pi-freeflow 1.44.0 → 1.45.0

package/src/system-ca-fetch.ts

@@ -13,6 +13,7 @@
 import { request as httpRequest } from "node:http";
 import { request as httpsRequest } from "node:https";
 import { execFileSync } from "node:child_process";
+import tls from "node:tls";
 import { randomBytes } from "node:crypto";
 import fs from "node:fs";
 import os from "node:os";
@@ -163,18 +164,26 @@ function windowsBundle(): string[] {
 
 let systemCaCache: string[] | null = null;
 
+/** Test-only: reset the system CA bundle cache. */
+export function _resetSystemCaCacheForTest(): void {
+ systemCaCache = null;
+}
+
 /** OS trust bundle: platform store plus NODE_EXTRA_CA_CERTS when set. */
-function systemCaBundle(): string[] {
+export function systemCaBundle(): string[] {
  if (systemCaCache) return systemCaCache;
  const extra = nodeExtraCa();
  const platform = process.platform === "win32" ? windowsBundle() : linuxBundle();
  const seen = new Set<string>();
- systemCaCache = [...extra, ...platform].filter((b) => {
+ const combined = [...extra, ...platform].filter((b) => {
   if (seen.has(b)) return false;
   seen.add(b);
   return true;
  });
-  return systemCaCache;
+ if (combined.length > 0) {
+  systemCaCache = combined;
+ }
+ return combined;
 }
 
 function toNodeHeaders(headers: HeadersInit | undefined): Record<string, string> {
@@ -229,9 +238,11 @@ export function requestViaNodeHttp(input: string, init?: RequestInit): Promise<R
  const req = sender(url, {
   method: init?.method ?? "GET",
   headers,
-  ca: bundle.length > 0 ? bundle : undefined,
+  ca: bundle.length > 0 ? [...tls.rootCertificates, ...bundle] : undefined,
   signal: nodeSignal,
  }, (res) => {
+  res.on("error", reject);
+  res.on("aborted", () => reject(new Error("upstream response aborted")));
   const chunks: Buffer[] = [];
   res.on("data", (c: Buffer) => chunks.push(c));
   res.on("end", () => {

package/src/token.ts

@@ -88,9 +88,14 @@ export function tokenAuthHeaders(dataDir?: string): Record<string, string> {
  * accepting unauthenticated traffic.
  */
 export function ensureToken(): string {
- const existing = readToken();
- if (existing) return existing;
  const file = resolveTokenPath();
+ const existing = readToken();
+ if (existing) {
+  try {
+   if (process.platform !== "win32") chmodSync(file, TOKEN_MODE);
+  } catch { }
+  return existing;
+ }
  const token = randomBytes(TOKEN_BYTES).toString("hex");
  try {
   mkdirSync(path.dirname(file), { recursive: true });

package/src/tool-args.ts

@@ -180,6 +180,7 @@ function matchesSchema(value: unknown, schema: Record<string, unknown>, depth: n
  }
  if (type === "string") return typeof value === "string";
  if (type === "number") return typeof value === "number" && Number.isFinite(value);
+ if (type === "integer") return typeof value === "number" && Number.isInteger(value);
  if (type === "boolean") return typeof value === "boolean";
  if (Array.isArray(resolved.enum)) return resolved.enum.some((member) => member === value);
  return true;
@@ -342,7 +343,13 @@ function adoptDeclaredKeys(
   for (const key of unknownKeys) {
    const raw = value[key];
    const want = Array.isArray(raw) ? "array" : raw !== null && typeof raw === "object" ? "object" : typeof raw;
-   const candidates = missing.filter((name) => !taken.has(name) && schemaType(declared[name]) === want);
+   const candidates = missing.filter((name) => {
+    if (taken.has(name)) return false;
+    const st = schemaType(declared[name]);
+    if (st === want) return true;
+    if (st === "integer" && want === "number" && typeof raw === "number" && Number.isInteger(raw)) return true;
+    return false;
+   });
    if (candidates.length !== 1) return null;
    taken.add(candidates[0]);
    targets.set(key, candidates[0]);
@@ -540,14 +547,14 @@ function parseArguments(argsJson: string): { value: Record<string, unknown>; sal
  // (`{"opts":{"a":1` must not salvage to `{"a":1}`).
  for (const start of topLevelObjectStarts(argsJson)) {
   const candidate = argsJson.slice(start);
-  const i = start;
   // Two shapes to try, in order: the candidate as written, then the candidate
   // with its missing closers appended. The closer is only offered at the FIRST
   // brace and only when something precedes it — that fragment is the evidence
   // the model was mid-call and lost the tail. A bare `{"op":"init"` stays
   // refused, and so does an inner `{"phase":…` inside an already-truncated
   // object, which is why this is not offered at every brace.
-  const candidates = i === 0 ? [candidate] : [candidate, appendClosers(candidate)];
+  const hasPreceding = argsJson.slice(0, start).trim().length > 0;
+  const candidates = hasPreceding ? [candidate, appendClosers(candidate)] : [candidate];
   for (const attempt of candidates) {
    if (attempt === undefined) continue;
    try {

package/src/tool-translation.ts

@@ -804,239 +804,4 @@ export function translateToolsForPath(tools: unknown[], pathname: string, opts?:
  }
  return out;
 }
-/**
- * Responses <-> Chat body translation. Cline serves chat completions only, so
- * the responses body is reshaped to chat before the Cline branch sends it,
- * and the chat answer is translated back. Tool shape conversion reuses
- * translateToolsForPath; only the message envelopes are remapped here.
- */
-/** Extract plain text from a Responses content field (string or parts array). */
-function responsesTextOf(content: unknown): string | null {
- if (typeof content === "string") return content;
- if (!Array.isArray(content)) return null;
- let text = "";
- let saw = false;
- for (const part of content) {
-  if (typeof part !== "object" || part === null || Array.isArray(part)) continue;
-  const rec = part as Record<string, unknown>;
-  if ((rec.type === "text" || rec.type === "input_text" || rec.type === "output_text" || rec.type === "summary_text") && typeof rec.text === "string") {
-   text += rec.text;
-   saw = true;
-  }
- }
- return saw ? text : null;
-}
-
-/** Chat role for a Responses item role; unknown roles ride as user text. */
-function chatRoleFor(role: unknown): string {
- if (role === "assistant" || role === "system" || role === "tool") return role;
- if (role === "developer") return "system";
- return "user";
-}
-
-/**
- * Map a Responses `input` (string or item array) to Chat `messages`.
- * function_call items become assistant tool_calls, function_call_output
- * items become tool messages, reasoning items keep only their summary text.
- */
-export function responsesInputToChatMessages(input: unknown): Record<string, unknown>[] {
- if (typeof input === "string") return input.length > 0 ? [{ role: "user", content: input }] : [];
- if (!Array.isArray(input)) return [];
- const messages: Record<string, unknown>[] = [];
- for (const item of input) {
-  if (typeof item !== "object" || item === null || Array.isArray(item)) continue;
-  const rec = item as Record<string, unknown>;
-  if (rec.type === "function_call") {
-   const args = typeof rec.arguments === "string" ? rec.arguments : JSON.stringify(rec.arguments ?? {});
-   const name = typeof rec.name === "string" ? rec.name : "tool";
-   const id = typeof rec.call_id === "string" ? rec.call_id : typeof rec.id === "string" ? rec.id : "";
-   messages.push({ role: "assistant", content: null, tool_calls: [{ id, type: "function", function: { name, arguments: args } }] });
-   continue;
-  }
-  if (rec.type === "function_call_output") {
-   const output = typeof rec.output === "string" ? rec.output : JSON.stringify(rec.output ?? "");
-   const callId = typeof rec.call_id === "string" ? rec.call_id : typeof rec.id === "string" ? rec.id : "";
-   messages.push({ role: "tool", tool_call_id: callId, content: output });
-   continue;
-  }
-  if (rec.type === "reasoning") {
-   const summary = Array.isArray(rec.summary) ? responsesTextOf(rec.summary) : null;
-   if (summary !== null && summary.length > 0) messages.push({ role: "assistant", content: summary });
-   continue;
-  }
-  const text = responsesTextOf(rec.content);
-  messages.push({ role: chatRoleFor(rec.role), content: text ?? JSON.stringify(item) });
- }
- return messages;
-}
-
-/**
- * Build a Chat Completions body from a Responses body. Carries model,
- * instructions (as the leading system message), input, tools (reshaped to
- * chat via translateToolsForPath), tool_choice, and plain sampling scalars.
- * Stream policy stays with the caller: this maps shape, never behavior.
- *
- * Lane-neutral: used by every direct-only lane that serves chat upstream and
- * answers a responses-path caller (Cline, OVHcloud AI Endpoints).
- */
-export function chatBodyFromResponsesBody(body: Record<string, unknown>): Record<string, unknown> {
- const out: Record<string, unknown> = {};
- if (typeof body.model === "string") out.model = body.model;
- const messages: Record<string, unknown>[] = [];
- if (typeof body.instructions === "string" && body.instructions.length > 0) {
-  messages.push({ role: "system", content: body.instructions });
- }
- messages.push(...responsesInputToChatMessages(body.input));
- out.messages = messages;
- if (Array.isArray(body.tools)) out.tools = translateToolsForPath(body.tools, "/v1/chat/completions");
- if (body.tool_choice !== undefined) out.tool_choice = body.tool_choice;
- // `max_output_tokens` is the Responses-native cap and is what a host actually
- // sets on this path; without it here the cap silently vanished on the
- // chat-only lanes and the model answered at its own default length.
- for (const key of ["temperature", "top_p", "max_tokens", "max_completion_tokens", "max_output_tokens", "stop", "presence_penalty", "frequency_penalty", "seed", "user", "parallel_tool_calls", "response_format"] as const) {
-  if (body[key] !== undefined) out[key] = body[key];
- }
- return out;
-}
-
-/** First chat choice message, or null when the completion carries none. */
-function firstChatMessage(chat: Record<string, unknown>): Record<string, unknown> | null {
- const choices = chat.choices;
- if (!Array.isArray(choices) || choices.length === 0) return null;
- const first = choices[0];
- if (typeof first !== "object" || first === null || Array.isArray(first)) return null;
- const message = (first as Record<string, unknown>).message;
- if (typeof message !== "object" || message === null || Array.isArray(message)) return null;
- return message as Record<string, unknown>;
-}
-
-/**
- * Build a Responses object from a Chat Completion object. Text becomes the
- * assistant message item, tool_calls become function_call items, usage rides
- * verbatim. `finish_reason: "length"` reports incomplete, else completed.
- */
-export function chatResponsesJsonFromChatCompletion(chat: Record<string, unknown>, fallbackModel: string): Record<string, unknown> {
- const message = firstChatMessage(chat);
- const model = typeof chat.model === "string" && chat.model.length > 0 ? chat.model : fallbackModel;
- const id = typeof chat.id === "string" ? chat.id.replace(/^chatcmpl/, "resp") : "resp_cline";
- // Both hosts key their text block off the item id — Pi builds `textSignature`
- // from item.id, OMP stores itemId — and each synthesizes a fallback when it
- // is missing, so the message item carries one derived from the response id,
- // the way upstream OpenAI ids share a suffix.
- const messageId = `msg_${id.replace(/^resp[_-]?/, "")}`;
- const choices = chat.choices;
- const first = Array.isArray(choices) && choices.length > 0 && typeof choices[0] === "object" && choices[0] !== null ? (choices[0] as Record<string, unknown>) : {};
- const status = first.finish_reason === "length" ? "incomplete" : "completed";
- const output: Record<string, unknown>[] = [];
- if (message) {
-  const text = typeof message.content === "string" ? message.content : null;
-  if (text !== null && text.length > 0) {
-   output.push({ type: "message", id: messageId, role: "assistant", status, content: [{ type: "output_text", text }] });
-  }
-  const toolCalls = message.tool_calls;
-  if (Array.isArray(toolCalls)) {
-   for (const tc of toolCalls) {
-    if (typeof tc !== "object" || tc === null || Array.isArray(tc)) continue;
-    const rec = tc as Record<string, unknown>;
-    const fn = typeof rec.function === "object" && rec.function !== null && !Array.isArray(rec.function) ? (rec.function as Record<string, unknown>) : {};
-    const args = typeof fn.arguments === "string" ? fn.arguments : JSON.stringify(fn.arguments ?? {});
-    const callId = typeof rec.id === "string" && rec.id.length > 0 ? rec.id : `call_cline_${output.length}`;
-    output.push({ type: "function_call", id: callId, call_id: callId, name: typeof fn.name === "string" ? fn.name : "tool", arguments: args });
-   }
-  }
- }
- const out: Record<string, unknown> = {
-  id,
-  object: "response",
-  created_at: typeof chat.created === "number" ? chat.created : Math.floor(Date.now() / 1000),
-  model,
-  output,
-  status,
- };
- if (chat.usage !== undefined) out.usage = chat.usage;
- return out;
-}
-
-/**
- * Wrap a Responses object in the minimal valid Responses SSE sequence
- * (created + completed + DONE) so streamed responses-path clients get a
- * stream even though the upstream lane only serves chat. Round-trips through
- * sseToResponsesJson: the completed event carries the full object.
- *
- * Every output item is framed the way hosts consume streams: it opens with
- * `response.output_item.added` before its deltas and closes with
- * `response.output_item.done` after them. A host creates a slot only on
- * `added` and DROPS a keyed delta that has no open slot (Pi
- * api/openai-responses-shared.ts createSlot/getSlot; OMP
- * providers/openai-shared.ts registerOpenItem/lookupOpenItem), so a message
- * item emitted as bare `response.output_text.delta` frames left every
- * chat-only lane answer blank on the caller side.
- */
-export function chatResponsesSseFromChatCompletion(resp: Record<string, unknown>): string {
- const head = { type: "response.created", response: { id: resp.id, object: "response", model: resp.model } };
- let out = `event: response.created\ndata: ${JSON.stringify(head)}\n\n`;
- const output = resp.output;
- if (Array.isArray(output)) {
-  for (let idx = 0; idx < output.length; idx++) {
-   const item = output[idx] as Record<string, unknown>;
-   if (item && item.type === "message" && Array.isArray(item.content)) {
-    const parts = item.content as Record<string, unknown>[];
-    const hasText = parts.some((p) => p && p.type === "output_text" && typeof p.text === "string" && p.text.length > 0);
-    // An item carrying no text (a pure tool-call turn) stays unopened: opening
-    // and closing it would leave the host with an empty text block.
-    if (hasText) {
-     out += `event: response.output_item.added\ndata: ${JSON.stringify({
-      type: "response.output_item.added",
-      output_index: idx,
-      item: { type: "message", id: item.id, role: typeof item.role === "string" ? item.role : "assistant", status: "in_progress", content: [] },
-     })}\n\n`;
-     for (let partIndex = 0; partIndex < parts.length; partIndex++) {
-      const p = parts[partIndex];
-      if (p && p.type === "output_text" && typeof p.text === "string" && p.text.length > 0) {
-       out += `event: response.output_text.delta\ndata: ${JSON.stringify({
-        type: "response.output_text.delta",
-        item_id: item.id,
-        output_index: idx,
-        content_index: partIndex,
-        delta: p.text,
-       })}\n\n`;
-      }
-     }
-     out += `event: response.output_item.done\ndata: ${JSON.stringify({
-      type: "response.output_item.done",
-      output_index: idx,
-      item,
-     })}\n\n`;
-    }
-   } else if (item && item.type === "function_call") {
-    out += `event: response.output_item.added\ndata: ${JSON.stringify({
-     type: "response.output_item.added",
-     output_index: idx,
-     item: {
-      type: "function_call",
-      id: item.id,
-      call_id: item.call_id,
-      name: item.name,
-      arguments: "",
-     },
-    })}\n\n`;
-    if (typeof item.arguments === "string" && item.arguments.length > 0) {
-     out += `event: response.function_call_arguments.delta\ndata: ${JSON.stringify({
-      type: "response.function_call_arguments.delta",
-      output_index: idx,
-      delta: item.arguments,
-     })}\n\n`;
-    }
-    out += `event: response.output_item.done\ndata: ${JSON.stringify({
-     type: "response.output_item.done",
-     output_index: idx,
-     item,
-    })}\n\n`;
-   }
-  }
- }
- const done = { type: "response.completed", response: resp };
- out += `event: response.completed\ndata: ${JSON.stringify(done)}\n\n`;
- out += `data: [DONE]\n\n`;
- return out;
-}
+export * from "./lane-translation.ts";

package/src/toolcall-audit.ts

@@ -101,6 +101,8 @@ interface CallAcc {
  /** Accumulated arguments, bounded; `bytes` is the unbounded payload size. */
  args: string;
  bytes: number;
+ argsTruncated?: boolean;
+ argsValid?: boolean;
 }
 
 interface StreamState {
@@ -189,6 +191,9 @@ function appendArgs(state: StreamState, call: CallAcc, chunk: string): void {
   MAX_ARGS_CHARS - call.args.length,
   MAX_TURN_ARGS_CHARS - state.argsChars,
  );
+ if (room <= 0 || chunk.length > room) {
+  call.argsTruncated = true;
+ }
  if (room <= 0) return;
  const take = chunk.length > room ? chunk.slice(0, room) : chunk;
  call.args += take;
@@ -203,6 +208,10 @@ function setArgs(state: StreamState, call: CallAcc, args: string): void {
   0,
   Math.min(MAX_ARGS_CHARS, MAX_TURN_ARGS_CHARS - state.argsChars),
  );
+ if (args.length > room) {
+  call.argsTruncated = true;
+  call.argsValid = isArgsObject(args);
+ }
  const take = args.length > room ? args.slice(0, room) : args;
  call.args = take;
  state.argsChars += take.length;
@@ -261,14 +270,18 @@ function observeChat(evt: Record<string, unknown>, state: StreamState): void {
 
 function observeResponses(evt: Record<string, unknown>, state: StreamState): void {
  const type = typeof evt["type"] === "string" ? (evt["type"] as string) : "";
+ const outputIndex = typeof evt["output_index"] === "number" ? (evt["output_index"] as number) : undefined;
  if (type === "response.output_item.added" || type === "response.output_item.done") {
   const item = asRecord(evt["item"]);
   if (!item || item["type"] !== "function_call") return;
   const id = item["id"] !== undefined ? clip(item["id"], MAX_TEXT) : clip(item["call_id"], MAX_TEXT);
-  let call = findById(state.calls, id);
+  const index = outputIndex ?? state.calls.length;
+  let call = findById(state.calls, id) ?? (outputIndex !== undefined ? findByIndex(state.calls, outputIndex, id) : null);
   if (!call) {
-   call = pushCall(state, state.calls.length, id);
+   call = pushCall(state, index, id);
    if (!call) return;
+  } else if (call.id === "" && id !== "") {
+   call.id = id;
   }
   const name = clip(item["name"], MAX_TEXT);
   if (name !== "") call.name = name;
@@ -281,9 +294,9 @@ function observeResponses(evt: Record<string, unknown>, state: StreamState): voi
  }
  if (type === "response.function_call_arguments.delta") {
   const id = clip(evt["item_id"], MAX_TEXT);
-  let call = findById(state.calls, id);
+  let call = findById(state.calls, id) ?? (outputIndex !== undefined ? findByIndex(state.calls, outputIndex, id) : null);
   if (!call) {
-   call = pushCall(state, state.calls.length, id);
+   call = pushCall(state, outputIndex ?? state.calls.length, id);
    if (!call) return;
   }
   if (typeof evt["delta"] === "string") appendArgs(state, call, evt["delta"] as string);
@@ -291,9 +304,9 @@ function observeResponses(evt: Record<string, unknown>, state: StreamState): voi
  }
  if (type === "response.function_call_arguments.done") {
   const id = clip(evt["item_id"], MAX_TEXT);
-  let call = findById(state.calls, id);
+  let call = findById(state.calls, id) ?? (outputIndex !== undefined ? findByIndex(state.calls, outputIndex, id) : null);
   if (!call) {
-   call = pushCall(state, state.calls.length, id);
+   call = pushCall(state, outputIndex ?? state.calls.length, id);
    if (!call) return;
   }
   if (typeof evt["arguments"] === "string") setArgs(state, call, evt["arguments"] as string);
@@ -421,7 +434,7 @@ export function createToolcallRecorder(opts: ToolcallRecorderOptions): ToolcallR
   const calls = state.calls.slice(0, MAX_CALLS).map((call) => ({
    name: clip(call.name, MAX_NAME),
    argsBytes: call.bytes,
-   argsValid: isArgsObject(call.args),
+   argsValid: call.argsValid ?? (call.argsTruncated ? true : isArgsObject(call.args)),
    known: declaredExact.has(call.name),
   }));
   // A body that never carried an event stream says nothing about the model:

package/src/update-checker.ts

@@ -67,20 +67,33 @@ export function setCachedUpdate(latest: string): void {
  }
 }
 
+let inFlightUpdateCheck: Promise<void> | null = null;
+
 export function checkForUpdateInBackground(ui?: ExtensionUIContext | null): void {
  try {
   if (isLinkedInstall()) return;
 
   const cached = getCachedUpdate();
+  const local = getLocalVersion();
   if (
    cached &&
    typeof cached.checkedAt === "number" &&
    Date.now() - cached.checkedAt < UPDATE_CHECK_TTL_MS
   ) {
+   if (local && compareVersions(cached.latest, local) > 0) {
+    try {
+     if (!getActiveRelayState().hideWidget) {
+      const targetUi = ui ?? getStatusUi();
+      targetUi?.setStatus?.("freeflow", `update: ${local} → ${cached.latest}`);
+     }
+    } catch { }
+   }
    return;
   }
 
-  void fetchLatestVersion()
+  if (inFlightUpdateCheck !== null) return;
+
+  inFlightUpdateCheck = fetchLatestVersion()
    .then((latest) => {
     if (!latest) return;
     try {
@@ -119,6 +132,9 @@ export function checkForUpdateInBackground(ui?: ExtensionUIContext | null): void
    })
    .catch(() => {
     // swallow — offline / transient network error
+   })
+   .finally(() => {
+    inFlightUpdateCheck = null;
    });
  } catch {
   // swallow — never throw from background check

package/src/update-core.ts

@@ -252,8 +252,11 @@ export function runUpdateStep(
    // unref is best-effort
   }
   const emit = (d: Buffer): void => {
-   const s = String(d).trim();
-   if (s) opts.onOutput?.(s);
+   const text = String(d);
+   for (const raw of text.split(/\r?\n/)) {
+    const s = raw.trim();
+    if (s) opts.onOutput?.(s);
+   }
   };
   child.stdout?.on("data", emit);
   child.stderr?.on("data", emit);

package/src/updater.ts

@@ -12,7 +12,7 @@
  * spawnSync install (minutes on npm/bun) would freeze the host TUI.
  */
 
-import { spawn, spawnSync } from "node:child_process";
+import { spawn, spawnSync, type ChildProcess } from "node:child_process";
 
 import { getClientPort } from "./client.ts";
 import {
@@ -122,9 +122,14 @@ export function probeCommandsAvailable(cmds: string[]): Promise<boolean[]> {
       resolve(false);
       return;
      }
-     const timer = setTimeout(() => resolve(false), PROBE_TIMEOUT_MS);
+     let child: ChildProcess | undefined;
+     const timer = setTimeout(() => {
+      try { child?.kill(); } catch { }
+      resolve(false);
+     }, PROBE_TIMEOUT_MS);
+     timer.unref?.();
      try {
-      const child = spawn(cmd, ["--version"], {
+      child = spawn(cmd, ["--version"], {
        stdio: "ignore",
        windowsHide: true,
        shell: process.platform === "win32",

package/src/upstream-health.ts

@@ -400,8 +400,28 @@ export function isUnprovenSession(parsedBody: unknown, pathname: string): boolea
  const key = sessionKeyOf(parsedBody);
  if (key && isEstablished(key)) return false;
  if (String(pathname ?? "").includes("responses")) return true;
- const messages = (parsedBody as { messages?: unknown }).messages;
- if (Array.isArray(messages) && messages.length > 1) return false;
+ const messages = typeof parsedBody === "object" && parsedBody !== null && "messages" in parsedBody
+  ? (parsedBody as { messages?: unknown }).messages
+  : undefined;
+ if (Array.isArray(messages)) {
+  const hasPriorTurn = messages.some(
+   (m) =>
+    m !== null &&
+    typeof m === "object" &&
+    "role" in m &&
+    (m.role === "assistant" || m.role === "tool"),
+  );
+  if (hasPriorTurn) return false;
+  const nonSystemCount = messages.filter(
+   (m) =>
+    m !== null &&
+    typeof m === "object" &&
+    "role" in m &&
+    m.role !== "system" &&
+    m.role !== "developer",
+  ).length;
+  if (nonSystemCount > 1) return false;
+ }
  return true;
 }
 

package/src/zen-sidecar.ts

@@ -82,6 +82,7 @@ process.stdout.write(`${JSON.stringify({ status: res.status, headers: out })}\n`
 // A closed stdout means the bridge is gone; stop quietly instead of crashing
 // on EPIPE while the body is still streaming.
 process.stdout.on("error", () => process.exit(0));
+process.stdout.on("close", () => process.exit(0));
 try {
  if (res.body) {
   for await (const c of res.body) {

package/src/zen-transport.ts

@@ -13,6 +13,7 @@
 import { spawn, spawnSync, type ChildProcess } from "node:child_process";
 import fs from "node:fs";
 import path from "node:path";
+import os from "node:os";
 import { fileURLToPath } from "node:url";
 import { Readable } from "node:stream";
 import { ZEN_TRANSPORT_ENV } from "./config.ts";
@@ -132,21 +133,32 @@ export function probeBunVersion(opts: {
  */
 export function findBunOnPath(envPath?: string): string | null {
  const raw = envPath ?? process.env.PATH ?? process.env.Path ?? "";
- if (!raw || typeof raw !== "string") return null;
- const extensions = process.platform === "win32"
-  ? (process.env.PATHEXT ? process.env.PATHEXT.split(";").filter(Boolean) : [".exe", ".cmd", ".bat"])
-  : [""];
- for (const dir of raw.split(path.delimiter).filter(Boolean)) {
-  for (const ext of extensions) {
-   const candidate = ext ? path.join(dir, `bun${ext}`) : path.join(dir, "bun");
-   try {
-    const stat = fs.statSync(candidate);
-    if (!stat.isFile()) continue;
-    if (process.platform !== "win32") fs.accessSync(candidate, fs.constants.X_OK);
-    return candidate;
-   } catch { }
+ if (raw && typeof raw === "string") {
+  const extensions = process.platform === "win32"
+   ? (process.env.PATHEXT ? process.env.PATHEXT.split(";").filter(Boolean) : [".exe", ".cmd", ".bat"])
+   : [""];
+  for (const dir of raw.split(path.delimiter).filter(Boolean)) {
+   for (const ext of extensions) {
+    const candidate = ext ? path.join(dir, `bun${ext}`) : path.join(dir, "bun");
+    try {
+     const stat = fs.statSync(candidate);
+     if (!stat.isFile()) continue;
+     if (process.platform !== "win32") fs.accessSync(candidate, fs.constants.X_OK);
+     return candidate;
+    } catch { }
+   }
   }
  }
+ if (envPath === undefined) {
+  const fallback = path.join(os.homedir(), ".bun", "bin", process.platform === "win32" ? "bun.exe" : "bun");
+  try {
+   const stat = fs.statSync(fallback);
+   if (stat.isFile()) {
+    if (process.platform !== "win32") fs.accessSync(fallback, fs.constants.X_OK);
+    return fallback;
+   }
+  } catch { }
+ }
  return null;
 }
 
@@ -252,11 +264,21 @@ export function fetchZenDirectViaSidecar(
  let stdoutEnded = false;
  const spawnFn = opts.spawnImpl ?? spawn;
  try {
-  child = spawnFn(opts.runtimePath, [...(opts.runtimeArgs ?? []), opts.scriptPath], {
-   stdio: ["pipe", "pipe", "pipe"],
-   windowsHide: true,
-   detached: false,
-  });
+  if (process.platform === "win32" && /\.(?:cmd|bat)$/i.test(opts.runtimePath) && opts.spawnImpl === undefined) {
+   const quotedCmd = `"${opts.runtimePath}" ${[...(opts.runtimeArgs ?? []), opts.scriptPath].map((a) => `"${a}"`).join(" ")}`;
+   child = spawnFn(quotedCmd, [], {
+    stdio: ["pipe", "pipe", "pipe"],
+    windowsHide: true,
+    detached: false,
+    shell: true,
+   });
+  } else {
+   child = spawnFn(opts.runtimePath, [...(opts.runtimeArgs ?? []), opts.scriptPath], {
+    stdio: ["pipe", "pipe", "pipe"],
+    windowsHide: true,
+    detached: false,
+   });
+  }
  } catch (e) {
   reject(e instanceof Error ? e : new Error(String(e)));
   return promise;
@@ -363,6 +385,14 @@ export function fetchZenDirectViaSidecar(
     // Backpressure: only resume the child pipe when the consumer wants more.
     if (!stdoutEnded) stdout.resume();
    },
+   destroy(err, cb) {
+    finished = true;
+    opts.signal?.removeEventListener("abort", onAbort);
+    try {
+     killZenSidecarTree(proc);
+    } catch { }
+    cb(err);
+   },
   });
   const pushBody = (c: Buffer): void => {
    if (nullBody || stream === null) return;