsgotty/static/js/kitty.js

@@ -1079,7 +1079,31 @@
     state.outputTail = text.slice(-64);
   }
 
-  function handleKittyMessage(payload) {
+  // Only a server advertising this capability receives the private control.
+  const frameFlowSockets = new WeakSet();
+  function sendFrameControl(socket, fields) {
+    if (socket?.readyState === 1 && frameFlowSockets.has(socket))
+      socket.send("G" + JSON.stringify({version: 1, ...fields}));
+  }
+  function inspectFrameCapability(socket, data) {
+    if (typeof data !== "string" || data[0] !== "a") return;
+    try {
+      if (JSON.parse(data.slice(1)).kittyFrameFlow !== 1 || frameFlowSockets.has(socket)) return;
+      frameFlowSockets.add(socket);
+      sendFrameControl(socket, {visible: !document.hidden});
+    } catch {}
+  }
+  document.addEventListener("visibilitychange", () => {
+    sendFrameControl(state.socket, {visible: !document.hidden});
+  });
+  function acknowledgeFrame(socket, sequence) {
+    if (!Number.isSafeInteger(sequence)) return;
+    // rAF stops while hidden and also bounds delivery if WebView is suspended
+    // without a visibility event. Credits belong to their original connection.
+    requestAnimationFrame(() => sendFrameControl(socket, {ack: sequence}));
+  }
+
+  function handleKittyMessage(payload, socket) {
     const message = JSON.parse(payload);
     sendBrowserDebug("kitty-message", {
       kind: message.kind,
@@ -1091,7 +1115,9 @@
       // The server records this cursor exactly where the Kitty APC occurred.
       // Do not replace it with xterm's later cursor, which may already have
       // moved because of redraw or scrolling output queued after the APC.
-      placeImage(message);
+      Promise.resolve(placeImage(message)).catch(error => {
+        console.warn("Kitty image decode failed", error);
+      }).finally(() => acknowledgeFrame(socket, message.frameSequence));
       return true;
     }
     if (message.kind === "delete") {
@@ -1119,9 +1145,10 @@
       const wrapped = function (event) {
         state.socket = this;
         watchTouchSocket(this);
+        inspectFrameCapability(this, event.data);
         inspectTerminalOutput(event.data);
         if (typeof event.data === "string" && event.data[0] === MSG_KITTY) {
-          if (handleKittyMessage(event.data.slice(1))) {
+          if (handleKittyMessage(event.data.slice(1), this)) {
             return;
           }
         }
@@ -1166,9 +1193,10 @@
       const wrapped = function (event) {
         state.socket = this;
         watchTouchSocket(this);
+        inspectFrameCapability(this, event.data);
         inspectTerminalOutput(event.data);
         if (typeof event.data === "string" && event.data[0] === MSG_KITTY) {
-          if (handleKittyMessage(event.data.slice(1))) {
+          if (handleKittyMessage(event.data.slice(1), this)) {
             return;
           }
         }

package/initramfs/buninu/apps/jsgotty/tests/kitty-flow-browser.test.js

@@ -0,0 +1,43 @@
+// CHROMIUM_HEADLESS=/usr/local/bin/chromium-headless-shell bun test tests/kitty-flow-browser.test.js
+const test=require('node:test'),assert=require('node:assert/strict');
+const fs=require('node:fs'),path=require('node:path'),http=require('node:http');
+const {spawn}=require('node:child_process'),{once}=require('node:events');
+const WebSocket=require('ws'),{KittyFrameFlow}=require('../kitty-flow.js');
+test('real browser resumes latest image after visibility loss or suspended animation callbacks',{skip:!process.env.CHROMIUM_HEADLESS,timeout:30000},async()=>{
+ const source=fs.readFileSync(path.join(__dirname,'../static/js/kitty.js'));
+ const server=http.createServer((req,res)=>{
+  if(req.url==='/kitty.js'){res.setHeader('Content-Type','text/javascript');res.end(source);return;}
+  res.end(`<div id="terminal" style="width:800px;height:600px"><div class="xterm-screen"></div></div><div id="kitty-overlay"></div>
+<script>window.hidden=false;Object.defineProperty(document,'hidden',{get:()=>window.hidden});window.held=[];window.suspended=false;const raf=window.requestAnimationFrame.bind(window);window.requestAnimationFrame=fn=>suspended?(held.push(fn),0):raf(fn);</script>
+<script src="/kitty.js"></script><script>window.messages=[];window.socket=new WebSocket('ws://'+location.host);socket.onmessage=e=>messages.push(e.data);</script>`);
+ });server.listen(0,'127.0.0.1');await once(server,'listening');
+ const wss=new WebSocket.WebSocketServer({server});let flow,socket,count=0,last=null;
+ wss.on('connection',ws=>{socket=ws;flow=new KittyFrameFlow(g=>{count++;last=g;ws.send('7'+JSON.stringify(g));});ws.on('message',m=>{if(String(m)[0]==='G')flow.control(JSON.parse(String(m).slice(1)))});ws.send('a{"kittyFrameFlow":1}');});
+ const child=spawn(process.env.CHROMIUM_HEADLESS,['--no-sandbox','--disable-gpu','--remote-debugging-port=0','http://127.0.0.1:'+server.address().port],{stdio:['ignore','ignore','pipe']});let cdp;
+ try{
+  const endpoint=await new Promise((resolve,reject)=>{let log='';child.on('error',reject);child.stderr.on('data',b=>{log+=b;const m=log.match(/DevTools listening on (ws:\/\/[^\s]+)/);if(m)resolve(m[1]);});});
+  let tab;for(let i=0;i<100;i++){tab=(await(await fetch('http://'+new URL(endpoint).host+'/json/list')).json()).find(x=>x.type==='page');if(tab)break;await new Promise(r=>setTimeout(r,20));}
+  cdp=new WebSocket(tab.webSocketDebuggerUrl);await once(cdp,'open');let id=0;const pending=new Map();cdp.on('message',data=>{const m=JSON.parse(data),p=pending.get(m.id);if(p){pending.delete(m.id);m.error?p.reject(m.error):p.resolve(m.result)}});
+  const call=(method,params)=>new Promise((resolve,reject)=>{pending.set(++id,{resolve,reject});cdp.send(JSON.stringify({id,method,params}));});
+  const evaluate=async expression=>{const r=await call('Runtime.evaluate',{expression,returnByValue:true,awaitPromise:true});if(r.exceptionDetails)throw Error(JSON.stringify(r.exceptionDetails));return r.result.value;};
+  const until=async check=>{for(let i=0;i<100;i++){if(await check())return;await new Promise(r=>setTimeout(r,20));}throw Error('fixture timed out')};
+  await until(()=>flow?.enabled);
+  const png=await evaluate(`(()=>{const c=document.createElement('canvas');c.width=c.height=1;c.getContext('2d').fillRect(0,0,1,1);return c.toDataURL().split(',')[1]})()`);
+  const frame=n=>({kind:'placement',control:{i:'1',C:'1',c:'2',r:'2'},cursor:{row:1,col:1},image:{id:'1',format:100,data:png},testFrame:n});
+  flow.graphic(frame(0));await until(()=>flow.inFlight.size===0);
+  await evaluate('window.hidden=true;document.dispatchEvent(new Event("visibilitychange"))');await until(()=>flow.visible===false);
+  const before=count;for(let n=1;n<=1800;n++)flow.graphic(frame(n));assert.equal(count,before);assert.equal(flow.pending.size,1);
+  socket.send('1'+Buffer.from('TEXT_WHILE_HIDDEN').toString('base64'));
+  await until(async()=>await evaluate('messages.some(x=>x.startsWith("1"))'));
+  await evaluate('window.hidden=false;document.dispatchEvent(new Event("visibilitychange"))');await until(()=>flow.inFlight.size===0&&last.testFrame===1800);
+  assert.equal(count,before+1);
+  // A renderer can freeze without delivering visibilitychange. Missing rAF
+  // acknowledgements still bound the server to two outstanding frames.
+  await evaluate('window.suspended=true');const baseline=count;
+  for(let n=1801;n<=3600;n++)flow.graphic(frame(n));assert.equal(count,baseline+2);assert.equal(flow.pending.size,1);
+  await until(async()=>await evaluate('held.length>=2'));
+  await evaluate('window.suspended=false;for(const fn of held.splice(0))requestAnimationFrame(fn)');
+  await until(()=>flow.inFlight.size===0&&last.testFrame===3600);assert.equal(count,baseline+3);
+  await until(async()=>await evaluate('document.querySelector("img.kitty-image__content").naturalWidth===1'));
+ }finally{cdp?.close();for(const ws of wss.clients)ws.terminate();wss.close();server.close();child.kill();}
+});

package/initramfs/buninu/apps/jsgotty/tests/kitty-flow.test.js

@@ -0,0 +1,55 @@
+const {test}=require('node:test');
+const assert=require('node:assert/strict');
+const {KittyFrameFlow}=require('../kitty-flow.js');
+const graphic=(n,id='1')=>({kind:'placement',control:{i:id,C:'1'},cursor:{row:2,col:1},image:{id,data:String(n)}});
+test('browser credits bound suspension to two frames and latest replacement',()=>{
+ const sent=[],flow=new KittyFrameFlow(g=>sent.push(g));
+ assert.equal(flow.graphic(graphic(0)),false); // CLI and old WebViews unchanged
+ flow.control({version:1,visible:true});
+ for(let n=0;n<1800;n++)assert.equal(flow.graphic(graphic(n)),true);
+ assert.equal(sent.length,2);assert.equal(flow.pending.size,1);
+ flow.control({version:1,ack:9999});assert.equal(sent.length,2);
+ flow.control({version:1,ack:sent[0].frameSequence});
+ assert.equal(sent.length,3);assert.equal(sent[2].image.data,'1799');
+ flow.control({version:1,ack:sent[0].frameSequence});assert.equal(sent.length,3);
+});
+test('hidden viewers keep only latest per placement and resume without another update',()=>{
+ const sent=[],flow=new KittyFrameFlow(g=>sent.push(g));flow.control({version:1,visible:false});
+ for(let n=0;n<100;n++){flow.graphic(graphic(n,'1'));flow.graphic(graphic(n,'2'));}
+ assert.equal(sent.length,0);assert.equal(flow.pending.size,2);
+ flow.control({version:1,visible:true});assert.deepEqual(sent.map(g=>g.image.data),['99','99']);
+});
+test('delete, terminal reset and alternate screen do not resurrect pending images',()=>{
+ const sent=[],flow=new KittyFrameFlow(g=>sent.push(g));flow.control({version:1,visible:false});
+ flow.graphic(graphic(1));flow.graphic(graphic(2,'2'));
+ assert.equal(flow.graphic({kind:'delete',delete:{imageId:'1'}}),false);
+ assert.equal(flow.pending.size,1);
+ flow.output(Buffer.from('\x1b[?104').toString('base64'));
+ flow.output(Buffer.from('9l').toString('base64'));assert.equal(flow.pending.size,0);
+ flow.graphic(graphic(3));flow.graphic({kind:'delete',delete:{scope:'a'}});
+ flow.control({version:1,visible:true});assert.equal(sent.length,0);
+});
+test('connections have independent credits; normal scrolling images are unchanged',()=>{
+ const one=[],two=[],a=new KittyFrameFlow(g=>one.push(g)),b=new KittyFrameFlow(g=>two.push(g));
+ a.control({version:1,visible:false});b.control({version:1,visible:true});
+ a.graphic(graphic(1));b.graphic(graphic(1));assert.equal(one.length,0);assert.equal(two.length,1);
+ const scroll=graphic(2);delete scroll.control.C;assert.equal(a.graphic(scroll),false);
+ // A later ordinary placement replaces the same deferred position immediately.
+ assert.equal(a.pending.size,0);a.graphic(graphic(3));
+ a.output(Buffer.from('ordinary text').toString('base64'));assert.equal(a.pending.size,1);
+});
+
+test('browser negotiates only on advertisement and acknowledges after animation opportunity',async()=>{
+ const fs=require('node:fs'),vm=require('node:vm'),source=fs.readFileSync(require('node:path').join(__dirname,'../static/js/kitty.js'),'utf8');
+ const start=source.indexOf('  // Only a server advertising'),end=source.indexOf('  function deleteImages');
+ const helpers=source.slice(start,source.indexOf('  function handleKittyMessage',start));
+ const frames=[],events={},sent=[],socket={readyState:1,send:m=>sent.push(JSON.parse(m.slice(1)))};
+ const document={hidden:true,addEventListener:(k,fn)=>events[k]=fn};
+ const api=vm.runInNewContext(`(()=>{${helpers};return {inspectFrameCapability,acknowledgeFrame}})()`,{document,state:{socket},requestAnimationFrame:fn=>frames.push(fn)});
+ api.inspectFrameCapability(socket,'a{"role":"viewer"}');assert.equal(sent.length,0);
+ api.inspectFrameCapability(socket,'a{"kittyFrameFlow":1}');assert.equal(sent[0].visible,false);
+ api.acknowledgeFrame(socket,1);assert.equal(sent.length,1); // suspended rAF
+ document.hidden=false;events.visibilitychange();assert.equal(sent[1].visible,true);
+ frames.shift()();assert.equal(sent[2].ack,1);
+ socket.readyState=3;api.acknowledgeFrame(socket,2);frames.shift()();assert.equal(sent.length,3);
+});

package/initramfs/buninu/apps/jsgotty/tests/manual/fps-collector.mjs

@@ -0,0 +1,18 @@
+// bun tests/manual/fps-collector.mjs [log.jsonl]
+import {appendFileSync} from 'node:fs';
+import {resolve} from 'node:path';
+const log=resolve(process.argv[2]||'jsgotty-fps.jsonl'),token=crypto.randomUUID();
+const source=await Bun.file(new URL('./fps-debug.js',import.meta.url)).text();
+let rows=0;
+const headers={'Access-Control-Allow-Origin':'*','Access-Control-Allow-Methods':'POST, OPTIONS','Access-Control-Allow-Headers':'Content-Type','Access-Control-Allow-Private-Network':'true','Cache-Control':'no-store'};
+const server=Bun.serve({hostname:'127.0.0.1',port:0,maxRequestBodySize:262144,async fetch(req){
+ if(new URL(req.url).pathname!=='/'+token)return new Response('',{status:404});
+ if(req.method==='OPTIONS')return new Response(null,{status:204,headers});
+ if(req.method!=='POST')return new Response('',{status:405,headers});
+ if(rows>=1200)return new Response('',{status:429,headers});
+ try{const row=await req.json();appendFileSync(log,JSON.stringify({receivedAt:Date.now(),...row})+'\n',{mode:0o600});rows++;return new Response(null,{status:204,headers});}
+ catch{return new Response('',{status:400,headers});}
+}});
+const endpoint=`http://127.0.0.1:${server.port}/${token}`;
+const script=log+'.inject.js';await Bun.write(script,source+'\nwindow.startGottyFpsDebug({endpoint:'+JSON.stringify(endpoint)+'});\n');
+console.log(JSON.stringify({endpoint,log,script,pid:process.pid}));

package/initramfs/buninu/apps/jsgotty/tests/manual/fps-debug.js

@@ -0,0 +1,31 @@
+// Eval manually; counts completed Kitty <img> loads, not physical display flips.
+window.startGottyFpsDebug = ({endpoint, duration=600000}={}) => {
+  window.stopGottyFpsDebug?.(); window.stopKittyFPS?.();
+  const box=document.createElement('div');
+  box.style.cssText='position:fixed;top:0;right:0;z-index:2147483647;background:#000b;color:cyan;padding:4px 8px;font:16px monospace;pointer-events:none';
+  box.textContent='Kitty: 0 FPS';document.body.append(box);
+  const session=Date.now().toString(36),ids=new WeakMap();let id=0,previous=0,started=performance.now(),last=started,frames=[],busy=false,dropped=0,sequence=0,stopped=false;
+  const records=[];window.__gottyFpsRecords=records;
+  const load=e=>{const el=e.target;if(!el.matches?.('img.kitty-image__content'))return;
+    const now=performance.now();if(!ids.has(el))ids.set(el,++id);
+    if(frames.length<2000)frames.push({t:now,id:ids.get(el),gap:previous?now-previous:null,w:el.naturalWidth,h:el.naturalHeight});else dropped++;
+    previous=now;
+  };
+  document.addEventListener('load',load,true);
+  const flush=()=>{
+    const now=performance.now(),batch=frames;frames=[];
+    const gaps=batch.map(f=>f.gap).filter(g=>g!==null).sort((a,b)=>a-b);
+    const row={session,sequence:sequence++,time:Date.now(),timeOrigin:performance.timeOrigin,elapsed:now-last,fps:batch.length*1000/(now-last),hidden:document.hidden,frames:batch,dropped,
+      p95:gaps[Math.floor(gaps.length*.95)]??null,p99:gaps[Math.floor(gaps.length*.99)]??null,max:gaps.at(-1)??null};last=now;
+    box.textContent=`Kitty: ${row.fps.toFixed(1)} FPS`;
+    records.push(row);if(records.length>600)records.shift();window.__gottyFpsLatest=row;
+    if(endpoint&&!busy){busy=true;fetch(endpoint,{method:'POST',headers:{'Content-Type':'text/plain'},body:JSON.stringify(row),signal:AbortSignal.timeout(5000)})
+      .then(r=>{if(!r.ok)throw Error('HTTP '+r.status);window.__gottyFpsDeliveryError=null;})
+      .catch(e=>{window.__gottyFpsDeliveryError=String(e);dropped+=batch.length;}).finally(()=>{busy=false;});}
+    else if(endpoint)dropped+=batch.length;
+  };
+  const timer=setInterval(flush,1000);
+  const expiry=setTimeout(()=>window.stopGottyFpsDebug?.(),Math.max(1000,Math.min(duration,600000)));
+  window.stopGottyFpsDebug=()=>{if(stopped)return;stopped=true;document.removeEventListener('load',load,true);clearInterval(timer);clearTimeout(expiry);box.remove();};
+  return 'Kitty FPS enabled (image loads; auto-stop in at most 10 minutes)';
+};

package/initramfs/buninu/apps/jsgotty/tests/manual/js-eval-show-fps.js

@@ -0,0 +1,35 @@
+(() => {
+    window.stopKittyFPS?.();
+
+    const box = document.createElement("div");
+    box.style.cssText =
+      "position:fixed;top:0;right:0;z-index:2147483647;" +
+      "background:#000b;color:cyan;padding:4px 8px;" +
+      "font:16px monospace;pointer-events:none";
+    box.textContent = "Kitty: 0 FPS";
+    document.body.append(box);
+
+    let count = 0, last = performance.now();
+    const loaded = e => {
+      if (e.target.matches?.("img.kitty-image__content"))
+  count++;
+    };
+    document.addEventListener("load", loaded, true);
+
+    const timer = setInterval(() => {
+      const now = performance.now();
+      box.textContent =
+        `Kitty: ${(count * 1000 / (now - last)).toFixed(1)}
+  FPS`;
+      count = 0;
+      last = now;
+    }, 1000);
+
+    window.stopKittyFPS = () => {
+      clearInterval(timer);
+      document.removeEventListener("load", loaded, true);
+      box.remove();
+      delete window.stopKittyFPS;
+    };
+    return "Kitty FPS enabled";
+  })()

package/initramfs/buninu/apps/jsgotty/tests/manual/kitty-background-debug.js

@@ -0,0 +1,24 @@
+// Eval manually. Counts delivery, bitmap decoding, image loads and animation ticks.
+// Observational only: no frame dropping, focus changes or socket reconnects.
+window.startKittyBackgroundDebug = (endpoint) => {
+  window.stopKittyBackgroundDebug?.();
+  const parse=JSON.parse,bitmap=window.createImageBitmap,history=[];
+  let received=0,bytes=0,decoded=0,loads=0,ticks=0,pending=0,maxPending=0,decodeMs=0,last=performance.now(),busy=false,stopped=false,raf;
+  const wrappedParse=function(...args){const v=parse.apply(this,args);if(v?.kind==='placement'&&v.image){received++;bytes+=v.image.data?.length||0;}return v;};
+  const wrappedBitmap=async function(...args){const start=performance.now();pending++;maxPending=Math.max(maxPending,pending);try{return await bitmap.apply(this,args)}finally{pending--;decoded++;decodeMs+=performance.now()-start;}};
+  JSON.parse=wrappedParse;if(bitmap)window.createImageBitmap=wrappedBitmap;
+  const load=e=>{if(e.target.matches?.('img.kitty-image__content'))loads++;};
+  document.addEventListener('load',load,true);
+  const tick=()=>{ticks++;if(!stopped)raf=requestAnimationFrame(tick)};raf=requestAnimationFrame(tick);
+  function flush(reason='interval'){
+    const now=performance.now(),row={kind:'background-profile',time:Date.now(),elapsed:now-last,reason,hidden:document.hidden,received,bytes,decoded,loads,ticks,pending,maxPending,decodeMs};
+    last=now;received=bytes=decoded=loads=ticks=decodeMs=0;maxPending=pending;
+    history.push(row);if(history.length>600)history.shift();window.__kittyBackgroundLatest=row;
+    if(endpoint&&!busy){busy=true;fetch(endpoint,{method:'POST',headers:{'Content-Type':'text/plain'},body:JSON.stringify(row),signal:AbortSignal.timeout(5000)}).catch(()=>{}).finally(()=>busy=false);}
+  }
+  const visibility=()=>flush('visibilitychange');document.addEventListener('visibilitychange',visibility);
+  const timer=setInterval(flush,1000),expiry=setTimeout(()=>window.stopKittyBackgroundDebug(),600000);
+  window.__kittyBackgroundHistory=history;
+  window.stopKittyBackgroundDebug=()=>{stopped=true;if(JSON.parse===wrappedParse)JSON.parse=parse;if(window.createImageBitmap===wrappedBitmap)window.createImageBitmap=bitmap;document.removeEventListener('load',load,true);document.removeEventListener('visibilitychange',visibility);cancelAnimationFrame(raf);clearInterval(timer);clearTimeout(expiry);};
+  return 'background diagnostic enabled';
+};

package/initramfs/buninu/package.json

@@ -1,6 +1,6 @@
 {
   "name": "buninu",
-  "version": "0.7.0",
+  "version": "0.7.1",
   "description": "Buninu is a portable, self-bootstrapping Unix-like userspace built on Bun that runs across operating systems",
   "type": "module",
   "main": "./bin/init.js",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "buninu-linux",
-  "version": "0.17.60",
+  "version": "0.18.62",
   "description": "A Linux distribution running Bun as PID 1 with the Buninu userspace.",
   "type": "module",
   "main": "./index.js",

package/scripts/arch.js

@@ -16,8 +16,8 @@ export const rootDir = resolve(dirname(fileURLToPath(import.meta.url)), "..");
 
 const pins = {
   x86_64: {
-    linuxVirtSha256: "3ff658cf5aada14687238527f48526cef7a75ac8c673fc597f3a65791c86a25e",
-    linuxLtsSha256: "f205a980e1d683414f5557d26366bee1e52cf128613aa74ef371b3f11b019085",
+    linuxVirtSha256: "e121b547d9b86194a641718b52ae1c3e605085c59f31525b1649a59b3d4db0c7",
+    linuxLtsSha256: "2e03d0d13959a369764d8d24d51844634d1fd6973a523f4e49166a300c782a06",
     muslSha256: "573712e2f49c15bfc20a2699f204acdfc74c772722b15e7353d768057fae0e71",
     stubSha256: "8e64a5a3afee5f930e6e6716be726dc6d405530ac7f8fa5be6251dae68671ec9",
     libstdcppSha256: "14c987b556f5385a5db18376e788c75f37d85321b8dc1920d926ea7daac1d6f6",
@@ -32,8 +32,8 @@ const pins = {
     serialMajor: 4,
   },
   aarch64: {
-    linuxVirtSha256: "b931f14a93634469cc8930afe5d6837361325456b620b94e970bb981d841c99c",
-    linuxLtsSha256: "4d398f1d401597da5e92fa7c3c1af93c4a9988b3747222c0173bfe3ff4cfe4a2",
+    linuxVirtSha256: "3a9a0f16adaabee0e4e05e373682249e2a99ab000faebf6aaaf682ae575c661d",
+    linuxLtsSha256: "29d6cbf6f432667d5d17080037b3cfd4d28d71c3b0ecb4ad7e53438abf9f24e7",
     muslSha256: "5e9674b7f41152fe2119093b5cb4c13eaaadb19c2d5422b2d7267913e663ee6e",
     stubSha256: "a1823d2d7082db555d528f82c1809f276c818aeb5b40f198f4565f104e055c38",
     libstdcppSha256: "2302e766d4e4926038ec166ecb85837ee884576115236ddb565e3a5fca4a11d7",
@@ -68,7 +68,7 @@ export const config = ({
   // The Alpine repository keeps only the newest build of a package, so a pin
   // stops downloading when Alpine bumps it; the hashes then fail loudly.
   const alpineBase = `${mirror}/v3.24/main/${arch}`;
-  const kernelVersion = "6.18.60";
+  const kernelVersion = "6.18.62";
   const kernelRelease = `${kernelVersion}-0-${flavor}`;
   const bunVersion = "1.4.2";
   const downloadsDir = join(rootDir, "downloads", arch);

package/scripts/arch.sh

@@ -44,7 +44,7 @@ fi
 alpine_mirror=${ALPINE_MIRROR:-https://dl-cdn.alpinelinux.org/alpine}
 alpine_base="$alpine_mirror/v3.24/main/$arch"
 
-kernel_version=6.18.60
+kernel_version=6.18.62
 kernel_release="$kernel_version-0-$linux_flavor"
 linux_package="linux-$linux_flavor-$kernel_version-r0.apk"
 musl_package=musl-1.2.6-r2.apk
@@ -63,8 +63,8 @@ musl_libc="libc.musl-$arch.so.1"
 
 case $arch in
     x86_64)
-        linux_virt_sha256=3ff658cf5aada14687238527f48526cef7a75ac8c673fc597f3a65791c86a25e
-        linux_lts_sha256=f205a980e1d683414f5557d26366bee1e52cf128613aa74ef371b3f11b019085
+        linux_virt_sha256=e121b547d9b86194a641718b52ae1c3e605085c59f31525b1649a59b3d4db0c7
+        linux_lts_sha256=2e03d0d13959a369764d8d24d51844634d1fd6973a523f4e49166a300c782a06
         musl_sha256=573712e2f49c15bfc20a2699f204acdfc74c772722b15e7353d768057fae0e71
         stub_sha256=8e64a5a3afee5f930e6e6716be726dc6d405530ac7f8fa5be6251dae68671ec9
         libstdcpp_sha256=14c987b556f5385a5db18376e788c75f37d85321b8dc1920d926ea7daac1d6f6
@@ -82,8 +82,8 @@ case $arch in
         serial_major=4
         ;;
     aarch64)
-        linux_virt_sha256=b931f14a93634469cc8930afe5d6837361325456b620b94e970bb981d841c99c
-        linux_lts_sha256=4d398f1d401597da5e92fa7c3c1af93c4a9988b3747222c0173bfe3ff4cfe4a2
+        linux_virt_sha256=3a9a0f16adaabee0e4e05e373682249e2a99ab000faebf6aaaf682ae575c661d
+        linux_lts_sha256=29d6cbf6f432667d5d17080037b3cfd4d28d71c3b0ecb4ad7e53438abf9f24e7
         musl_sha256=5e9674b7f41152fe2119093b5cb4c13eaaadb19c2d5422b2d7267913e663ee6e
         stub_sha256=a1823d2d7082db555d528f82c1809f276c818aeb5b40f198f4565f104e055c38
         libstdcpp_sha256=2302e766d4e4926038ec166ecb85837ee884576115236ddb565e3a5fca4a11d7

package/scripts/fetch.js

@@ -76,34 +76,69 @@ export const readTar = (path) => {
   const links = new Map();
   let longName = null;
   let longLink = null;
-  for (let offset = 0; offset + 512 <= data.length;) {
+  let extended = {}, global = {};
+  const invalid = (reason) => { throw new Error(`${path}: ${reason}`); };
+  const number = (header, start, length) => {
+    if (header[start] & 0x80) {
+      let value = BigInt(header[start] & 0x7f);
+      for (let i = start + 1; i < start + length; i++) value = value * 256n + BigInt(header[i]);
+      if (value > BigInt(Number.MAX_SAFE_INTEGER)) invalid("unsafe tar numeric field");
+      return Number(value);
+    }
+    const digits = header.toString("ascii", start, start + length).replace(/\0.*$/s, "").trim();
+    if (digits && !/^[0-7]+$/.test(digits)) invalid("invalid tar numeric field");
+    return digits ? Number.parseInt(digits, 8) : 0;
+  };
+  let offset = 0;
+  for (; offset + 512 <= data.length;) {
     const header = data.subarray(offset, offset + 512);
-    if (header.every((byte) => byte === 0)) { offset += 512; continue; }
+    if (header.every((byte) => byte === 0)) {
+      offset += 512; longName = longLink = null; extended = {}; global = {}; continue;
+    }
+    let checksum = 0;
+    for (let i = 0; i < 512; i++) checksum += i >= 148 && i < 156 ? 32 : header[i];
+    if (checksum !== number(header, 148, 8)) invalid("invalid tar header checksum");
     const field = (start, length) => header.toString("utf8", start, start + length).replace(/\0.*$/s, "");
-    const size = Number.parseInt(field(124, 12).trim() || "0", 8);
     const type = String.fromCharCode(header[156] || 0x30);
+    const metadata = ["x", "X", "g", "L", "K"].includes(type);
+    const attrs = { ...global, ...extended };
+    if (!metadata && attrs.size !== undefined && !/^[0-9]+$/.test(attrs.size)) invalid("invalid pax size");
+    const size = !metadata && attrs.size !== undefined ? Number(attrs.size) : number(header, 124, 12);
+    const padded = Math.ceil(size / 512) * 512;
+    if (!Number.isSafeInteger(size) || size < 0 || !Number.isSafeInteger(padded)
+        || padded > data.length - offset - 512) invalid("invalid or truncated tar member size");
     const body = data.subarray(offset + 512, offset + 512 + size);
-    offset += 512 + Math.ceil(size / 512) * 512;
-    if (type === "x") {
-      // pax records: "LENGTH key=value\n"
-      for (const record of body.toString("utf8").split("\n")) {
-        const match = /^\d+ path=(.*)$/.exec(record);
-        if (match) longName = match[1];
-        const link = /^\d+ linkpath=(.*)$/.exec(record);
-        if (link) longLink = link[1];
+    offset += 512 + padded;
+    if (type === "x" || type === "X" || type === "g") {
+      // PAX lengths count bytes, not UTF-16 characters. Reject malformed records.
+      const attrs = type === "g" ? global : extended;
+      for (let at = 0; at < body.length;) {
+        const space = body.indexOf(32, at);
+        if (space < 0) invalid("invalid pax record length");
+        const digits = body.toString("ascii", at, space);
+        const length = /^[0-9]+$/.test(digits) ? Number(digits) : NaN;
+        if (!Number.isSafeInteger(length) || length <= space - at + 1
+            || length > body.length - at || body[at + length - 1] !== 10) invalid("invalid pax record length");
+        const record = body.toString("utf8", space + 1, at + length - 1);
+        const equals = record.indexOf("=");
+        if (equals > 0) Object.defineProperty(attrs, record.slice(0, equals), {
+          value: record.slice(equals + 1), writable: true, enumerable: true, configurable: true,
+        });
+        at += length;
       }
       continue;
     }
     if (type === "L") { longName = body.toString("utf8").replace(/\0.*$/s, ""); continue; }
     if (type === "K") { longLink = body.toString("utf8").replace(/\0.*$/s, ""); continue; }
-    if (type === "g") continue;
-    const prefix = field(345, 155);
-    const name = longName ?? (prefix ? `${prefix}/${field(0, 100)}` : field(0, 100));
+    const prefix = field(257, 5) === "ustar" ? field(345, 155) : "";
+    const name = attrs.path ?? longName ?? (prefix ? `${prefix}/${field(0, 100)}` : field(0, 100));
     longName = null;
     if (type === "0" || type === "\0") files.set(name.replace(/^\.\//, ""), body);
-    if (type === "1" || type === "2") links.set(name.replace(/^\.\//, ""), { target: longLink ?? field(157, 100), hard: type === "1" });
+    if (type === "1" || type === "2") links.set(name.replace(/^\.\//, ""), { target: attrs.linkpath ?? longLink ?? field(157, 100), hard: type === "1" });
     longLink = null;
+    extended = {};
   }
+  if (offset !== data.length) invalid("truncated tar header");
   return {
     // Enumerate regular files without exposing the Map's mutation methods.
     entries() { return files.entries(); },

package/scripts/npm-packages.md

@@ -1,20 +1,20 @@
 # npm packages
-# Latest versions checked on 2026-10-11; SHA-256 pins verified against registry SHA-512 integrity.
-# buninu-browser 0.9.0, buninu-land 0.4.0, and casty 1.6.1 verified on 2026-11-02.
+# SHA-256 pins verified against registry SHA-512 integrity.
+# buninu-browser 0.9.2, buninu-land 0.4.1, and casty 1.6.2 verified on 2026-11-03.
 # jspulse 0.2.3 verified on 2026-10-22.
 # jspinyin 0.2.0 verified on 2026-10-22.
 
-"buninu-browser@0.9.0":
-  - https://registry.npmjs.org/buninu-browser/-/buninu-browser-0.9.0.tgz
-  - sha256:18702e6211db9a5aeb1584f924a040ce6c7d77778b730c0374a659ddf1cdfb20
+"buninu-browser@0.9.2":
+  - https://registry.npmjs.org/buninu-browser/-/buninu-browser-0.9.2.tgz
+  - sha256:faba0d55272882da02cc5993047d831dae11845137b53b7f5c7642e99567391a
 
-"buninu-land@0.4.0":
-  - https://registry.npmjs.org/buninu-land/-/buninu-land-0.4.0.tgz
-  - sha256:92c5177058fb52a9961fea8196937fdb4c75ef0d472f2c0d0d07fab03ea42116
+"buninu-land@0.4.1":
+  - https://registry.npmjs.org/buninu-land/-/buninu-land-0.4.1.tgz
+  - sha256:18281a77725cdce53cd26aa447c657c530616e0f0bcb44819352d3420023a34a
 
-"@drxiaozhi/casty@1.6.1":
-  - https://registry.npmjs.org/@drxiaozhi/casty/-/casty-1.6.1.tgz
-  - sha256:d7ce0fd5fd478340ac32cbd164bd008b97e0a0fe75a3366921da0aa2c55d46bc
+"@drxiaozhi/casty@1.6.2":
+  - https://registry.npmjs.org/@drxiaozhi/casty/-/casty-1.6.2.tgz
+  - sha256:8aa8e59998aa82ef0e28ca172828eba116e0f19d890490fc19d7ca4dd295a77c
 
 "@drxiaozhi/jspulse@0.2.3":
   - https://registry.npmjs.org/@drxiaozhi/jspulse/-/jspulse-0.2.3.tgz