@cortexkit/aft-opencode 0.16.0 → 0.17.0

package/dist/index.js

@@ -7803,10 +7803,10 @@ var require_src2 = __commonJS((exports, module) => {
 });
 
 // src/index.ts
-import { existsSync as existsSync9, mkdirSync as mkdirSync8, readFileSync as readFileSync5, writeFileSync as writeFileSync5 } from "fs";
+import { existsSync as existsSync12, mkdirSync as mkdirSync10, readFileSync as readFileSync6, writeFileSync as writeFileSync6 } from "fs";
 import { createRequire as createRequire2 } from "module";
-import { homedir as homedir7 } from "os";
-import { join as join13 } from "path";
+import { homedir as homedir8 } from "os";
+import { join as join16 } from "path";
 
 // src/config.ts
 var import_comment_json = __toESM(require_src2(), 1);
@@ -21461,7 +21461,10 @@ var LspServerSchema = LspServerEntrySchema.extend({
 var LspConfigSchema = exports_external.object({
   servers: exports_external.record(exports_external.string().trim().min(1), LspServerEntrySchema).optional(),
   disabled: exports_external.array(exports_external.string().trim().min(1)).optional(),
-  python: exports_external.enum(["pyright", "ty", "auto"]).optional()
+  python: exports_external.enum(["pyright", "ty", "auto"]).optional(),
+  auto_install: exports_external.boolean().optional(),
+  grace_days: exports_external.number().int().positive().optional(),
+  versions: exports_external.record(exports_external.string().trim().min(1), exports_external.string().trim().min(1)).optional()
 });
 var AftConfigSchema = exports_external.object({
   format_on_edit: exports_external.boolean().optional(),
@@ -21490,7 +21493,7 @@ function resolveLspConfigForConfigure(config2) {
   switch (config2.lsp?.python ?? "auto") {
     case "ty":
       experimentalTy = true;
-      disabled.add("pyright");
+      disabled.add("python");
       break;
     case "pyright":
       experimentalTy = false;
@@ -21604,26 +21607,79 @@ function mergeSemanticConfig(baseSemantic, overrideSemantic) {
   }
   return Object.fromEntries(Object.entries(semantic).filter(([, value]) => value !== undefined));
 }
+function mergeLspConfig(baseLsp, overrideLsp) {
+  const projectLsp = {};
+  if (overrideLsp?.python !== undefined)
+    projectLsp.python = overrideLsp.python;
+  const userDisabled = baseLsp?.disabled ?? [];
+  const lsp = {
+    ...baseLsp,
+    ...projectLsp,
+    ...userDisabled.length > 0 ? { disabled: [...userDisabled] } : {}
+  };
+  if (Object.values(lsp).every((value) => value === undefined)) {
+    return;
+  }
+  return Object.fromEntries(Object.entries(lsp).filter(([, value]) => value !== undefined));
+}
+function getProjectLspStrippedKeys(lsp) {
+  if (!lsp) {
+    return [];
+  }
+  const strippedKeys = [];
+  if (lsp.servers !== undefined)
+    strippedKeys.push("lsp.servers");
+  if (lsp.versions !== undefined)
+    strippedKeys.push("lsp.versions");
+  if (lsp.auto_install !== undefined)
+    strippedKeys.push("lsp.auto_install");
+  if (lsp.grace_days !== undefined)
+    strippedKeys.push("lsp.grace_days");
+  if (lsp.disabled !== undefined)
+    strippedKeys.push("lsp.disabled");
+  return strippedKeys;
+}
+var PROJECT_SAFE_TOP_LEVEL_FIELDS = new Set([
+  "tool_surface",
+  "hoist_builtin_tools",
+  "format_on_edit",
+  "validate_on_edit",
+  "experimental_search_index",
+  "experimental_semantic_search",
+  "experimental_lsp_ty"
+]);
+function pickProjectSafeFields(override) {
+  const safe = {};
+  for (const key of PROJECT_SAFE_TOP_LEVEL_FIELDS) {
+    if (override[key] !== undefined) {
+      safe[key] = override[key];
+    }
+  }
+  return safe;
+}
+function getStrippedTopLevelKeys(override) {
+  const stripped = [];
+  if (override.restrict_to_project_root !== undefined)
+    stripped.push("restrict_to_project_root");
+  if (override.url_fetch_allow_private !== undefined)
+    stripped.push("url_fetch_allow_private");
+  if (override.max_callgraph_files !== undefined)
+    stripped.push("max_callgraph_files");
+  return stripped;
+}
 function mergeConfigs(base, override) {
   const disabledTools = [...base.disabled_tools ?? [], ...override.disabled_tools ?? []];
   const formatter = { ...base.formatter, ...override.formatter };
   const checker = { ...base.checker, ...override.checker };
   const semantic = mergeSemanticConfig(base.semantic, override.semantic);
-  const lspServers = { ...base.lsp?.servers, ...override.lsp?.servers };
-  const disabledLsp = [...base.lsp?.disabled ?? [], ...override.lsp?.disabled ?? []];
-  const lsp = {
-    ...base.lsp,
-    ...override.lsp,
-    ...Object.keys(lspServers).length > 0 ? { servers: lspServers } : {},
-    ...disabledLsp.length > 0 ? { disabled: [...new Set(disabledLsp)] } : {}
-  };
-  const { semantic: _stripSemantic, ...safeOverride } = override;
+  const lsp = mergeLspConfig(base.lsp, override.lsp);
+  const safeOverride = pickProjectSafeFields(override);
   return {
     ...base,
     ...safeOverride,
     ...Object.keys(formatter).length > 0 ? { formatter } : {},
     ...Object.keys(checker).length > 0 ? { checker } : {},
-    ...Object.values(lsp).some((value) => value !== undefined) ? { lsp } : {},
+    ...lsp ? { lsp } : {},
     semantic,
     ...disabledTools.length > 0 ? { disabled_tools: [...new Set(disabledTools)] } : {}
   };
@@ -21650,6 +21706,14 @@ function loadAftConfig(projectDirectory) {
     if (projectConfig.semantic?.backend !== undefined || projectConfig.semantic?.base_url !== undefined || projectConfig.semantic?.api_key_env !== undefined) {
       warn("Ignoring semantic.backend/base_url/api_key_env from project config (security: use user config for external backends)");
     }
+    const strippedLspKeys = getProjectLspStrippedKeys(projectConfig.lsp);
+    if (strippedLspKeys.length > 0) {
+      warn(`Ignoring ${strippedLspKeys.join(", ")} from project config ${projectConfigPath} (security: these LSP settings only honor user-level config)`);
+    }
+    const strippedTopLevelKeys = getStrippedTopLevelKeys(projectConfig);
+    if (strippedTopLevelKeys.length > 0) {
+      warn(`Ignoring ${strippedTopLevelKeys.join(", ")} from project config ${projectConfigPath} (security: these settings only honor user-level config \u2014 a project should not weaken security boundaries for the user)`);
+    }
     config2 = mergeConfigs(config2, projectConfig);
   }
   return config2;
@@ -21805,6 +21869,1361 @@ async function fetchLatestTag() {
   }
 }
 
+// src/lsp-auto-install.ts
+import { spawn } from "child_process";
+import { createHash } from "crypto";
+import { createReadStream, statSync as statSync2 } from "fs";
+
+// src/lsp-cache.ts
+import {
+  closeSync,
+  existsSync as existsSync3,
+  mkdirSync as mkdirSync2,
+  openSync,
+  readFileSync as readFileSync2,
+  statSync,
+  unlinkSync as unlinkSync2,
+  writeFileSync
+} from "fs";
+import { homedir as homedir3 } from "os";
+import { join as join4 } from "path";
+function aftCacheBase() {
+  const override = process.env.AFT_CACHE_DIR;
+  if (override && override.length > 0)
+    return override;
+  if (process.platform === "win32") {
+    const localAppData = process.env.LOCALAPPDATA || process.env.APPDATA;
+    const base2 = localAppData || join4(homedir3(), "AppData", "Local");
+    return join4(base2, "aft");
+  }
+  const base = process.env.XDG_CACHE_HOME || join4(homedir3(), ".cache");
+  return join4(base, "aft");
+}
+function lspCacheRoot() {
+  return join4(aftCacheBase(), "lsp-packages");
+}
+function lspPackageDir(npmPackage) {
+  return join4(lspCacheRoot(), encodeURIComponent(npmPackage));
+}
+function lspBinaryPath(npmPackage, binary) {
+  return join4(lspPackageDir(npmPackage), "node_modules", ".bin", binary);
+}
+function lspBinDir(npmPackage) {
+  return join4(lspPackageDir(npmPackage), "node_modules", ".bin");
+}
+function isInstalled(npmPackage, binary) {
+  for (const candidate of lspBinaryCandidates(binary)) {
+    try {
+      if (statSync(join4(lspBinDir(npmPackage), candidate)).isFile())
+        return true;
+    } catch {}
+  }
+  return false;
+}
+function lspBinaryCandidates(binary) {
+  if (process.platform !== "win32")
+    return [binary];
+  return [binary, `${binary}.cmd`, `${binary}.exe`, `${binary}.bat`];
+}
+var INSTALLED_META_FILE = ".aft-installed";
+function writeInstalledMetaIn(installDir, version2, sha256) {
+  try {
+    mkdirSync2(installDir, { recursive: true });
+    const meta3 = {
+      version: version2,
+      installedAt: new Date().toISOString(),
+      ...sha256 ? { sha256 } : {}
+    };
+    writeFileSync(join4(installDir, INSTALLED_META_FILE), JSON.stringify(meta3), "utf8");
+  } catch (err) {
+    log(`[lsp-cache] failed to write installed-meta in ${installDir}: ${err}`);
+  }
+}
+function readInstalledMetaIn(installDir) {
+  const path2 = join4(installDir, INSTALLED_META_FILE);
+  try {
+    if (!statSync(path2).isFile())
+      return null;
+    const raw = readFileSync2(path2, "utf8");
+    const parsed = JSON.parse(raw);
+    if (typeof parsed.version !== "string" || parsed.version.length === 0)
+      return null;
+    return {
+      version: parsed.version,
+      installedAt: typeof parsed.installedAt === "string" ? parsed.installedAt : "",
+      ...typeof parsed.sha256 === "string" && parsed.sha256.length > 0 ? { sha256: parsed.sha256 } : {}
+    };
+  } catch {
+    return null;
+  }
+}
+function writeInstalledMeta(packageKey, version2, sha256) {
+  writeInstalledMetaIn(lspPackageDir(packageKey), version2, sha256);
+}
+function readInstalledMeta(packageKey) {
+  return readInstalledMetaIn(lspPackageDir(packageKey));
+}
+function lockPath(npmPackage) {
+  return join4(lspPackageDir(npmPackage), ".aft-installing");
+}
+var STALE_LOCK_MS = 30 * 60 * 1000;
+function acquireInstallLock(lockKey) {
+  mkdirSync2(lspPackageDir(lockKey), { recursive: true });
+  const lock = lockPath(lockKey);
+  const tryClaim = () => {
+    try {
+      const fd = openSync(lock, "wx");
+      try {
+        writeFileSync(fd, `${process.pid}
+${new Date().toISOString()}
+`);
+      } finally {
+        closeSync(fd);
+      }
+      return true;
+    } catch (err) {
+      const code = err.code;
+      if (code === "EEXIST")
+        return false;
+      warn(`[lsp] unexpected error acquiring install lock for ${lockKey}: ${err}`);
+      return false;
+    }
+  };
+  if (tryClaim())
+    return true;
+  let owningPid = null;
+  let lockMtimeMs = 0;
+  try {
+    const raw = readFileSync2(lock, "utf8");
+    const firstLine = raw.split(/\r?\n/, 1)[0]?.trim() ?? "";
+    const parsed = Number.parseInt(firstLine, 10);
+    if (Number.isFinite(parsed) && parsed > 0)
+      owningPid = parsed;
+    lockMtimeMs = statSync(lock).mtimeMs;
+  } catch {
+    return tryClaim();
+  }
+  const age = Date.now() - lockMtimeMs;
+  const ageWithinFresh = Math.abs(age) < STALE_LOCK_MS;
+  const skipLiveness = process.platform === "win32";
+  const ownerAlive = !skipLiveness && owningPid !== null && isProcessAlive(owningPid);
+  if (skipLiveness ? ageWithinFresh : ownerAlive && ageWithinFresh) {
+    return false;
+  }
+  log(`[lsp] reclaiming install lock for ${lockKey} (owner_pid=${owningPid ?? "unknown"}, alive=${ownerAlive}, age_ms=${age})`);
+  try {
+    unlinkSync2(lock);
+  } catch {}
+  return tryClaim();
+}
+function isProcessAlive(pid) {
+  try {
+    process.kill(pid, 0);
+    return true;
+  } catch (err) {
+    const code = err.code;
+    if (code === "ESRCH")
+      return false;
+    return true;
+  }
+}
+function releaseInstallLock(lockKey) {
+  const lock = lockPath(lockKey);
+  try {
+    if (existsSync3(lock)) {
+      unlinkSync2(lock);
+    }
+  } catch (err) {
+    warn(`[lsp] failed to release install lock for ${lockKey}: ${err}`);
+  }
+}
+async function withInstallLock(lockKey, task) {
+  if (!acquireInstallLock(lockKey))
+    return null;
+  try {
+    return await task();
+  } finally {
+    releaseInstallLock(lockKey);
+  }
+}
+var VERSION_CHECK_FILE = ".aft-version-check";
+function readVersionCheck(npmPackage) {
+  const file2 = join4(lspPackageDir(npmPackage), VERSION_CHECK_FILE);
+  try {
+    const raw = readFileSync2(file2, "utf8");
+    const parsed = JSON.parse(raw);
+    if (typeof parsed.last_checked === "string") {
+      return {
+        last_checked: parsed.last_checked,
+        latest_eligible: typeof parsed.latest_eligible === "string" ? parsed.latest_eligible : null
+      };
+    }
+    return null;
+  } catch {
+    return null;
+  }
+}
+function writeVersionCheck(npmPackage, latest) {
+  mkdirSync2(lspPackageDir(npmPackage), { recursive: true });
+  const file2 = join4(lspPackageDir(npmPackage), VERSION_CHECK_FILE);
+  const record2 = {
+    last_checked: new Date().toISOString(),
+    latest_eligible: latest
+  };
+  writeFileSync(file2, JSON.stringify(record2, null, 2));
+}
+function shouldRecheckVersion(record2, weeklyCheckIntervalMs = 7 * 24 * 60 * 60 * 1000) {
+  if (!record2)
+    return true;
+  const age = Date.now() - new Date(record2.last_checked).getTime();
+  if (Number.isNaN(age) || age < 0)
+    return true;
+  return age >= weeklyCheckIntervalMs;
+}
+
+// src/lsp-github-probe.ts
+function pickEligibleRelease(releases, graceDays, now = Date.now()) {
+  const cutoff = now - graceDays * 24 * 60 * 60 * 1000;
+  const candidates = releases.filter((r) => !r.draft && !r.prerelease && typeof r.published_at === "string").map((r) => {
+    const ts = Date.parse(r.published_at);
+    return { release: r, ts };
+  }).filter((c) => !Number.isNaN(c.ts)).sort((a, b) => b.ts - a.ts);
+  const eligible = candidates.filter((c) => c.ts <= cutoff);
+  const blockedByGrace = candidates.length > 0 && eligible.length === 0;
+  const chosen = eligible[0]?.release;
+  if (!chosen) {
+    return { tag: null, assets: [], blockedByGrace };
+  }
+  return {
+    tag: chosen.tag_name,
+    assets: (chosen.assets ?? []).map((a) => ({
+      name: a.name,
+      url: a.browser_download_url,
+      size: a.size
+    })),
+    blockedByGrace: false
+  };
+}
+async function probeGithubReleases(githubRepo, graceDays, fetchImpl = fetch) {
+  const url2 = `https://api.github.com/repos/${githubRepo}/releases?per_page=30`;
+  try {
+    const headers = { accept: "application/vnd.github+json" };
+    if (process.env.GITHUB_TOKEN) {
+      headers.authorization = `Bearer ${process.env.GITHUB_TOKEN}`;
+    }
+    const res = await fetchImpl(url2, {
+      headers,
+      signal: AbortSignal.timeout(1e4)
+    });
+    if (!res.ok) {
+      warn(`[lsp] github releases probe failed for ${githubRepo}: HTTP ${res.status}`);
+      return null;
+    }
+    const json2 = await res.json();
+    if (!Array.isArray(json2)) {
+      warn(`[lsp] unexpected response shape from github releases for ${githubRepo}`);
+      return null;
+    }
+    return pickEligibleRelease(json2, graceDays);
+  } catch (err) {
+    warn(`[lsp] github releases probe failed for ${githubRepo}: ${err}`);
+    return null;
+  }
+}
+var SAFE_VERSION_RE = /^[A-Za-z0-9._+-]+$/;
+function assertSafeVersion(version2) {
+  if (!SAFE_VERSION_RE.test(version2)) {
+    throw new Error(`unsafe version/tag string ${JSON.stringify(version2)}: must match ${SAFE_VERSION_RE.source}`);
+  }
+}
+function stripTagV(tag) {
+  assertSafeVersion(tag);
+  return tag.startsWith("v") ? tag.slice(1) : tag;
+}
+
+// src/lsp-npm-table.ts
+var NPM_LSP_TABLE = [
+  {
+    id: "typescript",
+    npm: "typescript-language-server",
+    binary: "typescript-language-server",
+    extensions: ["ts", "tsx", "js", "jsx", "mjs", "cjs", "mts", "cts"],
+    rootMarkers: ["tsconfig.json", "jsconfig.json", "package.json"]
+  },
+  {
+    id: "python",
+    npm: "pyright",
+    binary: "pyright-langserver",
+    extensions: ["py", "pyi"],
+    rootMarkers: ["pyproject.toml", "pyrightconfig.json", "requirements.txt"]
+  },
+  {
+    id: "yaml",
+    npm: "yaml-language-server",
+    binary: "yaml-language-server",
+    extensions: ["yaml", "yml"]
+  },
+  {
+    id: "bash",
+    npm: "bash-language-server",
+    binary: "bash-language-server",
+    extensions: ["sh", "bash", "zsh"]
+  },
+  {
+    id: "dockerfile",
+    npm: "dockerfile-language-server-nodejs",
+    binary: "docker-langserver",
+    extensions: ["dockerfile"],
+    rootMarkers: ["Dockerfile", "dockerfile"]
+  },
+  {
+    id: "vue",
+    npm: "@vue/language-server",
+    binary: "vue-language-server",
+    extensions: ["vue"]
+  },
+  {
+    id: "astro",
+    npm: "@astrojs/language-server",
+    binary: "astro-ls",
+    extensions: ["astro"]
+  },
+  {
+    id: "svelte",
+    npm: "svelte-language-server",
+    binary: "svelteserver",
+    extensions: ["svelte"]
+  },
+  {
+    id: "php-intelephense",
+    npm: "intelephense",
+    binary: "intelephense",
+    extensions: ["php"]
+  },
+  {
+    id: "biome",
+    npm: "@biomejs/biome",
+    binary: "biome",
+    extensions: ["ts", "tsx", "js", "jsx", "mjs", "cjs", "mts", "cts", "json", "jsonc"],
+    rootMarkers: ["biome.json", "biome.jsonc"]
+  }
+];
+
+// src/lsp-project-relevance.ts
+import { existsSync as existsSync4, readdirSync } from "fs";
+import { join as join5 } from "path";
+var MAX_WALK_DIRS = 200;
+var MAX_WALK_DEPTH = 4;
+var NOISE_DIRS = new Set([
+  ".git",
+  ".next",
+  ".venv",
+  "__pycache__",
+  "build",
+  "dist",
+  "node_modules",
+  "target"
+]);
+function hasRootMarker(projectRoot, rootMarkers) {
+  if (!rootMarkers)
+    return false;
+  for (const marker of rootMarkers) {
+    if (existsSync4(join5(projectRoot, marker)))
+      return true;
+  }
+  return false;
+}
+function relevantExtensionsInProject(projectRoot, extToServer) {
+  const wanted = new Set(Object.keys(extToServer).map((ext) => ext.toLowerCase()));
+  const found = new Set;
+  if (wanted.size === 0)
+    return found;
+  const queue = [{ dir: projectRoot, depth: 0 }];
+  let visitedDirs = 0;
+  while (queue.length > 0 && visitedDirs < MAX_WALK_DIRS) {
+    const current = queue.shift();
+    if (!current)
+      break;
+    visitedDirs += 1;
+    let entries;
+    try {
+      entries = readdirSync(current.dir, { withFileTypes: true });
+    } catch {
+      continue;
+    }
+    for (const entry of entries) {
+      if (entry.isDirectory()) {
+        if (current.depth < MAX_WALK_DEPTH && !NOISE_DIRS.has(entry.name.toLowerCase())) {
+          queue.push({ dir: join5(current.dir, entry.name), depth: current.depth + 1 });
+        }
+        continue;
+      }
+      if (!entry.isFile())
+        continue;
+      const ext = extensionOf(entry.name);
+      if (ext && wanted.has(ext))
+        found.add(ext);
+    }
+  }
+  return found;
+}
+function extensionOf(fileName) {
+  const dot = fileName.lastIndexOf(".");
+  if (dot < 0 || dot === fileName.length - 1)
+    return null;
+  return fileName.slice(dot + 1).toLowerCase();
+}
+
+// src/lsp-registry-probe.ts
+var NPM_REGISTRY_BASE = "https://registry.npmjs.org";
+function pickEligibleVersion(response, graceDays, now = Date.now()) {
+  const times = response.time || {};
+  const cutoff = now - graceDays * 24 * 60 * 60 * 1000;
+  const candidates = [];
+  for (const [version2, publishedAt] of Object.entries(times)) {
+    if (version2 === "created" || version2 === "modified")
+      continue;
+    if (version2.includes("-"))
+      continue;
+    if (typeof publishedAt !== "string")
+      continue;
+    const ts = Date.parse(publishedAt);
+    if (Number.isNaN(ts))
+      continue;
+    candidates.push({ version: version2, publishedAt, ts });
+  }
+  candidates.sort((a, b) => b.ts - a.ts);
+  const eligible = candidates.filter((c) => c.ts <= cutoff);
+  const blockedByGrace = candidates.length > 0 && eligible.length === 0;
+  return {
+    version: eligible[0]?.version ?? null,
+    blockedByGrace,
+    eligible: eligible.map(({ version: version2, publishedAt }) => ({ version: version2, publishedAt }))
+  };
+}
+async function probeRegistry(npmPackage, graceDays, fetchImpl = fetch) {
+  const encoded = encodeURIComponent(npmPackage).replace(/^%40/, "@");
+  const url2 = `${NPM_REGISTRY_BASE}/${encoded}`;
+  try {
+    const res = await fetchImpl(url2, {
+      headers: { accept: "application/json" },
+      signal: AbortSignal.timeout(1e4)
+    });
+    if (!res.ok) {
+      warn(`[lsp] registry probe failed for ${npmPackage}: HTTP ${res.status}`);
+      return null;
+    }
+    const json2 = await res.json();
+    return pickEligibleVersion(json2, graceDays);
+  } catch (err) {
+    warn(`[lsp] registry probe failed for ${npmPackage}: ${err}`);
+    return null;
+  }
+}
+
+// src/lsp-auto-install.ts
+function isProjectRelevant(spec, projectRoot, projectExtensions) {
+  if (hasRootMarker(projectRoot, spec.rootMarkers))
+    return true;
+  const extensions = projectExtensions();
+  return spec.extensions.some((ext) => extensions.has(ext.toLowerCase()));
+}
+var npmExtToServerIds = buildExtensionMap(NPM_LSP_TABLE);
+function buildExtensionMap(specs) {
+  const byExt = {};
+  for (const spec of specs) {
+    for (const ext of spec.extensions) {
+      const key = ext.toLowerCase();
+      byExt[key] ??= [];
+      byExt[key].push(spec.id);
+    }
+  }
+  return byExt;
+}
+var inFlightAutoInstalls = new Set;
+function trackInFlightAutoInstall(controller, promise2) {
+  const entry = { controller, promise: promise2 };
+  inFlightAutoInstalls.add(entry);
+  promise2.then(() => inFlightAutoInstalls.delete(entry), () => inFlightAutoInstalls.delete(entry));
+  return promise2;
+}
+async function abortInFlightAutoInstalls() {
+  const installs = Array.from(inFlightAutoInstalls);
+  for (const install of installs) {
+    install.controller.abort();
+  }
+  await Promise.allSettled(installs.map((install) => install.promise));
+}
+async function resolveTargetVersion(spec, config2, fetchImpl = fetch) {
+  const pinned = config2.versions[spec.npm];
+  if (pinned) {
+    assertSafeVersion(pinned);
+    return { version: pinned, pinned: true, probe: null };
+  }
+  const cached2 = readVersionCheck(spec.npm);
+  const weeklyMs = config2.graceDays * 24 * 60 * 60 * 1000;
+  if (!shouldRecheckVersion(cached2, weeklyMs) && cached2?.latest_eligible) {
+    return { version: cached2.latest_eligible, pinned: false, probe: null };
+  }
+  const probe = await probeRegistry(spec.npm, config2.graceDays, fetchImpl);
+  if (!probe) {
+    return {
+      version: cached2?.latest_eligible ?? null,
+      pinned: false,
+      probe: null
+    };
+  }
+  writeVersionCheck(spec.npm, probe.version);
+  return { version: probe.version, pinned: false, probe };
+}
+function runInstall(spec, version2, cwd, signal) {
+  return new Promise((resolve) => {
+    const target = `${spec.npm}@${version2}`;
+    log(`[lsp] installing ${target} to ${cwd}`);
+    if (signal?.aborted) {
+      warn(`[lsp] install ${target} aborted before spawn`);
+      resolve(false);
+      return;
+    }
+    const child = spawn("bun", ["add", target, "--cwd", cwd, "--ignore-scripts", "--silent"], {
+      stdio: ["ignore", "pipe", "pipe"]
+    });
+    child.unref();
+    let stderrBuf = "";
+    let settled = false;
+    let killTimer = null;
+    const cleanup = () => {
+      signal?.removeEventListener("abort", onAbort);
+      if (killTimer)
+        clearTimeout(killTimer);
+    };
+    const finish = (ok) => {
+      if (settled)
+        return;
+      settled = true;
+      cleanup();
+      resolve(ok);
+    };
+    const onAbort = () => {
+      warn(`[lsp] install ${target} aborted during shutdown`);
+      child.kill("SIGTERM");
+      killTimer = setTimeout(() => {
+        if (!settled)
+          child.kill("SIGKILL");
+      }, 5000);
+      killTimer.unref?.();
+    };
+    signal?.addEventListener("abort", onAbort, { once: true });
+    if (signal?.aborted)
+      onAbort();
+    child.stdout?.on("data", () => {});
+    child.stderr?.on("data", (chunk) => {
+      const text = String(chunk);
+      stderrBuf += text;
+      if (stderrBuf.length > 4096) {
+        stderrBuf = stderrBuf.slice(stderrBuf.length - 4096);
+      }
+    });
+    child.on("error", (err) => {
+      error48(`[lsp] install ${target} failed to spawn: ${err}`);
+      finish(false);
+    });
+    child.on("exit", (code) => {
+      if (code === 0) {
+        log(`[lsp] installed ${target}`);
+        finish(true);
+      } else {
+        error48(`[lsp] install ${target} exited with code ${code}; last stderr:
+${stderrBuf.trim()}`);
+        finish(false);
+      }
+    });
+  });
+}
+async function ensureServerInstalled(spec, config2, fetchImpl, signal) {
+  const outcome = await withInstallLock(spec.npm, async () => {
+    const { version: version2, probe } = await resolveTargetVersion(spec, config2, fetchImpl);
+    if (!version2) {
+      const installed = isInstalled(spec.npm, spec.binary);
+      if (installed) {
+        warn(`[lsp] no eligible version of ${spec.npm} (grace=${config2.graceDays}d); keeping existing install`);
+        return { started: false, reason: "kept existing install" };
+      }
+      const blocked = probe?.blockedByGrace ? `all versions are within ${config2.graceDays}-day grace window` : "registry probe failed";
+      warn(`[lsp] skipping ${spec.npm}: ${blocked}`);
+      return { started: false, reason: blocked };
+    }
+    if (isInstalled(spec.npm, spec.binary)) {
+      const installedMeta = readInstalledMeta(spec.npm);
+      if (installedMeta && installedMeta.version === version2) {
+        if (installedMeta.sha256) {
+          const currentHash = await hashInstalledBinary(spec).catch((err) => {
+            warn(`[lsp] could not hash existing ${spec.npm} binary for TOFU check: ${err}`);
+            return null;
+          });
+          if (currentHash && currentHash !== installedMeta.sha256) {
+            error48(`[lsp] ${spec.npm}@${version2}: TOFU sha256 mismatch \u2014 refusing to use ` + `tampered binary. Recorded ${installedMeta.sha256}, current ${currentHash}. ` + `Run \`aft doctor --clear\` to re-install from scratch.`);
+            return {
+              started: false,
+              reason: `TOFU sha256 mismatch on ${spec.npm}@${version2} \u2014 see plugin log`
+            };
+          }
+        }
+        return { started: false, reason: "already installed" };
+      }
+      if (installedMeta) {
+        log(`[lsp] reinstalling ${spec.npm}: cached ${installedMeta.version} \u2260 target ${version2}`);
+      } else {
+        log(`[lsp] reinstalling ${spec.npm}@${version2}: no installed-version metadata recorded`);
+      }
+    }
+    const ok = await runInstall(spec, version2, cachedPackageDir(spec.npm), signal).catch((err) => {
+      error48(`[lsp] background install ${spec.npm} crashed: ${err}`);
+      return false;
+    });
+    if (!ok) {
+      return { started: true, reason: "install failed (see plugin log)" };
+    }
+    const installedHash = await hashInstalledBinary(spec).catch((err) => {
+      warn(`[lsp] could not hash newly-installed ${spec.npm} binary: ${err}`);
+      return null;
+    });
+    if (installedHash) {
+      log(`[lsp] ${spec.npm}@${version2} installed sha256=${installedHash}`);
+    }
+    writeInstalledMeta(spec.npm, version2, installedHash ?? undefined);
+    return { started: true };
+  });
+  if (outcome === null) {
+    return { started: false, reason: "another install in progress" };
+  }
+  return outcome;
+}
+function cachedPackageDir(npmPackage) {
+  return lspBinDir(npmPackage).replace(/[\\/]node_modules[\\/]\.bin[\\/]?$/, "");
+}
+function hashInstalledBinary(spec) {
+  return new Promise((resolve, reject) => {
+    const candidates = process.platform === "win32" ? [
+      lspBinaryPath(spec.npm, spec.binary),
+      lspBinaryPath(spec.npm, `${spec.binary}.cmd`),
+      lspBinaryPath(spec.npm, `${spec.binary}.exe`),
+      lspBinaryPath(spec.npm, `${spec.binary}.bat`)
+    ] : [lspBinaryPath(spec.npm, spec.binary)];
+    let pathToHash = null;
+    for (const p of candidates) {
+      try {
+        if (statSync2(p).isFile()) {
+          pathToHash = p;
+          break;
+        }
+      } catch {}
+    }
+    if (!pathToHash) {
+      reject(new Error(`installed binary not found at any of: ${candidates.join(", ")}`));
+      return;
+    }
+    const hash2 = createHash("sha256");
+    const stream = createReadStream(pathToHash);
+    stream.on("error", reject);
+    stream.on("data", (chunk) => hash2.update(chunk));
+    stream.on("end", () => resolve(hash2.digest("hex")));
+  });
+}
+function runAutoInstall(projectRoot, config2, fetchImpl = fetch) {
+  const cachedBinDirs = [];
+  const skipped = [];
+  const installPromises = [];
+  let installsStarted = 0;
+  let projectExtensions = null;
+  const getProjectExtensions = () => {
+    projectExtensions ??= relevantExtensionsInProject(projectRoot, npmExtToServerIds);
+    return projectExtensions;
+  };
+  for (const spec of NPM_LSP_TABLE) {
+    if (isInstalled(spec.npm, spec.binary)) {
+      cachedBinDirs.push(lspBinDir(spec.npm));
+    }
+    if (config2.disabled.has(spec.id)) {
+      skipped.push({ id: spec.id, reason: "disabled by config" });
+      continue;
+    }
+    if (!config2.autoInstall) {
+      skipped.push({ id: spec.id, reason: "auto_install: false" });
+      continue;
+    }
+    if (!isProjectRelevant(spec, projectRoot, getProjectExtensions)) {
+      skipped.push({ id: spec.id, reason: "not relevant to project" });
+      continue;
+    }
+    installsStarted += 1;
+    const controller = new AbortController;
+    const promise2 = ensureServerInstalled(spec, config2, fetchImpl, controller.signal).then((outcome) => {
+      if (!outcome.started)
+        installsStarted -= 1;
+      if (outcome.reason && outcome.reason !== "already installed") {
+        skipped.push({ id: spec.id, reason: outcome.reason });
+      }
+    }, (err) => {
+      installsStarted -= 1;
+      const reason = err instanceof Error ? err.message : String(err);
+      skipped.push({ id: spec.id, reason: `install error: ${reason}` });
+      error48(`[lsp] background install ${spec.npm} promise rejected: ${reason}`);
+    });
+    installPromises.push(trackInFlightAutoInstall(controller, promise2));
+  }
+  return {
+    cachedBinDirs,
+    get installsStarted() {
+      return installsStarted;
+    },
+    skipped,
+    installsComplete: Promise.all(installPromises).then(() => {})
+  };
+}
+
+// src/lsp-github-install.ts
+import { execFileSync } from "child_process";
+import { createHash as createHash2, randomBytes } from "crypto";
+import {
+  copyFileSync,
+  createReadStream as createReadStream2,
+  createWriteStream,
+  existsSync as existsSync5,
+  lstatSync,
+  mkdirSync as mkdirSync3,
+  readdirSync as readdirSync2,
+  readlinkSync,
+  realpathSync,
+  renameSync,
+  rmSync,
+  statSync as statSync3,
+  unlinkSync as unlinkSync3
+} from "fs";
+import { dirname, join as join6, relative, resolve } from "path";
+import { Readable } from "stream";
+import { pipeline } from "stream/promises";
+
+// src/lsp-github-table.ts
+function exe(platform, name) {
+  return platform === "win32" ? `${name}.exe` : name;
+}
+var CLANGD = {
+  id: "clangd",
+  githubRepo: "clangd/clangd",
+  binary: "clangd",
+  resolveAsset: (platform, _arch, version2) => {
+    const platformName = platform === "darwin" ? "mac" : platform === "linux" ? "linux" : "windows";
+    return { name: `clangd-${platformName}-${version2}.zip`, archive: "zip" };
+  },
+  binaryPathInArchive: (platform, _arch, version2) => `clangd_${version2}/bin/${exe(platform, "clangd")}`
+};
+var LUA_LS = {
+  id: "lua-ls",
+  githubRepo: "LuaLS/lua-language-server",
+  binary: "lua-language-server",
+  resolveAsset: (platform, arch, version2) => {
+    const ext = platform === "win32" ? "zip" : "tar.gz";
+    const platformName = platform === "darwin" ? "darwin" : platform === "linux" ? "linux" : "win32";
+    const archName = arch === "arm64" ? "arm64" : "x64";
+    return {
+      name: `lua-language-server-${version2}-${platformName}-${archName}.${ext}`,
+      archive: ext
+    };
+  },
+  binaryPathInArchive: (platform, _arch, _version) => `bin/${exe(platform, "lua-language-server")}`
+};
+var ZLS = {
+  id: "zls",
+  githubRepo: "zigtools/zls",
+  binary: "zls",
+  resolveAsset: (platform, arch, _version) => {
+    const ext = platform === "win32" ? "zip" : "tar.xz";
+    const archName = arch === "arm64" ? "aarch64" : "x86_64";
+    const platformName = platform === "darwin" ? "macos" : platform === "linux" ? "linux" : "windows";
+    return { name: `zls-${archName}-${platformName}.${ext}`, archive: ext };
+  },
+  binaryPathInArchive: (platform, _arch, _version) => exe(platform, "zls")
+};
+var TINYMIST = {
+  id: "tinymist",
+  githubRepo: "Myriad-Dreamin/tinymist",
+  binary: "tinymist",
+  resolveAsset: (platform, arch, _version) => {
+    const archName = arch === "arm64" ? "aarch64" : "x86_64";
+    const triple = platform === "darwin" ? "apple-darwin" : platform === "linux" ? "unknown-linux-gnu" : "pc-windows-msvc";
+    const ext = platform === "win32" ? "zip" : "tar.gz";
+    return { name: `tinymist-${archName}-${triple}.${ext}`, archive: ext };
+  },
+  binaryPathInArchive: (platform, _arch, _version) => exe(platform, "tinymist")
+};
+var TEXLAB = {
+  id: "texlab",
+  githubRepo: "latex-lsp/texlab",
+  binary: "texlab",
+  resolveAsset: (platform, arch, _version) => {
+    const archName = arch === "arm64" ? "aarch64" : "x86_64";
+    const platformName = platform === "darwin" ? "macos" : platform === "linux" ? "linux" : "windows";
+    const ext = platform === "win32" ? "zip" : "tar.gz";
+    return { name: `texlab-${archName}-${platformName}.${ext}`, archive: ext };
+  },
+  binaryPathInArchive: (platform, _arch, _version) => exe(platform, "texlab")
+};
+var GITHUB_LSP_TABLE = [
+  CLANGD,
+  LUA_LS,
+  ZLS,
+  TINYMIST,
+  TEXLAB
+];
+function detectHostPlatform() {
+  const platform = process.platform;
+  if (platform !== "darwin" && platform !== "linux" && platform !== "win32")
+    return null;
+  const arch = process.arch;
+  if (arch === "x64")
+    return { platform, arch: "x64" };
+  if (arch === "arm64")
+    return { platform, arch: "arm64" };
+  return null;
+}
+
+// src/lsp-github-install.ts
+function ghCacheRoot() {
+  return join6(aftCacheBase(), "lsp-binaries");
+}
+function ghPackageDir(spec) {
+  return join6(ghCacheRoot(), spec.id);
+}
+function ghBinDir(spec) {
+  return join6(ghPackageDir(spec), "bin");
+}
+function ghExtractDir(spec) {
+  return join6(ghPackageDir(spec), "extracted");
+}
+function ghBinaryPath(spec, platform) {
+  const ext = platform === "win32" ? ".exe" : "";
+  return join6(ghBinDir(spec), `${spec.binary}${ext}`);
+}
+function isGithubInstalled(spec, platform) {
+  for (const candidate of ghBinaryCandidates(spec, platform)) {
+    try {
+      if (statSync3(join6(ghBinDir(spec), candidate)).isFile())
+        return true;
+    } catch {}
+  }
+  return false;
+}
+function ghBinaryCandidates(spec, platform) {
+  if (platform !== "win32")
+    return [spec.binary];
+  return [spec.binary, `${spec.binary}.cmd`, `${spec.binary}.exe`, `${spec.binary}.bat`];
+}
+var MAX_DOWNLOAD_BYTES = 256 * 1024 * 1024;
+var MAX_EXTRACT_BYTES = 1024 * 1024 * 1024;
+function sha256OfFile(path2) {
+  return new Promise((resolve2, reject) => {
+    const hash2 = createHash2("sha256");
+    const stream = createReadStream2(path2);
+    stream.on("error", reject);
+    stream.on("data", (chunk) => hash2.update(chunk));
+    stream.on("end", () => resolve2(hash2.digest("hex")));
+  });
+}
+async function fetchReleaseByTag(githubRepo, tag, fetchImpl, signal) {
+  const candidates = [];
+  candidates.push(tag);
+  if (!tag.startsWith("v")) {
+    candidates.push(`v${tag}`);
+  } else {
+    candidates.push(tag.slice(1));
+  }
+  const headers = {
+    accept: "application/vnd.github+json",
+    "user-agent": "aft-opencode",
+    "x-github-api-version": "2022-11-28"
+  };
+  if (process.env.GITHUB_TOKEN) {
+    headers.authorization = `Bearer ${process.env.GITHUB_TOKEN}`;
+  }
+  for (const candidate of candidates) {
+    const url2 = `https://api.github.com/repos/${githubRepo}/releases/tags/${encodeURIComponent(candidate)}`;
+    const timeout = controlledTimeoutSignal(15000, signal);
+    try {
+      const res = await fetchImpl(url2, {
+        headers,
+        redirect: "follow",
+        signal: timeout.signal
+      });
+      if (res.status === 404)
+        continue;
+      if (!res.ok) {
+        warn(`[lsp] github release-by-tag ${githubRepo}@${candidate}: HTTP ${res.status}`);
+        return null;
+      }
+      const json2 = await res.json();
+      if (!json2.tag_name || !Array.isArray(json2.assets)) {
+        warn(`[lsp] github release-by-tag ${githubRepo}@${candidate}: malformed response`);
+        return null;
+      }
+      const assets = json2.assets.filter((a) => typeof a.name === "string" && typeof a.browser_download_url === "string").map((a) => ({
+        name: a.name,
+        url: a.browser_download_url,
+        size: typeof a.size === "number" ? a.size : undefined
+      }));
+      return { tag: json2.tag_name, assets };
+    } catch (err) {
+      if (signal?.aborted) {
+        warn(`[lsp] github release-by-tag ${githubRepo}@${candidate}: aborted`);
+        return null;
+      }
+      warn(`[lsp] github release-by-tag ${githubRepo}@${candidate}: ${err}`);
+    } finally {
+      timeout.cleanup();
+    }
+  }
+  return null;
+}
+async function resolveTargetTag(spec, config2, fetchImpl, signal) {
+  const pinned = config2.versions[spec.githubRepo];
+  if (pinned) {
+    try {
+      assertSafeVersion(pinned);
+    } catch (err) {
+      return {
+        tag: null,
+        assets: [],
+        blockedByGrace: false,
+        reason: `invalid pinned version ${JSON.stringify(pinned)}: ${err instanceof Error ? err.message : String(err)}`
+      };
+    }
+    const release = await fetchReleaseByTag(spec.githubRepo, pinned, fetchImpl, signal);
+    if (release) {
+      return {
+        tag: release.tag,
+        assets: release.assets,
+        blockedByGrace: false
+      };
+    }
+    return {
+      tag: null,
+      assets: [],
+      blockedByGrace: false,
+      reason: `pinned tag ${pinned} not found on GitHub`
+    };
+  }
+  const cached2 = readVersionCheck(spec.githubRepo);
+  const weeklyMs = config2.graceDays * 24 * 60 * 60 * 1000;
+  if (!shouldRecheckVersion(cached2, weeklyMs) && cached2?.latest_eligible) {
+    const release = await fetchReleaseByTag(spec.githubRepo, cached2.latest_eligible, fetchImpl);
+    if (release) {
+      return {
+        tag: release.tag,
+        assets: release.assets,
+        blockedByGrace: false
+      };
+    }
+  }
+  const probe = await probeGithubReleases(spec.githubRepo, config2.graceDays, fetchImpl);
+  if (!probe) {
+    return {
+      tag: null,
+      assets: [],
+      blockedByGrace: false,
+      reason: "github releases probe failed"
+    };
+  }
+  writeVersionCheck(spec.githubRepo, probe.tag);
+  return { tag: probe.tag, assets: probe.assets, blockedByGrace: probe.blockedByGrace };
+}
+function controlledTimeoutSignal(timeoutMs, parent) {
+  const controller = new AbortController;
+  const timeout = setTimeout(() => controller.abort(), timeoutMs);
+  timeout.unref?.();
+  const abort = () => controller.abort();
+  parent?.addEventListener("abort", abort, { once: true });
+  if (parent?.aborted)
+    abort();
+  return {
+    signal: controller.signal,
+    cleanup: () => {
+      clearTimeout(timeout);
+      parent?.removeEventListener("abort", abort);
+    }
+  };
+}
+async function downloadFile(url2, destPath, fetchImpl, assetSize, signal) {
+  if (assetSize !== undefined && assetSize > MAX_DOWNLOAD_BYTES) {
+    throw new Error(`asset size ${assetSize} exceeds max ${MAX_DOWNLOAD_BYTES} (set lsp.versions to pin a smaller release if this is wrong)`);
+  }
+  const timeout = controlledTimeoutSignal(120000, signal);
+  try {
+    const res = await fetchImpl(url2, {
+      headers: { accept: "application/octet-stream" },
+      redirect: "follow",
+      signal: timeout.signal
+    });
+    if (!res.ok || !res.body) {
+      throw new Error(`download failed (${res.status})`);
+    }
+    const advertised = Number.parseInt(res.headers.get("content-length") ?? "", 10);
+    if (Number.isFinite(advertised) && advertised > MAX_DOWNLOAD_BYTES) {
+      throw new Error(`Content-Length ${advertised} exceeds max ${MAX_DOWNLOAD_BYTES}`);
+    }
+    mkdirSync3(dirname(destPath), { recursive: true });
+    let bytesWritten = 0;
+    const guard = new TransformStream({
+      transform(chunk, controller) {
+        bytesWritten += chunk.byteLength;
+        if (bytesWritten > MAX_DOWNLOAD_BYTES) {
+          controller.error(new Error(`download exceeded ${MAX_DOWNLOAD_BYTES} bytes after streaming (server lied about size or sent unbounded body)`));
+          return;
+        }
+        controller.enqueue(chunk);
+      }
+    });
+    const guarded = res.body.pipeThrough(guard);
+    const nodeStream = Readable.fromWeb(guarded);
+    await pipeline(nodeStream, createWriteStream(destPath), { signal: timeout.signal });
+  } catch (err) {
+    try {
+      unlinkSync3(destPath);
+    } catch {}
+    throw err;
+  } finally {
+    timeout.cleanup();
+  }
+}
+function validateExtraction(stagingRoot) {
+  const realStagingRoot = realpathSync(stagingRoot);
+  let totalBytes = 0;
+  const walk = (dir) => {
+    let entries;
+    try {
+      entries = readdirSync2(dir);
+    } catch (err) {
+      throw new Error(`failed to read staging dir ${dir}: ${err}`);
+    }
+    for (const entry of entries) {
+      const full = join6(dir, entry);
+      let lst;
+      try {
+        lst = lstatSync(full);
+      } catch (err) {
+        throw new Error(`failed to lstat ${full}: ${err}`);
+      }
+      if (lst.isSymbolicLink()) {
+        let target = "<unreadable>";
+        try {
+          target = readlinkSync(full);
+        } catch {}
+        throw new Error(`archive contains symlink ${relative(realStagingRoot, full)} \u2192 ${target}; rejecting (zip-slip defense)`);
+      }
+      let realFull;
+      try {
+        realFull = realpathSync(full);
+      } catch (err) {
+        throw new Error(`failed to realpath ${full}: ${err}`);
+      }
+      const rel = relative(realStagingRoot, realFull);
+      if (rel.startsWith("..") || resolve(realStagingRoot, rel) !== realFull) {
+        throw new Error(`archive entry escapes staging root: ${full} \u2192 ${realFull} (zip-slip defense)`);
+      }
+      if (lst.isDirectory()) {
+        walk(full);
+      } else if (lst.isFile()) {
+        totalBytes += lst.size;
+        if (totalBytes > MAX_EXTRACT_BYTES) {
+          throw new Error(`extracted archive exceeds ${MAX_EXTRACT_BYTES} bytes (decompression bomb defense): saw ${totalBytes} bytes before hitting the cap`);
+        }
+      } else {
+        throw new Error(`archive contains non-file/non-dir entry: ${full}`);
+      }
+    }
+  };
+  walk(realStagingRoot);
+}
+function extractArchiveSafely(archivePath, destDir, archiveType) {
+  const suffix = randomBytes(8).toString("hex");
+  const stagingDir = `${destDir}.staging-${suffix}`;
+  try {
+    rmSync(stagingDir, { recursive: true, force: true });
+  } catch {}
+  mkdirSync3(stagingDir, { recursive: true });
+  try {
+    runPlatformExtractor(archivePath, stagingDir, archiveType);
+    validateExtraction(stagingDir);
+    try {
+      rmSync(destDir, { recursive: true, force: true });
+    } catch {}
+    renameSync(stagingDir, destDir);
+  } catch (err) {
+    try {
+      rmSync(stagingDir, { recursive: true, force: true });
+    } catch {}
+    throw err;
+  }
+}
+function runPlatformExtractor(archivePath, destDir, archiveType) {
+  if (archiveType === "zip") {
+    if (process.platform === "win32") {
+      execFileSync("tar.exe", ["-xf", archivePath, "-C", destDir], {
+        stdio: "pipe",
+        timeout: 180000
+      });
+      return;
+    }
+    execFileSync("unzip", ["-q", "-o", archivePath, "-d", destDir], {
+      stdio: "pipe",
+      timeout: 180000
+    });
+    return;
+  }
+  if (archiveType === "tar.gz") {
+    execFileSync("tar", ["-xzf", archivePath, "-C", destDir], {
+      stdio: "pipe",
+      timeout: 180000
+    });
+    return;
+  }
+  if (archiveType === "tar.xz") {
+    execFileSync("tar", ["-xf", archivePath, "-C", destDir], {
+      stdio: "pipe",
+      timeout: 180000
+    });
+    return;
+  }
+  throw new Error(`unsupported archive type: ${archiveType}`);
+}
+async function downloadAndInstall(spec, tag, assets, platform, arch, fetchImpl, signal) {
+  const version2 = stripTagV(tag);
+  const expected = spec.resolveAsset(platform, arch, version2);
+  if (!expected) {
+    warn(`[lsp] ${spec.id}: unsupported platform/arch combo ${platform}/${arch}`);
+    return null;
+  }
+  const matchingAsset = assets.find((a) => a.name === expected.name);
+  if (!matchingAsset) {
+    warn(`[lsp] ${spec.id}: asset ${expected.name} not found in release ${tag} (${assets.length} assets available)`);
+    return null;
+  }
+  const pkgDir = ghPackageDir(spec);
+  const extractDir = ghExtractDir(spec);
+  const archivePath = join6(pkgDir, expected.name);
+  log(`[lsp] downloading ${spec.id} ${tag} \u2192 ${matchingAsset.url}`);
+  try {
+    await downloadFile(matchingAsset.url, archivePath, fetchImpl, matchingAsset.size, signal);
+  } catch (err) {
+    error48(`[lsp] download ${spec.id} failed: ${err}`);
+    return null;
+  }
+  let archiveSha256;
+  try {
+    archiveSha256 = await sha256OfFile(archivePath);
+  } catch (err) {
+    error48(`[lsp] hash ${spec.id} failed: ${err}`);
+    try {
+      unlinkSync3(archivePath);
+    } catch {}
+    return null;
+  }
+  log(`[lsp] ${spec.id} ${tag} sha256=${archiveSha256}`);
+  const previousMeta = readInstalledMetaIn(ghPackageDir(spec));
+  if (previousMeta && previousMeta.version === tag && previousMeta.sha256) {
+    if (previousMeta.sha256 !== archiveSha256) {
+      error48(`[lsp] ${spec.id} ${tag}: TOFU sha256 mismatch \u2014 refusing install. ` + `Previously installed sha256=${previousMeta.sha256}, downloaded sha256=${archiveSha256}. ` + `This means the published release for tag ${tag} changed. Investigate before proceeding. ` + `Run \`aft doctor --clear\` to wipe the cache and force a fresh install if you've verified the change.`);
+      try {
+        unlinkSync3(archivePath);
+      } catch {}
+      return null;
+    }
+  }
+  try {
+    extractArchiveSafely(archivePath, extractDir, expected.archive);
+  } catch (err) {
+    error48(`[lsp] extract ${spec.id} failed: ${err}`);
+    return null;
+  } finally {
+    try {
+      unlinkSync3(archivePath);
+    } catch {}
+  }
+  const innerBinaryPath = join6(extractDir, spec.binaryPathInArchive(platform, arch, version2));
+  if (!existsSync5(innerBinaryPath)) {
+    error48(`[lsp] ${spec.id}: extracted binary not found at ${innerBinaryPath}`);
+    return null;
+  }
+  const targetBinary = ghBinaryPath(spec, platform);
+  mkdirSync3(dirname(targetBinary), { recursive: true });
+  try {
+    copyFileSync(innerBinaryPath, targetBinary);
+    if (platform !== "win32") {
+      const { chmodSync: chmodSync2 } = await import("fs");
+      chmodSync2(targetBinary, 493);
+    }
+  } catch (err) {
+    error48(`[lsp] ${spec.id}: failed to place binary at ${targetBinary}: ${err}`);
+    return null;
+  }
+  log(`[lsp] installed ${spec.id} ${tag} at ${targetBinary}`);
+  return archiveSha256;
+}
+async function ensureGithubInstalled(spec, config2, fetchImpl, platform, arch, signal) {
+  const outcome = await withInstallLock(spec.githubRepo, async () => {
+    const { tag, assets, blockedByGrace, reason } = await resolveTargetTag(spec, config2, fetchImpl, signal);
+    if (!tag) {
+      const installed = isGithubInstalled(spec, platform);
+      if (installed) {
+        warn(`[lsp] no eligible release of ${spec.githubRepo} (grace=${config2.graceDays}d); keeping existing install`);
+        return { started: false, reason: "kept existing install" };
+      }
+      const fallbackReason = reason ?? (blockedByGrace ? `all releases are within ${config2.graceDays}-day grace window` : "github releases probe failed");
+      warn(`[lsp] skipping ${spec.id}: ${fallbackReason}`);
+      return { started: false, reason: fallbackReason };
+    }
+    if (isGithubInstalled(spec, platform)) {
+      const installedMeta = readInstalledMetaIn(ghPackageDir(spec));
+      if (installedMeta && installedMeta.version === tag) {
+        return { started: false, reason: "already installed" };
+      }
+      if (installedMeta) {
+        log(`[lsp] reinstalling ${spec.id}: cached ${installedMeta.version} \u2260 target ${tag}`);
+      } else {
+        log(`[lsp] reinstalling ${spec.id}@${tag}: no installed-version metadata recorded`);
+      }
+    }
+    const archiveSha256 = await downloadAndInstall(spec, tag, assets, platform, arch, fetchImpl, signal).catch((err) => {
+      error48(`[lsp] github install ${spec.id} crashed: ${err}`);
+      return null;
+    });
+    if (!archiveSha256) {
+      return { started: true, reason: "install failed (see plugin log)" };
+    }
+    writeInstalledMetaIn(ghPackageDir(spec), tag, archiveSha256);
+    return { started: true };
+  });
+  if (outcome === null) {
+    return { started: false, reason: "another install in progress" };
+  }
+  return outcome;
+}
+var inFlightGithubInstalls = new Set;
+function trackInFlightGithubInstall(controller, promise2) {
+  const entry = { controller, promise: promise2 };
+  inFlightGithubInstalls.add(entry);
+  promise2.then(() => inFlightGithubInstalls.delete(entry), () => inFlightGithubInstalls.delete(entry));
+  return promise2;
+}
+async function abortInFlightGithubInstalls() {
+  const installs = Array.from(inFlightGithubInstalls);
+  for (const install of installs) {
+    install.controller.abort();
+  }
+  await Promise.allSettled(installs.map((install) => install.promise));
+}
+function runGithubAutoInstall(relevantServers, config2, fetchImpl = fetch) {
+  const cachedBinDirs = [];
+  const skipped = [];
+  const installPromises = [];
+  let installsStarted = 0;
+  const host = detectHostPlatform();
+  if (!host) {
+    for (const spec of GITHUB_LSP_TABLE) {
+      try {
+        if (existsSync5(ghBinDir(spec))) {
+          cachedBinDirs.push(ghBinDir(spec));
+        }
+      } catch {}
+    }
+    return {
+      cachedBinDirs,
+      installsStarted: 0,
+      skipped,
+      installsComplete: Promise.resolve()
+    };
+  }
+  for (const spec of GITHUB_LSP_TABLE) {
+    if (isGithubInstalled(spec, host.platform)) {
+      cachedBinDirs.push(ghBinDir(spec));
+    }
+    if (config2.disabled.has(spec.id)) {
+      skipped.push({ id: spec.id, reason: "disabled by config" });
+      continue;
+    }
+    if (!config2.autoInstall) {
+      skipped.push({ id: spec.id, reason: "auto_install: false" });
+      continue;
+    }
+    if (!relevantServers.has(spec.id)) {
+      skipped.push({ id: spec.id, reason: "not relevant to project" });
+      continue;
+    }
+    installsStarted += 1;
+    const controller = new AbortController;
+    const promise2 = ensureGithubInstalled(spec, config2, fetchImpl, host.platform, host.arch, controller.signal).then((outcome) => {
+      if (!outcome.started)
+        installsStarted -= 1;
+      if (outcome.reason && outcome.reason !== "already installed") {
+        skipped.push({ id: spec.id, reason: outcome.reason });
+      }
+    }, (err) => {
+      installsStarted -= 1;
+      const reason = err instanceof Error ? err.message : String(err);
+      skipped.push({ id: spec.id, reason: `install error: ${reason}` });
+      error48(`[lsp] github install ${spec.id} promise rejected: ${reason}`);
+    });
+    installPromises.push(trackInFlightGithubInstall(controller, promise2));
+  }
+  return {
+    cachedBinDirs,
+    get installsStarted() {
+      return installsStarted;
+    },
+    skipped,
+    installsComplete: Promise.all(installPromises).then(() => {})
+  };
+}
+function discoverRelevantGithubServers(projectRoot) {
+  const extToServerIds = {
+    c: ["clangd"],
+    "c++": ["clangd"],
+    cc: ["clangd"],
+    cpp: ["clangd"],
+    cxx: ["clangd"],
+    h: ["clangd"],
+    "h++": ["clangd"],
+    hpp: ["clangd"],
+    hh: ["clangd"],
+    hxx: ["clangd"],
+    lua: ["lua-ls"],
+    zig: ["zls"],
+    zon: ["zls"],
+    typ: ["tinymist"],
+    typc: ["tinymist"],
+    tex: ["texlab"],
+    bib: ["texlab"]
+  };
+  const rootMarkers = {
+    clangd: ["compile_commands.json", "compile_flags.txt", ".clangd"],
+    "lua-ls": [".luarc.json", ".luarc.jsonc", ".stylua.toml", "stylua.toml"],
+    zls: ["build.zig"],
+    tinymist: ["typst.toml"],
+    texlab: [".latexmkrc", "latexmkrc", ".texlabroot", "texlabroot"]
+  };
+  const relevant = new Set;
+  for (const spec of GITHUB_LSP_TABLE) {
+    if (hasRootMarker(projectRoot, rootMarkers[spec.id]))
+      relevant.add(spec.id);
+  }
+  const extensions = relevantExtensionsInProject(projectRoot, extToServerIds);
+  for (const ext of extensions) {
+    for (const id of extToServerIds[ext] ?? []) {
+      relevant.add(id);
+    }
+  }
+  return relevant;
+}
+
 // src/metadata-store.ts
 var pendingStore = new Map;
 var STALE_TIMEOUT_MS = 15 * 60 * 1000;
@@ -21871,9 +23290,9 @@ function normalizeToolMap(tools) {
 }
 
 // src/notifications.ts
-import { existsSync as existsSync3, mkdirSync as mkdirSync2, readFileSync as readFileSync2, writeFileSync } from "fs";
-import { homedir as homedir3, platform } from "os";
-import { join as join4 } from "path";
+import { existsSync as existsSync6, mkdirSync as mkdirSync4, readFileSync as readFileSync3, writeFileSync as writeFileSync2 } from "fs";
+import { homedir as homedir4, platform } from "os";
+import { join as join7 } from "path";
 function isTuiMode() {
   return process.env.OPENCODE_CLIENT === "cli";
 }
@@ -21895,27 +23314,27 @@ var STATUS_MARKER = `${AFT_MARKER} \u2705`;
 var WARNED_TOOLS_FILE = "warned_tools.json";
 function getDesktopStatePath() {
   const os2 = platform();
-  const home = homedir3();
+  const home = homedir4();
   if (os2 === "darwin") {
-    return join4(home, "Library", "Application Support", "ai.opencode.desktop", "opencode.global.dat");
+    return join7(home, "Library", "Application Support", "ai.opencode.desktop", "opencode.global.dat");
   }
   if (os2 === "linux") {
-    const xdgConfig = process.env.XDG_CONFIG_HOME || join4(home, ".config");
-    return join4(xdgConfig, "ai.opencode.desktop", "opencode.global.dat");
+    const xdgConfig = process.env.XDG_CONFIG_HOME || join7(home, ".config");
+    return join7(xdgConfig, "ai.opencode.desktop", "opencode.global.dat");
   }
   if (os2 === "win32") {
-    const appData = process.env.APPDATA || join4(home, "AppData", "Roaming");
-    return join4(appData, "ai.opencode.desktop", "opencode.global.dat");
+    const appData = process.env.APPDATA || join7(home, "AppData", "Roaming");
+    return join7(appData, "ai.opencode.desktop", "opencode.global.dat");
   }
   return null;
 }
 function readDesktopState(directory) {
   const statePath = getDesktopStatePath();
-  if (!statePath || !existsSync3(statePath)) {
+  if (!statePath || !existsSync6(statePath)) {
     return { sessionId: null, serverUrl: null };
   }
   try {
-    const raw = readFileSync2(statePath, "utf-8");
+    const raw = readFileSync3(statePath, "utf-8");
     const state = JSON.parse(raw);
     let serverUrl = null;
     const serverStr = state.server;
@@ -22009,10 +23428,10 @@ async function sendWarning(opts, message) {
 }
 async function sendFeatureAnnouncement(opts, version2, features, storageDir) {
   if (storageDir) {
-    const versionFile = join4(storageDir, "last_announced_version");
+    const versionFile = join7(storageDir, "last_announced_version");
     try {
-      if (existsSync3(versionFile)) {
-        const lastVersion = readFileSync2(versionFile, "utf-8").trim();
+      if (existsSync6(versionFile)) {
+        const lastVersion = readFileSync3(versionFile, "utf-8").trim();
         if (lastVersion === version2)
           return;
       }
@@ -22032,17 +23451,17 @@ async function sendFeatureAnnouncement(opts, version2, features, storageDir) {
   }
   if (storageDir) {
     try {
-      mkdirSync2(storageDir, { recursive: true });
-      writeFileSync(join4(storageDir, "last_announced_version"), version2);
+      mkdirSync4(storageDir, { recursive: true });
+      writeFileSync2(join7(storageDir, "last_announced_version"), version2);
     } catch {}
   }
 }
 function readWarnedTools(storageDir) {
   try {
-    const warnedToolsPath = join4(storageDir, WARNED_TOOLS_FILE);
-    if (!existsSync3(warnedToolsPath))
+    const warnedToolsPath = join7(storageDir, WARNED_TOOLS_FILE);
+    if (!existsSync6(warnedToolsPath))
       return {};
-    const parsed = JSON.parse(readFileSync2(warnedToolsPath, "utf-8"));
+    const parsed = JSON.parse(readFileSync3(warnedToolsPath, "utf-8"));
     if (!parsed || typeof parsed !== "object" || Array.isArray(parsed))
       return {};
     const warned = {};
@@ -22058,9 +23477,9 @@ function readWarnedTools(storageDir) {
 }
 function writeWarnedTools(storageDir, warned) {
   try {
-    mkdirSync2(storageDir, { recursive: true });
-    const warnedToolsPath = join4(storageDir, WARNED_TOOLS_FILE);
-    writeFileSync(warnedToolsPath, `${JSON.stringify(warned, null, 2)}
+    mkdirSync4(storageDir, { recursive: true });
+    const warnedToolsPath = join7(storageDir, WARNED_TOOLS_FILE);
+    writeFileSync2(warnedToolsPath, `${JSON.stringify(warned, null, 2)}
 `);
   } catch {}
 }
@@ -22151,8 +23570,8 @@ async function cleanupWarnings(opts) {
 }
 
 // src/onnx-runtime.ts
-import { chmodSync as chmodSync2, existsSync as existsSync4, mkdirSync as mkdirSync3, readdirSync, unlinkSync as unlinkSync2 } from "fs";
-import { join as join5 } from "path";
+import { chmodSync as chmodSync2, existsSync as existsSync7, mkdirSync as mkdirSync5, readdirSync as readdirSync3, unlinkSync as unlinkSync4 } from "fs";
+import { join as join8 } from "path";
 var ORT_VERSION = "1.24.4";
 var ORT_REPO = "microsoft/onnxruntime";
 var ORT_PLATFORM_MAP = {
@@ -22208,9 +23627,9 @@ function getManualInstallHint() {
 }
 async function ensureOnnxRuntime(storageDir) {
   const info = getPlatformInfo();
-  const ortDir = join5(storageDir, "onnxruntime", ORT_VERSION);
-  const libPath = join5(ortDir, info?.libName ?? "libonnxruntime.dylib");
-  if (existsSync4(libPath)) {
+  const ortDir = join8(storageDir, "onnxruntime", ORT_VERSION);
+  const libPath = join8(ortDir, info?.libName ?? "libonnxruntime.dylib");
+  if (existsSync7(libPath)) {
     log(`ONNX Runtime found at ${ortDir}`);
     return ortDir;
   }
@@ -22235,7 +23654,7 @@ function findSystemOnnxRuntime(libName) {
     searchPaths.push("/usr/lib", "/usr/lib/x86_64-linux-gnu", "/usr/lib/aarch64-linux-gnu", "/usr/local/lib");
   }
   for (const dir of searchPaths) {
-    if (existsSync4(join5(dir, libName))) {
+    if (existsSync7(join8(dir, libName))) {
       return dir;
     }
   }
@@ -22246,34 +23665,34 @@ async function downloadOnnxRuntime(info, targetDir) {
   log(`Downloading ONNX Runtime v${ORT_VERSION} for ${process.platform}/${process.arch}...`);
   try {
     const tmpDir = `${targetDir}.tmp.${process.pid}`;
-    mkdirSync3(tmpDir, { recursive: true });
-    const archivePath = join5(tmpDir, `onnxruntime.${info.archiveType}`);
-    const { execFileSync } = await import("child_process");
-    execFileSync("curl", ["-fsSL", url2, "-o", archivePath], {
+    mkdirSync5(tmpDir, { recursive: true });
+    const archivePath = join8(tmpDir, `onnxruntime.${info.archiveType}`);
+    const { execFileSync: execFileSync2 } = await import("child_process");
+    execFileSync2("curl", ["-fsSL", url2, "-o", archivePath], {
       stdio: "pipe",
       timeout: 120000
     });
     if (info.archiveType === "tgz") {
-      execFileSync("tar", ["xzf", archivePath, "-C", tmpDir], { stdio: "pipe" });
+      execFileSync2("tar", ["xzf", archivePath, "-C", tmpDir], { stdio: "pipe" });
     } else {
       await extractZipArchive(archivePath, tmpDir);
     }
-    const extractedDir = join5(tmpDir, info.assetName, "lib");
-    if (!existsSync4(extractedDir)) {
+    const extractedDir = join8(tmpDir, info.assetName, "lib");
+    if (!existsSync7(extractedDir)) {
       throw new Error(`Expected directory not found: ${extractedDir}`);
     }
-    mkdirSync3(targetDir, { recursive: true });
-    const libFiles = readdirSync(extractedDir).filter((f) => f.startsWith("libonnxruntime") || f.startsWith("onnxruntime"));
-    const { lstatSync, symlinkSync, readlinkSync, copyFileSync: cpFile } = await import("fs");
+    mkdirSync5(targetDir, { recursive: true });
+    const libFiles = readdirSync3(extractedDir).filter((f) => f.startsWith("libonnxruntime") || f.startsWith("onnxruntime"));
+    const { lstatSync: lstatSync2, symlinkSync, readlinkSync: readlinkSync2, copyFileSync: cpFile } = await import("fs");
     const realFiles = [];
     const symlinks = [];
     for (const libFile of libFiles) {
-      const src = join5(extractedDir, libFile);
+      const src = join8(extractedDir, libFile);
       try {
-        const stat = lstatSync(src);
+        const stat = lstatSync2(src);
         log(`ORT extract: ${libFile} \u2014 isSymlink=${stat.isSymbolicLink()}, isFile=${stat.isFile()}, size=${stat.size}`);
         if (stat.isSymbolicLink()) {
-          symlinks.push({ name: libFile, target: readlinkSync(src) });
+          symlinks.push({ name: libFile, target: readlinkSync2(src) });
         } else {
           realFiles.push(libFile);
         }
@@ -22283,8 +23702,8 @@ async function downloadOnnxRuntime(info, targetDir) {
       }
     }
     for (const libFile of realFiles) {
-      const src = join5(extractedDir, libFile);
-      const dst = join5(targetDir, libFile);
+      const src = join8(extractedDir, libFile);
+      const dst = join8(targetDir, libFile);
       try {
         cpFile(src, dst);
         if (process.platform !== "win32") {
@@ -22295,62 +23714,44 @@ async function downloadOnnxRuntime(info, targetDir) {
       }
     }
     for (const link of symlinks) {
-      const dst = join5(targetDir, link.name);
+      const dst = join8(targetDir, link.name);
       try {
-        unlinkSync2(dst);
+        unlinkSync4(dst);
       } catch {}
       symlinkSync(link.target, dst);
     }
-    const { rmSync } = await import("fs");
-    rmSync(tmpDir, { recursive: true, force: true });
+    const { rmSync: rmSync2 } = await import("fs");
+    rmSync2(tmpDir, { recursive: true, force: true });
     log(`ONNX Runtime v${ORT_VERSION} installed to ${targetDir}`);
     return targetDir;
   } catch (err) {
     error48(`Failed to download ONNX Runtime: ${err}`);
     try {
-      const { rmSync } = await import("fs");
-      rmSync(`${targetDir}.tmp.${process.pid}`, { recursive: true, force: true });
+      const { rmSync: rmSync2 } = await import("fs");
+      rmSync2(`${targetDir}.tmp.${process.pid}`, { recursive: true, force: true });
     } catch {}
     return null;
   }
 }
 async function extractZipArchive(archivePath, destinationDir) {
-  const { execFileSync } = await import("child_process");
+  const { execFileSync: execFileSync2 } = await import("child_process");
   if (process.platform === "win32") {
-    let powershellError;
-    try {
-      execFileSync("powershell.exe", [
-        "-NoProfile",
-        "-NonInteractive",
-        "-ExecutionPolicy",
-        "Bypass",
-        "-Command",
-        "& { Expand-Archive -LiteralPath $args[0] -DestinationPath $args[1] -Force }",
-        archivePath,
-        destinationDir
-      ], { stdio: "pipe", timeout: 120000 });
-      return;
-    } catch (err) {
-      powershellError = err;
-      warn(`PowerShell Expand-Archive failed, falling back to cmd/tar: ${String(err)}`);
-    }
-    try {
-      execFileSync("cmd.exe", ["/d", "/s", "/c", `tar -xf "${archivePath}" -C "${destinationDir}"`], { stdio: "pipe", timeout: 120000 });
-      return;
-    } catch (cmdError) {
-      throw new Error(`ZIP extraction failed via PowerShell and cmd/tar. PowerShell: ${String(powershellError)} | cmd/tar: ${String(cmdError)}`);
-    }
+    execFileSync2("tar.exe", ["-xf", archivePath, "-C", destinationDir], {
+      stdio: "pipe",
+      timeout: 120000
+    });
+    return;
   }
-  execFileSync("unzip", ["-q", archivePath, "-d", destinationDir], {
+  execFileSync2("unzip", ["-q", archivePath, "-d", destinationDir], {
     stdio: "pipe",
     timeout: 120000
   });
 }
 
 // src/bridge.ts
-import { spawn } from "child_process";
-import { homedir as homedir4 } from "os";
-import { join as join6 } from "path";
+import { spawn as spawn2 } from "child_process";
+import { homedir as homedir5 } from "os";
+import { join as join9 } from "path";
 var DEFAULT_BRIDGE_TIMEOUT_MS = 30000;
 var SEMANTIC_TIMEOUT_SAFETY_MARGIN_MS = 5000;
 var MAX_STDOUT_BUFFER = 64 * 1024 * 1024;
@@ -22492,14 +23893,14 @@ class BinaryBridge {
     const line = `${JSON.stringify(request)}
 `;
     const effectiveTimeoutMs = options?.timeoutMs ?? this.timeoutMs;
-    return new Promise((resolve, reject) => {
+    return new Promise((resolve2, reject) => {
       const timer = setTimeout(() => {
         this.pending.delete(id);
         warn(`Request "${command}" (id=${id}) timed out after ${effectiveTimeoutMs}ms \u2014 restarting bridge`);
         reject(new Error(`[aft-plugin] Request "${command}" (id=${id}) timed out after ${effectiveTimeoutMs}ms`));
         this.handleTimeout();
       }, effectiveTimeoutMs);
-      this.pending.set(id, { resolve, reject, timer });
+      this.pending.set(id, { resolve: resolve2, reject, timer });
       if (!this.process?.stdin?.writable) {
         this.pending.delete(id);
         clearTimeout(timer);
@@ -22542,15 +23943,15 @@ class BinaryBridge {
     if (this.process) {
       const proc = this.process;
       this.process = null;
-      return new Promise((resolve) => {
+      return new Promise((resolve2) => {
         const forceKillTimer = setTimeout(() => {
           proc.kill("SIGKILL");
-          resolve();
+          resolve2();
         }, 5000);
         proc.once("exit", () => {
           clearTimeout(forceKillTimer);
           log("Process exited during shutdown");
-          resolve();
+          resolve2();
         });
         proc.kill("SIGTERM");
       });
@@ -22592,19 +23993,19 @@ class BinaryBridge {
     })();
     const useFastembedBackend = semanticBackend === undefined || semanticBackend === "fastembed" || semanticBackend === "";
     const ortDir = typeof this.configOverrides._ort_dylib_dir === "string" && useFastembedBackend ? this.configOverrides._ort_dylib_dir : null;
-    const ortLibraryPath = ortDir == null ? null : join6(ortDir, process.platform === "win32" ? "onnxruntime.dll" : process.platform === "darwin" ? "libonnxruntime.dylib" : "libonnxruntime.so");
+    const ortLibraryPath = ortDir == null ? null : join9(ortDir, process.platform === "win32" ? "onnxruntime.dll" : process.platform === "darwin" ? "libonnxruntime.dylib" : "libonnxruntime.so");
     const envPath = process.platform === "win32" && ortDir ? `${ortDir};${process.env.PATH ?? ""}` : process.env.PATH;
     const env = {
       ...process.env,
       ...envPath ? { PATH: envPath } : {}
     };
     if (useFastembedBackend) {
-      env.FASTEMBED_CACHE_DIR = process.env.FASTEMBED_CACHE_DIR || (typeof this.configOverrides.storage_dir === "string" ? join6(this.configOverrides.storage_dir, "semantic", "models") : join6(homedir4() || "", ".cache", "fastembed"));
+      env.FASTEMBED_CACHE_DIR = process.env.FASTEMBED_CACHE_DIR || (typeof this.configOverrides.storage_dir === "string" ? join9(this.configOverrides.storage_dir, "semantic", "models") : join9(homedir5() || "", ".cache", "fastembed"));
       if (ortLibraryPath) {
         env.ORT_DYLIB_PATH = ortLibraryPath;
       }
     }
-    const child = spawn(this.binaryPath, [], {
+    const child = spawn2(this.binaryPath, [], {
       cwd: this.cwd,
       stdio: ["pipe", "pipe", "pipe"],
       env
@@ -22865,10 +24266,10 @@ function normalizeKey(projectRoot) {
 
 // src/resolver.ts
 import { execSync, spawnSync } from "child_process";
-import { chmodSync as chmodSync3, copyFileSync, existsSync as existsSync5, mkdirSync as mkdirSync4, renameSync } from "fs";
+import { chmodSync as chmodSync3, copyFileSync as copyFileSync2, existsSync as existsSync8, mkdirSync as mkdirSync6, renameSync as renameSync2 } from "fs";
 import { createRequire } from "module";
-import { homedir as homedir5 } from "os";
-import { join as join7 } from "path";
+import { homedir as homedir6 } from "os";
+import { join as join10 } from "path";
 function copyToVersionedCache(npmBinaryPath) {
   try {
     const result = spawnSync(npmBinaryPath, ["--version"], {
@@ -22882,18 +24283,18 @@ function copyToVersionedCache(npmBinaryPath) {
     const version2 = rawVersion.replace(/^aft\s+/, "");
     const tag = version2.startsWith("v") ? version2 : `v${version2}`;
     const cacheDir = getCacheDir();
-    const versionedDir = join7(cacheDir, tag);
+    const versionedDir = join10(cacheDir, tag);
     const ext = process.platform === "win32" ? ".exe" : "";
-    const cachedPath = join7(versionedDir, `aft${ext}`);
-    if (existsSync5(cachedPath))
+    const cachedPath = join10(versionedDir, `aft${ext}`);
+    if (existsSync8(cachedPath))
       return cachedPath;
-    mkdirSync4(versionedDir, { recursive: true });
+    mkdirSync6(versionedDir, { recursive: true });
     const tmpPath = `${cachedPath}.tmp`;
-    copyFileSync(npmBinaryPath, tmpPath);
+    copyFileSync2(npmBinaryPath, tmpPath);
     if (process.platform !== "win32") {
       chmodSync3(tmpPath, 493);
     }
-    renameSync(tmpPath, cachedPath);
+    renameSync2(tmpPath, cachedPath);
     log(`Copied npm binary to versioned cache: ${cachedPath}`);
     return cachedPath;
   } catch (err) {
@@ -22932,7 +24333,7 @@ function findBinarySync() {
     const packageBin = `@cortexkit/aft-${key}/bin/aft${ext}`;
     const req = createRequire(import.meta.url);
     const resolved = req.resolve(packageBin);
-    if (existsSync5(resolved)) {
+    if (existsSync8(resolved)) {
       const copied = copyToVersionedCache(resolved);
       return copied ?? resolved;
     }
@@ -22946,8 +24347,8 @@ function findBinarySync() {
     if (result)
       return result;
   } catch {}
-  const cargoPath = join7(homedir5(), ".cargo", "bin", `aft${ext}`);
-  if (existsSync5(cargoPath))
+  const cargoPath = join10(homedir6(), ".cargo", "bin", `aft${ext}`);
+  if (existsSync8(cargoPath))
     return cargoPath;
   return null;
 }
@@ -22982,21 +24383,21 @@ async function findBinary() {
 }
 
 // src/shared/rpc-server.ts
-import { randomBytes } from "crypto";
-import { mkdirSync as mkdirSync5, renameSync as renameSync2, unlinkSync as unlinkSync3, writeFileSync as writeFileSync2 } from "fs";
+import { randomBytes as randomBytes2 } from "crypto";
+import { mkdirSync as mkdirSync7, renameSync as renameSync3, unlinkSync as unlinkSync5, writeFileSync as writeFileSync3 } from "fs";
 import { createServer } from "http";
-import { dirname } from "path";
+import { dirname as dirname2 } from "path";
 
 // src/shared/rpc-utils.ts
-import { createHash } from "crypto";
-import { join as join8 } from "path";
+import { createHash as createHash3 } from "crypto";
+import { join as join11 } from "path";
 function projectHash(directory) {
   const normalized = directory.replace(/\/+$/, "");
-  return createHash("sha256").update(normalized).digest("hex").slice(0, 16);
+  return createHash3("sha256").update(normalized).digest("hex").slice(0, 16);
 }
 function rpcPortFilePath(storageDir, directory) {
   const hash2 = projectHash(directory);
-  return join8(storageDir, "rpc", hash2, "port");
+  return join11(storageDir, "rpc", hash2, "port");
 }
 
 // src/shared/rpc-server.ts
@@ -23013,7 +24414,7 @@ class AftRpcServer {
     this.handlers.set(method, handler);
   }
   async start() {
-    return new Promise((resolve, reject) => {
+    return new Promise((resolve2, reject) => {
       const server = createServer((req, res) => this.dispatch(req, res));
       server.on("error", (err) => {
         warn(`RPC server error: ${err.message}`);
@@ -23026,19 +24427,19 @@ class AftRpcServer {
           return;
         }
         this.port = addr.port;
-        this.token = randomBytes(32).toString("hex");
+        this.token = randomBytes2(32).toString("hex");
         this.server = server;
         try {
-          const dir = dirname(this.portFilePath);
-          mkdirSync5(dir, { recursive: true });
+          const dir = dirname2(this.portFilePath);
+          mkdirSync7(dir, { recursive: true });
           const tmpPath = `${this.portFilePath}.tmp`;
-          writeFileSync2(tmpPath, JSON.stringify({ port: this.port, token: this.token }), "utf-8");
-          renameSync2(tmpPath, this.portFilePath);
+          writeFileSync3(tmpPath, JSON.stringify({ port: this.port, token: this.token }), "utf-8");
+          renameSync3(tmpPath, this.portFilePath);
           log(`RPC server listening on 127.0.0.1:${this.port}`);
         } catch (err) {
           warn(`Failed to write RPC port file: ${err}`);
         }
-        resolve(this.port);
+        resolve2(this.port);
       });
       server.unref();
     });
@@ -23050,7 +24451,7 @@ class AftRpcServer {
     }
     this.token = null;
     try {
-      unlinkSync3(this.portFilePath);
+      unlinkSync5(this.portFilePath);
     } catch {}
   }
   dispatch(req, res) {
@@ -23272,21 +24673,21 @@ function formatStatusMarkdown(status) {
 
 // src/shared/tui-config.ts
 var import_comment_json2 = __toESM(require_src2(), 1);
-import { existsSync as existsSync6, mkdirSync as mkdirSync6, readFileSync as readFileSync3, writeFileSync as writeFileSync3 } from "fs";
-import { dirname as dirname2, join as join10 } from "path";
+import { existsSync as existsSync9, mkdirSync as mkdirSync8, readFileSync as readFileSync4, writeFileSync as writeFileSync4 } from "fs";
+import { dirname as dirname3, join as join13 } from "path";
 
 // src/shared/opencode-config-dir.ts
-import { homedir as homedir6 } from "os";
-import { join as join9, resolve } from "path";
+import { homedir as homedir7 } from "os";
+import { join as join12, resolve as resolve2 } from "path";
 function getCliConfigDir() {
   const envConfigDir = process.env.OPENCODE_CONFIG_DIR?.trim();
   if (envConfigDir) {
-    return resolve(envConfigDir);
+    return resolve2(envConfigDir);
   }
   if (process.platform === "win32") {
-    return join9(homedir6(), ".config", "opencode");
+    return join12(homedir7(), ".config", "opencode");
   }
-  return join9(process.env.XDG_CONFIG_HOME || join9(homedir6(), ".config"), "opencode");
+  return join12(process.env.XDG_CONFIG_HOME || join12(homedir7(), ".config"), "opencode");
 }
 function getOpenCodeConfigDir2(_options) {
   return getCliConfigDir();
@@ -23295,10 +24696,10 @@ function getOpenCodeConfigPaths(options) {
   const configDir = getOpenCodeConfigDir2(options);
   return {
     configDir,
-    configJson: join9(configDir, "opencode.json"),
-    configJsonc: join9(configDir, "opencode.jsonc"),
-    packageJson: join9(configDir, "package.json"),
-    omoConfig: join9(configDir, "magic-context.jsonc")
+    configJson: join12(configDir, "opencode.json"),
+    configJsonc: join12(configDir, "opencode.jsonc"),
+    packageJson: join12(configDir, "package.json"),
+    omoConfig: join12(configDir, "magic-context.jsonc")
   };
 }
 
@@ -23307,11 +24708,11 @@ var PLUGIN_NAME = "@cortexkit/aft-opencode";
 var PLUGIN_ENTRY = `${PLUGIN_NAME}@latest`;
 function resolveTuiConfigPath() {
   const configDir = getOpenCodeConfigPaths({ binary: "opencode" }).configDir;
-  const jsoncPath = join10(configDir, "tui.jsonc");
-  const jsonPath = join10(configDir, "tui.json");
-  if (existsSync6(jsoncPath))
+  const jsoncPath = join13(configDir, "tui.jsonc");
+  const jsonPath = join13(configDir, "tui.json");
+  if (existsSync9(jsoncPath))
     return jsoncPath;
-  if (existsSync6(jsonPath))
+  if (existsSync9(jsonPath))
     return jsonPath;
   return jsonPath;
 }
@@ -23319,8 +24720,8 @@ function ensureTuiPluginEntry() {
   try {
     const configPath = resolveTuiConfigPath();
     let config2 = {};
-    if (existsSync6(configPath)) {
-      config2 = import_comment_json2.parse(readFileSync3(configPath, "utf-8")) ?? {};
+    if (existsSync9(configPath)) {
+      config2 = import_comment_json2.parse(readFileSync4(configPath, "utf-8")) ?? {};
     }
     const plugins = Array.isArray(config2.plugin) ? config2.plugin.filter((value) => typeof value === "string") : [];
     if (plugins.some((plugin) => plugin === PLUGIN_NAME || plugin.startsWith(`${PLUGIN_NAME}@`) || plugin.includes("opencode-plugin") || plugin.includes("aft-opencode"))) {
@@ -23328,8 +24729,8 @@ function ensureTuiPluginEntry() {
     }
     plugins.push(PLUGIN_ENTRY);
     config2.plugin = plugins;
-    mkdirSync6(dirname2(configPath), { recursive: true });
-    writeFileSync3(configPath, `${import_comment_json2.stringify(config2, null, 2)}
+    mkdirSync8(dirname3(configPath), { recursive: true });
+    writeFileSync4(configPath, `${import_comment_json2.stringify(config2, null, 2)}
 `);
     log(`[aft-plugin] added TUI plugin entry to ${configPath}`);
     return true;
@@ -23340,33 +24741,33 @@ function ensureTuiPluginEntry() {
 }
 
 // src/shared/url-fetch.ts
-import { createHash as createHash2 } from "crypto";
+import { createHash as createHash4 } from "crypto";
 import { lookup } from "dns/promises";
 import {
-  existsSync as existsSync7,
-  mkdirSync as mkdirSync7,
-  readdirSync as readdirSync2,
-  readFileSync as readFileSync4,
-  unlinkSync as unlinkSync4,
-  writeFileSync as writeFileSync4
+  existsSync as existsSync10,
+  mkdirSync as mkdirSync9,
+  readdirSync as readdirSync4,
+  readFileSync as readFileSync5,
+  unlinkSync as unlinkSync6,
+  writeFileSync as writeFileSync5
 } from "fs";
 import { isIP } from "net";
-import { join as join11 } from "path";
+import { join as join14 } from "path";
 var MAX_RESPONSE_BYTES = 10 * 1024 * 1024;
 var CACHE_TTL_MS = 24 * 60 * 60 * 1000;
 var FETCH_TIMEOUT_MS = 30000;
 var MAX_REDIRECTS = 5;
 function cacheDir(storageDir) {
-  return join11(storageDir, "url_cache");
+  return join14(storageDir, "url_cache");
 }
 function hashUrl(url2) {
-  return createHash2("sha256").update(url2).digest("hex").slice(0, 16);
+  return createHash4("sha256").update(url2).digest("hex").slice(0, 16);
 }
 function metaPath(storageDir, hash2) {
-  return join11(cacheDir(storageDir), `${hash2}.meta.json`);
+  return join14(cacheDir(storageDir), `${hash2}.meta.json`);
 }
 function contentPath(storageDir, hash2, extension) {
-  return join11(cacheDir(storageDir), `${hash2}${extension}`);
+  return join14(cacheDir(storageDir), `${hash2}${extension}`);
 }
 function _isPrivateIpv4(address) {
   const parts = address.split(".").map((part) => Number.parseInt(part, 10));
@@ -23525,15 +24926,15 @@ async function fetchUrlToTempFile(url2, storageDir, options = {}) {
   }
   const allowPrivate = options.allowPrivate === true;
   const dir = cacheDir(storageDir);
-  mkdirSync7(dir, { recursive: true });
+  mkdirSync9(dir, { recursive: true });
   const hash2 = hashUrl(url2);
   const metaFile = metaPath(storageDir, hash2);
-  if (existsSync7(metaFile)) {
+  if (existsSync10(metaFile)) {
     try {
-      const meta4 = JSON.parse(readFileSync4(metaFile, "utf8"));
+      const meta4 = JSON.parse(readFileSync5(metaFile, "utf8"));
       const age = Date.now() - meta4.fetchedAt;
       const cached2 = contentPath(storageDir, hash2, meta4.extension);
-      if (age < CACHE_TTL_MS && existsSync7(cached2)) {
+      if (age < CACHE_TTL_MS && existsSync10(cached2)) {
         log(`URL cache hit: ${url2} (${Math.round(age / 1000)}s old)`);
         return cached2;
       }
@@ -23578,9 +24979,9 @@ async function fetchUrlToTempFile(url2, storageDir, options = {}) {
   const body = Buffer.concat(chunks);
   const contentFile = contentPath(storageDir, hash2, extension);
   const tmpContent = `${contentFile}.tmp-${process.pid}`;
-  writeFileSync4(tmpContent, body);
-  const { renameSync: renameSync3 } = await import("fs");
-  renameSync3(tmpContent, contentFile);
+  writeFileSync5(tmpContent, body);
+  const { renameSync: renameSync4 } = await import("fs");
+  renameSync4(tmpContent, contentFile);
   const meta3 = {
     url: url2,
     contentType,
@@ -23588,35 +24989,35 @@ async function fetchUrlToTempFile(url2, storageDir, options = {}) {
     fetchedAt: Date.now()
   };
   const tmpMeta = `${metaFile}.tmp-${process.pid}`;
-  writeFileSync4(tmpMeta, JSON.stringify(meta3));
-  renameSync3(tmpMeta, metaFile);
+  writeFileSync5(tmpMeta, JSON.stringify(meta3));
+  renameSync4(tmpMeta, metaFile);
   log(`URL cached (${total} bytes): ${url2}`);
   return contentFile;
 }
 function cleanupUrlCache(storageDir) {
   const dir = cacheDir(storageDir);
-  if (!existsSync7(dir))
+  if (!existsSync10(dir))
     return;
   let removed = 0;
   try {
-    for (const entry of readdirSync2(dir)) {
+    for (const entry of readdirSync4(dir)) {
       if (!entry.endsWith(".meta.json"))
         continue;
-      const metaFile = join11(dir, entry);
+      const metaFile = join14(dir, entry);
       try {
-        const meta3 = JSON.parse(readFileSync4(metaFile, "utf8"));
+        const meta3 = JSON.parse(readFileSync5(metaFile, "utf8"));
         const age = Date.now() - meta3.fetchedAt;
         if (age > CACHE_TTL_MS) {
           const hash2 = entry.slice(0, -".meta.json".length);
           const content = contentPath(storageDir, hash2, meta3.extension);
-          if (existsSync7(content))
-            unlinkSync4(content);
-          unlinkSync4(metaFile);
+          if (existsSync10(content))
+            unlinkSync6(content);
+          unlinkSync6(metaFile);
           removed++;
         }
       } catch {
         try {
-          unlinkSync4(metaFile);
+          unlinkSync6(metaFile);
           removed++;
         } catch {}
       }
@@ -25375,7 +26776,7 @@ function navigationTools(ctx) {
 
 // src/tools/reading.ts
 import { readdir } from "fs/promises";
-import { extname as extname2, join as join12, resolve as resolve5 } from "path";
+import { extname as extname2, join as join15, resolve as resolve6 } from "path";
 import { tool as tool7 } from "@opencode-ai/plugin";
 var OUTLINE_EXTENSIONS = new Set([
   ".ts",
@@ -25453,7 +26854,7 @@ function readingTools(ctx) {
         if (!dirArg && typeof args.filePath === "string" && !Array.isArray(args.files)) {
           try {
             const { stat } = await import("fs/promises");
-            const resolved = resolve5(context.directory, args.filePath);
+            const resolved = resolve6(context.directory, args.filePath);
             const st = await stat(resolved);
             if (st.isDirectory()) {
               dirArg = args.filePath;
@@ -25461,7 +26862,7 @@ function readingTools(ctx) {
           } catch {}
         }
         if (dirArg) {
-          const dirPath = resolve5(context.directory, dirArg);
+          const dirPath = resolve6(context.directory, dirArg);
           const files = await discoverSourceFiles(dirPath);
           if (files.length === 0) {
             return JSON.stringify({
@@ -25569,12 +26970,12 @@ async function discoverSourceFiles(dir, maxFiles = 200) {
         return;
       if (entry.isDirectory()) {
         if (!SKIP_DIRS.has(entry.name) && !entry.name.startsWith(".")) {
-          await walk(join12(current, entry.name));
+          await walk(join15(current, entry.name));
         }
       } else if (entry.isFile()) {
         const ext = extname2(entry.name).toLowerCase();
         if (OUTLINE_EXTENSIONS.has(ext)) {
-          files.push(join12(current, entry.name));
+          files.push(join15(current, entry.name));
         }
       }
     }
@@ -26167,8 +27568,8 @@ var plugin = async (input) => {
   if (aftConfig.max_callgraph_files !== undefined)
     configOverrides.max_callgraph_files = aftConfig.max_callgraph_files;
   const isFastembedSemanticBackend = (aftConfig.semantic?.backend ?? "fastembed") === "fastembed";
-  const dataHome = process.env.XDG_DATA_HOME || join13(homedir7(), ".local", "share");
-  configOverrides.storage_dir = join13(dataHome, "opencode", "storage", "plugin", "aft");
+  const dataHome = process.env.XDG_DATA_HOME || join16(homedir8(), ".local", "share");
+  configOverrides.storage_dir = join16(dataHome, "opencode", "storage", "plugin", "aft");
   if (aftConfig.experimental_semantic_search && isFastembedSemanticBackend) {
     const storageDir2 = configOverrides.storage_dir;
     const ortDylibDir = await ensureOnnxRuntime(storageDir2).catch((err) => {
@@ -26181,6 +27582,63 @@ var plugin = async (input) => {
       warn(`Semantic search requires ONNX Runtime. Install: ${getManualInstallHint()}`);
     }
   }
+  try {
+    const lspAutoInstall = aftConfig.lsp?.auto_install ?? true;
+    const lspGraceDays = aftConfig.lsp?.grace_days ?? 7;
+    const lspVersions = aftConfig.lsp?.versions ?? {};
+    const lspDisabled = new Set(aftConfig.lsp?.disabled ?? []);
+    const npmResult = runAutoInstall(input.directory, {
+      autoInstall: lspAutoInstall,
+      graceDays: lspGraceDays,
+      versions: lspVersions,
+      disabled: lspDisabled
+    });
+    const relevantGithub = discoverRelevantGithubServers(input.directory);
+    const ghResult = runGithubAutoInstall(relevantGithub, {
+      autoInstall: lspAutoInstall,
+      graceDays: lspGraceDays,
+      versions: lspVersions,
+      disabled: lspDisabled
+    });
+    const mergedBinDirs = [...npmResult.cachedBinDirs, ...ghResult.cachedBinDirs];
+    if (mergedBinDirs.length > 0) {
+      configOverrides.lsp_paths_extra = mergedBinDirs;
+    }
+    if (npmResult.installsStarted > 0 || ghResult.installsStarted > 0) {
+      log(`[lsp] auto-install: ${npmResult.installsStarted} npm + ${ghResult.installsStarted} github install(s) running in background`);
+    }
+    Promise.all([npmResult.installsComplete, ghResult.installsComplete]).then(() => {
+      const actionable = [...npmResult.skipped, ...ghResult.skipped].filter((s) => {
+        const r = s.reason.toLowerCase();
+        if (r === "auto_install: false")
+          return false;
+        if (r === "disabled by config")
+          return false;
+        if (r === "not relevant to project")
+          return false;
+        if (r === "already installed")
+          return false;
+        if (r === "another install in progress")
+          return false;
+        return true;
+      });
+      if (actionable.length === 0)
+        return;
+      const lines = actionable.map((s) => `  \u2022 ${s.id}: ${s.reason}`).join(`
+`);
+      const message = `AFT skipped or failed to install ${actionable.length} LSP server(s):
+${lines}
+
+` + "See `/aft-status` for details, or check the plugin log. " + 'Pin a working version with `lsp.versions: { "<package>": "<version>" }` if grace is blocking, ' + "or set `lsp.auto_install: false` to suppress this entirely.";
+      sendWarning({ client: input.client, directory: input.directory }, message).catch((err) => {
+        warn(`[lsp] failed to deliver install summary: ${err}`);
+      });
+    }).catch((err) => {
+      warn(`[lsp] install-summary aggregation failed: ${err}`);
+    });
+  } catch (err) {
+    warn(`[lsp] auto-install setup failed: ${err instanceof Error ? err.message : String(err)}`);
+  }
   let versionUpgradeAttempted = null;
   const pool = new BridgePool(binaryPath, {
     minVersion: PLUGIN_VERSION,
@@ -26228,6 +27686,7 @@ var plugin = async (input) => {
   setSharedBridgePool(pool);
   const rpcServer = new AftRpcServer(configOverrides.storage_dir, input.directory);
   const unregisterShutdown = registerShutdownCleanup(async () => {
+    await Promise.allSettled([abortInFlightAutoInstalls(), abortInFlightGithubInstalls()]);
     try {
       rpcServer.stop();
     } catch {}
@@ -26244,10 +27703,10 @@ var plugin = async (input) => {
       return { show: false };
     }
     if (storageDir) {
-      const versionFile = join13(storageDir, "last_announced_version");
+      const versionFile = join16(storageDir, "last_announced_version");
       try {
-        if (existsSync9(versionFile)) {
-          const lastVersion = readFileSync5(versionFile, "utf-8").trim();
+        if (existsSync12(versionFile)) {
+          const lastVersion = readFileSync6(versionFile, "utf-8").trim();
           if (lastVersion === ANNOUNCEMENT_VERSION)
             return { show: false };
         }
@@ -26258,8 +27717,8 @@ var plugin = async (input) => {
   rpcServer.handle("mark-announced", async () => {
     if (storageDir && ANNOUNCEMENT_VERSION) {
       try {
-        mkdirSync8(storageDir, { recursive: true });
-        writeFileSync5(join13(storageDir, "last_announced_version"), ANNOUNCEMENT_VERSION);
+        mkdirSync10(storageDir, { recursive: true });
+        writeFileSync6(join16(storageDir, "last_announced_version"), ANNOUNCEMENT_VERSION);
       } catch {}
     }
     return { success: true };
@@ -26389,11 +27848,12 @@ Install: ${getManualInstallHint()}`).catch(() => {});
         }
       };
     },
-    dispose: () => {
+    dispose: async () => {
       unregisterShutdown();
+      await Promise.allSettled([abortInFlightAutoInstalls(), abortInFlightGithubInstalls()]);
       rpcServer.stop();
       clearSharedBridgePool();
-      return pool.shutdown();
+      await pool.shutdown();
     }
   };
 };