pi-cursor-sdk 0.4.0 → 0.5.2

package/docs/platform-smoke.md

@@ -1,6 +1,6 @@
-# Platform Smoke Gate
+# Platform Smoke
 
-Status: current local-runtime release gate for Cursor provider/runtime changes. Cloud-runtime changes also require the separate paid `npm run smoke:cloud` gate. The Crabbox runner, packed-install platform-build suite, and real live PTY/ConPTY suite runner are implemented for macOS, Ubuntu, and Windows native targets with one-lease-per-target orchestration.
+Status: optional comprehensive local-runtime matrix plus focused changed-behavior checks. Offline/faux verification and exact-input retained-evidence reuse come first. Paid checks are only the smallest meaningful proof needed for changed behavior on one representative environment; docs/metadata-only changes need none. No full paid campaign replay, matrix-only host coverage, or automatic paid retries. No paid Cloud testing for generic PRs/releases; only PRs/issues explicitly focused on Cursor Cloud may select a necessary focused Cloud check. Automated Cursor PR reviews continue unchanged. The Crabbox runner, packed-install platform-build suite, and real live PTY/ConPTY suite runner are implemented for macOS, Ubuntu, and Windows native targets with one-lease-per-target orchestration.
 
 Detailed detector, registry, command-rendering, implementation-history, replacement, and portability reference: [Platform Smoke Implementation Reference](./platform-smoke-implementation.md).
 
@@ -12,48 +12,47 @@ Crabbox best-practice baseline applied from `~/Projects/crabbox`: Crabbox owns l
 
 ## Decision
 
-Crabbox is the required local platform smoke runner for `pi-cursor-sdk` releases that touch Cursor provider/runtime behavior. PRs that touch actual cloud runtime execution must also run `npm run smoke:cloud`.
+Keep offline cross-platform CI, build/type/package checks, and native/faux contracts. Reuse retained proof when its tested inputs are unchanged. If changed behavior needs new real-service proof, choose the smallest existing check and one representative environment. Source-file touch alone does not require a live run.
 
-Inner-loop checks remain useful, but they are not release gates:
+Offline checks:
 
 ```bash
 npm run verify
 npm pack --dry-run
 ```
 
-The required local release gate is exactly:
+Example focused live selection for changed restart behavior (choose the relevant suite/target, not this example by default):
 
 ```bash
-npm run smoke:platform:all
+node scripts/platform-smoke.mjs run --target macos --suite cursor-local-resume-restart
 ```
 
-Cloud-runtime changes additionally require:
+Optional comprehensive coverage, not an unconditional commit/release gate:
 
 ```bash
-npm run smoke:cloud
+npm run smoke:platform:all
 ```
 
-`smoke:platform:all` runs `smoke:platform:doctor` first and only starts the target matrix after doctor passes. Maintainers may still run `npm run smoke:platform:doctor` by itself for setup diagnosis.
-
+That command runs doctor first, then all configured targets/suites. The CLI can run one existing suite on one target without running the full matrix. Doctor itself makes no Cursor calls but checks the comprehensive setup; it is not proof of a provider turn. Per-target commands without `--suite` run every configured suite on that target, so prefer explicit suite selection.
 
-Per-target commands exist for diagnosis and iteration. They are not additional release-gate commands because requiring each per-target command plus `all` doubles Cursor token use.
+Only a PR/issue explicitly focused on Cursor Cloud permits necessary paid Cloud testing; generic PRs/releases and incidental Cloud changes do not. Even for Cloud-focused work, `npm run smoke:cloud` is an optional multi-lane matrix, not mandatory. Select coverage only when its live proof is needed, retaining the selected check's full assertions and cleanup contract.
 
-No partial adoption exists. The release evidence must include macOS, Ubuntu, and Windows native passing through `smoke:platform:all`.
+Do not repeat successful unchanged lanes or automatically retry paid failures. Preserve raw failed evidence, diagnose offline, and choose another call only when necessary. Report selected scope honestly; optional unrun hosts/lanes do not block landing, and focused evidence is not full-matrix proof.
 
 ## Non-negotiable constraints
 
 - No GitHub Actions dependency.
-- No cloud provider dependency in the default local platform gate; cloud-runtime changes use the separate paid cloud gate.
+- No paid Cloud testing for generic PRs/releases. Explicitly Cursor Cloud-focused PRs/issues are the only testing exception; keep Cloud checks separate from local checks.
 - No Crabbox broker/coordinator dependency.
-- No release gate that runs on only one operating system.
-- No release gate that proves command behavior but not TUI visual behavior.
-- No platform release gate based on `pi -e .`.
-- No skipped target because setup is missing; missing setup is a doctor failure.
+- Keep offline cross-platform coverage; do not require a paid host matrix merely for matrix coverage.
+- Visual claims require rendered evidence, not command success alone.
+- Packed-install claims require packed-install evidence; direct `pi -e .` proof has a narrower scope.
+- Missing setup fails a selected check; optional unselected targets are not failed release prerequisites.
 - No one-prompt-per-card visual matrix.
 - No `tmux` as the canonical visual test contract.
 - No target passes from stdout alone when JSONL or visual proof is required.
 - No target loses artifacts on failure.
-- No hidden optional evidence. Every required artifact is produced or the suite fails.
+- Every selected suite retains its required artifacts and assertions or fails. Do not weaken a check to reduce cost.
 
 ## Required Crabbox baseline
 
@@ -67,7 +66,7 @@ version: 0.26.0 or newer
 binary: Homebrew `crabbox` on PATH (`/opt/homebrew/bin/crabbox` on Apple Silicon Homebrew installs)
 ```
 
-Use the Homebrew Crabbox binary on PATH for normal release gates. `PLATFORM_SMOKE_CRABBOX=/path/to/crabbox` is only an explicit override for testing a non-default binary. `smoke:platform:doctor` verifies the configured binary and fails when it is older than the configured minimum version.
+Use the Homebrew Crabbox binary on PATH for selected platform checks. `PLATFORM_SMOKE_CRABBOX=/path/to/crabbox` is only an explicit override for testing a non-default binary. `smoke:platform:doctor` verifies the configured binary and fails when it is older than the configured minimum version.
 
 Required Crabbox providers:
 
@@ -106,7 +105,7 @@ Rendering is host-side. Targets capture the real ANSI stream; the macOS host ren
 
 ## Target session model
 
-Each target opens one Crabbox target session, syncs once, runs all suites for that target under one coherent target run id, collects artifacts, and stops/releases the target. The release-gate entrypoint runs required targets sequentially to prevent shared host, VM/container, and Cursor API contention; each target runs its own suites in order and fails fast within that target. Platform smoke disables Crabbox git-seed sync (`CRABBOX_SYNC_GIT_SEED=false`) so every run tests the current local checkout and uncommitted smoke-runner changes rather than a remote Git seed.
+Each selected target opens one Crabbox session, syncs once, runs selected suites under one coherent run id, collects artifacts, and stops/releases the target. The comprehensive entrypoint runs configured targets sequentially to prevent shared host, VM/container, and Cursor API contention; each target runs its own suites in order and fails fast within that target. Platform smoke disables Crabbox git-seed sync (`CRABBOX_SYNC_GIT_SEED=false`) so every run tests the current local checkout and uncommitted smoke-runner changes rather than a remote Git seed.
 
 ```text
 start target session
@@ -135,7 +134,7 @@ start target session
 end target session
 ```
 
-The target session fails fast. The release-gate path handles one target at a time: it warms one Crabbox lease, performs one fresh sync, runs suites in order, and stops that target after the first failure before starting the next target. Total wall time is therefore additive across required targets; this avoids nondeterministic worker loss and live-run stalls from competing VM/container load and concurrent Cursor API calls. Per-suite commands remain available for diagnosis, but they are intentionally not the normal release path because repeated warmup/sync/install cycles make releases too slow.
+The target session fails fast. The comprehensive path handles one target at a time: it warms one lease, syncs once, runs suites in order, and stops the target after its first failure before starting the next. This avoids competing VM/container load and Cursor calls. Routine verification should instead select the smallest meaningful changed-behavior suite on one representative target; do not replay the full campaign or duplicate a focused run with the full matrix.
 
 Runtime budget is part of the contract:
 
@@ -146,7 +145,7 @@ Runtime budget is part of the contract:
 - Visual coverage is batched into one native prompt, one focused HTTP/1.1 transport prompt, one bridge prompt, and one abort/cleanup prompt per target. Do not split the card matrices into one prompt per card.
 - The gate is fail-fast by target to avoid burning Cursor calls after a platform has already failed.
 
-## Required targets
+## Comprehensive matrix targets
 
 | Target | Crabbox provider | Execution contract | TUI visual contract |
 | --- | --- | --- | --- |
@@ -156,15 +155,15 @@ Runtime budget is part of the contract:
 
 Ubuntu is covered as its own local-container target, and Windows native remains a full visual TUI target.
 
-## Required cloud smoke gate
+## Explicit Cursor Cloud-focused testing exception
 
-Cloud validation stays separate from `smoke:platform:all`. Releases that touch actual cloud execution must run both the local platform gate and:
+No paid Cloud testing for generic PRs or releases. Only a PR or issue explicitly focused on Cursor Cloud may select necessary paid Cloud proof, after offline/faux checks and retained-evidence reuse. Incidental Cloud code changes do not qualify. The no-flag multi-lane command remains callable but is not mandatory even for Cloud-focused work:
 
 ```bash
 npm run smoke:cloud
 ```
 
-The no-flag command is the required `cursor/grok-4.6` matrix. It uses current `gh` CLI authentication to create one private throwaway GitHub repository, seeds clean `main`, `starting-ref`, and `direct-push` branches, and runs persisted-session named lanes for:
+This optional `cursor/grok-4.6` matrix retains its complete run/evidence and cleanup contract. It uses current `gh` CLI authentication to create one private throwaway GitHub repository, seeds clean `main`, `starting-ref`, and `direct-push` branches, and runs persisted-session named lanes for:
 
 - cancellation, with exact agent/run IDs captured before abort, retained `runIdSource` (`metadata` or installed-SDK `Agent.listRuns()` recovery), and terminal `cancelled` independently read through the SDK;
 - explicit HTTPS repository plus `startingRef`, requiring a distinct pushed cloud branch with remote-content and starting-ref-ancestry proof, recording whether the SDK returned branch metadata, and validating any returned PR URL through GitHub;
@@ -179,13 +178,13 @@ Every path harvests exact IDs from provider metadata and canonical lifecycle ses
 
 Before removing successful raw artifacts, the gate atomically replaces `docs/evidence/cursor-cloud-smoke-matrix-latest.json` with a known-shape summary containing timestamp, model, lane observations, exact agent/run IDs, agent cleanup proof, repository cleanup proof, and retained evidence provenance. Provenance records the extension package version, installed `@cursor/sdk` version, git source revision, and a deterministic `packageSourceSha256` over the full published package surface from `package.json` `files` plus `package.json` itself (relative path + bytes; directories expanded; symlinks/non-regular paths rejected). Generated `docs/evidence/*` is outside that published surface and is not hashed. Because successful pre-commit checkouts may be uncommitted, the package-source hash is authoritative for code identity and the revision is baseline identity only. The summary is a runtime-validated known shape (explicit six-lane allowlist, complete lane-agent cleanup coverage, repository proof, provenance) that round-trips through the persisted-evidence validator with no prompts or raw output, and must pass canonical secret scrubbing plus forbidden-field scanning; a run or cleanup failure observed before the atomic rename commit point never overwrites the last successful summary. A signal first dispatched after that point can fail the process while retaining the newly committed completed-cleanup summary, as defined above. Offline release-gate resource coordination (run → harvest IDs → cleanup agents → cleanup repo → evidence only on complete success) lives in `coordinateCloudSmokeReleaseGate()` inside `scripts/lib/cloud-smoke-cleanup-evidence.mjs`. GitHub throwaway fixture ownership lives in `scripts/lib/cloud-smoke-github.mjs`, signal-safe child shutdown lives in `scripts/lib/cloud-smoke-shutdown.mjs`, and `scripts/cloud-runtime-smoke.mjs` keeps concrete lane logic.
 
-`npm run smoke:cloud:context` (`--context-matrix`) remains optional, separate proof for fresh-versus-bootstrap context handoff. `fresh` must answer `NO_MARKER`; `bootstrap` must recall the marker. Its agents receive the same archive, delete, `Agent.get` not-found/404, and archived-inclusive list-exclusion verification, but it does not create a GitHub repository or replace the required-matrix evidence summary.
+Only within the explicitly Cursor Cloud-focused exception, `npm run smoke:cloud:context` (`--context-matrix`) remains optional, separate proof for fresh-versus-bootstrap context handoff. `fresh` must answer `NO_MARKER`; `bootstrap` must recall the marker. Its agents receive the same archive, delete, `Agent.get` not-found/404, and archived-inclusive list-exclusion verification, but it does not create a GitHub repository or replace the required-matrix evidence summary.
 
-This cloud gate does not replace the local macOS/Ubuntu/Windows `smoke:platform:all` gate.
+Cloud product capabilities and offline contracts remain supported. Neither this Cloud matrix nor the comprehensive local matrix is an unconditional ship requirement.
 
 ## Focused local resume smoke
 
-The platform matrix includes the required local-resume lanes: restart, safety, tool-surface, abort, tree, copy/switch, fallback, compaction, default/opt-out proof, and recorded-ID-only cleanup. Platform lanes run those scripts against the target's shared packed package path, then copy each lane's session JSONL, Cursor SDK debug metadata, runtime-launch record, and other bounded smoke artifacts into its canonical platform suite directory. The same scripts still load the source checkout by default when run directly as focused host-local inner-loop checks. Windows uses the intentionally short target-side evidence component `lr` so the Cursor SDK's derived SQLite path remains below legacy `MAX_PATH`; every suite removes and verifies that directory before use, failing closed on stale or locked evidence.
+The optional comprehensive platform matrix includes these local-resume lanes: restart, safety, tool-surface, abort, tree, copy/switch, fallback, compaction, default/opt-out proof, and recorded-ID-only cleanup. Platform lanes run those scripts against the target's shared packed package path, then copy each lane's session JSONL, Cursor SDK debug metadata, runtime-launch record, and other bounded smoke artifacts into its canonical platform suite directory. The same scripts still load the source checkout by default when run directly as focused host-local inner-loop checks. Windows uses the intentionally short target-side evidence component `lr` so the Cursor SDK's derived SQLite path remains below legacy `MAX_PATH`; every suite removes and verifies that directory before use, failing closed on stale or locked evidence.
 
 The smoke starts one sessionful local Cursor run with local resume enabled by default, records the SDK agent id from provider debug metadata, restarts pi against the same session, asks for the remembered marker, and verifies:
 
@@ -319,7 +318,7 @@ export default {
 };
 ```
 
-`ubuntuContainerBaseImage` is `cimg/node:24.21`, the Ubuntu 24.04 Node 24 base with the current glibc baseline for native test dependencies. The runner builds the local `ubuntuContainerImage` wrapper with only `USER root` changed before warmup because Crabbox 0.36.0 must install SSH/Git/rsync/curl during bootstrap and `cimg/node` defaults to an unprivileged user. An explicit `PLATFORM_SMOKE_UBUNTU_IMAGE` bypasses that build and must already support Crabbox bootstrap. Package 0.4.0 requires Node 24+, and this gate validates Node 24 on macOS, Ubuntu, and Windows.
+`ubuntuContainerBaseImage` is `cimg/node:24.21`, the Ubuntu 24.04 Node 24 base with the current glibc baseline for native test dependencies. The runner builds the local `ubuntuContainerImage` wrapper with only `USER root` changed before warmup because Crabbox 0.36.0 must install SSH/Git/rsync/curl during bootstrap and `cimg/node` defaults to an unprivileged user. An explicit `PLATFORM_SMOKE_UBUNTU_IMAGE` bypasses that build and must already support Crabbox bootstrap. The package requires Node 24+, and this gate validates Node 24 on macOS, Ubuntu, and Windows.
 
 `windowsParallels` records this repo's default shared Windows template contract. Environment overrides may point at a temporary candidate template during infrastructure work, but release runs should use the shared `pi-extension-windows-template` / `crabbox-ready` baseline unless this document is updated.
 
@@ -524,7 +523,7 @@ Cursor calls: `2`.
 
 Purpose:
 
-- prove guarded local resume default-on behavior across a pi process restart on each required OS;
+- prove guarded local resume default-on behavior across a pi process restart on each selected OS;
 - assert the first turn creates a local `agent-*` and the second turn resumes the same `agent-*`;
 - force local runtime and clear cloud env knobs so ambient cloud settings cannot satisfy this suite.
 
@@ -637,9 +636,9 @@ PI_CURSOR_SDK_EVENT_DEBUG=1
 
 Purpose:
 
-- prove the packed extension completes a real local provider turn through the SDK's opt-in HTTP/1.1/SSE transport on every required OS;
+- prove the packed extension completes a real local provider turn through the SDK's opt-in HTTP/1.1/SSE transport on each selected OS;
 - prove the final TUI status visibly includes `cursor:local ... http1`;
-- keep the default transport covered by the other required live suites.
+- use offline contracts or valid retained default-transport evidence rather than adding unrelated live runs.
 
 Required final marker: `HTTP1_LIVE_OK`.
 
@@ -796,9 +795,9 @@ cursor-local-resume-cleanup: 4
 
 Maximum per target: `37` Cursor invocations.
 
-Maximum full gate: `111` Cursor invocations.
+Declared maximum full matrix: `111` Cursor invocations (`37` per target across three targets). These are scenario budgets, not measured fixed billable model-call or SDK-step counts; actual service usage can differ.
 
-The merge gate is `npm run smoke:platform:all`; that script runs doctor first and then the matrix to preserve this budget. No suite adds a new Cursor invocation without updating this plan and the scenario source of truth (`scripts/platform-smoke/scenarios.mjs`, plus `scripts/platform-smoke/local-resume-suites.mjs` for local-resume lanes).
+`npm run smoke:platform:all` is optional comprehensive coverage; it runs doctor first and then the matrix within these declared budgets. Routine verification selects only necessary changed-behavior proof on one representative environment. No suite adds a new Cursor invocation without updating this plan and the scenario source of truth (`scripts/platform-smoke/scenarios.mjs`, plus `scripts/platform-smoke/local-resume-suites.mjs` for local-resume lanes).
 
 ## Artifact contract
 
@@ -982,16 +981,6 @@ Bridge diagnostics may include safe tool names and correlation IDs only.
 
 ## Release bar
 
-A local provider/runtime release is ready only after this exact command passes on the maintainer machine:
-
-```bash
-npm run smoke:platform:all
-```
-
-Cloud-runtime releases additionally require:
-
-```bash
-npm run smoke:cloud
-```
+Complete offline/faux verification and reuse valid exact-input retained proof. If changed behavior still needs real-service evidence, run the smallest meaningful existing check on one representative environment. Keep its assertions, visual proof when relevant, persisted session/debug evidence, and cleanup intact. Docs/metadata-only changes need no paid calls; optional unrun matrix lanes do not block landing.
 
-`smoke:platform:all` runs doctor first and then all required local targets and suites in one full gate execution.
+No paid Cloud testing for generic PRs/releases; only explicitly Cursor Cloud-focused PRs/issues may select necessary focused Cloud proof. The multi-lane Cloud command and `smoke:platform:all` remain optional comprehensive tools, not unconditional gates. No full paid campaign replay, matrix-only host coverage, or automatic paid retries. Automated Cursor PR reviews continue unchanged. Record exactly what passed, what retained evidence was reused, and any specific necessary proof still missing.

package/node_modules/@hono/node-server/README.md

@@ -5,20 +5,20 @@ Initially, Hono wasn't designed for Node.js, but with this adapter, you can now
 
 ## Benchmarks
 
-Hono is 4.1 times faster than Express.
+Hono is 3.1 times faster than Express.
 
-Express:
+Express v5:
 
 ```txt
 $ bombardier -d 10s --fasthttp http://localhost:3000/
 
 Statistics        Avg      Stdev        Max
-  Reqs/sec     20803.37    1713.06   24910.85
-  Latency        6.01ms     5.21ms   451.37ms
+  Reqs/sec     24380.41    1409.74   26604.88
+  Latency        5.12ms     2.95ms   305.21ms
   HTTP codes:
-    1xx - 0, 2xx - 208131, 3xx - 0, 4xx - 0, 5xx - 0
+    1xx - 0, 2xx - 243915, 3xx - 0, 4xx - 0, 5xx - 0
     others - 0
-  Throughput:     5.75MB/s
+  Throughput:     6.98MB/s
 ```
 
 Hono + `@hono/node-server`:
@@ -27,12 +27,12 @@ Hono + `@hono/node-server`:
 $ bombardier -d 10s --fasthttp http://localhost:3000/
 
 Statistics        Avg      Stdev        Max
-  Reqs/sec     85405.51    7250.65  102658.51
-  Latency        1.46ms     1.00ms   149.95ms
+  Reqs/sec     74428.96    3815.27   88228.32
+  Latency        1.68ms   621.25us   106.20ms
   HTTP codes:
-    1xx - 0, 2xx - 854120, 3xx - 0, 4xx - 0, 5xx - 0
+    1xx - 0, 2xx - 744378, 3xx - 0, 4xx - 0, 5xx - 0
     others - 0
-  Throughput:    18.49MB/s
+  Throughput:    16.82MB/s
 ```
 
 ## Requirements
@@ -226,6 +226,17 @@ Notice that `root` here is not relative to `src/index.ts`, rather to `my-hono-pr
 
 ### Options
 
+#### `allowPercentInPath`
+
+By default, `serveStatic` skips request paths that still contain `%` after routing. This prevents a second decoding step from serving a file under a different path than the one checked by route middleware. Set `allowPercentInPath: true` to keep the previous behavior when serving files whose names contain percent signs.
+
+If you restrict access to only some paths under `root` (for example, `/static/admin/*`), enabling this option may let requests bypass those restrictions. Apply access control to the same route pattern as `serveStatic` (for example, `/static/*`), before the static middleware:
+
+```ts
+app.use('/static/*', authMiddleware)
+app.use('/static/*', serveStatic({ root: './static', allowPercentInPath: true }))
+```
+
 #### `rewriteRequestPath`
 
 If you want to serve files in `./.foojs` with the request path `/__foo/*`, you can write like the following.

package/node_modules/@hono/node-server/dist/early-hints.cjs

@@ -15,7 +15,7 @@ const earlyHints = (options) => {
 		const dest = c.req.header("Sec-Fetch-Dest");
 		if (mode && mode !== "navigate" || dest && dest !== "document") return next();
 		const env = c.env || {};
-		const outgoing = (env.server ? env.server : env)?.outgoing;
+		const outgoing = ("server" in env ? env.server : env)?.outgoing;
 		if (typeof outgoing?.writeEarlyHints !== "function") {
 			if (!warned) {
 				console.warn("Early Hints Middleware is not supported because writeEarlyHints is not defined.");

package/node_modules/@hono/node-server/dist/early-hints.mjs

@@ -13,7 +13,7 @@ const earlyHints = (options) => {
 		const dest = c.req.header("Sec-Fetch-Dest");
 		if (mode && mode !== "navigate" || dest && dest !== "document") return next();
 		const env = c.env || {};
-		const outgoing = (env.server ? env.server : env)?.outgoing;
+		const outgoing = ("server" in env ? env.server : env)?.outgoing;
 		if (typeof outgoing?.writeEarlyHints !== "function") {
 			if (!warned) {
 				console.warn("Early Hints Middleware is not supported because writeEarlyHints is not defined.");

package/node_modules/@hono/node-server/dist/index.cjs

@@ -868,7 +868,10 @@ const handleResponseError = (e, outgoing) => {
 	if (err.code === "ERR_STREAM_PREMATURE_CLOSE") console.info("The user aborted a request.");
 	else {
 		console.error(e);
-		if (!outgoing.headersSent) outgoing.writeHead(500, { "Content-Type": "text/plain" });
+		if (!outgoing.headersSent) {
+			if (outgoing instanceof node_http.ServerResponse) outgoing._contentLength = null;
+			outgoing.writeHead(500, { "Content-Type": "text/plain" });
+		}
 		outgoing.end(`Error: ${err.message}`);
 		outgoing.destroy(err);
 	}
@@ -876,6 +879,21 @@ const handleResponseError = (e, outgoing) => {
 const flushHeaders = (outgoing) => {
 	if ("flushHeaders" in outgoing && outgoing.writable) outgoing.flushHeaders();
 };
+const trySetContentLength = (outgoing, status, length) => {
+	const http1 = outgoing;
+	if (http1._contentLength === null && http1._hasBody && http1.useChunkedEncodingByDefault && !http1._removedContLen && status >= 200 && status !== 204 && status !== 304 && !outgoing.hasHeader("content-length") && !outgoing.hasHeader("transfer-encoding") && !outgoing.hasHeader("trailer")) {
+		http1._contentLength = length;
+		return true;
+	}
+	return false;
+};
+const writeDefaultHeaders = (outgoing, status, length) => {
+	if (trySetContentLength(outgoing, status, length)) outgoing.writeHead(status, { "Content-Type": defaultContentType });
+	else outgoing.writeHead(status, {
+		"Content-Type": defaultContentType,
+		"Content-Length": length
+	});
+};
 const responseViaCache = async (res, outgoing) => {
 	let [status, body, header] = res[cacheKey];
 	if (!header) {
@@ -883,22 +901,13 @@ const responseViaCache = async (res, outgoing) => {
 			outgoing.writeHead(status);
 			outgoing.end();
 		} else if (typeof body === "string") {
-			outgoing.writeHead(status, {
-				"Content-Type": defaultContentType,
-				"Content-Length": Buffer.byteLength(body)
-			});
+			writeDefaultHeaders(outgoing, status, Buffer.byteLength(body));
 			outgoing.end(body);
 		} else if (body instanceof Uint8Array) {
-			outgoing.writeHead(status, {
-				"Content-Type": defaultContentType,
-				"Content-Length": body.byteLength
-			});
+			writeDefaultHeaders(outgoing, status, body.byteLength);
 			outgoing.end(body);
 		} else if (body instanceof Blob) {
-			outgoing.writeHead(status, {
-				"Content-Type": defaultContentType,
-				"Content-Length": body.size
-			});
+			writeDefaultHeaders(outgoing, status, body.size);
 			outgoing.end(new Uint8Array(await body.arrayBuffer()));
 		} else {
 			outgoing.writeHead(status, { "Content-Type": defaultContentType });
@@ -909,6 +918,8 @@ const responseViaCache = async (res, outgoing) => {
 		return;
 	}
 	let hasContentLength = false;
+	let plainHeaders = false;
+	let canAutoLength = true;
 	if (header instanceof Headers) {
 		hasContentLength = header.has("content-length");
 		header = buildOutgoingHttpHeaders(header, body === null ? void 0 : defaultContentType);
@@ -916,14 +927,25 @@ const responseViaCache = async (res, outgoing) => {
 		const headerObj = new Headers(header);
 		hasContentLength = headerObj.has("content-length");
 		header = buildOutgoingHttpHeaders(headerObj, body === null ? void 0 : defaultContentType);
-	} else for (const key in header) if (key.length === 14 && key.toLowerCase() === "content-length") {
-		hasContentLength = true;
-		break;
+	} else {
+		plainHeaders = true;
+		for (const key in header) {
+			if (key.length === 14 && key.toLowerCase() === "content-length") {
+				hasContentLength = true;
+				break;
+			}
+			if (key.length === 17 && key.toLowerCase() === "transfer-encoding" || key.length === 7 && key.toLowerCase() === "trailer") canAutoLength = false;
+		}
 	}
 	if (!hasContentLength) {
-		if (typeof body === "string") header["Content-Length"] = Buffer.byteLength(body);
-		else if (body instanceof Uint8Array) header["Content-Length"] = body.byteLength;
-		else if (body instanceof Blob) header["Content-Length"] = body.size;
+		let length;
+		if (typeof body === "string") length = Buffer.byteLength(body);
+		else if (body instanceof Uint8Array) length = body.byteLength;
+		else if (body instanceof Blob) length = body.size;
+		if (length !== void 0 && (!plainHeaders || !canAutoLength || !trySetContentLength(outgoing, status, length))) {
+			if (plainHeaders) header = { ...header };
+			header["Content-Length"] = length;
+		}
 	}
 	outgoing.writeHead(status, header);
 	if (body == null) outgoing.end();

package/node_modules/@hono/node-server/dist/index.mjs

@@ -1,5 +1,5 @@
 import { t as X_ALREADY_SENT } from "./constants-BLSFu_RU.mjs";
-import { STATUS_CODES, createServer } from "node:http";
+import { STATUS_CODES, ServerResponse, createServer } from "node:http";
 import { Http2ServerRequest, constants } from "node:http2";
 import { Readable } from "node:stream";
 import { defineWebSocketHelper } from "hono/ws";
@@ -867,7 +867,10 @@ const handleResponseError = (e, outgoing) => {
 	if (err.code === "ERR_STREAM_PREMATURE_CLOSE") console.info("The user aborted a request.");
 	else {
 		console.error(e);
-		if (!outgoing.headersSent) outgoing.writeHead(500, { "Content-Type": "text/plain" });
+		if (!outgoing.headersSent) {
+			if (outgoing instanceof ServerResponse) outgoing._contentLength = null;
+			outgoing.writeHead(500, { "Content-Type": "text/plain" });
+		}
 		outgoing.end(`Error: ${err.message}`);
 		outgoing.destroy(err);
 	}
@@ -875,6 +878,21 @@ const handleResponseError = (e, outgoing) => {
 const flushHeaders = (outgoing) => {
 	if ("flushHeaders" in outgoing && outgoing.writable) outgoing.flushHeaders();
 };
+const trySetContentLength = (outgoing, status, length) => {
+	const http1 = outgoing;
+	if (http1._contentLength === null && http1._hasBody && http1.useChunkedEncodingByDefault && !http1._removedContLen && status >= 200 && status !== 204 && status !== 304 && !outgoing.hasHeader("content-length") && !outgoing.hasHeader("transfer-encoding") && !outgoing.hasHeader("trailer")) {
+		http1._contentLength = length;
+		return true;
+	}
+	return false;
+};
+const writeDefaultHeaders = (outgoing, status, length) => {
+	if (trySetContentLength(outgoing, status, length)) outgoing.writeHead(status, { "Content-Type": defaultContentType });
+	else outgoing.writeHead(status, {
+		"Content-Type": defaultContentType,
+		"Content-Length": length
+	});
+};
 const responseViaCache = async (res, outgoing) => {
 	let [status, body, header] = res[cacheKey];
 	if (!header) {
@@ -882,22 +900,13 @@ const responseViaCache = async (res, outgoing) => {
 			outgoing.writeHead(status);
 			outgoing.end();
 		} else if (typeof body === "string") {
-			outgoing.writeHead(status, {
-				"Content-Type": defaultContentType,
-				"Content-Length": Buffer.byteLength(body)
-			});
+			writeDefaultHeaders(outgoing, status, Buffer.byteLength(body));
 			outgoing.end(body);
 		} else if (body instanceof Uint8Array) {
-			outgoing.writeHead(status, {
-				"Content-Type": defaultContentType,
-				"Content-Length": body.byteLength
-			});
+			writeDefaultHeaders(outgoing, status, body.byteLength);
 			outgoing.end(body);
 		} else if (body instanceof Blob) {
-			outgoing.writeHead(status, {
-				"Content-Type": defaultContentType,
-				"Content-Length": body.size
-			});
+			writeDefaultHeaders(outgoing, status, body.size);
 			outgoing.end(new Uint8Array(await body.arrayBuffer()));
 		} else {
 			outgoing.writeHead(status, { "Content-Type": defaultContentType });
@@ -908,6 +917,8 @@ const responseViaCache = async (res, outgoing) => {
 		return;
 	}
 	let hasContentLength = false;
+	let plainHeaders = false;
+	let canAutoLength = true;
 	if (header instanceof Headers) {
 		hasContentLength = header.has("content-length");
 		header = buildOutgoingHttpHeaders(header, body === null ? void 0 : defaultContentType);
@@ -915,14 +926,25 @@ const responseViaCache = async (res, outgoing) => {
 		const headerObj = new Headers(header);
 		hasContentLength = headerObj.has("content-length");
 		header = buildOutgoingHttpHeaders(headerObj, body === null ? void 0 : defaultContentType);
-	} else for (const key in header) if (key.length === 14 && key.toLowerCase() === "content-length") {
-		hasContentLength = true;
-		break;
+	} else {
+		plainHeaders = true;
+		for (const key in header) {
+			if (key.length === 14 && key.toLowerCase() === "content-length") {
+				hasContentLength = true;
+				break;
+			}
+			if (key.length === 17 && key.toLowerCase() === "transfer-encoding" || key.length === 7 && key.toLowerCase() === "trailer") canAutoLength = false;
+		}
 	}
 	if (!hasContentLength) {
-		if (typeof body === "string") header["Content-Length"] = Buffer.byteLength(body);
-		else if (body instanceof Uint8Array) header["Content-Length"] = body.byteLength;
-		else if (body instanceof Blob) header["Content-Length"] = body.size;
+		let length;
+		if (typeof body === "string") length = Buffer.byteLength(body);
+		else if (body instanceof Uint8Array) length = body.byteLength;
+		else if (body instanceof Blob) length = body.size;
+		if (length !== void 0 && (!plainHeaders || !canAutoLength || !trySetContentLength(outgoing, status, length))) {
+			if (plainHeaders) header = { ...header };
+			header["Content-Length"] = length;
+		}
 	}
 	outgoing.writeHead(status, header);
 	if (body == null) outgoing.end();

package/node_modules/@hono/node-server/dist/serve-static.cjs

@@ -77,6 +77,7 @@ const serveStatic = (options = { root: "" }) => {
 		let filename;
 		if (optionPath) filename = optionPath;
 		else try {
+			if (!options.allowPercentInPath && c.req.path.includes("%")) throw new Error();
 			filename = tryDecodeURI(c.req.path);
 			if (/(?:^|[\/\\])\.{1,2}(?:$|[\/\\])|[\/\\]{2,}|\\/.test(filename)) throw new Error();
 		} catch {

package/node_modules/@hono/node-server/dist/serve-static.d.cts

@@ -8,7 +8,8 @@ type ServeStaticOptions<E extends Env = Env> = {
   root?: string;
   path?: string;
   index?: string;
-  precompressed?: boolean;
+  precompressed?: boolean; /** Allow percent signs in the routed request path. Defaults to false. */
+  allowPercentInPath?: boolean;
   rewriteRequestPath?: (path: string, c: Context<E>) => string;
   onFound?: (path: string, c: Context<E>) => void | Promise<void>;
   onNotFound?: (path: string, c: Context<E>) => void | Promise<void>;

package/node_modules/@hono/node-server/dist/serve-static.d.mts

@@ -8,7 +8,8 @@ type ServeStaticOptions<E extends Env = Env> = {
   root?: string;
   path?: string;
   index?: string;
-  precompressed?: boolean;
+  precompressed?: boolean; /** Allow percent signs in the routed request path. Defaults to false. */
+  allowPercentInPath?: boolean;
   rewriteRequestPath?: (path: string, c: Context<E>) => string;
   onFound?: (path: string, c: Context<E>) => void | Promise<void>;
   onNotFound?: (path: string, c: Context<E>) => void | Promise<void>;

package/node_modules/@hono/node-server/dist/serve-static.mjs

@@ -76,6 +76,7 @@ const serveStatic = (options = { root: "" }) => {
 		let filename;
 		if (optionPath) filename = optionPath;
 		else try {
+			if (!options.allowPercentInPath && c.req.path.includes("%")) throw new Error();
 			filename = tryDecodeURI(c.req.path);
 			if (/(?:^|[\/\\])\.{1,2}(?:$|[\/\\])|[\/\\]{2,}|\\/.test(filename)) throw new Error();
 		} catch {

package/node_modules/@hono/node-server/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@hono/node-server",
-  "version": "2.1.1",
+  "version": "2.1.3",
   "description": "Node.js Adapter for Hono",
   "main": "dist/index.mjs",
   "type": "module",
@@ -100,7 +100,7 @@
     "@types/ws": "^8.18.1",
     "@whatwg-node/fetch": "^0.9.14",
     "eslint": "^9.10.0",
-    "hono": "^4.12.8",
+    "hono": "^4.13.9",
     "np": "^11.2.1",
     "prettier": "^3.2.4",
     "publint": "^0.3.18",
@@ -119,6 +119,7 @@
     "postbuild": "publint",
     "prerelease": "pnpm run build && pnpm run test --run",
     "release": "np --no-publish",
+    "typecheck": "tsc --noEmit",
     "lint": "eslint src test",
     "lint:fix": "eslint src test --fix",
     "format": "prettier --check \"src/**/*.{js,ts}\" \"test/**/*.{js,ts}\"",