@cortexkit/aft-bridge 0.18.5 → 0.19.1

package/dist/bridge.js

@@ -0,0 +1,671 @@
+import { spawn } from "node:child_process";
+import { homedir } from "node:os";
+import { join } from "node:path";
+import { error, getLogFilePath, log, sessionWarn, warn } from "./active-logger.js";
+const DEFAULT_BRIDGE_TIMEOUT_MS = 30_000;
+const SEMANTIC_TIMEOUT_SAFETY_MARGIN_MS = 5_000;
+const MAX_STDOUT_BUFFER = 64 * 1024 * 1024; // 64MB
+// ## Note on TypeScript `as` type assertions
+//
+// Bridge responses use `as string`, `as string[]` etc. in several places.
+// This is intentional: all 16 tool handlers already guard against error
+// responses with `if (response.success === false) throw ...` before accessing
+// typed fields. The remaining `as` casts are on fields from known-success
+// Rust responses where the shape is guaranteed by the protocol contract.
+// Adding Zod runtime validation for every bridge response would add ~2ms
+// per call with no practical safety benefit given the error guards.
+/**
+ * Compare two semver version strings (major.minor.patch plus pre-release).
+ * Returns: negative if a < b, 0 if equal, positive if a > b.
+ */
+/**
+ * Re-tag a single stderr line forwarded from the `aft` child process.
+ *
+ * env_logger in `aft` emits each log line with an outer `[aft]` or `[aft-lsp]`
+ * tag based on log target. The plugin logger then wraps those lines with its
+ * own `[aft-plugin]` outer tag. We must NOT add a second `[aft]` here when
+ * the line is already tagged, or LSP errors end up rendered as
+ * `[aft-plugin] [aft] [aft-lsp] [aft] ...` (the v0.19.0 doubled-prefix bug).
+ *
+ * Rule:
+ * - Already starts with `[aft]` or `[aft-<word>]` → leave as-is.
+ * - Untagged (rare child-library output, panics, etc.) → prepend `[aft]`.
+ *
+ * Exported for unit testing; production callers use it inside the stderr
+ * `on("data")` handler in `BinaryBridge.spawn`.
+ */
+export function tagStderrLine(line) {
+    return /^\[aft(-\w+)?\] /.test(line) ? line : `[aft] ${line}`;
+}
+export function compareSemver(a, b) {
+    const [aMain, aPre] = a.split("-", 2);
+    const [bMain, bPre] = b.split("-", 2);
+    const aParts = aMain.split(".").map(Number);
+    const bParts = bMain.split(".").map(Number);
+    for (let i = 0; i < 3; i++) {
+        if (aParts[i] !== bParts[i])
+            return (aParts[i] ?? 0) - (bParts[i] ?? 0);
+    }
+    if (!aPre && !bPre)
+        return 0;
+    if (!aPre)
+        return 1;
+    if (!bPre)
+        return -1;
+    const aIds = aPre.split(".");
+    const bIds = bPre.split(".");
+    for (let i = 0; i < Math.max(aIds.length, bIds.length); i++) {
+        const ai = aIds[i];
+        const bi = bIds[i];
+        if (ai === undefined)
+            return -1;
+        if (bi === undefined)
+            return 1;
+        const aNum = /^\d+$/.test(ai);
+        const bNum = /^\d+$/.test(bi);
+        if (aNum && bNum) {
+            const diff = Number.parseInt(ai, 10) - Number.parseInt(bi, 10);
+            if (diff !== 0)
+                return diff;
+        }
+        else if (aNum) {
+            return -1;
+        }
+        else if (bNum) {
+            return 1;
+        }
+        else {
+            const cmp = ai.localeCompare(bi);
+            if (cmp !== 0)
+                return cmp;
+        }
+    }
+    return 0;
+}
+function clampSemanticTimeout(configOverrides, bridgeTimeoutMs) {
+    const semantic = configOverrides.semantic;
+    if (!semantic || typeof semantic !== "object" || Array.isArray(semantic)) {
+        return configOverrides;
+    }
+    const timeoutMs = semantic.timeout_ms;
+    if (typeof timeoutMs !== "number" || !Number.isFinite(timeoutMs)) {
+        return configOverrides;
+    }
+    const maxSemanticTimeoutMs = bridgeTimeoutMs > SEMANTIC_TIMEOUT_SAFETY_MARGIN_MS
+        ? bridgeTimeoutMs - SEMANTIC_TIMEOUT_SAFETY_MARGIN_MS
+        : Math.max(1, bridgeTimeoutMs - 1);
+    if (timeoutMs <= maxSemanticTimeoutMs) {
+        return configOverrides;
+    }
+    warn(`semantic.timeout_ms=${timeoutMs} exceeds bridge timeout budget; clamping to ${maxSemanticTimeoutMs}ms (bridge timeout: ${bridgeTimeoutMs}ms)`);
+    return {
+        ...configOverrides,
+        semantic: {
+            ...semantic,
+            timeout_ms: maxSemanticTimeoutMs,
+        },
+    };
+}
+/**
+ * Manages a persistent `aft` child process, communicating via NDJSON over
+ * stdin/stdout. Lazy-spawns on first `send()` call. Handles crash detection
+ * with exponential backoff auto-restart.
+ */
+export class BinaryBridge {
+    static RESTART_RESET_MS = 5 * 60 * 1000;
+    /** How many recent stderr lines to keep for crash diagnostics. */
+    static STDERR_TAIL_MAX = 20;
+    binaryPath;
+    cwd;
+    process = null;
+    pending = new Map();
+    nextId = 1;
+    stdoutBuffer = "";
+    /** Ring buffer of the last N stderr lines, cleared on every spawn. */
+    stderrTail = [];
+    _restartCount = 0;
+    _shuttingDown = false;
+    timeoutMs;
+    maxRestarts;
+    configured = false;
+    _configurePromise = null;
+    configOverrides;
+    minVersion;
+    onVersionMismatch;
+    onConfigureWarnings;
+    onBashCompletion;
+    /** Notification clients keyed by session_id for async configure warning pushes. */
+    configureWarningClients = new Map();
+    restartResetTimer = null;
+    errorPrefix;
+    constructor(binaryPath, cwd, options, configOverrides) {
+        this.binaryPath = binaryPath;
+        this.cwd = cwd;
+        this.timeoutMs = options?.timeoutMs ?? DEFAULT_BRIDGE_TIMEOUT_MS;
+        this.maxRestarts = options?.maxRestarts ?? 3;
+        this.configOverrides = clampSemanticTimeout(configOverrides ?? {}, this.timeoutMs);
+        this.minVersion = options?.minVersion;
+        this.onVersionMismatch = options?.onVersionMismatch;
+        this.onConfigureWarnings = options?.onConfigureWarnings;
+        this.onBashCompletion = options?.onBashCompletion;
+        this.errorPrefix = options?.errorPrefix ?? "[aft-bridge]";
+    }
+    /** Number of times the binary has been restarted after a crash. */
+    get restartCount() {
+        return this._restartCount;
+    }
+    /** Whether the child process is currently alive. */
+    isAlive() {
+        return this.process !== null && this.process.exitCode === null && !this.process.killed;
+    }
+    hasPendingRequests() {
+        return this.pending.size > 0;
+    }
+    /**
+     * Send a command to the binary and return the parsed response.
+     * Lazy-spawns the binary on first call.
+     */
+    async send(command, params = {}, options) {
+        if (this._shuttingDown) {
+            throw new Error(`${this.errorPrefix} Bridge is shutting down, cannot send "${command}"`);
+        }
+        if (Object.hasOwn(params, "id")) {
+            throw new Error("params cannot contain reserved key 'id'");
+        }
+        this.ensureSpawned();
+        // Capture session_id early so auto-configure can reuse the initiating
+        // session's notification client when the deferred configure warning frame
+        // arrives later. One project bridge can serve many sessions, so keep this
+        // per-session instead of one bridge-wide "last client".
+        const requestSessionId = typeof params.session_id === "string" && params.session_id.length > 0
+            ? params.session_id
+            : undefined;
+        if (requestSessionId && options?.configureWarningClient !== undefined) {
+            this.configureWarningClients.set(requestSessionId, options.configureWarningClient);
+        }
+        // Auto-configure project root + plugin config on first command, then check version.
+        // configured is set AFTER success to prevent skipping configuration on failure (#18).
+        // When multiple parallel calls arrive before configure completes, they all await
+        // the same promise instead of each independently trying to configure.
+        if (!this.configured) {
+            if (command !== "configure" && command !== "version") {
+                if (!this._configurePromise) {
+                    // First caller — create the configure promise.
+                    // All parallel callers await this same promise.
+                    //
+                    // Forward the triggering call's session_id into configure so
+                    // Rust's thread-local session context propagates through to
+                    // background tasks spawned by configure (search-index pre-warm,
+                    // semantic-index build). Without this, background log lines
+                    // emitted by configure threads appear with no session prefix.
+                    const sessionIdForConfigure = typeof params.session_id === "string" ? params.session_id : undefined;
+                    this._configurePromise = (async () => {
+                        try {
+                            const configResult = await this.send("configure", {
+                                project_root: this.cwd,
+                                ...this.configOverrides,
+                                ...(sessionIdForConfigure ? { session_id: sessionIdForConfigure } : {}),
+                            });
+                            if (configResult.success === false) {
+                                throw new Error(`${this.errorPrefix} Configure failed: ${configResult.message ?? "unknown error"}`);
+                            }
+                            // Large-repo warning is emitted by the Rust side via log::warn!
+                            // and relayed through stderr → plugin log. No need to re-log here
+                            // (doing so would just duplicate the same line in aft-plugin.log).
+                            await this.deliverConfigureWarnings(configResult, params, options);
+                            await this.checkVersion();
+                            // Re-check liveness after version check — checkVersion() swallows
+                            // errors as best-effort, so the bridge may have died without throwing.
+                            if (!this.isAlive()) {
+                                throw new Error(`${this.errorPrefix} Bridge died during version check. Check logs: ${getLogFilePath()}`);
+                            }
+                            this.configured = true;
+                        }
+                        finally {
+                            this._configurePromise = null;
+                        }
+                    })();
+                }
+                // All callers (including the first) await the shared promise
+                await this._configurePromise;
+            }
+        }
+        const id = String(this.nextId++);
+        // Wire format: when params contains a key that collides with the protocol
+        // envelope (`command`/`method`), nest params under a `params` key so the
+        // outer dispatch dispatches on `command: "<bridge command>"` rather than
+        // the user's payload key. Reserved envelope fields (`session_id`,
+        // `lsp_hints`) must STILL be promoted to the top level so RawRequest's
+        // dedicated fields deserialize correctly. Without this promotion, e.g.
+        // `bash` (whose params include `command: "<shell command>"`) silently
+        // loses `session_id` because it stays nested inside `params`.
+        let request;
+        if (Object.hasOwn(params, "command") || Object.hasOwn(params, "method")) {
+            const nested = { ...params };
+            const reserved = {};
+            for (const key of ["session_id", "lsp_hints"]) {
+                if (Object.hasOwn(nested, key)) {
+                    reserved[key] = nested[key];
+                    delete nested[key];
+                }
+            }
+            request = { id, command, ...reserved, params: nested };
+        }
+        else {
+            request = { id, command, ...params };
+        }
+        const line = `${JSON.stringify(request)}\n`;
+        // Per-op timeout override: tool wrappers can pass longer budgets for
+        // commands that legitimately need them (callers, trace_to, grep on big
+        // repos). Defaults to the bridge-wide timeout otherwise.
+        const effectiveTimeoutMs = options?.transportTimeoutMs ?? options?.timeoutMs ?? this.timeoutMs;
+        const keepBridgeOnTimeout = options?.keepBridgeOnTimeout === true;
+        return new Promise((resolve, reject) => {
+            const timer = setTimeout(() => {
+                this.pending.delete(id);
+                const restartSuffix = keepBridgeOnTimeout ? "" : " — restarting bridge";
+                const timeoutMsg = `Request "${command}" (id=${id}) timed out after ${effectiveTimeoutMs}ms${restartSuffix}`;
+                if (requestSessionId) {
+                    sessionWarn(requestSessionId, timeoutMsg);
+                }
+                else {
+                    warn(timeoutMsg);
+                }
+                reject(new Error(`${this.errorPrefix} Request "${command}" (id=${id}) timed out after ${effectiveTimeoutMs}ms`));
+                // Kill the hung process so the next request gets a fresh bridge —
+                // unless the caller explicitly opted out (e.g. bash, which enforces
+                // its own timeout on the Rust side and shouldn't lose warm bridge
+                // state when its response is merely late).
+                if (!keepBridgeOnTimeout) {
+                    this.handleTimeout();
+                }
+            }, effectiveTimeoutMs);
+            this.pending.set(id, { resolve, reject, timer, onProgress: options?.onProgress });
+            if (!this.process?.stdin?.writable) {
+                this.pending.delete(id);
+                clearTimeout(timer);
+                reject(new Error(`${this.errorPrefix} stdin not writable for command "${command}"`));
+                return;
+            }
+            this.process.stdin.write(line, (err) => {
+                if (err) {
+                    const entry = this.pending.get(id);
+                    if (entry) {
+                        this.pending.delete(id);
+                        clearTimeout(entry.timer);
+                        entry.reject(new Error(`${this.errorPrefix} Failed to write to stdin: ${err.message}`));
+                    }
+                }
+            });
+        });
+    }
+    async deliverConfigureWarnings(configResult, params, options) {
+        if (!this.onConfigureWarnings || !Array.isArray(configResult.warnings))
+            return;
+        if (configResult.warnings.length === 0)
+            return;
+        try {
+            const sessionId = typeof params.session_id === "string" ? params.session_id : undefined;
+            await this.onConfigureWarnings({
+                projectRoot: this.cwd,
+                sessionId,
+                client: options?.configureWarningClient ??
+                    (sessionId ? this.configureWarningClients.get(sessionId) : undefined),
+                warnings: configResult.warnings,
+            });
+        }
+        catch (err) {
+            warn(`configure warning delivery failed: ${err instanceof Error ? err.message : String(err)}`);
+        }
+    }
+    /**
+     * Handle the `configure_warnings` push frame the Rust binary emits after
+     * configure has returned. The frame carries the warnings produced by the
+     * deferred file walk + missing-binary detection. Forwards to the same
+     * `onConfigureWarnings` handler used for synchronous warnings so plugins
+     * don't need to know about the async path.
+     */
+    async handleConfigureWarningsFrame(frame) {
+        if (!this.onConfigureWarnings)
+            return;
+        const warnings = frame.warnings;
+        if (!Array.isArray(warnings) || warnings.length === 0)
+            return;
+        const projectRoot = typeof frame.project_root === "string" ? frame.project_root : this.cwd;
+        const rawSessionId = frame.session_id;
+        const sessionId = typeof rawSessionId === "string" && rawSessionId.length > 0 ? rawSessionId : null;
+        await this.onConfigureWarnings({
+            projectRoot,
+            sessionId,
+            client: sessionId ? this.configureWarningClients.get(sessionId) : undefined,
+            warnings: warnings,
+        });
+    }
+    /** Kill the child process and reject all pending requests. */
+    async shutdown() {
+        this._shuttingDown = true;
+        this.clearRestartResetTimer();
+        this.rejectAllPending(new Error(`${this.errorPrefix} Bridge shutting down`));
+        if (this.process) {
+            const proc = this.process;
+            this.process = null;
+            return new Promise((resolve) => {
+                const forceKillTimer = setTimeout(() => {
+                    proc.kill("SIGKILL");
+                    resolve();
+                }, 5_000);
+                proc.once("exit", () => {
+                    clearTimeout(forceKillTimer);
+                    log("Process exited during shutdown");
+                    resolve();
+                });
+                proc.kill("SIGTERM");
+            });
+        }
+    }
+    // ---- Internal ----
+    /** Query binary version and compare against minVersion. Calls onVersionMismatch if outdated. */
+    async checkVersion() {
+        if (!this.minVersion)
+            return;
+        try {
+            const resp = await this.send("version");
+            const binaryVersion = resp.version;
+            if (!binaryVersion) {
+                log("Binary did not report a version — skipping version check");
+                return;
+            }
+            log(`Binary version: ${binaryVersion}`);
+            if (compareSemver(binaryVersion, this.minVersion) < 0) {
+                warn(`Binary version ${binaryVersion} is older than required ${this.minVersion}`);
+                this.onVersionMismatch?.(binaryVersion, this.minVersion);
+            }
+        }
+        catch (err) {
+            // Version check is best-effort — don't block tool usage if it fails
+            warn(`Version check failed: ${err.message}`);
+        }
+    }
+    ensureSpawned() {
+        if (this.isAlive())
+            return;
+        this.spawnProcess();
+    }
+    spawnProcess() {
+        log(`Spawning binary: ${this.binaryPath} (cwd: ${this.cwd})`);
+        const semantic = this.configOverrides.semantic;
+        const semanticBackend = (() => {
+            if (semantic && typeof semantic === "object" && !Array.isArray(semantic)) {
+                const candidate = semantic.backend;
+                return typeof candidate === "string" ? candidate : undefined;
+            }
+            return undefined;
+        })();
+        const useFastembedBackend = semanticBackend === undefined || semanticBackend === "fastembed" || semanticBackend === "";
+        const ortDir = typeof this.configOverrides._ort_dylib_dir === "string" && useFastembedBackend
+            ? this.configOverrides._ort_dylib_dir
+            : null;
+        const ortLibraryPath = ortDir == null
+            ? null
+            : join(ortDir, process.platform === "win32"
+                ? "onnxruntime.dll"
+                : process.platform === "darwin"
+                    ? "libonnxruntime.dylib"
+                    : "libonnxruntime.so");
+        const envPath = process.platform === "win32" && ortDir
+            ? `${ortDir};${process.env.PATH ?? ""}`
+            : process.env.PATH;
+        const env = {
+            ...process.env,
+            ...(envPath ? { PATH: envPath } : {}),
+        };
+        if (useFastembedBackend) {
+            // Store fastembed model files alongside the semantic index, not the project cwd.
+            // This is only relevant when the fastembed backend is selected.
+            env.FASTEMBED_CACHE_DIR =
+                process.env.FASTEMBED_CACHE_DIR ||
+                    (typeof this.configOverrides.storage_dir === "string"
+                        ? join(this.configOverrides.storage_dir, "semantic", "models")
+                        : join(homedir() || "", ".cache", "fastembed"));
+            // Point ort to the auto-downloaded or system ONNX Runtime library.
+            if (ortLibraryPath) {
+                env.ORT_DYLIB_PATH = ortLibraryPath;
+            }
+        }
+        const child = spawn(this.binaryPath, [], {
+            cwd: this.cwd,
+            stdio: ["pipe", "pipe", "pipe"],
+            env,
+        });
+        const currentChild = child;
+        child.stdout?.on("data", (chunk) => {
+            this.onStdoutData(chunk.toString("utf-8"));
+        });
+        child.stderr?.on("data", (chunk) => {
+            const lines = chunk.toString("utf-8").trimEnd().split("\n");
+            for (const line of lines) {
+                if (!line)
+                    continue;
+                const tagged = tagStderrLine(line);
+                log(tagged);
+                this.pushStderrLine(tagged);
+            }
+        });
+        child.on("error", (err) => {
+            if (this.process !== currentChild)
+                return;
+            error(`Process error: ${err.message}${this.formatStderrTail()}`);
+            this.handleCrash();
+        });
+        child.on("exit", (code, signal) => {
+            if (this.process !== currentChild)
+                return;
+            if (this._shuttingDown)
+                return;
+            log(`Process exited: code=${code}, signal=${signal}`);
+            // External termination signals (SIGTERM/SIGKILL/SIGHUP/SIGINT) are almost
+            // always intentional kills — from our own shutdown path, OpenCode tearing
+            // down, OS shutdown, or the user killing the host. Auto-restarting here
+            // produces process avalanches (issue #14): N bridges all receive SIGTERM
+            // simultaneously, each "auto-restarts", spawning N fresh processes that
+            // reload ONNX + semantic + trigram indexes. Real Rust panics/crashes exit
+            // with a non-null `code` and `signal === null`; those still restart.
+            if (signal === "SIGTERM" ||
+                signal === "SIGKILL" ||
+                signal === "SIGHUP" ||
+                signal === "SIGINT") {
+                this.process = null;
+                this.configured = false;
+                this.clearRestartResetTimer();
+                this.rejectAllPending(new Error(`${this.errorPrefix} Binary killed by ${signal}`));
+                return;
+            }
+            this.handleCrash();
+        });
+        this.process = child;
+        this.stdoutBuffer = "";
+        // Fresh spawn — clear the stderr ring so crash diagnostics only reflect
+        // the current child's output, not output from prior restart cycles.
+        this.stderrTail = [];
+    }
+    pushStderrLine(line) {
+        this.stderrTail.push(line);
+        if (this.stderrTail.length > BinaryBridge.STDERR_TAIL_MAX) {
+            this.stderrTail.shift();
+        }
+    }
+    /**
+     * Format the current stderr tail for inclusion in error messages. Returns
+     * empty string when nothing has been captured (e.g., silent SIGKILL from
+     * macOS amfid) so the caller can safely concatenate unconditionally.
+     */
+    formatStderrTail() {
+        if (this.stderrTail.length === 0)
+            return "";
+        const tail = this.stderrTail.join("\n  ");
+        return `\n  --- last ${this.stderrTail.length} stderr lines ---\n  ${tail}`;
+    }
+    onStdoutData(data) {
+        this.stdoutBuffer += data;
+        if (this.stdoutBuffer.length > MAX_STDOUT_BUFFER) {
+            this.handleCrash(new Error(`aft bridge stdout buffer exceeded ${MAX_STDOUT_BUFFER} bytes — killing bridge`));
+            return;
+        }
+        // Process complete lines
+        let newlineIdx;
+        while ((newlineIdx = this.stdoutBuffer.indexOf("\n")) !== -1) {
+            const line = this.stdoutBuffer.slice(0, newlineIdx).trim();
+            this.stdoutBuffer = this.stdoutBuffer.slice(newlineIdx + 1);
+            if (!line)
+                continue;
+            try {
+                const response = JSON.parse(line);
+                if (response.type === "progress") {
+                    const requestId = response.request_id;
+                    const entry = requestId ? this.pending.get(requestId) : undefined;
+                    const kind = response.kind === "stderr" ? "stderr" : "stdout";
+                    const text = typeof response.chunk === "string" ? response.chunk : "";
+                    entry?.onProgress?.({ kind, text });
+                    continue;
+                }
+                if (response.type === "permission_ask") {
+                    const requestId = response.request_id;
+                    const entry = requestId ? this.pending.get(requestId) : undefined;
+                    if (requestId && entry) {
+                        this.pending.delete(requestId);
+                        clearTimeout(entry.timer);
+                        entry.resolve({
+                            success: false,
+                            code: "permission_required",
+                            message: "bash command requires permission",
+                            asks: response.asks,
+                        });
+                    }
+                    continue;
+                }
+                if (response.type === "bash_completed") {
+                    this.onBashCompletion?.(response, this);
+                    continue;
+                }
+                if (response.type === "configure_warnings") {
+                    this.handleConfigureWarningsFrame(response).catch((err) => {
+                        warn(`configure warning delivery failed: ${err instanceof Error ? err.message : String(err)}`);
+                    });
+                    continue;
+                }
+                const id = response.id;
+                if (id && this.pending.has(id)) {
+                    const entry = this.pending.get(id);
+                    if (!entry)
+                        continue;
+                    this.pending.delete(id);
+                    clearTimeout(entry.timer);
+                    this.scheduleRestartCountReset();
+                    entry.resolve(response);
+                }
+                else if (typeof response.type === "string") {
+                    log(`Ignoring unknown stdout push frame type: ${response.type}`);
+                }
+            }
+            catch (_err) {
+                warn(`Failed to parse stdout line: ${line}`);
+            }
+        }
+    }
+    handleTimeout() {
+        // A single request timed out. Kill the hung process so the bridge can
+        // respawn on the next call — but do NOT reject other pending requests
+        // here (#21). Each pending request has its own timer and will reject
+        // itself if it also times out. Proactively rejecting peers destroys work
+        // that may have been perfectly healthy (e.g. a `read` call waiting behind
+        // a slow `bash` command).
+        //
+        // When the process dies, its stdout closes and the crash handler fires,
+        // which will reject any remaining pending requests through the normal path.
+        if (this.process) {
+            this.process.kill("SIGKILL");
+            this.process = null;
+        }
+        this.clearRestartResetTimer();
+        this.configured = false;
+        // Capture the stderr tail for diagnostics. The tail goes to the plugin
+        // log only — it's operator-facing noise (loaded N backups, invalidated K
+        // files, etc.) that the agent can't act on, so we don't put it in the
+        // rejection error. Clear the ring so the next spawn doesn't inherit it.
+        const tail = this.formatStderrTail();
+        this.stderrTail = [];
+        if (tail) {
+            error(`Bridge killed after timeout.${tail}`);
+        }
+        else {
+            warn(`Bridge killed after timeout (see ${getLogFilePath()})`);
+        }
+        // Peer requests are NOT rejected here. They will either:
+        // 1. Resolve if the binary somehow still delivers their response (unlikely
+        //    after SIGKILL, but harmless to leave pending briefly), or
+        // 2. Reject through their own timers when they individually expire, or
+        // 3. Reject immediately through handleCrash() when the stdout pipe closes.
+    }
+    handleCrash(cause) {
+        const proc = this.process;
+        this.process = null;
+        if (proc && proc.exitCode === null && !proc.killed) {
+            proc.kill("SIGKILL");
+        }
+        this.clearRestartResetTimer();
+        this.configured = false; // Force reconfigure on next command after restart
+        // Capture the tail BEFORE spawning the replacement, because the next spawn
+        // clears the ring. The tail goes to the plugin log only — it's operator
+        // diagnostic output that the agent can't act on. The pending-request
+        // rejection only carries a pointer to the log.
+        const tail = this.formatStderrTail();
+        if (tail) {
+            error(`Binary crashed (restarts: ${this._restartCount})${cause ? `: ${cause.message}` : ""}.${tail}`);
+        }
+        this.rejectAllPending(new Error(`${this.errorPrefix} Binary crashed (restarts: ${this._restartCount})${cause ? `: ${cause.message}` : ""} (see ${getLogFilePath()})`));
+        // Auto-restart with exponential backoff
+        if (this._restartCount < this.maxRestarts) {
+            const delay = 100 * 2 ** this._restartCount; // 100ms, 200ms, 400ms
+            this._restartCount++;
+            log(`Auto-restart #${this._restartCount} in ${delay}ms`);
+            setTimeout(() => {
+                if (!this._shuttingDown && !this.isAlive()) {
+                    try {
+                        this.spawnProcess();
+                    }
+                    catch (err) {
+                        error(`Failed to restart: ${err.message}`);
+                    }
+                }
+            }, delay);
+            // Also decay the counter over time so repeated crashes without any
+            // successful response don't permanently wedge the bridge.
+            this.scheduleRestartCountReset();
+        }
+        else {
+            error(`Max restarts (${this.maxRestarts}) reached, giving up. Logs: ${getLogFilePath()}${tail}`);
+            this.scheduleRestartCountReset();
+        }
+    }
+    rejectAllPending(error) {
+        for (const [_id, entry] of this.pending) {
+            clearTimeout(entry.timer);
+            entry.reject(error);
+        }
+        this.pending.clear();
+    }
+    scheduleRestartCountReset() {
+        this.clearRestartResetTimer();
+        this.restartResetTimer = setTimeout(() => {
+            this._restartCount = 0;
+            this.restartResetTimer = null;
+        }, BinaryBridge.RESTART_RESET_MS);
+    }
+    clearRestartResetTimer() {
+        if (this.restartResetTimer) {
+            clearTimeout(this.restartResetTimer);
+            this.restartResetTimer = null;
+        }
+    }
+}
+//# sourceMappingURL=bridge.js.map