@cortexkit/aft-bridge 0.18.5 → 0.19.0

package/dist/index.js

@@ -1,1387 +1,23 @@
-import { createRequire } from "node:module";
-var __require = /* @__PURE__ */ createRequire(import.meta.url);
-
-// src/active-logger.ts
-var active;
-function setActiveLogger(logger) {
-  active = logger;
-}
-function getLogFilePath() {
-  return active?.getLogFilePath?.();
-}
-function log(message, meta) {
-  if (active) {
-    active.log(message, meta);
-  } else {
-    console.error(`[aft-bridge] ${message}`);
-  }
-}
-function warn(message, meta) {
-  if (active) {
-    active.warn(message, meta);
-  } else {
-    console.error(`[aft-bridge] WARN: ${message}`);
-  }
-}
-function error(message, meta) {
-  if (active) {
-    active.error(message, meta);
-  } else {
-    console.error(`[aft-bridge] ERROR: ${message}`);
-  }
-}
-function sessionWarn(sessionId, message) {
-  warn(message, sessionId ? { sessionId } : undefined);
-}
-// src/bridge.ts
-import { spawn } from "node:child_process";
-import { homedir } from "node:os";
-import { join } from "node:path";
-var DEFAULT_BRIDGE_TIMEOUT_MS = 30000;
-var SEMANTIC_TIMEOUT_SAFETY_MARGIN_MS = 5000;
-var MAX_STDOUT_BUFFER = 64 * 1024 * 1024;
-function compareSemver(a, b) {
-  const [aMain, aPre] = a.split("-", 2);
-  const [bMain, bPre] = b.split("-", 2);
-  const aParts = aMain.split(".").map(Number);
-  const bParts = bMain.split(".").map(Number);
-  for (let i = 0;i < 3; i++) {
-    if (aParts[i] !== bParts[i])
-      return (aParts[i] ?? 0) - (bParts[i] ?? 0);
-  }
-  if (!aPre && !bPre)
-    return 0;
-  if (!aPre)
-    return 1;
-  if (!bPre)
-    return -1;
-  const aIds = aPre.split(".");
-  const bIds = bPre.split(".");
-  for (let i = 0;i < Math.max(aIds.length, bIds.length); i++) {
-    const ai = aIds[i];
-    const bi = bIds[i];
-    if (ai === undefined)
-      return -1;
-    if (bi === undefined)
-      return 1;
-    const aNum = /^\d+$/.test(ai);
-    const bNum = /^\d+$/.test(bi);
-    if (aNum && bNum) {
-      const diff = Number.parseInt(ai, 10) - Number.parseInt(bi, 10);
-      if (diff !== 0)
-        return diff;
-    } else if (aNum) {
-      return -1;
-    } else if (bNum) {
-      return 1;
-    } else {
-      const cmp = ai.localeCompare(bi);
-      if (cmp !== 0)
-        return cmp;
-    }
-  }
-  return 0;
-}
-function clampSemanticTimeout(configOverrides, bridgeTimeoutMs) {
-  const semantic = configOverrides.semantic;
-  if (!semantic || typeof semantic !== "object" || Array.isArray(semantic)) {
-    return configOverrides;
-  }
-  const timeoutMs = semantic.timeout_ms;
-  if (typeof timeoutMs !== "number" || !Number.isFinite(timeoutMs)) {
-    return configOverrides;
-  }
-  const maxSemanticTimeoutMs = bridgeTimeoutMs > SEMANTIC_TIMEOUT_SAFETY_MARGIN_MS ? bridgeTimeoutMs - SEMANTIC_TIMEOUT_SAFETY_MARGIN_MS : Math.max(1, bridgeTimeoutMs - 1);
-  if (timeoutMs <= maxSemanticTimeoutMs) {
-    return configOverrides;
-  }
-  warn(`semantic.timeout_ms=${timeoutMs} exceeds bridge timeout budget; clamping to ${maxSemanticTimeoutMs}ms (bridge timeout: ${bridgeTimeoutMs}ms)`);
-  return {
-    ...configOverrides,
-    semantic: {
-      ...semantic,
-      timeout_ms: maxSemanticTimeoutMs
-    }
-  };
-}
-
-class BinaryBridge {
-  static RESTART_RESET_MS = 5 * 60 * 1000;
-  static STDERR_TAIL_MAX = 20;
-  binaryPath;
-  cwd;
-  process = null;
-  pending = new Map;
-  nextId = 1;
-  stdoutBuffer = "";
-  stderrTail = [];
-  _restartCount = 0;
-  _shuttingDown = false;
-  timeoutMs;
-  maxRestarts;
-  configured = false;
-  _configurePromise = null;
-  configOverrides;
-  minVersion;
-  onVersionMismatch;
-  onConfigureWarnings;
-  onBashCompletion;
-  configureWarningClients = new Map;
-  restartResetTimer = null;
-  errorPrefix;
-  constructor(binaryPath, cwd, options, configOverrides) {
-    this.binaryPath = binaryPath;
-    this.cwd = cwd;
-    this.timeoutMs = options?.timeoutMs ?? DEFAULT_BRIDGE_TIMEOUT_MS;
-    this.maxRestarts = options?.maxRestarts ?? 3;
-    this.configOverrides = clampSemanticTimeout(configOverrides ?? {}, this.timeoutMs);
-    this.minVersion = options?.minVersion;
-    this.onVersionMismatch = options?.onVersionMismatch;
-    this.onConfigureWarnings = options?.onConfigureWarnings;
-    this.onBashCompletion = options?.onBashCompletion;
-    this.errorPrefix = options?.errorPrefix ?? "[aft-bridge]";
-  }
-  get restartCount() {
-    return this._restartCount;
-  }
-  isAlive() {
-    return this.process !== null && this.process.exitCode === null && !this.process.killed;
-  }
-  hasPendingRequests() {
-    return this.pending.size > 0;
-  }
-  async send(command, params = {}, options) {
-    if (this._shuttingDown) {
-      throw new Error(`${this.errorPrefix} Bridge is shutting down, cannot send "${command}"`);
-    }
-    if (Object.hasOwn(params, "id")) {
-      throw new Error("params cannot contain reserved key 'id'");
-    }
-    this.ensureSpawned();
-    const requestSessionId = typeof params.session_id === "string" && params.session_id.length > 0 ? params.session_id : undefined;
-    if (requestSessionId && options?.configureWarningClient !== undefined) {
-      this.configureWarningClients.set(requestSessionId, options.configureWarningClient);
-    }
-    if (!this.configured) {
-      if (command !== "configure" && command !== "version") {
-        if (!this._configurePromise) {
-          const sessionIdForConfigure = typeof params["session_id"] === "string" ? params["session_id"] : undefined;
-          this._configurePromise = (async () => {
-            try {
-              const configResult = await this.send("configure", {
-                project_root: this.cwd,
-                ...this.configOverrides,
-                ...sessionIdForConfigure ? { session_id: sessionIdForConfigure } : {}
-              });
-              if (configResult.success === false) {
-                throw new Error(`${this.errorPrefix} Configure failed: ${configResult.message ?? "unknown error"}`);
-              }
-              await this.deliverConfigureWarnings(configResult, params, options);
-              await this.checkVersion();
-              if (!this.isAlive()) {
-                throw new Error(`${this.errorPrefix} Bridge died during version check. Check logs: ${getLogFilePath()}`);
-              }
-              this.configured = true;
-            } finally {
-              this._configurePromise = null;
-            }
-          })();
-        }
-        await this._configurePromise;
-      }
-    }
-    const id = String(this.nextId++);
-    let request;
-    if (Object.hasOwn(params, "command") || Object.hasOwn(params, "method")) {
-      const nested = { ...params };
-      const reserved = {};
-      for (const key of ["session_id", "lsp_hints"]) {
-        if (Object.hasOwn(nested, key)) {
-          reserved[key] = nested[key];
-          delete nested[key];
-        }
-      }
-      request = { id, command, ...reserved, params: nested };
-    } else {
-      request = { id, command, ...params };
-    }
-    const line = `${JSON.stringify(request)}
-`;
-    const effectiveTimeoutMs = options?.transportTimeoutMs ?? options?.timeoutMs ?? this.timeoutMs;
-    const keepBridgeOnTimeout = options?.keepBridgeOnTimeout === true;
-    return new Promise((resolve, reject) => {
-      const timer = setTimeout(() => {
-        this.pending.delete(id);
-        const restartSuffix = keepBridgeOnTimeout ? "" : " — restarting bridge";
-        const timeoutMsg = `Request "${command}" (id=${id}) timed out after ${effectiveTimeoutMs}ms${restartSuffix}`;
-        if (requestSessionId) {
-          sessionWarn(requestSessionId, timeoutMsg);
-        } else {
-          warn(timeoutMsg);
-        }
-        reject(new Error(`${this.errorPrefix} Request "${command}" (id=${id}) timed out after ${effectiveTimeoutMs}ms`));
-        if (!keepBridgeOnTimeout) {
-          this.handleTimeout();
-        }
-      }, effectiveTimeoutMs);
-      this.pending.set(id, { resolve, reject, timer, onProgress: options?.onProgress });
-      if (!this.process?.stdin?.writable) {
-        this.pending.delete(id);
-        clearTimeout(timer);
-        reject(new Error(`${this.errorPrefix} stdin not writable for command "${command}"`));
-        return;
-      }
-      this.process.stdin.write(line, (err) => {
-        if (err) {
-          const entry = this.pending.get(id);
-          if (entry) {
-            this.pending.delete(id);
-            clearTimeout(entry.timer);
-            entry.reject(new Error(`${this.errorPrefix} Failed to write to stdin: ${err.message}`));
-          }
-        }
-      });
-    });
-  }
-  async deliverConfigureWarnings(configResult, params, options) {
-    if (!this.onConfigureWarnings || !Array.isArray(configResult.warnings))
-      return;
-    if (configResult.warnings.length === 0)
-      return;
-    try {
-      const sessionId = typeof params.session_id === "string" ? params.session_id : undefined;
-      await this.onConfigureWarnings({
-        projectRoot: this.cwd,
-        sessionId,
-        client: options?.configureWarningClient ?? (sessionId ? this.configureWarningClients.get(sessionId) : undefined),
-        warnings: configResult.warnings
-      });
-    } catch (err) {
-      warn(`configure warning delivery failed: ${err instanceof Error ? err.message : String(err)}`);
-    }
-  }
-  async handleConfigureWarningsFrame(frame) {
-    if (!this.onConfigureWarnings)
-      return;
-    const warnings = frame.warnings;
-    if (!Array.isArray(warnings) || warnings.length === 0)
-      return;
-    const projectRoot = typeof frame.project_root === "string" ? frame.project_root : this.cwd;
-    const rawSessionId = frame.session_id;
-    const sessionId = typeof rawSessionId === "string" && rawSessionId.length > 0 ? rawSessionId : null;
-    await this.onConfigureWarnings({
-      projectRoot,
-      sessionId,
-      client: sessionId ? this.configureWarningClients.get(sessionId) : undefined,
-      warnings
-    });
-  }
-  async shutdown() {
-    this._shuttingDown = true;
-    this.clearRestartResetTimer();
-    this.rejectAllPending(new Error(`${this.errorPrefix} Bridge shutting down`));
-    if (this.process) {
-      const proc = this.process;
-      this.process = null;
-      return new Promise((resolve) => {
-        const forceKillTimer = setTimeout(() => {
-          proc.kill("SIGKILL");
-          resolve();
-        }, 5000);
-        proc.once("exit", () => {
-          clearTimeout(forceKillTimer);
-          log("Process exited during shutdown");
-          resolve();
-        });
-        proc.kill("SIGTERM");
-      });
-    }
-  }
-  async checkVersion() {
-    if (!this.minVersion)
-      return;
-    try {
-      const resp = await this.send("version");
-      const binaryVersion = resp.version;
-      if (!binaryVersion) {
-        log("Binary did not report a version — skipping version check");
-        return;
-      }
-      log(`Binary version: ${binaryVersion}`);
-      if (compareSemver(binaryVersion, this.minVersion) < 0) {
-        warn(`Binary version ${binaryVersion} is older than required ${this.minVersion}`);
-        this.onVersionMismatch?.(binaryVersion, this.minVersion);
-      }
-    } catch (err) {
-      warn(`Version check failed: ${err.message}`);
-    }
-  }
-  ensureSpawned() {
-    if (this.isAlive())
-      return;
-    this.spawnProcess();
-  }
-  spawnProcess() {
-    log(`Spawning binary: ${this.binaryPath} (cwd: ${this.cwd})`);
-    const semantic = this.configOverrides.semantic;
-    const semanticBackend = (() => {
-      if (semantic && typeof semantic === "object" && !Array.isArray(semantic)) {
-        const candidate = semantic.backend;
-        return typeof candidate === "string" ? candidate : undefined;
-      }
-      return;
-    })();
-    const useFastembedBackend = semanticBackend === undefined || semanticBackend === "fastembed" || semanticBackend === "";
-    const ortDir = typeof this.configOverrides._ort_dylib_dir === "string" && useFastembedBackend ? this.configOverrides._ort_dylib_dir : null;
-    const ortLibraryPath = ortDir == null ? null : join(ortDir, process.platform === "win32" ? "onnxruntime.dll" : process.platform === "darwin" ? "libonnxruntime.dylib" : "libonnxruntime.so");
-    const envPath = process.platform === "win32" && ortDir ? `${ortDir};${process.env.PATH ?? ""}` : process.env.PATH;
-    const env = {
-      ...process.env,
-      ...envPath ? { PATH: envPath } : {}
-    };
-    if (useFastembedBackend) {
-      env.FASTEMBED_CACHE_DIR = process.env.FASTEMBED_CACHE_DIR || (typeof this.configOverrides.storage_dir === "string" ? join(this.configOverrides.storage_dir, "semantic", "models") : join(homedir() || "", ".cache", "fastembed"));
-      if (ortLibraryPath) {
-        env.ORT_DYLIB_PATH = ortLibraryPath;
-      }
-    }
-    const child = spawn(this.binaryPath, [], {
-      cwd: this.cwd,
-      stdio: ["pipe", "pipe", "pipe"],
-      env
-    });
-    const currentChild = child;
-    child.stdout?.on("data", (chunk) => {
-      this.onStdoutData(chunk.toString("utf-8"));
-    });
-    child.stderr?.on("data", (chunk) => {
-      const lines = chunk.toString("utf-8").trimEnd().split(`
-`);
-      for (const line of lines) {
-        if (!line)
-          continue;
-        const stripped = line.replace(/^\[aft\]\s*/, "");
-        log(`[aft] ${stripped}`);
-        this.pushStderrLine(stripped);
-      }
-    });
-    child.on("error", (err) => {
-      if (this.process !== currentChild)
-        return;
-      error(`Process error: ${err.message}${this.formatStderrTail()}`);
-      this.handleCrash();
-    });
-    child.on("exit", (code, signal) => {
-      if (this.process !== currentChild)
-        return;
-      if (this._shuttingDown)
-        return;
-      log(`Process exited: code=${code}, signal=${signal}`);
-      if (signal === "SIGTERM" || signal === "SIGKILL" || signal === "SIGHUP" || signal === "SIGINT") {
-        this.process = null;
-        this.configured = false;
-        this.clearRestartResetTimer();
-        this.rejectAllPending(new Error(`${this.errorPrefix} Binary killed by ${signal}`));
-        return;
-      }
-      this.handleCrash();
-    });
-    this.process = child;
-    this.stdoutBuffer = "";
-    this.stderrTail = [];
-  }
-  pushStderrLine(line) {
-    this.stderrTail.push(line);
-    if (this.stderrTail.length > BinaryBridge.STDERR_TAIL_MAX) {
-      this.stderrTail.shift();
-    }
-  }
-  formatStderrTail() {
-    if (this.stderrTail.length === 0)
-      return "";
-    const tail = this.stderrTail.join(`
-  `);
-    return `
-  --- last ${this.stderrTail.length} stderr lines ---
-  ${tail}`;
-  }
-  onStdoutData(data) {
-    this.stdoutBuffer += data;
-    if (this.stdoutBuffer.length > MAX_STDOUT_BUFFER) {
-      this.handleCrash(new Error(`aft bridge stdout buffer exceeded ${MAX_STDOUT_BUFFER} bytes — killing bridge`));
-      return;
-    }
-    let newlineIdx;
-    while ((newlineIdx = this.stdoutBuffer.indexOf(`
-`)) !== -1) {
-      const line = this.stdoutBuffer.slice(0, newlineIdx).trim();
-      this.stdoutBuffer = this.stdoutBuffer.slice(newlineIdx + 1);
-      if (!line)
-        continue;
-      try {
-        const response = JSON.parse(line);
-        if (response.type === "progress") {
-          const requestId = response.request_id;
-          const entry = requestId ? this.pending.get(requestId) : undefined;
-          const kind = response.kind === "stderr" ? "stderr" : "stdout";
-          const text = typeof response.chunk === "string" ? response.chunk : "";
-          entry?.onProgress?.({ kind, text });
-          continue;
-        }
-        if (response.type === "permission_ask") {
-          const requestId = response.request_id;
-          const entry = requestId ? this.pending.get(requestId) : undefined;
-          if (requestId && entry) {
-            this.pending.delete(requestId);
-            clearTimeout(entry.timer);
-            entry.resolve({
-              success: false,
-              code: "permission_required",
-              message: "bash command requires permission",
-              asks: response.asks
-            });
-          }
-          continue;
-        }
-        if (response.type === "bash_completed") {
-          this.onBashCompletion?.(response, this);
-          continue;
-        }
-        if (response.type === "configure_warnings") {
-          this.handleConfigureWarningsFrame(response).catch((err) => {
-            warn(`configure warning delivery failed: ${err instanceof Error ? err.message : String(err)}`);
-          });
-          continue;
-        }
-        const id = response.id;
-        if (id && this.pending.has(id)) {
-          const entry = this.pending.get(id);
-          if (!entry)
-            continue;
-          this.pending.delete(id);
-          clearTimeout(entry.timer);
-          this.scheduleRestartCountReset();
-          entry.resolve(response);
-        } else if (typeof response.type === "string") {
-          log(`Ignoring unknown stdout push frame type: ${response.type}`);
-        }
-      } catch (_err) {
-        warn(`Failed to parse stdout line: ${line}`);
-      }
-    }
-  }
-  handleTimeout() {
-    if (this.process) {
-      this.process.kill("SIGKILL");
-      this.process = null;
-    }
-    this.clearRestartResetTimer();
-    this.configured = false;
-    const tail = this.formatStderrTail();
-    this.stderrTail = [];
-    if (tail) {
-      error(`Bridge killed after timeout.${tail}`);
-    } else {
-      warn(`Bridge killed after timeout (see ${getLogFilePath()})`);
-    }
-  }
-  handleCrash(cause) {
-    const proc = this.process;
-    this.process = null;
-    if (proc && proc.exitCode === null && !proc.killed) {
-      proc.kill("SIGKILL");
-    }
-    this.clearRestartResetTimer();
-    this.configured = false;
-    const tail = this.formatStderrTail();
-    if (tail) {
-      error(`Binary crashed (restarts: ${this._restartCount})${cause ? `: ${cause.message}` : ""}.${tail}`);
-    }
-    this.rejectAllPending(new Error(`${this.errorPrefix} Binary crashed (restarts: ${this._restartCount})${cause ? `: ${cause.message}` : ""} (see ${getLogFilePath()})`));
-    if (this._restartCount < this.maxRestarts) {
-      const delay = 100 * 2 ** this._restartCount;
-      this._restartCount++;
-      log(`Auto-restart #${this._restartCount} in ${delay}ms`);
-      setTimeout(() => {
-        if (!this._shuttingDown && !this.isAlive()) {
-          try {
-            this.spawnProcess();
-          } catch (err) {
-            error(`Failed to restart: ${err.message}`);
-          }
-        }
-      }, delay);
-      this.scheduleRestartCountReset();
-    } else {
-      error(`Max restarts (${this.maxRestarts}) reached, giving up. Logs: ${getLogFilePath()}${tail}`);
-      this.scheduleRestartCountReset();
-    }
-  }
-  rejectAllPending(error2) {
-    for (const [_id, entry] of this.pending) {
-      clearTimeout(entry.timer);
-      entry.reject(error2);
-    }
-    this.pending.clear();
-  }
-  scheduleRestartCountReset() {
-    this.clearRestartResetTimer();
-    this.restartResetTimer = setTimeout(() => {
-      this._restartCount = 0;
-      this.restartResetTimer = null;
-    }, BinaryBridge.RESTART_RESET_MS);
-  }
-  clearRestartResetTimer() {
-    if (this.restartResetTimer) {
-      clearTimeout(this.restartResetTimer);
-      this.restartResetTimer = null;
-    }
-  }
-}
-// src/downloader.ts
-import { chmodSync, existsSync, mkdirSync, unlinkSync } from "node:fs";
-import { homedir as homedir2 } from "node:os";
-import { join as join2 } from "node:path";
-
-// src/platform.ts
-var PLATFORM_ARCH_MAP = {
-  darwin: { arm64: "darwin-arm64", x64: "darwin-x64" },
-  linux: { arm64: "linux-arm64", x64: "linux-x64" },
-  win32: { x64: "win32-x64" }
-};
-var PLATFORM_ASSET_MAP = {
-  "darwin-arm64": "aft-darwin-arm64",
-  "darwin-x64": "aft-darwin-x64",
-  "linux-arm64": "aft-linux-arm64",
-  "linux-x64": "aft-linux-x64",
-  "win32-x64": "aft-win32-x64.exe"
-};
-
-// src/downloader.ts
-var REPO = "cortexkit/aft";
-function getCacheDir() {
-  if (process.platform === "win32") {
-    const localAppData = process.env.LOCALAPPDATA || process.env.APPDATA;
-    const base2 = localAppData || join2(homedir2(), "AppData", "Local");
-    return join2(base2, "aft", "bin");
-  }
-  const base = process.env.XDG_CACHE_HOME || join2(homedir2(), ".cache");
-  return join2(base, "aft", "bin");
-}
-function getBinaryName() {
-  return process.platform === "win32" ? "aft.exe" : "aft";
-}
-function getCachedBinaryPath(version) {
-  if (!version)
-    return null;
-  const binaryPath = join2(getCacheDir(), version, getBinaryName());
-  return existsSync(binaryPath) ? binaryPath : null;
-}
-async function downloadBinary(version) {
-  const platformKey = `${process.platform}-${process.arch}`;
-  const assetName = PLATFORM_ASSET_MAP[platformKey];
-  if (!assetName) {
-    error(`Unsupported platform: ${platformKey}`);
-    return null;
-  }
-  const tag = version ?? await fetchLatestTag();
-  if (!tag) {
-    error("Could not determine latest release version.");
-    return null;
-  }
-  const versionedCacheDir = join2(getCacheDir(), tag);
-  const binaryName = getBinaryName();
-  const binaryPath = join2(versionedCacheDir, binaryName);
-  if (existsSync(binaryPath)) {
-    return binaryPath;
-  }
-  const downloadUrl = `https://github.com/${REPO}/releases/download/${tag}/${assetName}`;
-  const checksumUrl = `https://github.com/${REPO}/releases/download/${tag}/checksums.sha256`;
-  log(`Downloading AFT binary (${tag}) for ${platformKey}...`);
-  try {
-    if (!existsSync(versionedCacheDir)) {
-      mkdirSync(versionedCacheDir, { recursive: true });
-    }
-    const [binaryResponse, checksumResponse] = await Promise.all([
-      fetch(downloadUrl, { redirect: "follow" }),
-      fetch(checksumUrl, { redirect: "follow" })
-    ]);
-    if (!binaryResponse.ok) {
-      throw new Error(`HTTP ${binaryResponse.status}: ${binaryResponse.statusText} (${downloadUrl})`);
-    }
-    const arrayBuffer = await binaryResponse.arrayBuffer();
-    if (!checksumResponse.ok) {
-      warn(`Checksum verification failed: no checksums.sha256 found for ${tag}. ` + "Binary download aborted for security reasons.");
-      return null;
-    }
-    const checksumText = await checksumResponse.text();
-    const expectedHash = parseChecksumForAsset(checksumText, assetName);
-    if (!expectedHash) {
-      warn(`Checksum verification failed: checksums.sha256 found but no entry for ${assetName}. ` + "Binary download aborted for security reasons.");
-      return null;
-    }
-    const { createHash } = await import("node:crypto");
-    const actualHash = createHash("sha256").update(Buffer.from(arrayBuffer)).digest("hex");
-    if (actualHash !== expectedHash) {
-      throw new Error(`Checksum mismatch for ${assetName}: expected ${expectedHash}, got ${actualHash}. The binary may have been tampered with.`);
-    }
-    log(`Checksum verified (SHA-256: ${actualHash.slice(0, 16)}...)`);
-    const tmpPath = `${binaryPath}.tmp`;
-    const { writeFileSync } = await import("node:fs");
-    writeFileSync(tmpPath, Buffer.from(arrayBuffer));
-    if (process.platform !== "win32") {
-      chmodSync(tmpPath, 493);
-    }
-    const { renameSync } = await import("node:fs");
-    renameSync(tmpPath, binaryPath);
-    log(`AFT binary ready at ${binaryPath}`);
-    return binaryPath;
-  } catch (err) {
-    const msg = err instanceof Error ? err.message : String(err);
-    error(`Failed to download AFT binary: ${msg}`);
-    const tmpPath = `${binaryPath}.tmp`;
-    if (existsSync(tmpPath)) {
-      try {
-        unlinkSync(tmpPath);
-      } catch {}
-    }
-    return null;
-  }
-}
-async function ensureBinary(version) {
-  if (version) {
-    const versionCached = getCachedBinaryPath(version);
-    if (versionCached) {
-      log(`Found cached binary for ${version}: ${versionCached}`);
-      return versionCached;
-    }
-    log(`No cached binary for ${version}, downloading...`);
-    return downloadBinary(version);
-  }
-  log("No cached binary found, downloading latest...");
-  return downloadBinary();
-}
-function parseChecksumForAsset(checksumText, assetName) {
-  for (const line of checksumText.split(`
-`)) {
-    const trimmed = line.trim();
-    if (!trimmed)
-      continue;
-    const match = trimmed.match(/^([0-9a-f]{64})\s+(.+)$/);
-    if (match && match[2] === assetName) {
-      return match[1];
-    }
-  }
-  return null;
-}
-async function fetchLatestTag() {
-  try {
-    const response = await fetch(`https://api.github.com/repos/${REPO}/releases/latest`, {
-      headers: { Accept: "application/vnd.github.v3+json" }
-    });
-    if (!response.ok)
-      return null;
-    const data = await response.json();
-    return data.tag_name ?? null;
-  } catch {
-    return null;
-  }
-}
-// src/onnx-runtime.ts
-import { execFileSync } from "node:child_process";
-import { createHash } from "node:crypto";
-import {
-  chmodSync as chmodSync2,
-  closeSync,
-  copyFileSync,
-  createWriteStream,
-  existsSync as existsSync2,
-  lstatSync,
-  mkdirSync as mkdirSync2,
-  openSync,
-  readdirSync,
-  readFileSync,
-  readlinkSync,
-  realpathSync,
-  rmSync,
-  statSync,
-  symlinkSync,
-  unlinkSync as unlinkSync2,
-  writeFileSync
-} from "node:fs";
-import { dirname, join as join3, relative, resolve } from "node:path";
-import { Readable } from "node:stream";
-import { pipeline } from "node:stream/promises";
-var ORT_VERSION = "1.24.4";
-var ORT_REPO = "microsoft/onnxruntime";
-var MAX_DOWNLOAD_BYTES = 256 * 1024 * 1024;
-var MAX_EXTRACT_BYTES = 1 * 1024 * 1024 * 1024;
-var ONNX_LOCK_FILE = ".aft-onnx-installing";
-var ONNX_INSTALLED_META_FILE = ".aft-onnx-installed";
-var STALE_LOCK_MS = 30 * 60 * 1000;
-var ORT_PLATFORM_MAP = {
-  darwin: {
-    arm64: {
-      assetName: `onnxruntime-osx-arm64-${ORT_VERSION}`,
-      libName: "libonnxruntime.dylib",
-      archiveType: "tgz"
-    }
-  },
-  linux: {
-    x64: {
-      assetName: `onnxruntime-linux-x64-${ORT_VERSION}`,
-      libName: "libonnxruntime.so",
-      archiveType: "tgz"
-    },
-    arm64: {
-      assetName: `onnxruntime-linux-aarch64-${ORT_VERSION}`,
-      libName: "libonnxruntime.so",
-      archiveType: "tgz"
-    }
-  },
-  win32: {
-    x64: {
-      assetName: `onnxruntime-win-x64-${ORT_VERSION}`,
-      libName: "onnxruntime.dll",
-      archiveType: "zip"
-    },
-    arm64: {
-      assetName: `onnxruntime-win-arm64-${ORT_VERSION}`,
-      libName: "onnxruntime.dll",
-      archiveType: "zip"
-    }
-  }
-};
-function getPlatformInfo() {
-  const platformMap = ORT_PLATFORM_MAP[process.platform];
-  if (!platformMap)
-    return null;
-  return platformMap[process.arch] || null;
-}
-function isOrtAutoDownloadSupported() {
-  return getPlatformInfo() !== null;
-}
-function getManualInstallHint() {
-  if (process.platform === "darwin" && process.arch === "x64") {
-    return "brew install onnxruntime";
-  }
-  if (process.platform === "linux") {
-    return "apt install libonnxruntime or download from https://github.com/microsoft/onnxruntime/releases";
-  }
-  return "Download from https://github.com/microsoft/onnxruntime/releases";
-}
-async function ensureOnnxRuntime(storageDir) {
-  const info = getPlatformInfo();
-  const ortDir = join3(storageDir, "onnxruntime", ORT_VERSION);
-  const libPath = join3(ortDir, info?.libName ?? "libonnxruntime.dylib");
-  if (existsSync2(libPath)) {
-    const meta = readOnnxInstalledMeta(ortDir);
-    if (meta?.sha256) {
-      try {
-        const currentHash = sha256File(libPath);
-        if (currentHash !== meta.sha256) {
-          error(`ONNX Runtime at ${ortDir}: TOFU sha256 mismatch — refusing to use ` + `tampered binary. Recorded ${meta.sha256}, current ${currentHash}. ` + `Run \`aft doctor --clear\` to re-download from scratch.`);
-        } else {
-          log(`ONNX Runtime found at ${ortDir} (TOFU verified)`);
-          return ortDir;
-        }
-      } catch (err) {
-        warn(`Could not verify ONNX Runtime hash at ${ortDir}: ${err}`);
-        return ortDir;
-      }
-    } else {
-      log(`ONNX Runtime found at ${ortDir} (no recorded hash, accepting)`);
-      return ortDir;
-    }
-  }
-  const systemPath = findSystemOnnxRuntime(info?.libName);
-  if (systemPath) {
-    log(`ONNX Runtime found at system path: ${systemPath}`);
-    return systemPath;
-  }
-  if (!info) {
-    warn(`ONNX Runtime auto-download not available for ${process.platform}/${process.arch}. Install manually: ${getManualInstallHint()}`);
-    return null;
-  }
-  const onnxBaseDir = join3(storageDir, "onnxruntime");
-  mkdirSync2(onnxBaseDir, { recursive: true });
-  const lockPath = join3(onnxBaseDir, ONNX_LOCK_FILE);
-  if (!acquireLock(lockPath)) {
-    warn(`ONNX Runtime install already in progress in another process (lock: ${lockPath}). Skipping.`);
-    return null;
-  }
-  try {
-    return await downloadOnnxRuntime(info, ortDir);
-  } finally {
-    releaseLock(lockPath);
-  }
-}
-function findSystemOnnxRuntime(libName) {
-  if (!libName)
-    return null;
-  const searchPaths = [];
-  if (process.platform === "darwin") {
-    searchPaths.push("/opt/homebrew/lib", "/usr/local/lib");
-  } else if (process.platform === "linux") {
-    searchPaths.push("/usr/lib", "/usr/lib/x86_64-linux-gnu", "/usr/lib/aarch64-linux-gnu", "/usr/local/lib");
-  }
-  for (const dir of searchPaths) {
-    if (existsSync2(join3(dir, libName))) {
-      return dir;
-    }
-  }
-  return null;
-}
-async function downloadFileWithCap(url, destPath) {
-  const controller = new AbortController;
-  const timeout = setTimeout(() => controller.abort(), 300000);
-  try {
-    const res = await fetch(url, {
-      headers: { accept: "application/octet-stream" },
-      redirect: "follow",
-      signal: controller.signal
-    });
-    if (!res.ok || !res.body) {
-      throw new Error(`download failed (HTTP ${res.status})`);
-    }
-    const advertised = Number.parseInt(res.headers.get("content-length") ?? "", 10);
-    if (Number.isFinite(advertised) && advertised > MAX_DOWNLOAD_BYTES) {
-      throw new Error(`Content-Length ${advertised} exceeds max ${MAX_DOWNLOAD_BYTES}`);
-    }
-    mkdirSync2(dirname(destPath), { recursive: true });
-    let bytesWritten = 0;
-    const guard = new TransformStream({
-      transform(chunk, transformController) {
-        bytesWritten += chunk.byteLength;
-        if (bytesWritten > MAX_DOWNLOAD_BYTES) {
-          transformController.error(new Error(`download exceeded ${MAX_DOWNLOAD_BYTES} bytes after streaming (server lied about size or sent unbounded body)`));
-          return;
-        }
-        transformController.enqueue(chunk);
-      }
-    });
-    const guarded = res.body.pipeThrough(guard);
-    const nodeStream = Readable.fromWeb(guarded);
-    await pipeline(nodeStream, createWriteStream(destPath), { signal: controller.signal });
-  } catch (err) {
-    try {
-      unlinkSync2(destPath);
-    } catch {}
-    throw err;
-  } finally {
-    clearTimeout(timeout);
-  }
-}
-function validateExtractedTree(stagingRoot) {
-  const realRoot = realpathSync(stagingRoot);
-  let totalBytes = 0;
-  const walk = (dir) => {
-    const entries = readdirSync(dir);
-    for (const entry of entries) {
-      const fullPath = join3(dir, entry);
-      const lst = lstatSync(fullPath);
-      if (lst.isSymbolicLink()) {
-        const linkTarget = readlinkSync(fullPath);
-        const resolvedTarget = resolve(dirname(fullPath), linkTarget);
-        const rel2 = relative(realRoot, resolvedTarget);
-        if (rel2.startsWith("..") || process.platform !== "win32" && rel2.startsWith("/")) {
-          throw new Error(`extracted symlink ${fullPath} points outside staging root: ${linkTarget}`);
-        }
-        continue;
-      }
-      const rel = relative(realRoot, fullPath);
-      if (rel.startsWith("..") || process.platform !== "win32" && rel.startsWith("/")) {
-        throw new Error(`extracted entry ${fullPath} escapes staging root`);
-      }
-      if (lst.isDirectory()) {
-        walk(fullPath);
-        continue;
-      }
-      if (lst.isFile()) {
-        totalBytes += lst.size;
-        if (totalBytes > MAX_EXTRACT_BYTES) {
-          throw new Error(`extracted size ${totalBytes} exceeds max ${MAX_EXTRACT_BYTES} (decompression bomb defense)`);
-        }
-      }
-    }
-  };
-  walk(realRoot);
-}
-async function downloadOnnxRuntime(info, targetDir) {
-  const url = `https://github.com/${ORT_REPO}/releases/download/v${ORT_VERSION}/${info.assetName}.${info.archiveType === "tgz" ? "tgz" : "zip"}`;
-  log(`Downloading ONNX Runtime v${ORT_VERSION} for ${process.platform}/${process.arch}...`);
-  const tmpDir = `${targetDir}.tmp.${process.pid}.${Date.now().toString(36)}`;
-  try {
-    mkdirSync2(tmpDir, { recursive: true });
-    const archivePath = join3(tmpDir, `onnxruntime.${info.archiveType}`);
-    await downloadFileWithCap(url, archivePath);
-    const archiveSha256 = sha256File(archivePath);
-    log(`ONNX Runtime archive sha256=${archiveSha256}`);
-    if (info.archiveType === "tgz") {
-      execFileSync("tar", ["xzf", archivePath, "-C", tmpDir], {
-        stdio: "pipe",
-        timeout: 120000
-      });
-    } else {
-      await extractZipArchive(archivePath, tmpDir);
-    }
-    try {
-      unlinkSync2(archivePath);
-    } catch {}
-    validateExtractedTree(tmpDir);
-    const extractedDir = join3(tmpDir, info.assetName, "lib");
-    if (!existsSync2(extractedDir)) {
-      throw new Error(`Expected directory not found: ${extractedDir}`);
-    }
-    mkdirSync2(targetDir, { recursive: true });
-    const libFiles = readdirSync(extractedDir).filter((f) => f.startsWith("libonnxruntime") || f.startsWith("onnxruntime"));
-    const realFiles = [];
-    const symlinks = [];
-    for (const libFile of libFiles) {
-      const src = join3(extractedDir, libFile);
-      try {
-        const stat = lstatSync(src);
-        log(`ORT extract: ${libFile} — isSymlink=${stat.isSymbolicLink()}, isFile=${stat.isFile()}, size=${stat.size}`);
-        if (stat.isSymbolicLink()) {
-          symlinks.push({ name: libFile, target: readlinkSync(src) });
-        } else {
-          realFiles.push(libFile);
-        }
-      } catch (e) {
-        log(`ORT extract: ${libFile} — stat failed: ${e}`);
-        realFiles.push(libFile);
-      }
-    }
-    for (const libFile of realFiles) {
-      const src = join3(extractedDir, libFile);
-      const dst = join3(targetDir, libFile);
-      try {
-        copyFileSync(src, dst);
-        if (process.platform !== "win32") {
-          chmodSync2(dst, 493);
-        }
-      } catch (copyErr) {
-        log(`ORT extract: failed to copy ${libFile}: ${copyErr}`);
-      }
-    }
-    for (const link of symlinks) {
-      const dst = join3(targetDir, link.name);
-      try {
-        unlinkSync2(dst);
-      } catch {}
-      symlinkSync(link.target, dst);
-    }
-    const libPath = join3(targetDir, info.libName);
-    let libHash = null;
-    try {
-      libHash = sha256File(libPath);
-    } catch (err) {
-      warn(`Could not hash newly-installed ONNX library at ${libPath}: ${err}`);
-    }
-    writeOnnxInstalledMeta(targetDir, ORT_VERSION, libHash, archiveSha256);
-    rmSync(tmpDir, { recursive: true, force: true });
-    log(`ONNX Runtime v${ORT_VERSION} installed to ${targetDir}`);
-    return targetDir;
-  } catch (err) {
-    error(`Failed to download ONNX Runtime: ${err}`);
-    try {
-      rmSync(tmpDir, { recursive: true, force: true });
-    } catch {}
-    try {
-      rmSync(targetDir, { recursive: true, force: true });
-    } catch {}
-    return null;
-  }
-}
-async function extractZipArchive(archivePath, destinationDir) {
-  if (process.platform === "win32") {
-    execFileSync("tar.exe", ["-xf", archivePath, "-C", destinationDir], {
-      stdio: "pipe",
-      timeout: 120000
-    });
-    return;
-  }
-  execFileSync("unzip", ["-q", archivePath, "-d", destinationDir], {
-    stdio: "pipe",
-    timeout: 120000
-  });
-}
-function writeOnnxInstalledMeta(installDir, version, sha256, archiveSha256) {
-  try {
-    const meta = {
-      version,
-      installedAt: new Date().toISOString(),
-      ...sha256 ? { sha256 } : {},
-      archiveSha256
-    };
-    writeFileSync(join3(installDir, ONNX_INSTALLED_META_FILE), JSON.stringify(meta), "utf8");
-  } catch (err) {
-    log(`[onnx] failed to write installed-meta in ${installDir}: ${err}`);
-  }
-}
-function readOnnxInstalledMeta(installDir) {
-  const path = join3(installDir, ONNX_INSTALLED_META_FILE);
-  try {
-    if (!statSync(path).isFile())
-      return null;
-    const raw = readFileSync(path, "utf8");
-    const parsed = JSON.parse(raw);
-    if (typeof parsed.version !== "string" || parsed.version.length === 0)
-      return null;
-    return {
-      version: parsed.version,
-      installedAt: typeof parsed.installedAt === "string" ? parsed.installedAt : "",
-      ...typeof parsed.sha256 === "string" && parsed.sha256.length > 0 ? { sha256: parsed.sha256 } : {},
-      ...typeof parsed.archiveSha256 === "string" && parsed.archiveSha256.length > 0 ? { archiveSha256: parsed.archiveSha256 } : {}
-    };
-  } catch {
-    return null;
-  }
-}
-function sha256File(path) {
-  const hash = createHash("sha256");
-  hash.update(readFileSync(path));
-  return hash.digest("hex");
-}
-function acquireLock(lockPath) {
-  const tryClaim = () => {
-    try {
-      const fd = openSync(lockPath, "wx");
-      try {
-        writeFileSync(fd, `${process.pid}
-${new Date().toISOString()}
-`);
-      } finally {
-        closeSync(fd);
-      }
-      return true;
-    } catch (err) {
-      const code = err.code;
-      if (code === "EEXIST")
-        return false;
-      warn(`[onnx] unexpected error acquiring lock ${lockPath}: ${err}`);
-      return false;
-    }
-  };
-  if (tryClaim())
-    return true;
-  let owningPid = null;
-  let lockMtimeMs = 0;
-  try {
-    const raw = readFileSync(lockPath, "utf8");
-    const firstLine = raw.split(/\r?\n/, 1)[0]?.trim() ?? "";
-    const parsed = Number.parseInt(firstLine, 10);
-    if (Number.isFinite(parsed) && parsed > 0)
-      owningPid = parsed;
-    lockMtimeMs = statSync(lockPath).mtimeMs;
-  } catch {
-    return tryClaim();
-  }
-  const age = Date.now() - lockMtimeMs;
-  const ageWithinFresh = Math.abs(age) < STALE_LOCK_MS;
-  const skipLiveness = process.platform === "win32";
-  const ownerAlive = !skipLiveness && owningPid !== null && isProcessAlive(owningPid);
-  if (skipLiveness ? ageWithinFresh : ownerAlive && ageWithinFresh) {
-    return false;
-  }
-  log(`[onnx] reclaiming install lock (owner_pid=${owningPid ?? "unknown"}, alive=${ownerAlive}, age_ms=${age})`);
-  try {
-    unlinkSync2(lockPath);
-  } catch {}
-  return tryClaim();
-}
-function releaseLock(lockPath) {
-  try {
-    let owningPid = null;
-    try {
-      const raw = readFileSync(lockPath, "utf8");
-      const firstLine = raw.split(/\r?\n/, 1)[0]?.trim() ?? "";
-      const parsed = Number.parseInt(firstLine, 10);
-      if (Number.isFinite(parsed) && parsed > 0)
-        owningPid = parsed;
-    } catch (readErr) {
-      const code = readErr.code;
-      if (code === "ENOENT")
-        return;
-      warn(`[onnx] could not read lock ${lockPath} during release: ${readErr}`);
-      return;
-    }
-    if (owningPid !== process.pid) {
-      log(`[onnx] not releasing lock ${lockPath}: owned by pid ${owningPid ?? "unknown"} (we are ${process.pid})`);
-      return;
-    }
-    try {
-      unlinkSync2(lockPath);
-    } catch (unlinkErr) {
-      const code = unlinkErr.code;
-      if (code !== "ENOENT") {
-        warn(`[onnx] failed to release lock ${lockPath}: ${unlinkErr}`);
-      }
-    }
-  } catch (err) {
-    warn(`[onnx] unexpected error releasing lock ${lockPath}: ${err}`);
-  }
-}
-function isProcessAlive(pid) {
-  try {
-    process.kill(pid, 0);
-    return true;
-  } catch (err) {
-    const code = err.code;
-    if (code === "ESRCH")
-      return false;
-    return true;
-  }
-}
-function cleanupOnnxRuntime(storageDir) {
-  try {
-    const ortBase = join3(storageDir, "onnxruntime");
-    if (existsSync2(ortBase)) {
-      rmSync(ortBase, { recursive: true, force: true });
-    }
-  } catch {}
-}
-// src/pool.ts
-import { realpathSync as realpathSync2 } from "node:fs";
-var DEFAULT_IDLE_TIMEOUT_MS = Infinity;
-var DEFAULT_MAX_POOL_SIZE = 8;
-var CLEANUP_INTERVAL_MS = 60 * 1000;
-
-class BridgePool {
-  bridges = new Map;
-  binaryPath;
-  maxPoolSize;
-  idleTimeoutMs;
-  bridgeOptions;
-  configOverrides;
-  cleanupTimer = null;
-  constructor(binaryPath, options = {}, configOverrides = {}) {
-    this.binaryPath = binaryPath;
-    this.maxPoolSize = options.maxPoolSize ?? DEFAULT_MAX_POOL_SIZE;
-    this.idleTimeoutMs = options.idleTimeoutMs ?? DEFAULT_IDLE_TIMEOUT_MS;
-    this.bridgeOptions = {
-      timeoutMs: options.timeoutMs,
-      maxRestarts: options.maxRestarts,
-      minVersion: options.minVersion,
-      onVersionMismatch: options.onVersionMismatch,
-      onConfigureWarnings: options.onConfigureWarnings,
-      onBashCompletion: options.onBashCompletion
-    };
-    this.configOverrides = configOverrides;
-    if (Number.isFinite(this.idleTimeoutMs)) {
-      this.cleanupTimer = setInterval(() => this.cleanup(), CLEANUP_INTERVAL_MS);
-      this.cleanupTimer.unref();
-    }
-  }
-  getActiveBridgeForRoot(projectRoot) {
-    const key = normalizeKey(projectRoot);
-    const entry = this.bridges.get(key);
-    if (!entry?.bridge.isAlive())
-      return null;
-    entry.lastUsed = Date.now();
-    return entry.bridge;
-  }
-  getBridge(projectRoot) {
-    const key = normalizeKey(projectRoot);
-    const existing = this.bridges.get(key);
-    if (existing) {
-      existing.lastUsed = Date.now();
-      return existing.bridge;
-    }
-    if (this.bridges.size >= this.maxPoolSize) {
-      this.evictLRU();
-    }
-    const bridge = new BinaryBridge(this.binaryPath, key, this.bridgeOptions, this.configOverrides);
-    this.bridges.set(key, { bridge, lastUsed: Date.now() });
-    return bridge;
-  }
-  cleanup() {
-    const now = Date.now();
-    for (const [dir, entry] of this.bridges) {
-      if (now - entry.lastUsed > this.idleTimeoutMs) {
-        entry.bridge.shutdown().catch((err) => error("cleanup shutdown failed:", err));
-        this.bridges.delete(dir);
-      }
-    }
-  }
-  evictLRU() {
-    let oldestDir = null;
-    let oldestTime = Infinity;
-    for (const [dir, entry] of this.bridges) {
-      if (entry.lastUsed < oldestTime) {
-        oldestTime = entry.lastUsed;
-        oldestDir = dir;
-      }
-    }
-    if (oldestDir) {
-      const entry = this.bridges.get(oldestDir);
-      entry?.bridge.shutdown().catch((err) => error("eviction shutdown failed:", err));
-      this.bridges.delete(oldestDir);
-    }
-  }
-  async shutdown() {
-    if (this.cleanupTimer) {
-      clearInterval(this.cleanupTimer);
-      this.cleanupTimer = null;
-    }
-    const shutdowns = Array.from(this.bridges.values()).map((e) => e.bridge.shutdown());
-    this.bridges.clear();
-    await Promise.allSettled(shutdowns);
-  }
-  async replaceBinary(newPath) {
-    this.binaryPath = newPath;
-    const shutdowns = Array.from(this.bridges.values()).map((entry) => entry.bridge.shutdown());
-    this.bridges.clear();
-    await Promise.allSettled(shutdowns);
-    log(`Binary path updated to ${newPath}. All bridges cleared — next calls will use the new binary.`);
-  }
-  get size() {
-    return this.bridges.size;
-  }
-}
-function normalizeKey(projectRoot) {
-  const stripped = projectRoot.replace(/[/\\]+$/, "");
-  try {
-    return realpathSync2(stripped);
-  } catch {
-    return stripped;
-  }
-}
-// src/resolver.ts
-import { execSync, spawnSync } from "node:child_process";
-import { chmodSync as chmodSync3, copyFileSync as copyFileSync2, existsSync as existsSync3, mkdirSync as mkdirSync3, renameSync } from "node:fs";
-import { createRequire as createRequire2 } from "node:module";
-import { homedir as homedir3 } from "node:os";
-import { join as join4 } from "node:path";
-function copyToVersionedCache(npmBinaryPath) {
-  try {
-    const result = spawnSync(npmBinaryPath, ["--version"], {
-      encoding: "utf-8",
-      stdio: ["pipe", "pipe", "pipe"],
-      timeout: 5000
-    });
-    const rawVersion = result.stdout?.trim();
-    if (!rawVersion)
-      return null;
-    const version = rawVersion.replace(/^aft\s+/, "");
-    const tag = version.startsWith("v") ? version : `v${version}`;
-    const cacheDir = getCacheDir();
-    const versionedDir = join4(cacheDir, tag);
-    const ext = process.platform === "win32" ? ".exe" : "";
-    const cachedPath = join4(versionedDir, `aft${ext}`);
-    if (existsSync3(cachedPath))
-      return cachedPath;
-    mkdirSync3(versionedDir, { recursive: true });
-    const tmpPath = `${cachedPath}.tmp`;
-    copyFileSync2(npmBinaryPath, tmpPath);
-    if (process.platform !== "win32") {
-      chmodSync3(tmpPath, 493);
-    }
-    renameSync(tmpPath, cachedPath);
-    log(`Copied npm binary to versioned cache: ${cachedPath}`);
-    return cachedPath;
-  } catch (err) {
-    warn(`Failed to copy binary to cache: ${err instanceof Error ? err.message : String(err)}`);
-    return null;
-  }
-}
-function platformKey(platform = process.platform, arch = process.arch) {
-  const archMap = PLATFORM_ARCH_MAP[platform];
-  if (!archMap) {
-    throw new Error(`Unsupported platform: ${platform} (arch: ${arch}). ` + `Supported platforms: ${Object.keys(PLATFORM_ARCH_MAP).join(", ")}`);
-  }
-  const key = archMap[arch];
-  if (!key) {
-    throw new Error(`Unsupported architecture: ${arch} on platform ${platform}. ` + `Supported architectures for ${platform}: ${Object.keys(archMap).join(", ")}`);
-  }
-  return key;
-}
-function findBinarySync(expectedVersion) {
-  const ext = process.platform === "win32" ? ".exe" : "";
-  const pluginVersion = expectedVersion ?? (() => {
-    try {
-      const req = createRequire2(import.meta.url);
-      return req("../package.json").version;
-    } catch {
-      return null;
-    }
-  })();
-  if (pluginVersion) {
-    const tag = pluginVersion.startsWith("v") ? pluginVersion : `v${pluginVersion}`;
-    const versionCached = getCachedBinaryPath(tag);
-    if (versionCached)
-      return versionCached;
-  }
-  try {
-    const key = platformKey();
-    const packageBin = `@cortexkit/aft-${key}/bin/aft${ext}`;
-    const req = createRequire2(import.meta.url);
-    const resolved = req.resolve(packageBin);
-    if (existsSync3(resolved)) {
-      const copied = copyToVersionedCache(resolved);
-      return copied ?? resolved;
-    }
-  } catch {}
-  try {
-    const whichCmd = process.platform === "win32" ? "where aft" : "which aft";
-    const result = execSync(whichCmd, {
-      encoding: "utf-8",
-      stdio: ["pipe", "pipe", "pipe"]
-    }).trim();
-    if (result)
-      return result;
-  } catch {}
-  const cargoPath = join4(homedir3(), ".cargo", "bin", `aft${ext}`);
-  if (existsSync3(cargoPath))
-    return cargoPath;
-  return null;
-}
-async function findBinary(expectedVersion) {
-  const syncResult = findBinarySync(expectedVersion);
-  if (syncResult) {
-    log(`Resolved binary: ${syncResult}`);
-    return syncResult;
-  }
-  log("Binary not found locally, attempting auto-download...");
-  const downloaded = await ensureBinary();
-  if (downloaded)
-    return downloaded;
-  throw new Error([
-    "Could not find the `aft` binary.",
-    "",
-    "Attempted sources:",
-    "  - Cache directory (~/.cache/aft/bin/)",
-    "  - npm platform package (@cortexkit/aft-<platform>)",
-    "  - PATH lookup (which aft)",
-    "  - ~/.cargo/bin/aft",
-    "  - Auto-download from GitHub releases (failed)",
-    "",
-    "Install it using one of these methods:",
-    "  npm install @cortexkit/aft-opencode        # installs platform-specific binary via npm",
-    "  cargo install agent-file-tools             # from crates.io",
-    "  cargo build --release         # from source (binary at target/release/aft)",
-    "",
-    "Or add the aft directory to your PATH."
-  ].join(`
-`));
-}
-export {
-  setActiveLogger,
-  platformKey,
-  isOrtAutoDownloadSupported,
-  getManualInstallHint,
-  getCachedBinaryPath,
-  getCacheDir,
-  getBinaryName,
-  findBinarySync,
-  findBinary,
-  ensureOnnxRuntime,
-  ensureBinary,
-  downloadBinary,
-  compareSemver,
-  cleanupOnnxRuntime,
-  PLATFORM_ASSET_MAP,
-  PLATFORM_ARCH_MAP,
-  BridgePool,
-  BinaryBridge
-};
+/**
+ * @cortexkit/aft-bridge
+ *
+ * Shared transport, binary resolution, and ONNX runtime helpers for AFT
+ * agent-host plugins. Public surface intentionally narrow — host policies
+ * (config loading, permission UX, tool registration, notifications) stay in
+ * each host plugin.
+ */
+// --- logger contract ---
+export { setActiveLogger } from "./active-logger.js";
+// --- transport ---
+export { BinaryBridge, compareSemver } from "./bridge.js";
+// --- binary resolution ---
+export { downloadBinary, ensureBinary, getBinaryName, getCacheDir, getCachedBinaryPath, } from "./downloader.js";
+// --- ONNX runtime ---
+export { cleanupOnnxRuntime, ensureOnnxRuntime, getManualInstallHint, isOrtAutoDownloadSupported, } from "./onnx-runtime.js";
+// --- platform helpers ---
+export { PLATFORM_ARCH_MAP, PLATFORM_ASSET_MAP } from "./platform.js";
+export { BridgePool } from "./pool.js";
+export { findBinary, findBinarySync, platformKey } from "./resolver.js";
+// --- URL fetch (shared by aft_outline / aft_zoom URL targets) ---
+export { _isPrivateIpv4, cleanupUrlCache, fetchUrlToTempFile } from "./url-fetch.js";
+//# sourceMappingURL=index.js.map