[JarryShaw]

• Searched for similar pull requests
• Followed the coding style (make pylint, make mypy, make isort)
• make test passes, and a test case covers the change
• Added a changelog entry — N/A — centralised in docs(changelog): shared 1.5.0 changelog — long-lived, merges last (#610, #616, #617, #618, #620) #657

What is the purpose of your pull request?

• fix — bug fixes

---

Description of your pull request and other information

Closes #2097. On Windows a pipe's file object reports seekable() as True while seek does nothing (the agent cites CPython gh-86768 / bpo-42602; not re-verified here). Extractor.__init__ therefore wrapped the raw pipe in PeekableStream, whose peek-then-seek-back lost the 4 magic octets. A buffered stdin got no wrapper at all, so its seek(0, SEEK_END) answers were wrong. That is why 25 pipe cases, pcapkit - included, failed on the Windows leg (job 120605026883).

• Fix: the new _can_seek() in pcapkit/foundation/extraction.py trusts seekable() only when os.fstat(fileno) reports a regular file. A stream without a descriptor (e.g. BytesIO) is taken at its word as before. Anything else is wrapped in SeekableReader.
• Test: test_extraction_windows_pipe_seekable_2097_unit uses a real os.pipe that claims to be seekable and has a no-op seek. Without the fix the raw case raises ProtocolError: invalid magic number, as in the CI log, and the buffered case returns 0 frames instead of 50. The non-seekable stream tests pass.

[JarryShaw]

GOOD TO GO at 61aa9f979 (Sonnet review).

• Test: the new test fails with extraction.py reverted to 862a6e679 and passes with the fix. The non-seekable, no-EOF, ownership, extraction, io and CLI tests pass.
• CPython reference: confirmed through the API. gh-86768 is "seekable() returns True on pipe objects in Windows". PR 133137, which makes os.lseek check seekability on Windows, merged to main on 2026-08-11. That it ships in 3.16 is the reviewer's inference.
• Linux probes of _can_seek: regular files, gzip.GzipFile, BytesIO and stdin redirected from a file stay unwrapped. A pipe, a socket makefile and /dev/null get wrapped. io.UnsupportedOperation from fileno() is caught. Wrapping a seekable device such as /dev/null is harmless, only slower.
• UNVERIFIED: that Windows os.fstat reports S_IFIFO for a pipe.
• Follow-up: PeekableStream in pcapkit/corekit/io.py has its own seekable() check without the fstat guard. Tracked separately.

[github-actions]

Coverage: 91.54% (unit tier, Python 3.15, 61aa9f979, Unit Tests run success)

Package	Statements	Missed	Branches	Partial	Cover
pcapkit (top level)	104	4	20	2	95.16%
pcapkit/const	19599	880	2618	866	92.12%
pcapkit/corekit	2565	71	812	37	96.56%
pcapkit/dumpkit	282	3	102	3	98.44%
pcapkit/foundation	2939	23	1024	25	98.79%
pcapkit/interface	138	4	52	3	96.32%
pcapkit/protocols	17414	219	4574	185	98.14%
pcapkit/toolkit	869	36	298	10	95.20%
pcapkit/utilities	473	7	136	5	98.03%
pcapkit/vendor	4432	1988	1018	167	51.87%

Per-file detail: the coverage-html artifact of this run.

[JarryShaw]

Ready to merge at 61aa9f979.

• Review: the Sonnet review is GOOD TO GO.
• CI: every blocking check passed (Required checks passed SUCCESS). The 3.8–3.10 KTLO legs carry no warnings.
• Ordering: the tests/foundation plain-unittest ordering leg passed on a scratch merge into main: 712 tests, 0 failures.
• Base: the head is behind main only by test-only and workflow commits that don't touch extraction.py, and the scratch merge was clean.

This closes #2097. #2108 (the record-skip helper) follows once it merges.