@cortexkit/aft-opencode 0.16.1 → 0.17.1

package/dist/index.js

@@ -7803,10 +7803,10 @@ var require_src2 = __commonJS((exports, module) => {
 });
 
 // src/index.ts
-import { existsSync as existsSync9, mkdirSync as mkdirSync8, readFileSync as readFileSync5, writeFileSync as writeFileSync5 } from "fs";
+import { existsSync as existsSync13, mkdirSync as mkdirSync10, readFileSync as readFileSync9, writeFileSync as writeFileSync9 } from "fs";
 import { createRequire as createRequire2 } from "module";
-import { homedir as homedir7 } from "os";
-import { join as join13 } from "path";
+import { homedir as homedir10 } from "os";
+import { join as join19 } from "path";
 
 // src/config.ts
 var import_comment_json = __toESM(require_src2(), 1);
@@ -21461,7 +21461,10 @@ var LspServerSchema = LspServerEntrySchema.extend({
 var LspConfigSchema = exports_external.object({
   servers: exports_external.record(exports_external.string().trim().min(1), LspServerEntrySchema).optional(),
   disabled: exports_external.array(exports_external.string().trim().min(1)).optional(),
-  python: exports_external.enum(["pyright", "ty", "auto"]).optional()
+  python: exports_external.enum(["pyright", "ty", "auto"]).optional(),
+  auto_install: exports_external.boolean().optional(),
+  grace_days: exports_external.number().int().positive().optional(),
+  versions: exports_external.record(exports_external.string().trim().min(1), exports_external.string().trim().min(1)).optional()
 });
 var AftConfigSchema = exports_external.object({
   format_on_edit: exports_external.boolean().optional(),
@@ -21478,7 +21481,8 @@ var AftConfigSchema = exports_external.object({
   lsp: LspConfigSchema.optional(),
   url_fetch_allow_private: exports_external.boolean().optional(),
   semantic: SemanticConfigSchema.optional(),
-  max_callgraph_files: exports_external.number().int().positive().optional()
+  max_callgraph_files: exports_external.number().int().positive().optional(),
+  auto_update: exports_external.boolean().optional()
 });
 function normalizeLspExtension(extension) {
   return extension.trim().replace(/^\.+/, "");
@@ -21604,26 +21608,81 @@ function mergeSemanticConfig(baseSemantic, overrideSemantic) {
   }
   return Object.fromEntries(Object.entries(semantic).filter(([, value]) => value !== undefined));
 }
+function mergeLspConfig(baseLsp, overrideLsp) {
+  const projectLsp = {};
+  if (overrideLsp?.python !== undefined)
+    projectLsp.python = overrideLsp.python;
+  const userDisabled = baseLsp?.disabled ?? [];
+  const lsp = {
+    ...baseLsp,
+    ...projectLsp,
+    ...userDisabled.length > 0 ? { disabled: [...userDisabled] } : {}
+  };
+  if (Object.values(lsp).every((value) => value === undefined)) {
+    return;
+  }
+  return Object.fromEntries(Object.entries(lsp).filter(([, value]) => value !== undefined));
+}
+function getProjectLspStrippedKeys(lsp) {
+  if (!lsp) {
+    return [];
+  }
+  const strippedKeys = [];
+  if (lsp.servers !== undefined)
+    strippedKeys.push("lsp.servers");
+  if (lsp.versions !== undefined)
+    strippedKeys.push("lsp.versions");
+  if (lsp.auto_install !== undefined)
+    strippedKeys.push("lsp.auto_install");
+  if (lsp.grace_days !== undefined)
+    strippedKeys.push("lsp.grace_days");
+  if (lsp.disabled !== undefined)
+    strippedKeys.push("lsp.disabled");
+  return strippedKeys;
+}
+var PROJECT_SAFE_TOP_LEVEL_FIELDS = new Set([
+  "tool_surface",
+  "hoist_builtin_tools",
+  "format_on_edit",
+  "validate_on_edit",
+  "experimental_search_index",
+  "experimental_semantic_search",
+  "experimental_lsp_ty"
+]);
+function pickProjectSafeFields(override) {
+  const safe = {};
+  for (const key of PROJECT_SAFE_TOP_LEVEL_FIELDS) {
+    if (override[key] !== undefined) {
+      safe[key] = override[key];
+    }
+  }
+  return safe;
+}
+function getStrippedTopLevelKeys(override) {
+  const stripped = [];
+  if (override.restrict_to_project_root !== undefined)
+    stripped.push("restrict_to_project_root");
+  if (override.url_fetch_allow_private !== undefined)
+    stripped.push("url_fetch_allow_private");
+  if (override.max_callgraph_files !== undefined)
+    stripped.push("max_callgraph_files");
+  if (override.auto_update !== undefined)
+    stripped.push("auto_update");
+  return stripped;
+}
 function mergeConfigs(base, override) {
   const disabledTools = [...base.disabled_tools ?? [], ...override.disabled_tools ?? []];
   const formatter = { ...base.formatter, ...override.formatter };
   const checker = { ...base.checker, ...override.checker };
   const semantic = mergeSemanticConfig(base.semantic, override.semantic);
-  const lspServers = { ...base.lsp?.servers, ...override.lsp?.servers };
-  const disabledLsp = [...base.lsp?.disabled ?? [], ...override.lsp?.disabled ?? []];
-  const lsp = {
-    ...base.lsp,
-    ...override.lsp,
-    ...Object.keys(lspServers).length > 0 ? { servers: lspServers } : {},
-    ...disabledLsp.length > 0 ? { disabled: [...new Set(disabledLsp)] } : {}
-  };
-  const { semantic: _stripSemantic, ...safeOverride } = override;
+  const lsp = mergeLspConfig(base.lsp, override.lsp);
+  const safeOverride = pickProjectSafeFields(override);
   return {
     ...base,
     ...safeOverride,
     ...Object.keys(formatter).length > 0 ? { formatter } : {},
     ...Object.keys(checker).length > 0 ? { checker } : {},
-    ...Object.values(lsp).some((value) => value !== undefined) ? { lsp } : {},
+    ...lsp ? { lsp } : {},
     semantic,
     ...disabledTools.length > 0 ? { disabled_tools: [...new Set(disabledTools)] } : {}
   };
@@ -21650,6 +21709,14 @@ function loadAftConfig(projectDirectory) {
     if (projectConfig.semantic?.backend !== undefined || projectConfig.semantic?.base_url !== undefined || projectConfig.semantic?.api_key_env !== undefined) {
       warn("Ignoring semantic.backend/base_url/api_key_env from project config (security: use user config for external backends)");
     }
+    const strippedLspKeys = getProjectLspStrippedKeys(projectConfig.lsp);
+    if (strippedLspKeys.length > 0) {
+      warn(`Ignoring ${strippedLspKeys.join(", ")} from project config ${projectConfigPath} (security: these LSP settings only honor user-level config)`);
+    }
+    const strippedTopLevelKeys = getStrippedTopLevelKeys(projectConfig);
+    if (strippedTopLevelKeys.length > 0) {
+      warn(`Ignoring ${strippedTopLevelKeys.join(", ")} from project config ${projectConfigPath} (security: these settings only honor user-level config \u2014 a project should not weaken security boundaries for the user)`);
+    }
     config2 = mergeConfigs(config2, projectConfig);
   }
   return config2;
@@ -21805,194 +21872,2115 @@ async function fetchLatestTag() {
   }
 }
 
-// src/metadata-store.ts
-var pendingStore = new Map;
-var STALE_TIMEOUT_MS = 15 * 60 * 1000;
-function makeKey(sessionID, callID) {
-  return `${sessionID}:${callID}`;
-}
-function cleanupStaleEntries() {
-  const now = Date.now();
-  for (const [key, entry] of pendingStore) {
-    if (now - entry.storedAt > STALE_TIMEOUT_MS) {
-      pendingStore.delete(key);
-    }
+// src/hooks/auto-update-checker/cache.ts
+var import_comment_json3 = __toESM(require_src2(), 1);
+import { spawn } from "child_process";
+import { existsSync as existsSync4, readFileSync as readFileSync3, rmSync, writeFileSync as writeFileSync2 } from "fs";
+import { basename, dirname as dirname2, join as join6 } from "path";
+
+// src/hooks/auto-update-checker/checker.ts
+var import_comment_json2 = __toESM(require_src2(), 1);
+import { existsSync as existsSync3, readFileSync as readFileSync2, statSync, writeFileSync } from "fs";
+import { homedir as homedir4 } from "os";
+import { dirname, isAbsolute, join as join5, resolve } from "path";
+import { fileURLToPath } from "url";
+
+// src/hooks/auto-update-checker/constants.ts
+import { homedir as homedir3, platform } from "os";
+import { join as join4 } from "path";
+var PACKAGE_NAME = "@cortexkit/aft-opencode";
+var NPM_REGISTRY_URL = "https://registry.npmjs.org";
+var NPM_FETCH_TIMEOUT = 1e4;
+function getOpenCodeCacheRoot() {
+  if (platform() === "win32") {
+    return join4(process.env.LOCALAPPDATA ?? homedir3(), "opencode");
   }
+  return join4(homedir3(), ".cache", "opencode");
 }
-function storeToolMetadata(sessionID, callID, data) {
-  cleanupStaleEntries();
-  pendingStore.set(makeKey(sessionID, callID), {
-    ...data,
-    storedAt: Date.now()
-  });
-}
-function consumeToolMetadata(sessionID, callID) {
-  const key = makeKey(sessionID, callID);
-  const stored = pendingStore.get(key);
-  if (stored) {
-    pendingStore.delete(key);
-    const { storedAt: _, ...data } = stored;
-    return data;
+function getOpenCodeConfigRoot() {
+  if (platform() === "win32") {
+    return join4(process.env.APPDATA ?? join4(homedir3(), "AppData", "Roaming"), "opencode");
   }
-  return;
+  return join4(process.env.XDG_CONFIG_HOME ?? join4(homedir3(), ".config"), "opencode");
 }
+var CACHE_DIR = join4(getOpenCodeCacheRoot(), "packages");
+var USER_OPENCODE_CONFIG = join4(getOpenCodeConfigRoot(), "opencode.json");
+var USER_OPENCODE_CONFIG_JSONC = join4(getOpenCodeConfigRoot(), "opencode.jsonc");
 
-// src/normalize-schemas.ts
-import { tool } from "@opencode-ai/plugin";
-function stripRootJsonSchemaFields(jsonSchema) {
-  const { $schema: _schema, ...rest } = jsonSchema;
-  return rest;
+// src/hooks/auto-update-checker/types.ts
+var NpmPackageEnvelopeSchema = exports_external.object({
+  "dist-tags": exports_external.record(exports_external.string(), exports_external.string()).optional().default({})
+});
+var OpencodePluginTupleSchema = exports_external.tuple([exports_external.string(), exports_external.record(exports_external.string(), exports_external.unknown())]);
+var OpencodeConfigSchema = exports_external.object({
+  plugin: exports_external.array(exports_external.union([exports_external.string(), OpencodePluginTupleSchema])).optional()
+});
+var PackageJsonSchema = exports_external.object({
+  name: exports_external.string().optional(),
+  version: exports_external.string().optional(),
+  dependencies: exports_external.record(exports_external.string(), exports_external.string()).optional()
+}).passthrough();
+
+// src/hooks/auto-update-checker/checker.ts
+function isString(value) {
+  return typeof value === "string";
 }
-function attachJsonSchemaOverride(schema) {
-  if (schema._zod.toJSONSchema) {
-    return;
+function pluginSpecifier(entry) {
+  return typeof entry === "string" ? entry : entry[0];
+}
+function getPluginEntries(config2) {
+  const parsed = OpencodeConfigSchema.safeParse(config2);
+  if (!parsed.success)
+    return [];
+  return (parsed.data.plugin ?? []).map(pluginSpecifier).filter(isString);
+}
+function parseJsonConfig(content) {
+  try {
+    return import_comment_json2.parse(content);
+  } catch (err) {
+    warn(`[auto-update-checker] Failed to parse OpenCode config: ${String(err)}`);
+    return null;
   }
-  schema._zod.toJSONSchema = () => {
-    const originalOverride = schema._zod.toJSONSchema;
-    delete schema._zod.toJSONSchema;
+}
+function isPrereleaseVersion(version2) {
+  return version2.includes("-");
+}
+function isDistTag(version2) {
+  return !/^\d/.test(version2);
+}
+function extractChannel(version2) {
+  if (!version2)
+    return "latest";
+  if (isDistTag(version2))
+    return version2;
+  if (isPrereleaseVersion(version2)) {
+    const prereleasePart = version2.split("-")[1];
+    const channelMatch = prereleasePart?.match(/^(alpha|beta|rc|canary|next)/);
+    if (channelMatch?.[1])
+      return channelMatch[1];
+  }
+  return "latest";
+}
+function getConfigPaths(directory) {
+  return [
+    join5(directory, ".opencode", "opencode.json"),
+    join5(directory, ".opencode", "opencode.jsonc"),
+    USER_OPENCODE_CONFIG,
+    USER_OPENCODE_CONFIG_JSONC
+  ];
+}
+function resolvePathPluginSpec(spec, configPath) {
+  if (spec.startsWith("file://")) {
     try {
-      return stripRootJsonSchemaFields(tool.schema.toJSONSchema(schema));
-    } finally {
-      schema._zod.toJSONSchema = originalOverride;
+      return fileURLToPath(spec);
+    } catch {
+      return spec.replace(/^file:\/\//, "");
     }
-  };
-}
-function normalizeToolArgSchemas(toolDefinition) {
-  for (const schema of Object.values(toolDefinition.args)) {
-    attachJsonSchemaOverride(schema);
   }
-  return toolDefinition;
+  if (isAbsolute(spec) || /^[A-Za-z]:[\\/]/.test(spec))
+    return spec;
+  return resolve(dirname(configPath), spec);
 }
-function normalizeToolMap(tools) {
-  for (const def of Object.values(tools)) {
-    normalizeToolArgSchemas(def);
+function getLocalDevPath(directory) {
+  for (const configPath of getConfigPaths(directory)) {
+    try {
+      if (!existsSync3(configPath))
+        continue;
+      const rawConfig = parseJsonConfig(readFileSync2(configPath, "utf-8"));
+      const plugins = getPluginEntries(rawConfig);
+      for (const entry of plugins) {
+        if (entry === PACKAGE_NAME || entry.startsWith(`${PACKAGE_NAME}@`))
+          continue;
+        if (entry.startsWith("file://") || entry.startsWith(".") || isAbsolute(entry)) {
+          const localPath = resolvePathPluginSpec(entry, configPath);
+          const pkgPath = findPackageJsonUp(localPath);
+          if (!pkgPath)
+            continue;
+          const pkg = PackageJsonSchema.safeParse(JSON.parse(readFileSync2(pkgPath, "utf-8")));
+          if (pkg.success && pkg.data.name === PACKAGE_NAME)
+            return localPath;
+        }
+      }
+    } catch {}
   }
-  return tools;
+  return null;
 }
-
-// src/notifications.ts
-import { existsSync as existsSync3, mkdirSync as mkdirSync2, readFileSync as readFileSync2, writeFileSync } from "fs";
-import { homedir as homedir3, platform } from "os";
-import { join as join4 } from "path";
-function isTuiMode() {
-  return process.env.OPENCODE_CLIENT === "cli";
+function findPackageJsonUp(startPath) {
+  try {
+    const stat = statSync(startPath);
+    let dir = stat.isDirectory() ? startPath : dirname(startPath);
+    for (let i = 0;i < 10; i++) {
+      const pkgPath = join5(dir, "package.json");
+      if (existsSync3(pkgPath)) {
+        try {
+          const pkg = PackageJsonSchema.safeParse(JSON.parse(readFileSync2(pkgPath, "utf-8")));
+          if (pkg.success && pkg.data.name === PACKAGE_NAME)
+            return pkgPath;
+        } catch {}
+      }
+      const parent = dirname(dir);
+      if (parent === dir)
+        break;
+      dir = parent;
+    }
+  } catch {}
+  return null;
 }
-async function showTuiToast(client, title, message, variant = "info", duration3 = 8000) {
-  const c = client;
-  if (typeof c.tui?.showToast !== "function")
-    return false;
+function getLocalDevVersion(directory) {
+  const localPath = getLocalDevPath(directory);
+  if (!localPath)
+    return null;
   try {
-    await c.tui.showToast({ body: { title, message, variant, duration: duration3 } });
-    return true;
+    const pkgPath = findPackageJsonUp(localPath);
+    if (!pkgPath)
+      return null;
+    const pkg = PackageJsonSchema.safeParse(JSON.parse(readFileSync2(pkgPath, "utf-8")));
+    return pkg.success ? pkg.data.version ?? null : null;
   } catch {
-    return false;
+    return null;
   }
 }
-var AFT_MARKER = "\uD83D\uDD27 AFT:";
-var FEATURE_MARKER = `${AFT_MARKER} New in`;
-var WARNING_MARKER = `${AFT_MARKER} \u26A0\uFE0F`;
-var STATUS_MARKER = `${AFT_MARKER} \u2705`;
-var WARNED_TOOLS_FILE = "warned_tools.json";
-function getDesktopStatePath() {
-  const os2 = platform();
-  const home = homedir3();
-  if (os2 === "darwin") {
-    return join4(home, "Library", "Application Support", "ai.opencode.desktop", "opencode.global.dat");
+function getCurrentRuntimePackageJsonPath(currentModuleUrl = import.meta.url) {
+  try {
+    return findPackageJsonUp(dirname(fileURLToPath(currentModuleUrl)));
+  } catch (err) {
+    warn(`[auto-update-checker] Failed to resolve runtime package path: ${String(err)}`);
+    return null;
   }
-  if (os2 === "linux") {
-    const xdgConfig = process.env.XDG_CONFIG_HOME || join4(home, ".config");
-    return join4(xdgConfig, "ai.opencode.desktop", "opencode.global.dat");
+}
+function findPluginEntry(directory) {
+  for (const configPath of getConfigPaths(directory)) {
+    try {
+      if (!existsSync3(configPath))
+        continue;
+      const rawConfig = parseJsonConfig(readFileSync2(configPath, "utf-8"));
+      const plugins = getPluginEntries(rawConfig);
+      for (const entry of plugins) {
+        if (entry === PACKAGE_NAME) {
+          return { entry, isPinned: false, pinnedVersion: null, configPath };
+        }
+        if (entry.startsWith(`${PACKAGE_NAME}@`)) {
+          const pinnedVersion = entry.slice(PACKAGE_NAME.length + 1);
+          const isPinned = pinnedVersion !== "latest";
+          return { entry, isPinned, pinnedVersion: isPinned ? pinnedVersion : null, configPath };
+        }
+      }
+    } catch {}
   }
-  if (os2 === "win32") {
-    const appData = process.env.APPDATA || join4(home, "AppData", "Roaming");
-    return join4(appData, "ai.opencode.desktop", "opencode.global.dat");
+  return null;
+}
+var cachedPackageVersion = null;
+function getSpecCachePackageJsonPath(spec) {
+  return join5(CACHE_DIR, spec, "node_modules", PACKAGE_NAME, "package.json");
+}
+function getCachedVersion(spec) {
+  if (!spec && cachedPackageVersion)
+    return cachedPackageVersion;
+  const candidates = [
+    getCurrentRuntimePackageJsonPath(),
+    spec ? getSpecCachePackageJsonPath(spec) : null,
+    getSpecCachePackageJsonPath(`${PACKAGE_NAME}@latest`),
+    join5(homedir4(), ".cache", "opencode", "node_modules", PACKAGE_NAME, "package.json")
+  ].filter(isString);
+  for (const packageJsonPath of candidates) {
+    try {
+      if (!existsSync3(packageJsonPath))
+        continue;
+      const pkg = PackageJsonSchema.safeParse(JSON.parse(readFileSync2(packageJsonPath, "utf-8")));
+      if (pkg.success && pkg.data.version) {
+        if (!spec)
+          cachedPackageVersion = pkg.data.version;
+        return pkg.data.version;
+      }
+    } catch {}
   }
   return null;
 }
-function readDesktopState(directory) {
-  const statePath = getDesktopStatePath();
-  if (!statePath || !existsSync3(statePath)) {
-    return { sessionId: null, serverUrl: null };
+function buildRegistryUrl(registryUrl) {
+  return `${registryUrl.replace(/\/+$/, "")}/${encodeURIComponent(PACKAGE_NAME).replace("%2F", "/")}`;
+}
+async function getLatestVersion(channel = "latest", options = {}) {
+  const controller = new AbortController;
+  const timeoutId = setTimeout(() => controller.abort(), options.timeoutMs ?? NPM_FETCH_TIMEOUT);
+  const abortHandler = () => controller.abort();
+  options.signal?.addEventListener("abort", abortHandler, { once: true });
+  try {
+    if (options.signal?.aborted)
+      return null;
+    const response = await fetch(buildRegistryUrl(options.registryUrl ?? NPM_REGISTRY_URL), {
+      signal: controller.signal,
+      headers: { Accept: "application/json" }
+    });
+    if (!response.ok)
+      return null;
+    const data = NpmPackageEnvelopeSchema.safeParse(await response.json());
+    if (!data.success)
+      return null;
+    return data.data["dist-tags"][channel] ?? data.data["dist-tags"].latest ?? null;
+  } catch {
+    return null;
+  } finally {
+    options.signal?.removeEventListener("abort", abortHandler);
+    clearTimeout(timeoutId);
+  }
+}
+
+// src/hooks/auto-update-checker/cache.ts
+function stripPackageNameFromPath(pathValue, packageName) {
+  let current = pathValue;
+  for (const segment of [...packageName.split("/")].reverse()) {
+    if (basename(current) !== segment)
+      return null;
+    current = dirname2(current);
   }
+  return current;
+}
+function removeFromBunLock(installDir, packageName) {
+  const lockPath = join6(installDir, "bun.lock");
+  if (!existsSync4(lockPath))
+    return false;
   try {
-    const raw = readFileSync2(statePath, "utf-8");
-    const state = JSON.parse(raw);
-    let serverUrl = null;
-    const serverStr = state.server;
-    if (typeof serverStr === "string") {
-      try {
-        const serverState = JSON.parse(serverStr);
-        if (typeof serverState.currentSidecarUrl === "string") {
-          serverUrl = serverState.currentSidecarUrl;
-        }
-      } catch {}
+    const lock = import_comment_json3.parse(readFileSync3(lockPath, "utf-8"));
+    let modified = false;
+    if (lock.workspaces?.[""]?.dependencies?.[packageName]) {
+      delete lock.workspaces[""].dependencies[packageName];
+      modified = true;
     }
-    let sessionId = null;
-    const layoutPage = state["layout.page"];
-    if (typeof layoutPage === "string") {
-      const parsed = JSON.parse(layoutPage);
-      const lastProjectSession = parsed.lastProjectSession;
-      if (lastProjectSession) {
-        const entry = lastProjectSession[directory];
-        sessionId = entry?.id ?? null;
-      }
+    if (lock.packages?.[packageName]) {
+      delete lock.packages[packageName];
+      modified = true;
     }
-    return { sessionId, serverUrl };
+    if (modified) {
+      writeFileSync2(lockPath, JSON.stringify(lock, null, 2));
+      log(`[auto-update-checker] Removed from bun.lock: ${packageName}`);
+    }
+    return modified;
   } catch {
-    return { sessionId: null, serverUrl: null };
+    return false;
   }
 }
-function getServerAuth() {
-  const password = process.env.OPENCODE_SERVER_PASSWORD;
-  if (!password)
-    return;
-  const username = process.env.OPENCODE_SERVER_USERNAME ?? "opencode";
-  return `Basic ${Buffer.from(`${username}:${password}`, "utf8").toString("base64")}`;
-}
-async function getSessionMessages(client, sessionId) {
+function ensureDependencyVersion(packageJsonPath, packageName, version2) {
+  if (!existsSync4(packageJsonPath))
+    return false;
   try {
-    const c = client;
-    if (typeof c.session?.messages === "function") {
-      const result = await c.session.messages({ path: { id: sessionId } });
-      return result?.data ?? [];
+    const raw = import_comment_json3.parse(readFileSync3(packageJsonPath, "utf-8"));
+    const pkgJson = PackageJsonSchema.safeParse(raw);
+    if (!pkgJson.success)
+      return false;
+    const nextPackageJson = { ...pkgJson.data };
+    const dependencies = { ...nextPackageJson.dependencies ?? {} };
+    if (dependencies[packageName] === version2)
+      return true;
+    dependencies[packageName] = version2;
+    nextPackageJson.dependencies = dependencies;
+    writeFileSync2(packageJsonPath, JSON.stringify(nextPackageJson, null, 2));
+    log(`[auto-update-checker] Updated dependency in package.json: ${packageName} \u2192 ${version2}`);
+    return true;
+  } catch (err) {
+    warn(`[auto-update-checker] Failed to update package.json dependency: ${String(err)}`);
+    return false;
+  }
+}
+function removeInstalledPackage(installDir, packageName) {
+  const packageDir = join6(installDir, "node_modules", packageName);
+  if (!existsSync4(packageDir))
+    return false;
+  rmSync(packageDir, { recursive: true, force: true });
+  log(`[auto-update-checker] Package removed: ${packageDir}`);
+  return true;
+}
+function resolveInstallContext(runtimePackageJsonPath = getCurrentRuntimePackageJsonPath()) {
+  if (runtimePackageJsonPath) {
+    const packageDir = dirname2(runtimePackageJsonPath);
+    const nodeModulesDir = stripPackageNameFromPath(packageDir, PACKAGE_NAME);
+    if (nodeModulesDir && basename(nodeModulesDir) === "node_modules") {
+      const installDir = dirname2(nodeModulesDir);
+      const packageJsonPath = join6(installDir, "package.json");
+      if (existsSync4(packageJsonPath))
+        return { installDir, packageJsonPath };
     }
-  } catch {}
-  return [];
+    return null;
+  }
+  const legacyPackageJsonPath = join6(dirname2(CACHE_DIR), "package.json");
+  if (existsSync4(legacyPackageJsonPath)) {
+    return { installDir: dirname2(CACHE_DIR), packageJsonPath: legacyPackageJsonPath };
+  }
+  return null;
 }
-async function sendIgnoredMessage(client, sessionId, text) {
+function preparePackageUpdate(version2, packageName = PACKAGE_NAME, runtimePackageJsonPath = getCurrentRuntimePackageJsonPath()) {
   try {
-    const c = client;
-    const promptInput = {
-      path: { id: sessionId },
-      body: {
-        noReply: true,
-        parts: [{ type: "text", text, ignored: true }]
-      }
-    };
-    if (typeof c.session?.prompt === "function") {
-      await Promise.resolve(c.session.prompt(promptInput));
-      return true;
+    const installContext = resolveInstallContext(runtimePackageJsonPath);
+    if (!installContext) {
+      warn("[auto-update-checker] No install context found for auto-update");
+      return null;
     }
-    if (typeof c.session?.promptAsync === "function") {
-      await c.session.promptAsync(promptInput);
-      return true;
+    if (!ensureDependencyVersion(installContext.packageJsonPath, packageName, version2))
+      return null;
+    const packageRemoved = removeInstalledPackage(installContext.installDir, packageName);
+    const lockRemoved = removeFromBunLock(installContext.installDir, packageName);
+    if (!packageRemoved && !lockRemoved) {
+      log(`[auto-update-checker] No cached package artifacts removed for ${packageName}; continuing with updated dependency spec`);
     }
+    return installContext.installDir;
   } catch (err) {
-    log(`[aft-plugin] notification send failed: ${err instanceof Error ? err.message : String(err)}`);
+    warn(`[auto-update-checker] Failed to prepare package update: ${String(err)}`);
+    return null;
   }
-  return false;
 }
-async function deleteMessage(serverUrl, sessionId, messageId) {
-  const auth = getServerAuth();
-  const url2 = `${serverUrl}/session/${encodeURIComponent(sessionId)}/message/${encodeURIComponent(messageId)}`;
+async function runBunInstallSafe(installDir, options = {}) {
+  let timeout = null;
   try {
-    const response = await fetch(url2, {
-      method: "DELETE",
-      headers: auth ? { Authorization: auth } : {},
-      signal: AbortSignal.timeout(1e4)
+    if (options.signal?.aborted)
+      return false;
+    const proc = spawn("bun", ["install"], {
+      cwd: installDir,
+      stdio: "pipe"
     });
-    return response.ok;
-  } catch {
+    const abortProcess = () => {
+      try {
+        proc.kill();
+      } catch {}
+    };
+    options.signal?.addEventListener("abort", abortProcess, { once: true });
+    const exitPromise = new Promise((resolveExit) => {
+      proc.on("error", () => resolveExit(false));
+      proc.on("exit", (code) => resolveExit(code === 0));
+    });
+    const timeoutPromise = new Promise((resolveTimeout) => {
+      timeout = setTimeout(() => resolveTimeout("timeout"), options.timeoutMs ?? 60000);
+    });
+    const result = await Promise.race([exitPromise, timeoutPromise]);
+    options.signal?.removeEventListener("abort", abortProcess);
+    if (result === "timeout" || options.signal?.aborted) {
+      abortProcess();
+      return false;
+    }
+    return result;
+  } catch (err) {
+    warn(`[auto-update-checker] bun install error: ${String(err)}`);
+    return false;
+  } finally {
+    if (timeout)
+      clearTimeout(timeout);
+  }
+}
+
+// src/hooks/auto-update-checker/index.ts
+function createAutoUpdateCheckerHook(ctx, options = {}) {
+  const {
+    enabled = true,
+    showStartupToast = true,
+    autoUpdate = true,
+    npmRegistryUrl = NPM_REGISTRY_URL,
+    fetchTimeoutMs = NPM_FETCH_TIMEOUT,
+    signal = new AbortController().signal
+  } = options;
+  let hasChecked = false;
+  return async ({ event }) => {
+    if (!enabled)
+      return;
+    if (event.type !== "session.created")
+      return;
+    if (hasChecked)
+      return;
+    if (getParentId(event.properties))
+      return;
+    hasChecked = true;
+    setTimeout(() => {
+      runStartupCheck(ctx, {
+        showStartupToast,
+        autoUpdate,
+        npmRegistryUrl,
+        fetchTimeoutMs,
+        signal
+      }).catch((err) => {
+        warn(`[auto-update-checker] Background update check failed: ${String(err)}`);
+      });
+    }, 0);
+  };
+}
+function getParentId(properties) {
+  if (!properties || typeof properties !== "object" || Array.isArray(properties))
+    return null;
+  const info = properties.info;
+  if (!info || typeof info !== "object" || Array.isArray(info))
+    return null;
+  const parentID = info.parentID;
+  return typeof parentID === "string" && parentID.length > 0 ? parentID : null;
+}
+async function runStartupCheck(ctx, options) {
+  if (options.signal.aborted)
+    return;
+  const cachedVersion = getCachedVersion();
+  const localDevVersion = getLocalDevVersion(ctx.directory);
+  const displayVersion = localDevVersion ?? cachedVersion;
+  if (localDevVersion) {
+    if (options.showStartupToast) {
+      showToast(ctx, `AFT ${displayVersion} (dev)`, "Running in local development mode.", "info");
+    }
+    log("[auto-update-checker] Local development mode");
+    return;
+  }
+  if (options.showStartupToast) {
+    showToast(ctx, `AFT ${displayVersion ?? "unknown"}`, "@cortexkit/aft-opencode is active.", "info");
+  }
+  await runBackgroundUpdateCheck(ctx, options);
+}
+async function runBackgroundUpdateCheck(ctx, options) {
+  if (options.signal.aborted)
+    return;
+  const pluginInfo = findPluginEntry(ctx.directory);
+  if (!pluginInfo) {
+    log("[auto-update-checker] Plugin not found in config");
+    return;
+  }
+  const cachedVersion = getCachedVersion(pluginInfo.entry);
+  const currentVersion = cachedVersion ?? pluginInfo.pinnedVersion;
+  if (!currentVersion) {
+    log("[auto-update-checker] No version found (cached or pinned)");
+    return;
+  }
+  const channel = extractChannel(pluginInfo.pinnedVersion ?? currentVersion);
+  const latestVersion = await getLatestVersion(channel, {
+    registryUrl: options.npmRegistryUrl,
+    timeoutMs: options.fetchTimeoutMs,
+    signal: options.signal
+  });
+  if (!latestVersion) {
+    warn(`[auto-update-checker] Failed to fetch latest version for channel: ${channel}`);
+    showToast(ctx, "AFT update check failed", "Could not check npm for @cortexkit/aft-opencode updates. Continuing with the cached version.", "warning", 8000);
+    return;
+  }
+  if (currentVersion === latestVersion) {
+    log(`[auto-update-checker] Already on latest version for channel: ${channel}`);
+    return;
+  }
+  log(`[auto-update-checker] Update available (${channel}): ${currentVersion} \u2192 ${latestVersion}`);
+  if (pluginInfo.isPinned) {
+    showToast(ctx, `AFT ${latestVersion}`, `v${latestVersion} available. Version is pinned; update your OpenCode plugin config to upgrade.`, "info", 8000);
+    log("[auto-update-checker] Version is pinned; skipping auto-update");
+    return;
+  }
+  if (!options.autoUpdate) {
+    showToast(ctx, `AFT ${latestVersion}`, `v${latestVersion} available. Auto-update is disabled.`, "info", 8000);
+    log("[auto-update-checker] Auto-update disabled, notification only");
+    return;
+  }
+  const installDir = preparePackageUpdate(latestVersion, PACKAGE_NAME);
+  if (!installDir) {
+    showToast(ctx, `AFT ${latestVersion}`, `v${latestVersion} available. Auto-update could not prepare the active install.`, "warning", 8000);
+    warn("[auto-update-checker] Failed to prepare install root for auto-update");
+    return;
+  }
+  const installSuccess = await runBunInstallSafe(installDir, { signal: options.signal });
+  if (installSuccess) {
+    showToast(ctx, "AFT Updated!", `v${currentVersion} \u2192 v${latestVersion}
+Restart OpenCode to apply.`, "success", 8000);
+    log(`[auto-update-checker] Update installed: ${currentVersion} \u2192 ${latestVersion}`);
+    return;
+  }
+  showToast(ctx, `AFT ${latestVersion}`, `v${latestVersion} available, but auto-update failed to install it. Check logs or retry manually.`, "error", 8000);
+  warn("[auto-update-checker] bun install failed; update not installed");
+}
+function showToast(ctx, title, message, variant = "info", duration3 = 3000) {
+  ctx.client.tui.showToast({ body: { title, message, variant, duration: duration3 } }).catch(() => {});
+}
+
+// src/lsp-auto-install.ts
+import { spawn as spawn2 } from "child_process";
+import { createHash } from "crypto";
+import { createReadStream, statSync as statSync3 } from "fs";
+
+// src/lsp-cache.ts
+import {
+  closeSync,
+  mkdirSync as mkdirSync2,
+  openSync,
+  readFileSync as readFileSync4,
+  statSync as statSync2,
+  unlinkSync as unlinkSync2,
+  writeFileSync as writeFileSync3
+} from "fs";
+import { homedir as homedir5 } from "os";
+import { join as join7 } from "path";
+function aftCacheBase() {
+  const override = process.env.AFT_CACHE_DIR;
+  if (override && override.length > 0)
+    return override;
+  if (process.platform === "win32") {
+    const localAppData = process.env.LOCALAPPDATA || process.env.APPDATA;
+    const base2 = localAppData || join7(homedir5(), "AppData", "Local");
+    return join7(base2, "aft");
+  }
+  const base = process.env.XDG_CACHE_HOME || join7(homedir5(), ".cache");
+  return join7(base, "aft");
+}
+function lspCacheRoot() {
+  return join7(aftCacheBase(), "lsp-packages");
+}
+function lspPackageDir(npmPackage) {
+  return join7(lspCacheRoot(), encodeURIComponent(npmPackage));
+}
+function lspBinaryPath(npmPackage, binary) {
+  return join7(lspPackageDir(npmPackage), "node_modules", ".bin", binary);
+}
+function lspBinDir(npmPackage) {
+  return join7(lspPackageDir(npmPackage), "node_modules", ".bin");
+}
+function isInstalled(npmPackage, binary) {
+  for (const candidate of lspBinaryCandidates(binary)) {
+    try {
+      if (statSync2(join7(lspBinDir(npmPackage), candidate)).isFile())
+        return true;
+    } catch {}
+  }
+  return false;
+}
+function lspBinaryCandidates(binary) {
+  if (process.platform !== "win32")
+    return [binary];
+  return [binary, `${binary}.cmd`, `${binary}.exe`, `${binary}.bat`];
+}
+var INSTALLED_META_FILE = ".aft-installed";
+function writeInstalledMetaIn(installDir, version2, sha256) {
+  try {
+    mkdirSync2(installDir, { recursive: true });
+    const meta3 = {
+      version: version2,
+      installedAt: new Date().toISOString(),
+      ...sha256 ? { sha256 } : {}
+    };
+    writeFileSync3(join7(installDir, INSTALLED_META_FILE), JSON.stringify(meta3), "utf8");
+  } catch (err) {
+    log(`[lsp-cache] failed to write installed-meta in ${installDir}: ${err}`);
+  }
+}
+function readInstalledMetaIn(installDir) {
+  const path2 = join7(installDir, INSTALLED_META_FILE);
+  try {
+    if (!statSync2(path2).isFile())
+      return null;
+    const raw = readFileSync4(path2, "utf8");
+    const parsed = JSON.parse(raw);
+    if (typeof parsed.version !== "string" || parsed.version.length === 0)
+      return null;
+    return {
+      version: parsed.version,
+      installedAt: typeof parsed.installedAt === "string" ? parsed.installedAt : "",
+      ...typeof parsed.sha256 === "string" && parsed.sha256.length > 0 ? { sha256: parsed.sha256 } : {}
+    };
+  } catch {
+    return null;
+  }
+}
+function writeInstalledMeta(packageKey, version2, sha256) {
+  writeInstalledMetaIn(lspPackageDir(packageKey), version2, sha256);
+}
+function readInstalledMeta(packageKey) {
+  return readInstalledMetaIn(lspPackageDir(packageKey));
+}
+function lockPath(npmPackage) {
+  return join7(lspPackageDir(npmPackage), ".aft-installing");
+}
+var STALE_LOCK_MS = 30 * 60 * 1000;
+function acquireInstallLock(lockKey) {
+  mkdirSync2(lspPackageDir(lockKey), { recursive: true });
+  const lock = lockPath(lockKey);
+  const tryClaim = () => {
+    try {
+      const fd = openSync(lock, "wx");
+      try {
+        writeFileSync3(fd, `${process.pid}
+${new Date().toISOString()}
+`);
+      } finally {
+        closeSync(fd);
+      }
+      return true;
+    } catch (err) {
+      const code = err.code;
+      if (code === "EEXIST")
+        return false;
+      warn(`[lsp] unexpected error acquiring install lock for ${lockKey}: ${err}`);
+      return false;
+    }
+  };
+  if (tryClaim())
+    return true;
+  let owningPid = null;
+  let lockMtimeMs = 0;
+  try {
+    const raw = readFileSync4(lock, "utf8");
+    const firstLine = raw.split(/\r?\n/, 1)[0]?.trim() ?? "";
+    const parsed = Number.parseInt(firstLine, 10);
+    if (Number.isFinite(parsed) && parsed > 0)
+      owningPid = parsed;
+    lockMtimeMs = statSync2(lock).mtimeMs;
+  } catch {
+    return tryClaim();
+  }
+  const age = Date.now() - lockMtimeMs;
+  const ageWithinFresh = Math.abs(age) < STALE_LOCK_MS;
+  const skipLiveness = process.platform === "win32";
+  const ownerAlive = !skipLiveness && owningPid !== null && isProcessAlive(owningPid);
+  if (skipLiveness ? ageWithinFresh : ownerAlive && ageWithinFresh) {
+    return false;
+  }
+  log(`[lsp] reclaiming install lock for ${lockKey} (owner_pid=${owningPid ?? "unknown"}, alive=${ownerAlive}, age_ms=${age})`);
+  try {
+    unlinkSync2(lock);
+  } catch {}
+  return tryClaim();
+}
+function isProcessAlive(pid) {
+  try {
+    process.kill(pid, 0);
+    return true;
+  } catch (err) {
+    const code = err.code;
+    if (code === "ESRCH")
+      return false;
+    return true;
+  }
+}
+function releaseInstallLock(lockKey) {
+  const lock = lockPath(lockKey);
+  try {
+    let owningPid = null;
+    try {
+      const raw = readFileSync4(lock, "utf8");
+      const firstLine = raw.split(/\r?\n/, 1)[0]?.trim() ?? "";
+      const parsed = Number.parseInt(firstLine, 10);
+      if (Number.isFinite(parsed) && parsed > 0)
+        owningPid = parsed;
+    } catch (readErr) {
+      const code = readErr.code;
+      if (code === "ENOENT")
+        return;
+      warn(`[lsp] could not read install lock for ${lockKey} during release: ${readErr}`);
+      return;
+    }
+    if (owningPid !== process.pid) {
+      log(`[lsp] not releasing install lock for ${lockKey}: owned by pid ${owningPid ?? "unknown"} (we are ${process.pid})`);
+      return;
+    }
+    try {
+      unlinkSync2(lock);
+    } catch (unlinkErr) {
+      const code = unlinkErr.code;
+      if (code !== "ENOENT") {
+        warn(`[lsp] failed to release install lock for ${lockKey}: ${unlinkErr}`);
+      }
+    }
+  } catch (err) {
+    warn(`[lsp] unexpected error releasing install lock for ${lockKey}: ${err}`);
+  }
+}
+async function withInstallLock(lockKey, task) {
+  if (!acquireInstallLock(lockKey))
+    return null;
+  try {
+    return await task();
+  } finally {
+    releaseInstallLock(lockKey);
+  }
+}
+var VERSION_CHECK_FILE = ".aft-version-check";
+function readVersionCheck(npmPackage) {
+  const file2 = join7(lspPackageDir(npmPackage), VERSION_CHECK_FILE);
+  try {
+    const raw = readFileSync4(file2, "utf8");
+    const parsed = JSON.parse(raw);
+    if (typeof parsed.last_checked === "string") {
+      return {
+        last_checked: parsed.last_checked,
+        latest_eligible: typeof parsed.latest_eligible === "string" ? parsed.latest_eligible : null
+      };
+    }
+    return null;
+  } catch {
+    return null;
+  }
+}
+function writeVersionCheck(npmPackage, latest) {
+  mkdirSync2(lspPackageDir(npmPackage), { recursive: true });
+  const file2 = join7(lspPackageDir(npmPackage), VERSION_CHECK_FILE);
+  const record2 = {
+    last_checked: new Date().toISOString(),
+    latest_eligible: latest
+  };
+  writeFileSync3(file2, JSON.stringify(record2, null, 2));
+}
+function shouldRecheckVersion(record2, weeklyCheckIntervalMs = 7 * 24 * 60 * 60 * 1000) {
+  if (!record2)
+    return true;
+  const age = Date.now() - new Date(record2.last_checked).getTime();
+  if (Number.isNaN(age) || age < 0)
+    return true;
+  return age >= weeklyCheckIntervalMs;
+}
+
+// src/lsp-github-probe.ts
+function pickEligibleRelease(releases, graceDays, now = Date.now()) {
+  const cutoff = now - graceDays * 24 * 60 * 60 * 1000;
+  const candidates = releases.filter((r) => !r.draft && !r.prerelease && typeof r.published_at === "string").map((r) => {
+    const ts = Date.parse(r.published_at);
+    return { release: r, ts };
+  }).filter((c) => !Number.isNaN(c.ts)).sort((a, b) => b.ts - a.ts);
+  const eligible = candidates.filter((c) => c.ts <= cutoff);
+  const blockedByGrace = candidates.length > 0 && eligible.length === 0;
+  const chosen = eligible[0]?.release;
+  if (!chosen) {
+    return { tag: null, assets: [], blockedByGrace };
+  }
+  return {
+    tag: chosen.tag_name,
+    assets: (chosen.assets ?? []).map((a) => ({
+      name: a.name,
+      url: a.browser_download_url,
+      size: a.size
+    })),
+    blockedByGrace: false
+  };
+}
+async function probeGithubReleases(githubRepo, graceDays, fetchImpl = fetch) {
+  const url2 = `https://api.github.com/repos/${githubRepo}/releases?per_page=30`;
+  try {
+    const headers = { accept: "application/vnd.github+json" };
+    if (process.env.GITHUB_TOKEN) {
+      headers.authorization = `Bearer ${process.env.GITHUB_TOKEN}`;
+    }
+    const res = await fetchImpl(url2, {
+      headers,
+      signal: AbortSignal.timeout(1e4)
+    });
+    if (!res.ok) {
+      warn(`[lsp] github releases probe failed for ${githubRepo}: HTTP ${res.status}`);
+      return null;
+    }
+    const json2 = await res.json();
+    if (!Array.isArray(json2)) {
+      warn(`[lsp] unexpected response shape from github releases for ${githubRepo}`);
+      return null;
+    }
+    return pickEligibleRelease(json2, graceDays);
+  } catch (err) {
+    warn(`[lsp] github releases probe failed for ${githubRepo}: ${err}`);
+    return null;
+  }
+}
+var SAFE_VERSION_RE = /^[A-Za-z0-9._+-]+$/;
+function assertSafeVersion(version2) {
+  if (!SAFE_VERSION_RE.test(version2)) {
+    throw new Error(`unsafe version/tag string ${JSON.stringify(version2)}: must match ${SAFE_VERSION_RE.source}`);
+  }
+}
+function isSafeVersion(version2) {
+  return typeof version2 === "string" && version2.length > 0 && SAFE_VERSION_RE.test(version2);
+}
+function stripTagV(tag) {
+  assertSafeVersion(tag);
+  return tag.startsWith("v") ? tag.slice(1) : tag;
+}
+
+// src/lsp-npm-table.ts
+var NPM_LSP_TABLE = [
+  {
+    id: "typescript",
+    npm: "typescript-language-server",
+    binary: "typescript-language-server",
+    extensions: ["ts", "tsx", "js", "jsx", "mjs", "cjs", "mts", "cts"],
+    rootMarkers: ["tsconfig.json", "jsconfig.json", "package.json"]
+  },
+  {
+    id: "python",
+    npm: "pyright",
+    binary: "pyright-langserver",
+    extensions: ["py", "pyi"],
+    rootMarkers: ["pyproject.toml", "pyrightconfig.json", "requirements.txt"]
+  },
+  {
+    id: "yaml",
+    npm: "yaml-language-server",
+    binary: "yaml-language-server",
+    extensions: ["yaml", "yml"]
+  },
+  {
+    id: "bash",
+    npm: "bash-language-server",
+    binary: "bash-language-server",
+    extensions: ["sh", "bash", "zsh"]
+  },
+  {
+    id: "dockerfile",
+    npm: "dockerfile-language-server-nodejs",
+    binary: "docker-langserver",
+    extensions: ["dockerfile"],
+    rootMarkers: ["Dockerfile", "dockerfile"]
+  },
+  {
+    id: "vue",
+    npm: "@vue/language-server",
+    binary: "vue-language-server",
+    extensions: ["vue"]
+  },
+  {
+    id: "astro",
+    npm: "@astrojs/language-server",
+    binary: "astro-ls",
+    extensions: ["astro"]
+  },
+  {
+    id: "svelte",
+    npm: "svelte-language-server",
+    binary: "svelteserver",
+    extensions: ["svelte"]
+  },
+  {
+    id: "php-intelephense",
+    npm: "intelephense",
+    binary: "intelephense",
+    extensions: ["php"]
+  },
+  {
+    id: "biome",
+    npm: "@biomejs/biome",
+    binary: "biome",
+    extensions: ["ts", "tsx", "js", "jsx", "mjs", "cjs", "mts", "cts", "json", "jsonc"],
+    rootMarkers: ["biome.json", "biome.jsonc"]
+  }
+];
+
+// src/lsp-project-relevance.ts
+import { existsSync as existsSync5, readdirSync } from "fs";
+import { join as join8 } from "path";
+var MAX_WALK_DIRS = 200;
+var MAX_WALK_DEPTH = 4;
+var NOISE_DIRS = new Set([
+  ".git",
+  ".next",
+  ".venv",
+  "__pycache__",
+  "build",
+  "dist",
+  "node_modules",
+  "target"
+]);
+function hasRootMarker(projectRoot, rootMarkers) {
+  if (!rootMarkers)
+    return false;
+  for (const marker of rootMarkers) {
+    if (existsSync5(join8(projectRoot, marker)))
+      return true;
+  }
+  return false;
+}
+function relevantExtensionsInProject(projectRoot, extToServer) {
+  const wanted = new Set(Object.keys(extToServer).map((ext) => ext.toLowerCase()));
+  const found = new Set;
+  if (wanted.size === 0)
+    return found;
+  const queue = [{ dir: projectRoot, depth: 0 }];
+  let visitedDirs = 0;
+  while (queue.length > 0 && visitedDirs < MAX_WALK_DIRS) {
+    const current = queue.shift();
+    if (!current)
+      break;
+    visitedDirs += 1;
+    let entries;
+    try {
+      entries = readdirSync(current.dir, { withFileTypes: true });
+    } catch {
+      continue;
+    }
+    for (const entry of entries) {
+      if (entry.isDirectory()) {
+        if (current.depth < MAX_WALK_DEPTH && !NOISE_DIRS.has(entry.name.toLowerCase())) {
+          queue.push({ dir: join8(current.dir, entry.name), depth: current.depth + 1 });
+        }
+        continue;
+      }
+      if (!entry.isFile())
+        continue;
+      const ext = extensionOf(entry.name);
+      if (ext && wanted.has(ext))
+        found.add(ext);
+    }
+  }
+  return found;
+}
+function extensionOf(fileName) {
+  const dot = fileName.lastIndexOf(".");
+  if (dot < 0 || dot === fileName.length - 1)
+    return null;
+  return fileName.slice(dot + 1).toLowerCase();
+}
+
+// src/lsp-registry-probe.ts
+var NPM_REGISTRY_BASE = "https://registry.npmjs.org";
+function pickEligibleVersion(response, graceDays, now = Date.now()) {
+  const times = response.time || {};
+  const cutoff = now - graceDays * 24 * 60 * 60 * 1000;
+  const candidates = [];
+  for (const [version2, publishedAt] of Object.entries(times)) {
+    if (version2 === "created" || version2 === "modified")
+      continue;
+    if (version2.includes("-"))
+      continue;
+    if (typeof publishedAt !== "string")
+      continue;
+    const ts = Date.parse(publishedAt);
+    if (Number.isNaN(ts))
+      continue;
+    candidates.push({ version: version2, publishedAt, ts });
+  }
+  candidates.sort((a, b) => b.ts - a.ts);
+  const eligible = candidates.filter((c) => c.ts <= cutoff);
+  const blockedByGrace = candidates.length > 0 && eligible.length === 0;
+  return {
+    version: eligible[0]?.version ?? null,
+    blockedByGrace,
+    eligible: eligible.map(({ version: version2, publishedAt }) => ({ version: version2, publishedAt }))
+  };
+}
+async function probeRegistry(npmPackage, graceDays, fetchImpl = fetch) {
+  const encoded = encodeURIComponent(npmPackage).replace(/^%40/, "@");
+  const url2 = `${NPM_REGISTRY_BASE}/${encoded}`;
+  try {
+    const res = await fetchImpl(url2, {
+      headers: { accept: "application/json" },
+      signal: AbortSignal.timeout(1e4)
+    });
+    if (!res.ok) {
+      warn(`[lsp] registry probe failed for ${npmPackage}: HTTP ${res.status}`);
+      return null;
+    }
+    const json2 = await res.json();
+    return pickEligibleVersion(json2, graceDays);
+  } catch (err) {
+    warn(`[lsp] registry probe failed for ${npmPackage}: ${err}`);
+    return null;
+  }
+}
+
+// src/lsp-auto-install.ts
+function isProjectRelevant(spec, projectRoot, projectExtensions) {
+  if (hasRootMarker(projectRoot, spec.rootMarkers))
+    return true;
+  const extensions = projectExtensions();
+  return spec.extensions.some((ext) => extensions.has(ext.toLowerCase()));
+}
+var npmExtToServerIds = buildExtensionMap(NPM_LSP_TABLE);
+function buildExtensionMap(specs) {
+  const byExt = {};
+  for (const spec of specs) {
+    for (const ext of spec.extensions) {
+      const key = ext.toLowerCase();
+      byExt[key] ??= [];
+      byExt[key].push(spec.id);
+    }
+  }
+  return byExt;
+}
+var inFlightAutoInstalls = new Set;
+function trackInFlightAutoInstall(controller, promise2) {
+  const entry = { controller, promise: promise2 };
+  inFlightAutoInstalls.add(entry);
+  promise2.then(() => inFlightAutoInstalls.delete(entry), () => inFlightAutoInstalls.delete(entry));
+  return promise2;
+}
+async function abortInFlightAutoInstalls() {
+  const installs = Array.from(inFlightAutoInstalls);
+  for (const install of installs) {
+    install.controller.abort();
+  }
+  await Promise.allSettled(installs.map((install) => install.promise));
+}
+async function resolveTargetVersion(spec, config2, fetchImpl = fetch) {
+  const pinned = config2.versions[spec.npm];
+  if (pinned) {
+    assertSafeVersion(pinned);
+    return { version: pinned, pinned: true, probe: null };
+  }
+  const cached2 = readVersionCheck(spec.npm);
+  const weeklyMs = config2.graceDays * 24 * 60 * 60 * 1000;
+  const cachedSafe = isSafeVersion(cached2?.latest_eligible ?? null);
+  if (cached2 && !shouldRecheckVersion(cached2, weeklyMs) && cachedSafe) {
+    return { version: cached2.latest_eligible, pinned: false, probe: null };
+  }
+  const probe = await probeRegistry(spec.npm, config2.graceDays, fetchImpl);
+  if (!probe) {
+    return {
+      version: cachedSafe ? cached2?.latest_eligible ?? null : null,
+      pinned: false,
+      probe: null
+    };
+  }
+  writeVersionCheck(spec.npm, probe.version);
+  return { version: probe.version, pinned: false, probe };
+}
+function runInstall(spec, version2, cwd, signal) {
+  return new Promise((resolve2) => {
+    const target = `${spec.npm}@${version2}`;
+    log(`[lsp] installing ${target} to ${cwd}`);
+    if (signal?.aborted) {
+      warn(`[lsp] install ${target} aborted before spawn`);
+      resolve2(false);
+      return;
+    }
+    const child = spawn2("bun", ["add", target, "--cwd", cwd, "--ignore-scripts", "--silent"], {
+      stdio: ["ignore", "pipe", "pipe"]
+    });
+    child.unref();
+    let stderrBuf = "";
+    let settled = false;
+    let killTimer = null;
+    const cleanup = () => {
+      signal?.removeEventListener("abort", onAbort);
+      if (killTimer)
+        clearTimeout(killTimer);
+    };
+    const finish = (ok) => {
+      if (settled)
+        return;
+      settled = true;
+      cleanup();
+      resolve2(ok);
+    };
+    const onAbort = () => {
+      warn(`[lsp] install ${target} aborted during shutdown`);
+      child.kill("SIGTERM");
+      killTimer = setTimeout(() => {
+        if (!settled)
+          child.kill("SIGKILL");
+      }, 5000);
+      killTimer.unref?.();
+    };
+    signal?.addEventListener("abort", onAbort, { once: true });
+    if (signal?.aborted)
+      onAbort();
+    child.stdout?.on("data", () => {});
+    child.stderr?.on("data", (chunk) => {
+      const text = String(chunk);
+      stderrBuf += text;
+      if (stderrBuf.length > 4096) {
+        stderrBuf = stderrBuf.slice(stderrBuf.length - 4096);
+      }
+    });
+    child.on("error", (err) => {
+      error48(`[lsp] install ${target} failed to spawn: ${err}`);
+      finish(false);
+    });
+    child.on("exit", (code) => {
+      if (code === 0) {
+        log(`[lsp] installed ${target}`);
+        finish(true);
+      } else {
+        error48(`[lsp] install ${target} exited with code ${code}; last stderr:
+${stderrBuf.trim()}`);
+        finish(false);
+      }
+    });
+  });
+}
+async function ensureServerInstalled(spec, config2, fetchImpl, signal) {
+  const outcome = await withInstallLock(spec.npm, async () => {
+    const { version: version2, probe } = await resolveTargetVersion(spec, config2, fetchImpl);
+    if (!version2) {
+      const installed = isInstalled(spec.npm, spec.binary);
+      if (installed) {
+        warn(`[lsp] no eligible version of ${spec.npm} (grace=${config2.graceDays}d); keeping existing install`);
+        return { started: false, reason: "kept existing install" };
+      }
+      const blocked = probe?.blockedByGrace ? `all versions are within ${config2.graceDays}-day grace window` : "registry probe failed";
+      warn(`[lsp] skipping ${spec.npm}: ${blocked}`);
+      return { started: false, reason: blocked };
+    }
+    if (isInstalled(spec.npm, spec.binary)) {
+      const installedMeta = readInstalledMeta(spec.npm);
+      if (installedMeta && installedMeta.version === version2) {
+        if (installedMeta.sha256) {
+          const currentHash = await hashInstalledBinary(spec).catch((err) => {
+            warn(`[lsp] could not hash existing ${spec.npm} binary for TOFU check: ${err}`);
+            return null;
+          });
+          if (currentHash && currentHash !== installedMeta.sha256) {
+            error48(`[lsp] ${spec.npm}@${version2}: TOFU sha256 mismatch \u2014 refusing to use ` + `tampered binary. Recorded ${installedMeta.sha256}, current ${currentHash}. ` + `Run \`aft doctor --clear\` to re-install from scratch.`);
+            return {
+              started: false,
+              reason: `TOFU sha256 mismatch on ${spec.npm}@${version2} \u2014 see plugin log`
+            };
+          }
+        }
+        return { started: false, reason: "already installed" };
+      }
+      if (installedMeta) {
+        log(`[lsp] reinstalling ${spec.npm}: cached ${installedMeta.version} \u2260 target ${version2}`);
+      } else {
+        log(`[lsp] reinstalling ${spec.npm}@${version2}: no installed-version metadata recorded`);
+      }
+    }
+    const ok = await runInstall(spec, version2, cachedPackageDir(spec.npm), signal).catch((err) => {
+      error48(`[lsp] background install ${spec.npm} crashed: ${err}`);
+      return false;
+    });
+    if (!ok) {
+      return { started: true, reason: "install failed (see plugin log)" };
+    }
+    const installedHash = await hashInstalledBinary(spec).catch((err) => {
+      warn(`[lsp] could not hash newly-installed ${spec.npm} binary: ${err}`);
+      return null;
+    });
+    if (installedHash) {
+      log(`[lsp] ${spec.npm}@${version2} installed sha256=${installedHash}`);
+    }
+    writeInstalledMeta(spec.npm, version2, installedHash ?? undefined);
+    return { started: true };
+  });
+  if (outcome === null) {
+    return { started: false, reason: "another install in progress" };
+  }
+  return outcome;
+}
+function cachedPackageDir(npmPackage) {
+  return lspBinDir(npmPackage).replace(/[\\/]node_modules[\\/]\.bin[\\/]?$/, "");
+}
+function hashInstalledBinary(spec) {
+  return new Promise((resolve2, reject) => {
+    const candidates = process.platform === "win32" ? [
+      lspBinaryPath(spec.npm, spec.binary),
+      lspBinaryPath(spec.npm, `${spec.binary}.cmd`),
+      lspBinaryPath(spec.npm, `${spec.binary}.exe`),
+      lspBinaryPath(spec.npm, `${spec.binary}.bat`)
+    ] : [lspBinaryPath(spec.npm, spec.binary)];
+    let pathToHash = null;
+    for (const p of candidates) {
+      try {
+        if (statSync3(p).isFile()) {
+          pathToHash = p;
+          break;
+        }
+      } catch {}
+    }
+    if (!pathToHash) {
+      reject(new Error(`installed binary not found at any of: ${candidates.join(", ")}`));
+      return;
+    }
+    const hash2 = createHash("sha256");
+    const stream = createReadStream(pathToHash);
+    stream.on("error", reject);
+    stream.on("data", (chunk) => hash2.update(chunk));
+    stream.on("end", () => resolve2(hash2.digest("hex")));
+  });
+}
+function runAutoInstall(projectRoot, config2, fetchImpl = fetch) {
+  const cachedBinDirs = [];
+  const skipped = [];
+  const installPromises = [];
+  let installsStarted = 0;
+  let projectExtensions = null;
+  const getProjectExtensions = () => {
+    projectExtensions ??= relevantExtensionsInProject(projectRoot, npmExtToServerIds);
+    return projectExtensions;
+  };
+  for (const spec of NPM_LSP_TABLE) {
+    if (isInstalled(spec.npm, spec.binary)) {
+      cachedBinDirs.push(lspBinDir(spec.npm));
+    }
+    if (config2.disabled.has(spec.id)) {
+      skipped.push({ id: spec.id, reason: "disabled by config" });
+      continue;
+    }
+    if (!config2.autoInstall) {
+      skipped.push({ id: spec.id, reason: "auto_install: false" });
+      continue;
+    }
+    if (!isProjectRelevant(spec, projectRoot, getProjectExtensions)) {
+      skipped.push({ id: spec.id, reason: "not relevant to project" });
+      continue;
+    }
+    installsStarted += 1;
+    const controller = new AbortController;
+    const promise2 = ensureServerInstalled(spec, config2, fetchImpl, controller.signal).then((outcome) => {
+      if (!outcome.started)
+        installsStarted -= 1;
+      if (outcome.reason && outcome.reason !== "already installed") {
+        skipped.push({ id: spec.id, reason: outcome.reason });
+      }
+    }, (err) => {
+      installsStarted -= 1;
+      const reason = err instanceof Error ? err.message : String(err);
+      skipped.push({ id: spec.id, reason: `install error: ${reason}` });
+      error48(`[lsp] background install ${spec.npm} promise rejected: ${reason}`);
+    });
+    installPromises.push(trackInFlightAutoInstall(controller, promise2));
+  }
+  return {
+    cachedBinDirs,
+    get installsStarted() {
+      return installsStarted;
+    },
+    skipped,
+    installsComplete: Promise.all(installPromises).then(() => {})
+  };
+}
+
+// src/lsp-github-install.ts
+import { execFileSync } from "child_process";
+import { createHash as createHash2, randomBytes } from "crypto";
+import {
+  copyFileSync,
+  createReadStream as createReadStream2,
+  createWriteStream,
+  existsSync as existsSync6,
+  lstatSync,
+  mkdirSync as mkdirSync3,
+  readdirSync as readdirSync2,
+  readlinkSync,
+  realpathSync,
+  renameSync,
+  rmSync as rmSync2,
+  statSync as statSync4,
+  unlinkSync as unlinkSync3
+} from "fs";
+import { dirname as dirname3, join as join9, relative, resolve as resolve2 } from "path";
+import { Readable } from "stream";
+import { pipeline } from "stream/promises";
+
+// src/lsp-github-table.ts
+function exe(platform2, name) {
+  return platform2 === "win32" ? `${name}.exe` : name;
+}
+var CLANGD = {
+  id: "clangd",
+  githubRepo: "clangd/clangd",
+  binary: "clangd",
+  resolveAsset: (platform2, _arch, version2) => {
+    const platformName = platform2 === "darwin" ? "mac" : platform2 === "linux" ? "linux" : "windows";
+    return { name: `clangd-${platformName}-${version2}.zip`, archive: "zip" };
+  },
+  binaryPathInArchive: (platform2, _arch, version2) => `clangd_${version2}/bin/${exe(platform2, "clangd")}`
+};
+var LUA_LS = {
+  id: "lua-ls",
+  githubRepo: "LuaLS/lua-language-server",
+  binary: "lua-language-server",
+  resolveAsset: (platform2, arch, version2) => {
+    const ext = platform2 === "win32" ? "zip" : "tar.gz";
+    const platformName = platform2 === "darwin" ? "darwin" : platform2 === "linux" ? "linux" : "win32";
+    const archName = arch === "arm64" ? "arm64" : "x64";
+    return {
+      name: `lua-language-server-${version2}-${platformName}-${archName}.${ext}`,
+      archive: ext
+    };
+  },
+  binaryPathInArchive: (platform2, _arch, _version) => `bin/${exe(platform2, "lua-language-server")}`
+};
+var ZLS = {
+  id: "zls",
+  githubRepo: "zigtools/zls",
+  binary: "zls",
+  resolveAsset: (platform2, arch, _version) => {
+    const ext = platform2 === "win32" ? "zip" : "tar.xz";
+    const archName = arch === "arm64" ? "aarch64" : "x86_64";
+    const platformName = platform2 === "darwin" ? "macos" : platform2 === "linux" ? "linux" : "windows";
+    return { name: `zls-${archName}-${platformName}.${ext}`, archive: ext };
+  },
+  binaryPathInArchive: (platform2, _arch, _version) => exe(platform2, "zls")
+};
+var TINYMIST = {
+  id: "tinymist",
+  githubRepo: "Myriad-Dreamin/tinymist",
+  binary: "tinymist",
+  resolveAsset: (platform2, arch, _version) => {
+    const archName = arch === "arm64" ? "aarch64" : "x86_64";
+    const triple = platform2 === "darwin" ? "apple-darwin" : platform2 === "linux" ? "unknown-linux-gnu" : "pc-windows-msvc";
+    const ext = platform2 === "win32" ? "zip" : "tar.gz";
+    return { name: `tinymist-${archName}-${triple}.${ext}`, archive: ext };
+  },
+  binaryPathInArchive: (platform2, _arch, _version) => exe(platform2, "tinymist")
+};
+var TEXLAB = {
+  id: "texlab",
+  githubRepo: "latex-lsp/texlab",
+  binary: "texlab",
+  resolveAsset: (platform2, arch, _version) => {
+    const archName = arch === "arm64" ? "aarch64" : "x86_64";
+    const platformName = platform2 === "darwin" ? "macos" : platform2 === "linux" ? "linux" : "windows";
+    const ext = platform2 === "win32" ? "zip" : "tar.gz";
+    return { name: `texlab-${archName}-${platformName}.${ext}`, archive: ext };
+  },
+  binaryPathInArchive: (platform2, _arch, _version) => exe(platform2, "texlab")
+};
+var GITHUB_LSP_TABLE = [
+  CLANGD,
+  LUA_LS,
+  ZLS,
+  TINYMIST,
+  TEXLAB
+];
+function detectHostPlatform() {
+  const platform2 = process.platform;
+  if (platform2 !== "darwin" && platform2 !== "linux" && platform2 !== "win32")
+    return null;
+  const arch = process.arch;
+  if (arch === "x64")
+    return { platform: platform2, arch: "x64" };
+  if (arch === "arm64")
+    return { platform: platform2, arch: "arm64" };
+  return null;
+}
+
+// src/lsp-github-install.ts
+function ghCacheRoot() {
+  return join9(aftCacheBase(), "lsp-binaries");
+}
+function ghPackageDir(spec) {
+  return join9(ghCacheRoot(), spec.id);
+}
+function ghBinDir(spec) {
+  return join9(ghPackageDir(spec), "bin");
+}
+function ghExtractDir(spec) {
+  return join9(ghPackageDir(spec), "extracted");
+}
+function ghBinaryPath(spec, platform2) {
+  const ext = platform2 === "win32" ? ".exe" : "";
+  return join9(ghBinDir(spec), `${spec.binary}${ext}`);
+}
+function isGithubInstalled(spec, platform2) {
+  for (const candidate of ghBinaryCandidates(spec, platform2)) {
+    try {
+      if (statSync4(join9(ghBinDir(spec), candidate)).isFile())
+        return true;
+    } catch {}
+  }
+  return false;
+}
+function ghBinaryCandidates(spec, platform2) {
+  if (platform2 !== "win32")
+    return [spec.binary];
+  return [spec.binary, `${spec.binary}.cmd`, `${spec.binary}.exe`, `${spec.binary}.bat`];
+}
+var MAX_DOWNLOAD_BYTES = 256 * 1024 * 1024;
+var MAX_EXTRACT_BYTES = 1024 * 1024 * 1024;
+function sha256OfFile(path2) {
+  return new Promise((resolve3, reject) => {
+    const hash2 = createHash2("sha256");
+    const stream = createReadStream2(path2);
+    stream.on("error", reject);
+    stream.on("data", (chunk) => hash2.update(chunk));
+    stream.on("end", () => resolve3(hash2.digest("hex")));
+  });
+}
+async function fetchReleaseByTag(githubRepo, tag, fetchImpl, signal) {
+  const candidates = [];
+  candidates.push(tag);
+  if (!tag.startsWith("v")) {
+    candidates.push(`v${tag}`);
+  } else {
+    candidates.push(tag.slice(1));
+  }
+  const headers = {
+    accept: "application/vnd.github+json",
+    "user-agent": "aft-opencode",
+    "x-github-api-version": "2022-11-28"
+  };
+  if (process.env.GITHUB_TOKEN) {
+    headers.authorization = `Bearer ${process.env.GITHUB_TOKEN}`;
+  }
+  for (const candidate of candidates) {
+    const url2 = `https://api.github.com/repos/${githubRepo}/releases/tags/${encodeURIComponent(candidate)}`;
+    const timeout = controlledTimeoutSignal(15000, signal);
+    try {
+      const res = await fetchImpl(url2, {
+        headers,
+        redirect: "follow",
+        signal: timeout.signal
+      });
+      if (res.status === 404)
+        continue;
+      if (!res.ok) {
+        warn(`[lsp] github release-by-tag ${githubRepo}@${candidate}: HTTP ${res.status}`);
+        return null;
+      }
+      const json2 = await res.json();
+      if (!json2.tag_name || !Array.isArray(json2.assets)) {
+        warn(`[lsp] github release-by-tag ${githubRepo}@${candidate}: malformed response`);
+        return null;
+      }
+      const assets = json2.assets.filter((a) => typeof a.name === "string" && typeof a.browser_download_url === "string").map((a) => ({
+        name: a.name,
+        url: a.browser_download_url,
+        size: typeof a.size === "number" ? a.size : undefined
+      }));
+      return { tag: json2.tag_name, assets };
+    } catch (err) {
+      if (signal?.aborted) {
+        warn(`[lsp] github release-by-tag ${githubRepo}@${candidate}: aborted`);
+        return null;
+      }
+      warn(`[lsp] github release-by-tag ${githubRepo}@${candidate}: ${err}`);
+    } finally {
+      timeout.cleanup();
+    }
+  }
+  return null;
+}
+async function resolveTargetTag(spec, config2, fetchImpl, signal) {
+  const pinned = config2.versions[spec.githubRepo];
+  if (pinned) {
+    try {
+      assertSafeVersion(pinned);
+    } catch (err) {
+      return {
+        tag: null,
+        assets: [],
+        blockedByGrace: false,
+        reason: `invalid pinned version ${JSON.stringify(pinned)}: ${err instanceof Error ? err.message : String(err)}`
+      };
+    }
+    const release = await fetchReleaseByTag(spec.githubRepo, pinned, fetchImpl, signal);
+    if (release) {
+      return {
+        tag: release.tag,
+        assets: release.assets,
+        blockedByGrace: false
+      };
+    }
+    return {
+      tag: null,
+      assets: [],
+      blockedByGrace: false,
+      reason: `pinned tag ${pinned} not found on GitHub`
+    };
+  }
+  const cached2 = readVersionCheck(spec.githubRepo);
+  const weeklyMs = config2.graceDays * 24 * 60 * 60 * 1000;
+  const cachedTag = cached2?.latest_eligible ?? null;
+  const cachedSafe = isSafeVersion(cachedTag);
+  if (cached2 && !shouldRecheckVersion(cached2, weeklyMs) && cachedSafe) {
+    const release = await fetchReleaseByTag(spec.githubRepo, cachedTag, fetchImpl);
+    if (release) {
+      return {
+        tag: release.tag,
+        assets: release.assets,
+        blockedByGrace: false
+      };
+    }
+  }
+  const probe = await probeGithubReleases(spec.githubRepo, config2.graceDays, fetchImpl);
+  if (!probe) {
+    return {
+      tag: null,
+      assets: [],
+      blockedByGrace: false,
+      reason: "github releases probe failed"
+    };
+  }
+  writeVersionCheck(spec.githubRepo, probe.tag);
+  return { tag: probe.tag, assets: probe.assets, blockedByGrace: probe.blockedByGrace };
+}
+function controlledTimeoutSignal(timeoutMs, parent) {
+  const controller = new AbortController;
+  const timeout = setTimeout(() => controller.abort(), timeoutMs);
+  timeout.unref?.();
+  const abort = () => controller.abort();
+  parent?.addEventListener("abort", abort, { once: true });
+  if (parent?.aborted)
+    abort();
+  return {
+    signal: controller.signal,
+    cleanup: () => {
+      clearTimeout(timeout);
+      parent?.removeEventListener("abort", abort);
+    }
+  };
+}
+var ALLOWED_DOWNLOAD_HOSTS = new Set([
+  "github.com",
+  "api.github.com",
+  "objects.githubusercontent.com",
+  "release-assets.githubusercontent.com",
+  "raw.githubusercontent.com",
+  "codeload.github.com"
+]);
+function assertAllowedDownloadUrl(rawUrl) {
+  let parsed;
+  try {
+    parsed = new URL(rawUrl);
+  } catch {
+    throw new Error(`download url is not a valid URL: ${rawUrl}`);
+  }
+  if (parsed.protocol !== "https:") {
+    throw new Error(`download url must be https (got ${parsed.protocol}): ${rawUrl}`);
+  }
+  if (!ALLOWED_DOWNLOAD_HOSTS.has(parsed.hostname.toLowerCase())) {
+    throw new Error(`download url host ${parsed.hostname} is not in the GitHub allowlist: ${rawUrl}`);
+  }
+  return parsed;
+}
+async function downloadFile(url2, destPath, fetchImpl, assetSize, signal) {
+  assertAllowedDownloadUrl(url2);
+  if (assetSize !== undefined && assetSize > MAX_DOWNLOAD_BYTES) {
+    throw new Error(`asset size ${assetSize} exceeds max ${MAX_DOWNLOAD_BYTES} (set lsp.versions to pin a smaller release if this is wrong)`);
+  }
+  const timeout = controlledTimeoutSignal(120000, signal);
+  try {
+    const res = await fetchImpl(url2, {
+      headers: { accept: "application/octet-stream" },
+      redirect: "follow",
+      signal: timeout.signal
+    });
+    if (!res.ok || !res.body) {
+      throw new Error(`download failed (${res.status})`);
+    }
+    const advertised = Number.parseInt(res.headers.get("content-length") ?? "", 10);
+    if (Number.isFinite(advertised) && advertised > MAX_DOWNLOAD_BYTES) {
+      throw new Error(`Content-Length ${advertised} exceeds max ${MAX_DOWNLOAD_BYTES}`);
+    }
+    mkdirSync3(dirname3(destPath), { recursive: true });
+    let bytesWritten = 0;
+    const guard = new TransformStream({
+      transform(chunk, controller) {
+        bytesWritten += chunk.byteLength;
+        if (bytesWritten > MAX_DOWNLOAD_BYTES) {
+          controller.error(new Error(`download exceeded ${MAX_DOWNLOAD_BYTES} bytes after streaming (server lied about size or sent unbounded body)`));
+          return;
+        }
+        controller.enqueue(chunk);
+      }
+    });
+    const guarded = res.body.pipeThrough(guard);
+    const nodeStream = Readable.fromWeb(guarded);
+    await pipeline(nodeStream, createWriteStream(destPath), { signal: timeout.signal });
+  } catch (err) {
+    try {
+      unlinkSync3(destPath);
+    } catch {}
+    throw err;
+  } finally {
+    timeout.cleanup();
+  }
+}
+function validateExtraction(stagingRoot) {
+  const realStagingRoot = realpathSync(stagingRoot);
+  let totalBytes = 0;
+  const walk = (dir) => {
+    let entries;
+    try {
+      entries = readdirSync2(dir);
+    } catch (err) {
+      throw new Error(`failed to read staging dir ${dir}: ${err}`);
+    }
+    for (const entry of entries) {
+      const full = join9(dir, entry);
+      let lst;
+      try {
+        lst = lstatSync(full);
+      } catch (err) {
+        throw new Error(`failed to lstat ${full}: ${err}`);
+      }
+      if (lst.isSymbolicLink()) {
+        let target = "<unreadable>";
+        try {
+          target = readlinkSync(full);
+        } catch {}
+        throw new Error(`archive contains symlink ${relative(realStagingRoot, full)} \u2192 ${target}; rejecting (zip-slip defense)`);
+      }
+      let realFull;
+      try {
+        realFull = realpathSync(full);
+      } catch (err) {
+        throw new Error(`failed to realpath ${full}: ${err}`);
+      }
+      const rel = relative(realStagingRoot, realFull);
+      if (rel.startsWith("..") || resolve2(realStagingRoot, rel) !== realFull) {
+        throw new Error(`archive entry escapes staging root: ${full} \u2192 ${realFull} (zip-slip defense)`);
+      }
+      if (lst.isDirectory()) {
+        walk(full);
+      } else if (lst.isFile()) {
+        totalBytes += lst.size;
+        if (totalBytes > MAX_EXTRACT_BYTES) {
+          throw new Error(`extracted archive exceeds ${MAX_EXTRACT_BYTES} bytes (decompression bomb defense): saw ${totalBytes} bytes before hitting the cap`);
+        }
+      } else {
+        throw new Error(`archive contains non-file/non-dir entry: ${full}`);
+      }
+    }
+  };
+  walk(realStagingRoot);
+}
+function extractArchiveSafely(archivePath, destDir, archiveType) {
+  const suffix = randomBytes(8).toString("hex");
+  const stagingDir = `${destDir}.staging-${suffix}`;
+  try {
+    rmSync2(stagingDir, { recursive: true, force: true });
+  } catch {}
+  mkdirSync3(stagingDir, { recursive: true });
+  try {
+    runPlatformExtractor(archivePath, stagingDir, archiveType);
+    validateExtraction(stagingDir);
+    try {
+      rmSync2(destDir, { recursive: true, force: true });
+    } catch {}
+    renameSync(stagingDir, destDir);
+  } catch (err) {
+    try {
+      rmSync2(stagingDir, { recursive: true, force: true });
+    } catch {}
+    throw err;
+  }
+}
+function runPlatformExtractor(archivePath, destDir, archiveType) {
+  if (archiveType === "zip") {
+    if (process.platform === "win32") {
+      execFileSync("tar.exe", ["-xf", archivePath, "-C", destDir], {
+        stdio: "pipe",
+        timeout: 180000
+      });
+      return;
+    }
+    execFileSync("unzip", ["-q", "-o", archivePath, "-d", destDir], {
+      stdio: "pipe",
+      timeout: 180000
+    });
+    return;
+  }
+  if (archiveType === "tar.gz") {
+    execFileSync("tar", ["-xzf", archivePath, "-C", destDir], {
+      stdio: "pipe",
+      timeout: 180000
+    });
+    return;
+  }
+  if (archiveType === "tar.xz") {
+    execFileSync("tar", ["-xf", archivePath, "-C", destDir], {
+      stdio: "pipe",
+      timeout: 180000
+    });
+    return;
+  }
+  throw new Error(`unsupported archive type: ${archiveType}`);
+}
+async function downloadAndInstall(spec, tag, assets, platform2, arch, fetchImpl, signal) {
+  const version2 = stripTagV(tag);
+  const expected = spec.resolveAsset(platform2, arch, version2);
+  if (!expected) {
+    warn(`[lsp] ${spec.id}: unsupported platform/arch combo ${platform2}/${arch}`);
+    return null;
+  }
+  const matchingAsset = assets.find((a) => a.name === expected.name);
+  if (!matchingAsset) {
+    warn(`[lsp] ${spec.id}: asset ${expected.name} not found in release ${tag} (${assets.length} assets available)`);
+    return null;
+  }
+  const pkgDir = ghPackageDir(spec);
+  const extractDir = ghExtractDir(spec);
+  const archivePath = join9(pkgDir, expected.name);
+  log(`[lsp] downloading ${spec.id} ${tag} \u2192 ${matchingAsset.url}`);
+  try {
+    await downloadFile(matchingAsset.url, archivePath, fetchImpl, matchingAsset.size, signal);
+  } catch (err) {
+    error48(`[lsp] download ${spec.id} failed: ${err}`);
+    return null;
+  }
+  let archiveSha256;
+  try {
+    archiveSha256 = await sha256OfFile(archivePath);
+  } catch (err) {
+    error48(`[lsp] hash ${spec.id} failed: ${err}`);
+    try {
+      unlinkSync3(archivePath);
+    } catch {}
+    return null;
+  }
+  log(`[lsp] ${spec.id} ${tag} sha256=${archiveSha256}`);
+  const previousMeta = readInstalledMetaIn(ghPackageDir(spec));
+  if (previousMeta && previousMeta.version === tag && previousMeta.sha256) {
+    if (previousMeta.sha256 !== archiveSha256) {
+      error48(`[lsp] ${spec.id} ${tag}: TOFU sha256 mismatch \u2014 refusing install. ` + `Previously installed sha256=${previousMeta.sha256}, downloaded sha256=${archiveSha256}. ` + `This means the published release for tag ${tag} changed. Investigate before proceeding. ` + `Run \`aft doctor --clear\` to wipe the cache and force a fresh install if you've verified the change.`);
+      try {
+        unlinkSync3(archivePath);
+      } catch {}
+      return null;
+    }
+  }
+  try {
+    extractArchiveSafely(archivePath, extractDir, expected.archive);
+  } catch (err) {
+    error48(`[lsp] extract ${spec.id} failed: ${err}`);
+    return null;
+  } finally {
+    try {
+      unlinkSync3(archivePath);
+    } catch {}
+  }
+  const innerBinaryPath = join9(extractDir, spec.binaryPathInArchive(platform2, arch, version2));
+  if (!existsSync6(innerBinaryPath)) {
+    error48(`[lsp] ${spec.id}: extracted binary not found at ${innerBinaryPath}`);
+    return null;
+  }
+  const targetBinary = ghBinaryPath(spec, platform2);
+  mkdirSync3(dirname3(targetBinary), { recursive: true });
+  try {
+    copyFileSync(innerBinaryPath, targetBinary);
+    if (platform2 !== "win32") {
+      const { chmodSync: chmodSync2 } = await import("fs");
+      chmodSync2(targetBinary, 493);
+    }
+  } catch (err) {
+    error48(`[lsp] ${spec.id}: failed to place binary at ${targetBinary}: ${err}`);
+    return null;
+  }
+  log(`[lsp] installed ${spec.id} ${tag} at ${targetBinary}`);
+  return archiveSha256;
+}
+async function ensureGithubInstalled(spec, config2, fetchImpl, platform2, arch, signal) {
+  const outcome = await withInstallLock(spec.githubRepo, async () => {
+    const { tag, assets, blockedByGrace, reason } = await resolveTargetTag(spec, config2, fetchImpl, signal);
+    if (!tag) {
+      const installed = isGithubInstalled(spec, platform2);
+      if (installed) {
+        warn(`[lsp] no eligible release of ${spec.githubRepo} (grace=${config2.graceDays}d); keeping existing install`);
+        return { started: false, reason: "kept existing install" };
+      }
+      const fallbackReason = reason ?? (blockedByGrace ? `all releases are within ${config2.graceDays}-day grace window` : "github releases probe failed");
+      warn(`[lsp] skipping ${spec.id}: ${fallbackReason}`);
+      return { started: false, reason: fallbackReason };
+    }
+    if (isGithubInstalled(spec, platform2)) {
+      const installedMeta = readInstalledMetaIn(ghPackageDir(spec));
+      if (installedMeta && installedMeta.version === tag) {
+        return { started: false, reason: "already installed" };
+      }
+      if (installedMeta) {
+        log(`[lsp] reinstalling ${spec.id}: cached ${installedMeta.version} \u2260 target ${tag}`);
+      } else {
+        log(`[lsp] reinstalling ${spec.id}@${tag}: no installed-version metadata recorded`);
+      }
+    }
+    const archiveSha256 = await downloadAndInstall(spec, tag, assets, platform2, arch, fetchImpl, signal).catch((err) => {
+      error48(`[lsp] github install ${spec.id} crashed: ${err}`);
+      return null;
+    });
+    if (!archiveSha256) {
+      return { started: true, reason: "install failed (see plugin log)" };
+    }
+    writeInstalledMetaIn(ghPackageDir(spec), tag, archiveSha256);
+    return { started: true };
+  });
+  if (outcome === null) {
+    return { started: false, reason: "another install in progress" };
+  }
+  return outcome;
+}
+var inFlightGithubInstalls = new Set;
+function trackInFlightGithubInstall(controller, promise2) {
+  const entry = { controller, promise: promise2 };
+  inFlightGithubInstalls.add(entry);
+  promise2.then(() => inFlightGithubInstalls.delete(entry), () => inFlightGithubInstalls.delete(entry));
+  return promise2;
+}
+async function abortInFlightGithubInstalls() {
+  const installs = Array.from(inFlightGithubInstalls);
+  for (const install of installs) {
+    install.controller.abort();
+  }
+  await Promise.allSettled(installs.map((install) => install.promise));
+}
+function runGithubAutoInstall(relevantServers, config2, fetchImpl = fetch) {
+  const cachedBinDirs = [];
+  const skipped = [];
+  const installPromises = [];
+  let installsStarted = 0;
+  const host = detectHostPlatform();
+  if (!host) {
+    for (const spec of GITHUB_LSP_TABLE) {
+      try {
+        if (existsSync6(ghBinDir(spec))) {
+          cachedBinDirs.push(ghBinDir(spec));
+        }
+      } catch {}
+    }
+    return {
+      cachedBinDirs,
+      installsStarted: 0,
+      skipped,
+      installsComplete: Promise.resolve()
+    };
+  }
+  for (const spec of GITHUB_LSP_TABLE) {
+    if (isGithubInstalled(spec, host.platform)) {
+      cachedBinDirs.push(ghBinDir(spec));
+    }
+    if (config2.disabled.has(spec.id)) {
+      skipped.push({ id: spec.id, reason: "disabled by config" });
+      continue;
+    }
+    if (!config2.autoInstall) {
+      skipped.push({ id: spec.id, reason: "auto_install: false" });
+      continue;
+    }
+    if (!relevantServers.has(spec.id)) {
+      skipped.push({ id: spec.id, reason: "not relevant to project" });
+      continue;
+    }
+    installsStarted += 1;
+    const controller = new AbortController;
+    const promise2 = ensureGithubInstalled(spec, config2, fetchImpl, host.platform, host.arch, controller.signal).then((outcome) => {
+      if (!outcome.started)
+        installsStarted -= 1;
+      if (outcome.reason && outcome.reason !== "already installed") {
+        skipped.push({ id: spec.id, reason: outcome.reason });
+      }
+    }, (err) => {
+      installsStarted -= 1;
+      const reason = err instanceof Error ? err.message : String(err);
+      skipped.push({ id: spec.id, reason: `install error: ${reason}` });
+      error48(`[lsp] github install ${spec.id} promise rejected: ${reason}`);
+    });
+    installPromises.push(trackInFlightGithubInstall(controller, promise2));
+  }
+  return {
+    cachedBinDirs,
+    get installsStarted() {
+      return installsStarted;
+    },
+    skipped,
+    installsComplete: Promise.all(installPromises).then(() => {})
+  };
+}
+function discoverRelevantGithubServers(projectRoot) {
+  const extToServerIds = {
+    c: ["clangd"],
+    "c++": ["clangd"],
+    cc: ["clangd"],
+    cpp: ["clangd"],
+    cxx: ["clangd"],
+    h: ["clangd"],
+    "h++": ["clangd"],
+    hpp: ["clangd"],
+    hh: ["clangd"],
+    hxx: ["clangd"],
+    lua: ["lua-ls"],
+    zig: ["zls"],
+    zon: ["zls"],
+    typ: ["tinymist"],
+    typc: ["tinymist"],
+    tex: ["texlab"],
+    bib: ["texlab"]
+  };
+  const rootMarkers = {
+    clangd: ["compile_commands.json", "compile_flags.txt", ".clangd"],
+    "lua-ls": [".luarc.json", ".luarc.jsonc", ".stylua.toml", "stylua.toml"],
+    zls: ["build.zig"],
+    tinymist: ["typst.toml"],
+    texlab: [".latexmkrc", "latexmkrc", ".texlabroot", "texlabroot"]
+  };
+  const relevant = new Set;
+  for (const spec of GITHUB_LSP_TABLE) {
+    if (hasRootMarker(projectRoot, rootMarkers[spec.id]))
+      relevant.add(spec.id);
+  }
+  const extensions = relevantExtensionsInProject(projectRoot, extToServerIds);
+  for (const ext of extensions) {
+    for (const id of extToServerIds[ext] ?? []) {
+      relevant.add(id);
+    }
+  }
+  return relevant;
+}
+
+// src/metadata-store.ts
+var pendingStore = new Map;
+var STALE_TIMEOUT_MS = 15 * 60 * 1000;
+function makeKey(sessionID, callID) {
+  return `${sessionID}:${callID}`;
+}
+function cleanupStaleEntries() {
+  const now = Date.now();
+  for (const [key, entry] of pendingStore) {
+    if (now - entry.storedAt > STALE_TIMEOUT_MS) {
+      pendingStore.delete(key);
+    }
+  }
+}
+function storeToolMetadata(sessionID, callID, data) {
+  cleanupStaleEntries();
+  pendingStore.set(makeKey(sessionID, callID), {
+    ...data,
+    storedAt: Date.now()
+  });
+}
+function consumeToolMetadata(sessionID, callID) {
+  const key = makeKey(sessionID, callID);
+  const stored = pendingStore.get(key);
+  if (stored) {
+    pendingStore.delete(key);
+    const { storedAt: _, ...data } = stored;
+    return data;
+  }
+  return;
+}
+
+// src/normalize-schemas.ts
+import { tool } from "@opencode-ai/plugin";
+function stripRootJsonSchemaFields(jsonSchema) {
+  const { $schema: _schema, ...rest } = jsonSchema;
+  return rest;
+}
+function attachJsonSchemaOverride(schema) {
+  if (schema._zod.toJSONSchema) {
+    return;
+  }
+  schema._zod.toJSONSchema = () => {
+    const originalOverride = schema._zod.toJSONSchema;
+    delete schema._zod.toJSONSchema;
+    try {
+      return stripRootJsonSchemaFields(tool.schema.toJSONSchema(schema));
+    } finally {
+      schema._zod.toJSONSchema = originalOverride;
+    }
+  };
+}
+function normalizeToolArgSchemas(toolDefinition) {
+  for (const schema of Object.values(toolDefinition.args)) {
+    attachJsonSchemaOverride(schema);
+  }
+  return toolDefinition;
+}
+function normalizeToolMap(tools) {
+  for (const def of Object.values(tools)) {
+    normalizeToolArgSchemas(def);
+  }
+  return tools;
+}
+
+// src/notifications.ts
+import { existsSync as existsSync7, mkdirSync as mkdirSync4, readFileSync as readFileSync5, writeFileSync as writeFileSync4 } from "fs";
+import { homedir as homedir6, platform as platform2 } from "os";
+import { join as join10 } from "path";
+function isTuiMode() {
+  return process.env.OPENCODE_CLIENT === "cli";
+}
+async function showTuiToast(client, title, message, variant = "info", duration3 = 8000) {
+  const c = client;
+  if (typeof c.tui?.showToast !== "function")
+    return false;
+  try {
+    await c.tui.showToast({ body: { title, message, variant, duration: duration3 } });
+    return true;
+  } catch {
+    return false;
+  }
+}
+var AFT_MARKER = "\uD83D\uDD27 AFT:";
+var FEATURE_MARKER = `${AFT_MARKER} New in`;
+var WARNING_MARKER = `${AFT_MARKER} \u26A0\uFE0F`;
+var STATUS_MARKER = `${AFT_MARKER} \u2705`;
+var WARNED_TOOLS_FILE = "warned_tools.json";
+function getDesktopStatePath() {
+  const os2 = platform2();
+  const home = homedir6();
+  if (os2 === "darwin") {
+    return join10(home, "Library", "Application Support", "ai.opencode.desktop", "opencode.global.dat");
+  }
+  if (os2 === "linux") {
+    const xdgConfig = process.env.XDG_CONFIG_HOME || join10(home, ".config");
+    return join10(xdgConfig, "ai.opencode.desktop", "opencode.global.dat");
+  }
+  if (os2 === "win32") {
+    const appData = process.env.APPDATA || join10(home, "AppData", "Roaming");
+    return join10(appData, "ai.opencode.desktop", "opencode.global.dat");
+  }
+  return null;
+}
+function readDesktopState(directory) {
+  const statePath = getDesktopStatePath();
+  if (!statePath || !existsSync7(statePath)) {
+    return { sessionId: null, serverUrl: null };
+  }
+  try {
+    const raw = readFileSync5(statePath, "utf-8");
+    const state = JSON.parse(raw);
+    let serverUrl = null;
+    const serverStr = state.server;
+    if (typeof serverStr === "string") {
+      try {
+        const serverState = JSON.parse(serverStr);
+        if (typeof serverState.currentSidecarUrl === "string") {
+          serverUrl = serverState.currentSidecarUrl;
+        }
+      } catch {}
+    }
+    let sessionId = null;
+    const layoutPage = state["layout.page"];
+    if (typeof layoutPage === "string") {
+      const parsed = JSON.parse(layoutPage);
+      const lastProjectSession = parsed.lastProjectSession;
+      if (lastProjectSession) {
+        const entry = lastProjectSession[directory];
+        sessionId = entry?.id ?? null;
+      }
+    }
+    return { sessionId, serverUrl };
+  } catch {
+    return { sessionId: null, serverUrl: null };
+  }
+}
+function getServerAuth() {
+  const password = process.env.OPENCODE_SERVER_PASSWORD;
+  if (!password)
+    return;
+  const username = process.env.OPENCODE_SERVER_USERNAME ?? "opencode";
+  return `Basic ${Buffer.from(`${username}:${password}`, "utf8").toString("base64")}`;
+}
+async function getSessionMessages(client, sessionId) {
+  try {
+    const c = client;
+    if (typeof c.session?.messages === "function") {
+      const result = await c.session.messages({ path: { id: sessionId } });
+      return result?.data ?? [];
+    }
+  } catch {}
+  return [];
+}
+async function sendIgnoredMessage(client, sessionId, text) {
+  try {
+    const c = client;
+    const promptInput = {
+      path: { id: sessionId },
+      body: {
+        noReply: true,
+        parts: [{ type: "text", text, ignored: true }]
+      }
+    };
+    if (typeof c.session?.prompt === "function") {
+      await Promise.resolve(c.session.prompt(promptInput));
+      return true;
+    }
+    if (typeof c.session?.promptAsync === "function") {
+      await c.session.promptAsync(promptInput);
+      return true;
+    }
+  } catch (err) {
+    log(`[aft-plugin] notification send failed: ${err instanceof Error ? err.message : String(err)}`);
+  }
+  return false;
+}
+async function deleteMessage(serverUrl, sessionId, messageId) {
+  const auth = getServerAuth();
+  const url2 = `${serverUrl}/session/${encodeURIComponent(sessionId)}/message/${encodeURIComponent(messageId)}`;
+  try {
+    const response = await fetch(url2, {
+      method: "DELETE",
+      headers: auth ? { Authorization: auth } : {},
+      signal: AbortSignal.timeout(1e4)
+    });
+    return response.ok;
+  } catch {
     return false;
   }
 }
@@ -22009,10 +23997,10 @@ async function sendWarning(opts, message) {
 }
 async function sendFeatureAnnouncement(opts, version2, features, storageDir) {
   if (storageDir) {
-    const versionFile = join4(storageDir, "last_announced_version");
+    const versionFile = join10(storageDir, "last_announced_version");
     try {
-      if (existsSync3(versionFile)) {
-        const lastVersion = readFileSync2(versionFile, "utf-8").trim();
+      if (existsSync7(versionFile)) {
+        const lastVersion = readFileSync5(versionFile, "utf-8").trim();
         if (lastVersion === version2)
           return;
       }
@@ -22032,17 +24020,17 @@ async function sendFeatureAnnouncement(opts, version2, features, storageDir) {
   }
   if (storageDir) {
     try {
-      mkdirSync2(storageDir, { recursive: true });
-      writeFileSync(join4(storageDir, "last_announced_version"), version2);
+      mkdirSync4(storageDir, { recursive: true });
+      writeFileSync4(join10(storageDir, "last_announced_version"), version2);
     } catch {}
   }
 }
 function readWarnedTools(storageDir) {
   try {
-    const warnedToolsPath = join4(storageDir, WARNED_TOOLS_FILE);
-    if (!existsSync3(warnedToolsPath))
+    const warnedToolsPath = join10(storageDir, WARNED_TOOLS_FILE);
+    if (!existsSync7(warnedToolsPath))
       return {};
-    const parsed = JSON.parse(readFileSync2(warnedToolsPath, "utf-8"));
+    const parsed = JSON.parse(readFileSync5(warnedToolsPath, "utf-8"));
     if (!parsed || typeof parsed !== "object" || Array.isArray(parsed))
       return {};
     const warned = {};
@@ -22058,9 +24046,9 @@ function readWarnedTools(storageDir) {
 }
 function writeWarnedTools(storageDir, warned) {
   try {
-    mkdirSync2(storageDir, { recursive: true });
-    const warnedToolsPath = join4(storageDir, WARNED_TOOLS_FILE);
-    writeFileSync(warnedToolsPath, `${JSON.stringify(warned, null, 2)}
+    mkdirSync4(storageDir, { recursive: true });
+    const warnedToolsPath = join10(storageDir, WARNED_TOOLS_FILE);
+    writeFileSync4(warnedToolsPath, `${JSON.stringify(warned, null, 2)}
 `);
   } catch {}
 }
@@ -22151,10 +24139,37 @@ async function cleanupWarnings(opts) {
 }
 
 // src/onnx-runtime.ts
-import { chmodSync as chmodSync2, existsSync as existsSync4, mkdirSync as mkdirSync3, readdirSync, unlinkSync as unlinkSync2 } from "fs";
-import { join as join5 } from "path";
+import { execFileSync as execFileSync2 } from "child_process";
+import { createHash as createHash3 } from "crypto";
+import {
+  chmodSync as chmodSync2,
+  closeSync as closeSync2,
+  copyFileSync as copyFileSync2,
+  createWriteStream as createWriteStream2,
+  existsSync as existsSync8,
+  lstatSync as lstatSync2,
+  mkdirSync as mkdirSync5,
+  openSync as openSync2,
+  readdirSync as readdirSync3,
+  readFileSync as readFileSync6,
+  readlinkSync as readlinkSync2,
+  realpathSync as realpathSync2,
+  rmSync as rmSync3,
+  statSync as statSync5,
+  symlinkSync,
+  unlinkSync as unlinkSync4,
+  writeFileSync as writeFileSync5
+} from "fs";
+import { dirname as dirname4, join as join11, relative as relative2, resolve as resolve3 } from "path";
+import { Readable as Readable2 } from "stream";
+import { pipeline as pipeline2 } from "stream/promises";
 var ORT_VERSION = "1.24.4";
 var ORT_REPO = "microsoft/onnxruntime";
+var MAX_DOWNLOAD_BYTES2 = 256 * 1024 * 1024;
+var MAX_EXTRACT_BYTES2 = 1 * 1024 * 1024 * 1024;
+var ONNX_LOCK_FILE = ".aft-onnx-installing";
+var ONNX_INSTALLED_META_FILE = ".aft-onnx-installed";
+var STALE_LOCK_MS2 = 30 * 60 * 1000;
 var ORT_PLATFORM_MAP = {
   darwin: {
     arm64: {
@@ -22208,11 +24223,27 @@ function getManualInstallHint() {
 }
 async function ensureOnnxRuntime(storageDir) {
   const info = getPlatformInfo();
-  const ortDir = join5(storageDir, "onnxruntime", ORT_VERSION);
-  const libPath = join5(ortDir, info?.libName ?? "libonnxruntime.dylib");
-  if (existsSync4(libPath)) {
-    log(`ONNX Runtime found at ${ortDir}`);
-    return ortDir;
+  const ortDir = join11(storageDir, "onnxruntime", ORT_VERSION);
+  const libPath = join11(ortDir, info?.libName ?? "libonnxruntime.dylib");
+  if (existsSync8(libPath)) {
+    const meta3 = readOnnxInstalledMeta(ortDir);
+    if (meta3?.sha256) {
+      try {
+        const currentHash = sha256File(libPath);
+        if (currentHash !== meta3.sha256) {
+          error48(`ONNX Runtime at ${ortDir}: TOFU sha256 mismatch \u2014 refusing to use ` + `tampered binary. Recorded ${meta3.sha256}, current ${currentHash}. ` + `Run \`aft doctor --clear\` to re-download from scratch.`);
+        } else {
+          log(`ONNX Runtime found at ${ortDir} (TOFU verified)`);
+          return ortDir;
+        }
+      } catch (err) {
+        warn(`Could not verify ONNX Runtime hash at ${ortDir}: ${err}`);
+        return ortDir;
+      }
+    } else {
+      log(`ONNX Runtime found at ${ortDir} (no recorded hash, accepting)`);
+      return ortDir;
+    }
   }
   const systemPath = findSystemOnnxRuntime(info?.libName);
   if (systemPath) {
@@ -22223,7 +24254,18 @@ async function ensureOnnxRuntime(storageDir) {
     warn(`ONNX Runtime auto-download not available for ${process.platform}/${process.arch}. Install manually: ${getManualInstallHint()}`);
     return null;
   }
-  return downloadOnnxRuntime(info, ortDir);
+  const onnxBaseDir = join11(storageDir, "onnxruntime");
+  mkdirSync5(onnxBaseDir, { recursive: true });
+  const lockPath2 = join11(onnxBaseDir, ONNX_LOCK_FILE);
+  if (!acquireLock(lockPath2)) {
+    warn(`ONNX Runtime install already in progress in another process (lock: ${lockPath2}). Skipping.`);
+    return null;
+  }
+  try {
+    return await downloadOnnxRuntime(info, ortDir);
+  } finally {
+    releaseLock(lockPath2);
+  }
 }
 function findSystemOnnxRuntime(libName) {
   if (!libName)
@@ -22235,45 +24277,124 @@ function findSystemOnnxRuntime(libName) {
     searchPaths.push("/usr/lib", "/usr/lib/x86_64-linux-gnu", "/usr/lib/aarch64-linux-gnu", "/usr/local/lib");
   }
   for (const dir of searchPaths) {
-    if (existsSync4(join5(dir, libName))) {
+    if (existsSync8(join11(dir, libName))) {
       return dir;
     }
   }
   return null;
 }
+async function downloadFileWithCap(url2, destPath) {
+  const controller = new AbortController;
+  const timeout = setTimeout(() => controller.abort(), 300000);
+  try {
+    const res = await fetch(url2, {
+      headers: { accept: "application/octet-stream" },
+      redirect: "follow",
+      signal: controller.signal
+    });
+    if (!res.ok || !res.body) {
+      throw new Error(`download failed (HTTP ${res.status})`);
+    }
+    const advertised = Number.parseInt(res.headers.get("content-length") ?? "", 10);
+    if (Number.isFinite(advertised) && advertised > MAX_DOWNLOAD_BYTES2) {
+      throw new Error(`Content-Length ${advertised} exceeds max ${MAX_DOWNLOAD_BYTES2}`);
+    }
+    mkdirSync5(dirname4(destPath), { recursive: true });
+    let bytesWritten = 0;
+    const guard = new TransformStream({
+      transform(chunk, transformController) {
+        bytesWritten += chunk.byteLength;
+        if (bytesWritten > MAX_DOWNLOAD_BYTES2) {
+          transformController.error(new Error(`download exceeded ${MAX_DOWNLOAD_BYTES2} bytes after streaming (server lied about size or sent unbounded body)`));
+          return;
+        }
+        transformController.enqueue(chunk);
+      }
+    });
+    const guarded = res.body.pipeThrough(guard);
+    const nodeStream = Readable2.fromWeb(guarded);
+    await pipeline2(nodeStream, createWriteStream2(destPath), { signal: controller.signal });
+  } catch (err) {
+    try {
+      unlinkSync4(destPath);
+    } catch {}
+    throw err;
+  } finally {
+    clearTimeout(timeout);
+  }
+}
+function validateExtractedTree(stagingRoot) {
+  const realRoot = realpathSync2(stagingRoot);
+  let totalBytes = 0;
+  const walk = (dir) => {
+    const entries = readdirSync3(dir);
+    for (const entry of entries) {
+      const fullPath = join11(dir, entry);
+      const lst = lstatSync2(fullPath);
+      if (lst.isSymbolicLink()) {
+        const linkTarget = readlinkSync2(fullPath);
+        const resolvedTarget = resolve3(dirname4(fullPath), linkTarget);
+        const rel2 = relative2(realRoot, resolvedTarget);
+        if (rel2.startsWith("..") || process.platform !== "win32" && rel2.startsWith("/")) {
+          throw new Error(`extracted symlink ${fullPath} points outside staging root: ${linkTarget}`);
+        }
+        continue;
+      }
+      const rel = relative2(realRoot, fullPath);
+      if (rel.startsWith("..") || process.platform !== "win32" && rel.startsWith("/")) {
+        throw new Error(`extracted entry ${fullPath} escapes staging root`);
+      }
+      if (lst.isDirectory()) {
+        walk(fullPath);
+        continue;
+      }
+      if (lst.isFile()) {
+        totalBytes += lst.size;
+        if (totalBytes > MAX_EXTRACT_BYTES2) {
+          throw new Error(`extracted size ${totalBytes} exceeds max ${MAX_EXTRACT_BYTES2} (decompression bomb defense)`);
+        }
+      }
+    }
+  };
+  walk(realRoot);
+}
 async function downloadOnnxRuntime(info, targetDir) {
   const url2 = `https://github.com/${ORT_REPO}/releases/download/v${ORT_VERSION}/${info.assetName}.${info.archiveType === "tgz" ? "tgz" : "zip"}`;
   log(`Downloading ONNX Runtime v${ORT_VERSION} for ${process.platform}/${process.arch}...`);
+  const tmpDir = `${targetDir}.tmp.${process.pid}.${Date.now().toString(36)}`;
   try {
-    const tmpDir = `${targetDir}.tmp.${process.pid}`;
-    mkdirSync3(tmpDir, { recursive: true });
-    const archivePath = join5(tmpDir, `onnxruntime.${info.archiveType}`);
-    const { execFileSync } = await import("child_process");
-    execFileSync("curl", ["-fsSL", url2, "-o", archivePath], {
-      stdio: "pipe",
-      timeout: 120000
-    });
+    mkdirSync5(tmpDir, { recursive: true });
+    const archivePath = join11(tmpDir, `onnxruntime.${info.archiveType}`);
+    await downloadFileWithCap(url2, archivePath);
+    const archiveSha256 = sha256File(archivePath);
+    log(`ONNX Runtime archive sha256=${archiveSha256}`);
     if (info.archiveType === "tgz") {
-      execFileSync("tar", ["xzf", archivePath, "-C", tmpDir], { stdio: "pipe" });
+      execFileSync2("tar", ["xzf", archivePath, "-C", tmpDir], {
+        stdio: "pipe",
+        timeout: 120000
+      });
     } else {
       await extractZipArchive(archivePath, tmpDir);
     }
-    const extractedDir = join5(tmpDir, info.assetName, "lib");
-    if (!existsSync4(extractedDir)) {
+    try {
+      unlinkSync4(archivePath);
+    } catch {}
+    validateExtractedTree(tmpDir);
+    const extractedDir = join11(tmpDir, info.assetName, "lib");
+    if (!existsSync8(extractedDir)) {
       throw new Error(`Expected directory not found: ${extractedDir}`);
     }
-    mkdirSync3(targetDir, { recursive: true });
-    const libFiles = readdirSync(extractedDir).filter((f) => f.startsWith("libonnxruntime") || f.startsWith("onnxruntime"));
-    const { lstatSync, symlinkSync, readlinkSync, copyFileSync: cpFile } = await import("fs");
+    mkdirSync5(targetDir, { recursive: true });
+    const libFiles = readdirSync3(extractedDir).filter((f) => f.startsWith("libonnxruntime") || f.startsWith("onnxruntime"));
     const realFiles = [];
     const symlinks = [];
     for (const libFile of libFiles) {
-      const src = join5(extractedDir, libFile);
+      const src = join11(extractedDir, libFile);
       try {
-        const stat = lstatSync(src);
+        const stat = lstatSync2(src);
         log(`ORT extract: ${libFile} \u2014 isSymlink=${stat.isSymbolicLink()}, isFile=${stat.isFile()}, size=${stat.size}`);
         if (stat.isSymbolicLink()) {
-          symlinks.push({ name: libFile, target: readlinkSync(src) });
+          symlinks.push({ name: libFile, target: readlinkSync2(src) });
         } else {
           realFiles.push(libFile);
         }
@@ -22283,10 +24404,10 @@ async function downloadOnnxRuntime(info, targetDir) {
       }
     }
     for (const libFile of realFiles) {
-      const src = join5(extractedDir, libFile);
-      const dst = join5(targetDir, libFile);
+      const src = join11(extractedDir, libFile);
+      const dst = join11(targetDir, libFile);
       try {
-        cpFile(src, dst);
+        copyFileSync2(src, dst);
         if (process.platform !== "win32") {
           chmodSync2(dst, 493);
         }
@@ -22295,62 +24416,179 @@ async function downloadOnnxRuntime(info, targetDir) {
       }
     }
     for (const link of symlinks) {
-      const dst = join5(targetDir, link.name);
+      const dst = join11(targetDir, link.name);
       try {
-        unlinkSync2(dst);
+        unlinkSync4(dst);
       } catch {}
       symlinkSync(link.target, dst);
     }
-    const { rmSync } = await import("fs");
-    rmSync(tmpDir, { recursive: true, force: true });
+    const libPath = join11(targetDir, info.libName);
+    let libHash = null;
+    try {
+      libHash = sha256File(libPath);
+    } catch (err) {
+      warn(`Could not hash newly-installed ONNX library at ${libPath}: ${err}`);
+    }
+    writeOnnxInstalledMeta(targetDir, ORT_VERSION, libHash, archiveSha256);
+    rmSync3(tmpDir, { recursive: true, force: true });
     log(`ONNX Runtime v${ORT_VERSION} installed to ${targetDir}`);
     return targetDir;
   } catch (err) {
     error48(`Failed to download ONNX Runtime: ${err}`);
     try {
-      const { rmSync } = await import("fs");
-      rmSync(`${targetDir}.tmp.${process.pid}`, { recursive: true, force: true });
+      rmSync3(tmpDir, { recursive: true, force: true });
+    } catch {}
+    try {
+      rmSync3(targetDir, { recursive: true, force: true });
     } catch {}
     return null;
   }
 }
 async function extractZipArchive(archivePath, destinationDir) {
-  const { execFileSync } = await import("child_process");
   if (process.platform === "win32") {
-    let powershellError;
+    execFileSync2("tar.exe", ["-xf", archivePath, "-C", destinationDir], {
+      stdio: "pipe",
+      timeout: 120000
+    });
+    return;
+  }
+  execFileSync2("unzip", ["-q", archivePath, "-d", destinationDir], {
+    stdio: "pipe",
+    timeout: 120000
+  });
+}
+function writeOnnxInstalledMeta(installDir, version2, sha256, archiveSha256) {
+  try {
+    const meta3 = {
+      version: version2,
+      installedAt: new Date().toISOString(),
+      ...sha256 ? { sha256 } : {},
+      archiveSha256
+    };
+    writeFileSync5(join11(installDir, ONNX_INSTALLED_META_FILE), JSON.stringify(meta3), "utf8");
+  } catch (err) {
+    log(`[onnx] failed to write installed-meta in ${installDir}: ${err}`);
+  }
+}
+function readOnnxInstalledMeta(installDir) {
+  const path2 = join11(installDir, ONNX_INSTALLED_META_FILE);
+  try {
+    if (!statSync5(path2).isFile())
+      return null;
+    const raw = readFileSync6(path2, "utf8");
+    const parsed = JSON.parse(raw);
+    if (typeof parsed.version !== "string" || parsed.version.length === 0)
+      return null;
+    return {
+      version: parsed.version,
+      installedAt: typeof parsed.installedAt === "string" ? parsed.installedAt : "",
+      ...typeof parsed.sha256 === "string" && parsed.sha256.length > 0 ? { sha256: parsed.sha256 } : {},
+      ...typeof parsed.archiveSha256 === "string" && parsed.archiveSha256.length > 0 ? { archiveSha256: parsed.archiveSha256 } : {}
+    };
+  } catch {
+    return null;
+  }
+}
+function sha256File(path2) {
+  const hash2 = createHash3("sha256");
+  hash2.update(readFileSync6(path2));
+  return hash2.digest("hex");
+}
+function acquireLock(lockPath2) {
+  const tryClaim = () => {
     try {
-      execFileSync("powershell.exe", [
-        "-NoProfile",
-        "-NonInteractive",
-        "-ExecutionPolicy",
-        "Bypass",
-        "-Command",
-        "& { Expand-Archive -LiteralPath $args[0] -DestinationPath $args[1] -Force }",
-        archivePath,
-        destinationDir
-      ], { stdio: "pipe", timeout: 120000 });
-      return;
+      const fd = openSync2(lockPath2, "wx");
+      try {
+        writeFileSync5(fd, `${process.pid}
+${new Date().toISOString()}
+`);
+      } finally {
+        closeSync2(fd);
+      }
+      return true;
     } catch (err) {
-      powershellError = err;
-      warn(`PowerShell Expand-Archive failed, falling back to cmd/tar: ${String(err)}`);
+      const code = err.code;
+      if (code === "EEXIST")
+        return false;
+      warn(`[onnx] unexpected error acquiring lock ${lockPath2}: ${err}`);
+      return false;
     }
+  };
+  if (tryClaim())
+    return true;
+  let owningPid = null;
+  let lockMtimeMs = 0;
+  try {
+    const raw = readFileSync6(lockPath2, "utf8");
+    const firstLine = raw.split(/\r?\n/, 1)[0]?.trim() ?? "";
+    const parsed = Number.parseInt(firstLine, 10);
+    if (Number.isFinite(parsed) && parsed > 0)
+      owningPid = parsed;
+    lockMtimeMs = statSync5(lockPath2).mtimeMs;
+  } catch {
+    return tryClaim();
+  }
+  const age = Date.now() - lockMtimeMs;
+  const ageWithinFresh = Math.abs(age) < STALE_LOCK_MS2;
+  const skipLiveness = process.platform === "win32";
+  const ownerAlive = !skipLiveness && owningPid !== null && isProcessAlive2(owningPid);
+  if (skipLiveness ? ageWithinFresh : ownerAlive && ageWithinFresh) {
+    return false;
+  }
+  log(`[onnx] reclaiming install lock (owner_pid=${owningPid ?? "unknown"}, alive=${ownerAlive}, age_ms=${age})`);
+  try {
+    unlinkSync4(lockPath2);
+  } catch {}
+  return tryClaim();
+}
+function releaseLock(lockPath2) {
+  try {
+    let owningPid = null;
     try {
-      execFileSync("cmd.exe", ["/d", "/s", "/c", `tar -xf "${archivePath}" -C "${destinationDir}"`], { stdio: "pipe", timeout: 120000 });
+      const raw = readFileSync6(lockPath2, "utf8");
+      const firstLine = raw.split(/\r?\n/, 1)[0]?.trim() ?? "";
+      const parsed = Number.parseInt(firstLine, 10);
+      if (Number.isFinite(parsed) && parsed > 0)
+        owningPid = parsed;
+    } catch (readErr) {
+      const code = readErr.code;
+      if (code === "ENOENT")
+        return;
+      warn(`[onnx] could not read lock ${lockPath2} during release: ${readErr}`);
       return;
-    } catch (cmdError) {
-      throw new Error(`ZIP extraction failed via PowerShell and cmd/tar. PowerShell: ${String(powershellError)} | cmd/tar: ${String(cmdError)}`);
     }
+    if (owningPid !== process.pid) {
+      log(`[onnx] not releasing lock ${lockPath2}: owned by pid ${owningPid ?? "unknown"} (we are ${process.pid})`);
+      return;
+    }
+    try {
+      unlinkSync4(lockPath2);
+    } catch (unlinkErr) {
+      const code = unlinkErr.code;
+      if (code !== "ENOENT") {
+        warn(`[onnx] failed to release lock ${lockPath2}: ${unlinkErr}`);
+      }
+    }
+  } catch (err) {
+    warn(`[onnx] unexpected error releasing lock ${lockPath2}: ${err}`);
+  }
+}
+function isProcessAlive2(pid) {
+  try {
+    process.kill(pid, 0);
+    return true;
+  } catch (err) {
+    const code = err.code;
+    if (code === "ESRCH")
+      return false;
+    return true;
   }
-  execFileSync("unzip", ["-q", archivePath, "-d", destinationDir], {
-    stdio: "pipe",
-    timeout: 120000
-  });
 }
 
 // src/bridge.ts
-import { spawn } from "child_process";
-import { homedir as homedir4 } from "os";
-import { join as join6 } from "path";
+import { spawn as spawn3 } from "child_process";
+import { homedir as homedir7 } from "os";
+import { join as join12 } from "path";
 var DEFAULT_BRIDGE_TIMEOUT_MS = 30000;
 var SEMANTIC_TIMEOUT_SAFETY_MARGIN_MS = 5000;
 var MAX_STDOUT_BUFFER = 64 * 1024 * 1024;
@@ -22492,14 +24730,14 @@ class BinaryBridge {
     const line = `${JSON.stringify(request)}
 `;
     const effectiveTimeoutMs = options?.timeoutMs ?? this.timeoutMs;
-    return new Promise((resolve, reject) => {
+    return new Promise((resolve4, reject) => {
       const timer = setTimeout(() => {
         this.pending.delete(id);
         warn(`Request "${command}" (id=${id}) timed out after ${effectiveTimeoutMs}ms \u2014 restarting bridge`);
         reject(new Error(`[aft-plugin] Request "${command}" (id=${id}) timed out after ${effectiveTimeoutMs}ms`));
         this.handleTimeout();
       }, effectiveTimeoutMs);
-      this.pending.set(id, { resolve, reject, timer });
+      this.pending.set(id, { resolve: resolve4, reject, timer });
       if (!this.process?.stdin?.writable) {
         this.pending.delete(id);
         clearTimeout(timer);
@@ -22542,15 +24780,15 @@ class BinaryBridge {
     if (this.process) {
       const proc = this.process;
       this.process = null;
-      return new Promise((resolve) => {
+      return new Promise((resolve4) => {
         const forceKillTimer = setTimeout(() => {
           proc.kill("SIGKILL");
-          resolve();
+          resolve4();
         }, 5000);
         proc.once("exit", () => {
           clearTimeout(forceKillTimer);
           log("Process exited during shutdown");
-          resolve();
+          resolve4();
         });
         proc.kill("SIGTERM");
       });
@@ -22592,19 +24830,19 @@ class BinaryBridge {
     })();
     const useFastembedBackend = semanticBackend === undefined || semanticBackend === "fastembed" || semanticBackend === "";
     const ortDir = typeof this.configOverrides._ort_dylib_dir === "string" && useFastembedBackend ? this.configOverrides._ort_dylib_dir : null;
-    const ortLibraryPath = ortDir == null ? null : join6(ortDir, process.platform === "win32" ? "onnxruntime.dll" : process.platform === "darwin" ? "libonnxruntime.dylib" : "libonnxruntime.so");
+    const ortLibraryPath = ortDir == null ? null : join12(ortDir, process.platform === "win32" ? "onnxruntime.dll" : process.platform === "darwin" ? "libonnxruntime.dylib" : "libonnxruntime.so");
     const envPath = process.platform === "win32" && ortDir ? `${ortDir};${process.env.PATH ?? ""}` : process.env.PATH;
     const env = {
       ...process.env,
       ...envPath ? { PATH: envPath } : {}
     };
     if (useFastembedBackend) {
-      env.FASTEMBED_CACHE_DIR = process.env.FASTEMBED_CACHE_DIR || (typeof this.configOverrides.storage_dir === "string" ? join6(this.configOverrides.storage_dir, "semantic", "models") : join6(homedir4() || "", ".cache", "fastembed"));
+      env.FASTEMBED_CACHE_DIR = process.env.FASTEMBED_CACHE_DIR || (typeof this.configOverrides.storage_dir === "string" ? join12(this.configOverrides.storage_dir, "semantic", "models") : join12(homedir7() || "", ".cache", "fastembed"));
       if (ortLibraryPath) {
         env.ORT_DYLIB_PATH = ortLibraryPath;
       }
     }
-    const child = spawn(this.binaryPath, [], {
+    const child = spawn3(this.binaryPath, [], {
       cwd: this.cwd,
       stdio: ["pipe", "pipe", "pipe"],
       env
@@ -22865,10 +25103,10 @@ function normalizeKey(projectRoot) {
 
 // src/resolver.ts
 import { execSync, spawnSync } from "child_process";
-import { chmodSync as chmodSync3, copyFileSync, existsSync as existsSync5, mkdirSync as mkdirSync4, renameSync } from "fs";
+import { chmodSync as chmodSync3, copyFileSync as copyFileSync3, existsSync as existsSync9, mkdirSync as mkdirSync6, renameSync as renameSync2 } from "fs";
 import { createRequire } from "module";
-import { homedir as homedir5 } from "os";
-import { join as join7 } from "path";
+import { homedir as homedir8 } from "os";
+import { join as join13 } from "path";
 function copyToVersionedCache(npmBinaryPath) {
   try {
     const result = spawnSync(npmBinaryPath, ["--version"], {
@@ -22882,18 +25120,18 @@ function copyToVersionedCache(npmBinaryPath) {
     const version2 = rawVersion.replace(/^aft\s+/, "");
     const tag = version2.startsWith("v") ? version2 : `v${version2}`;
     const cacheDir = getCacheDir();
-    const versionedDir = join7(cacheDir, tag);
+    const versionedDir = join13(cacheDir, tag);
     const ext = process.platform === "win32" ? ".exe" : "";
-    const cachedPath = join7(versionedDir, `aft${ext}`);
-    if (existsSync5(cachedPath))
+    const cachedPath = join13(versionedDir, `aft${ext}`);
+    if (existsSync9(cachedPath))
       return cachedPath;
-    mkdirSync4(versionedDir, { recursive: true });
+    mkdirSync6(versionedDir, { recursive: true });
     const tmpPath = `${cachedPath}.tmp`;
-    copyFileSync(npmBinaryPath, tmpPath);
+    copyFileSync3(npmBinaryPath, tmpPath);
     if (process.platform !== "win32") {
       chmodSync3(tmpPath, 493);
     }
-    renameSync(tmpPath, cachedPath);
+    renameSync2(tmpPath, cachedPath);
     log(`Copied npm binary to versioned cache: ${cachedPath}`);
     return cachedPath;
   } catch (err) {
@@ -22901,14 +25139,14 @@ function copyToVersionedCache(npmBinaryPath) {
     return null;
   }
 }
-function platformKey(platform2 = process.platform, arch = process.arch) {
-  const archMap = PLATFORM_ARCH_MAP[platform2];
+function platformKey(platform3 = process.platform, arch = process.arch) {
+  const archMap = PLATFORM_ARCH_MAP[platform3];
   if (!archMap) {
-    throw new Error(`Unsupported platform: ${platform2} (arch: ${arch}). ` + `Supported platforms: ${Object.keys(PLATFORM_ARCH_MAP).join(", ")}`);
+    throw new Error(`Unsupported platform: ${platform3} (arch: ${arch}). ` + `Supported platforms: ${Object.keys(PLATFORM_ARCH_MAP).join(", ")}`);
   }
   const key = archMap[arch];
   if (!key) {
-    throw new Error(`Unsupported architecture: ${arch} on platform ${platform2}. ` + `Supported architectures for ${platform2}: ${Object.keys(archMap).join(", ")}`);
+    throw new Error(`Unsupported architecture: ${arch} on platform ${platform3}. ` + `Supported architectures for ${platform3}: ${Object.keys(archMap).join(", ")}`);
   }
   return key;
 }
@@ -22932,7 +25170,7 @@ function findBinarySync() {
     const packageBin = `@cortexkit/aft-${key}/bin/aft${ext}`;
     const req = createRequire(import.meta.url);
     const resolved = req.resolve(packageBin);
-    if (existsSync5(resolved)) {
+    if (existsSync9(resolved)) {
       const copied = copyToVersionedCache(resolved);
       return copied ?? resolved;
     }
@@ -22946,8 +25184,8 @@ function findBinarySync() {
     if (result)
       return result;
   } catch {}
-  const cargoPath = join7(homedir5(), ".cargo", "bin", `aft${ext}`);
-  if (existsSync5(cargoPath))
+  const cargoPath = join13(homedir8(), ".cargo", "bin", `aft${ext}`);
+  if (existsSync9(cargoPath))
     return cargoPath;
   return null;
 }
@@ -22982,21 +25220,21 @@ async function findBinary() {
 }
 
 // src/shared/rpc-server.ts
-import { randomBytes } from "crypto";
-import { mkdirSync as mkdirSync5, renameSync as renameSync2, unlinkSync as unlinkSync3, writeFileSync as writeFileSync2 } from "fs";
+import { randomBytes as randomBytes2 } from "crypto";
+import { mkdirSync as mkdirSync7, renameSync as renameSync3, unlinkSync as unlinkSync5, writeFileSync as writeFileSync6 } from "fs";
 import { createServer } from "http";
-import { dirname } from "path";
+import { dirname as dirname5 } from "path";
 
 // src/shared/rpc-utils.ts
-import { createHash } from "crypto";
-import { join as join8 } from "path";
+import { createHash as createHash4 } from "crypto";
+import { join as join14 } from "path";
 function projectHash(directory) {
   const normalized = directory.replace(/\/+$/, "");
-  return createHash("sha256").update(normalized).digest("hex").slice(0, 16);
+  return createHash4("sha256").update(normalized).digest("hex").slice(0, 16);
 }
 function rpcPortFilePath(storageDir, directory) {
   const hash2 = projectHash(directory);
-  return join8(storageDir, "rpc", hash2, "port");
+  return join14(storageDir, "rpc", hash2, "port");
 }
 
 // src/shared/rpc-server.ts
@@ -23013,7 +25251,7 @@ class AftRpcServer {
     this.handlers.set(method, handler);
   }
   async start() {
-    return new Promise((resolve, reject) => {
+    return new Promise((resolve4, reject) => {
       const server = createServer((req, res) => this.dispatch(req, res));
       server.on("error", (err) => {
         warn(`RPC server error: ${err.message}`);
@@ -23026,19 +25264,19 @@ class AftRpcServer {
           return;
         }
         this.port = addr.port;
-        this.token = randomBytes(32).toString("hex");
+        this.token = randomBytes2(32).toString("hex");
         this.server = server;
         try {
-          const dir = dirname(this.portFilePath);
-          mkdirSync5(dir, { recursive: true });
+          const dir = dirname5(this.portFilePath);
+          mkdirSync7(dir, { recursive: true });
           const tmpPath = `${this.portFilePath}.tmp`;
-          writeFileSync2(tmpPath, JSON.stringify({ port: this.port, token: this.token }), "utf-8");
-          renameSync2(tmpPath, this.portFilePath);
+          writeFileSync6(tmpPath, JSON.stringify({ port: this.port, token: this.token }), "utf-8");
+          renameSync3(tmpPath, this.portFilePath);
           log(`RPC server listening on 127.0.0.1:${this.port}`);
         } catch (err) {
           warn(`Failed to write RPC port file: ${err}`);
         }
-        resolve(this.port);
+        resolve4(this.port);
       });
       server.unref();
     });
@@ -23050,7 +25288,7 @@ class AftRpcServer {
     }
     this.token = null;
     try {
-      unlinkSync3(this.portFilePath);
+      unlinkSync5(this.portFilePath);
     } catch {}
   }
   dispatch(req, res) {
@@ -23271,22 +25509,22 @@ function formatStatusMarkdown(status) {
 }
 
 // src/shared/tui-config.ts
-var import_comment_json2 = __toESM(require_src2(), 1);
-import { existsSync as existsSync6, mkdirSync as mkdirSync6, readFileSync as readFileSync3, writeFileSync as writeFileSync3 } from "fs";
-import { dirname as dirname2, join as join10 } from "path";
+var import_comment_json4 = __toESM(require_src2(), 1);
+import { existsSync as existsSync10, mkdirSync as mkdirSync8, readFileSync as readFileSync7, writeFileSync as writeFileSync7 } from "fs";
+import { dirname as dirname6, join as join16 } from "path";
 
 // src/shared/opencode-config-dir.ts
-import { homedir as homedir6 } from "os";
-import { join as join9, resolve } from "path";
+import { homedir as homedir9 } from "os";
+import { join as join15, resolve as resolve4 } from "path";
 function getCliConfigDir() {
   const envConfigDir = process.env.OPENCODE_CONFIG_DIR?.trim();
   if (envConfigDir) {
-    return resolve(envConfigDir);
+    return resolve4(envConfigDir);
   }
   if (process.platform === "win32") {
-    return join9(homedir6(), ".config", "opencode");
+    return join15(homedir9(), ".config", "opencode");
   }
-  return join9(process.env.XDG_CONFIG_HOME || join9(homedir6(), ".config"), "opencode");
+  return join15(process.env.XDG_CONFIG_HOME || join15(homedir9(), ".config"), "opencode");
 }
 function getOpenCodeConfigDir2(_options) {
   return getCliConfigDir();
@@ -23295,10 +25533,10 @@ function getOpenCodeConfigPaths(options) {
   const configDir = getOpenCodeConfigDir2(options);
   return {
     configDir,
-    configJson: join9(configDir, "opencode.json"),
-    configJsonc: join9(configDir, "opencode.jsonc"),
-    packageJson: join9(configDir, "package.json"),
-    omoConfig: join9(configDir, "magic-context.jsonc")
+    configJson: join15(configDir, "opencode.json"),
+    configJsonc: join15(configDir, "opencode.jsonc"),
+    packageJson: join15(configDir, "package.json"),
+    omoConfig: join15(configDir, "magic-context.jsonc")
   };
 }
 
@@ -23307,11 +25545,11 @@ var PLUGIN_NAME = "@cortexkit/aft-opencode";
 var PLUGIN_ENTRY = `${PLUGIN_NAME}@latest`;
 function resolveTuiConfigPath() {
   const configDir = getOpenCodeConfigPaths({ binary: "opencode" }).configDir;
-  const jsoncPath = join10(configDir, "tui.jsonc");
-  const jsonPath = join10(configDir, "tui.json");
-  if (existsSync6(jsoncPath))
+  const jsoncPath = join16(configDir, "tui.jsonc");
+  const jsonPath = join16(configDir, "tui.json");
+  if (existsSync10(jsoncPath))
     return jsoncPath;
-  if (existsSync6(jsonPath))
+  if (existsSync10(jsonPath))
     return jsonPath;
   return jsonPath;
 }
@@ -23319,8 +25557,8 @@ function ensureTuiPluginEntry() {
   try {
     const configPath = resolveTuiConfigPath();
     let config2 = {};
-    if (existsSync6(configPath)) {
-      config2 = import_comment_json2.parse(readFileSync3(configPath, "utf-8")) ?? {};
+    if (existsSync10(configPath)) {
+      config2 = import_comment_json4.parse(readFileSync7(configPath, "utf-8")) ?? {};
     }
     const plugins = Array.isArray(config2.plugin) ? config2.plugin.filter((value) => typeof value === "string") : [];
     if (plugins.some((plugin) => plugin === PLUGIN_NAME || plugin.startsWith(`${PLUGIN_NAME}@`) || plugin.includes("opencode-plugin") || plugin.includes("aft-opencode"))) {
@@ -23328,8 +25566,8 @@ function ensureTuiPluginEntry() {
     }
     plugins.push(PLUGIN_ENTRY);
     config2.plugin = plugins;
-    mkdirSync6(dirname2(configPath), { recursive: true });
-    writeFileSync3(configPath, `${import_comment_json2.stringify(config2, null, 2)}
+    mkdirSync8(dirname6(configPath), { recursive: true });
+    writeFileSync7(configPath, `${import_comment_json4.stringify(config2, null, 2)}
 `);
     log(`[aft-plugin] added TUI plugin entry to ${configPath}`);
     return true;
@@ -23340,33 +25578,33 @@ function ensureTuiPluginEntry() {
 }
 
 // src/shared/url-fetch.ts
-import { createHash as createHash2 } from "crypto";
+import { createHash as createHash5 } from "crypto";
 import { lookup } from "dns/promises";
 import {
-  existsSync as existsSync7,
-  mkdirSync as mkdirSync7,
-  readdirSync as readdirSync2,
-  readFileSync as readFileSync4,
-  unlinkSync as unlinkSync4,
-  writeFileSync as writeFileSync4
+  existsSync as existsSync11,
+  mkdirSync as mkdirSync9,
+  readdirSync as readdirSync4,
+  readFileSync as readFileSync8,
+  unlinkSync as unlinkSync6,
+  writeFileSync as writeFileSync8
 } from "fs";
 import { isIP } from "net";
-import { join as join11 } from "path";
+import { join as join17 } from "path";
 var MAX_RESPONSE_BYTES = 10 * 1024 * 1024;
 var CACHE_TTL_MS = 24 * 60 * 60 * 1000;
 var FETCH_TIMEOUT_MS = 30000;
 var MAX_REDIRECTS = 5;
 function cacheDir(storageDir) {
-  return join11(storageDir, "url_cache");
+  return join17(storageDir, "url_cache");
 }
 function hashUrl(url2) {
-  return createHash2("sha256").update(url2).digest("hex").slice(0, 16);
+  return createHash5("sha256").update(url2).digest("hex").slice(0, 16);
 }
 function metaPath(storageDir, hash2) {
-  return join11(cacheDir(storageDir), `${hash2}.meta.json`);
+  return join17(cacheDir(storageDir), `${hash2}.meta.json`);
 }
 function contentPath(storageDir, hash2, extension) {
-  return join11(cacheDir(storageDir), `${hash2}${extension}`);
+  return join17(cacheDir(storageDir), `${hash2}${extension}`);
 }
 function _isPrivateIpv4(address) {
   const parts = address.split(".").map((part) => Number.parseInt(part, 10));
@@ -23525,15 +25763,15 @@ async function fetchUrlToTempFile(url2, storageDir, options = {}) {
   }
   const allowPrivate = options.allowPrivate === true;
   const dir = cacheDir(storageDir);
-  mkdirSync7(dir, { recursive: true });
+  mkdirSync9(dir, { recursive: true });
   const hash2 = hashUrl(url2);
   const metaFile = metaPath(storageDir, hash2);
-  if (existsSync7(metaFile)) {
+  if (existsSync11(metaFile)) {
     try {
-      const meta4 = JSON.parse(readFileSync4(metaFile, "utf8"));
+      const meta4 = JSON.parse(readFileSync8(metaFile, "utf8"));
       const age = Date.now() - meta4.fetchedAt;
       const cached2 = contentPath(storageDir, hash2, meta4.extension);
-      if (age < CACHE_TTL_MS && existsSync7(cached2)) {
+      if (age < CACHE_TTL_MS && existsSync11(cached2)) {
         log(`URL cache hit: ${url2} (${Math.round(age / 1000)}s old)`);
         return cached2;
       }
@@ -23578,9 +25816,9 @@ async function fetchUrlToTempFile(url2, storageDir, options = {}) {
   const body = Buffer.concat(chunks);
   const contentFile = contentPath(storageDir, hash2, extension);
   const tmpContent = `${contentFile}.tmp-${process.pid}`;
-  writeFileSync4(tmpContent, body);
-  const { renameSync: renameSync3 } = await import("fs");
-  renameSync3(tmpContent, contentFile);
+  writeFileSync8(tmpContent, body);
+  const { renameSync: renameSync4 } = await import("fs");
+  renameSync4(tmpContent, contentFile);
   const meta3 = {
     url: url2,
     contentType,
@@ -23588,35 +25826,35 @@ async function fetchUrlToTempFile(url2, storageDir, options = {}) {
     fetchedAt: Date.now()
   };
   const tmpMeta = `${metaFile}.tmp-${process.pid}`;
-  writeFileSync4(tmpMeta, JSON.stringify(meta3));
-  renameSync3(tmpMeta, metaFile);
+  writeFileSync8(tmpMeta, JSON.stringify(meta3));
+  renameSync4(tmpMeta, metaFile);
   log(`URL cached (${total} bytes): ${url2}`);
   return contentFile;
 }
 function cleanupUrlCache(storageDir) {
   const dir = cacheDir(storageDir);
-  if (!existsSync7(dir))
+  if (!existsSync11(dir))
     return;
   let removed = 0;
   try {
-    for (const entry of readdirSync2(dir)) {
+    for (const entry of readdirSync4(dir)) {
       if (!entry.endsWith(".meta.json"))
         continue;
-      const metaFile = join11(dir, entry);
+      const metaFile = join17(dir, entry);
       try {
-        const meta3 = JSON.parse(readFileSync4(metaFile, "utf8"));
+        const meta3 = JSON.parse(readFileSync8(metaFile, "utf8"));
         const age = Date.now() - meta3.fetchedAt;
         if (age > CACHE_TTL_MS) {
           const hash2 = entry.slice(0, -".meta.json".length);
           const content = contentPath(storageDir, hash2, meta3.extension);
-          if (existsSync7(content))
-            unlinkSync4(content);
-          unlinkSync4(metaFile);
+          if (existsSync11(content))
+            unlinkSync6(content);
+          unlinkSync6(metaFile);
           removed++;
         }
       } catch {
         try {
-          unlinkSync4(metaFile);
+          unlinkSync6(metaFile);
           removed++;
         } catch {}
       }
@@ -25291,7 +27529,8 @@ function lspTools(ctx) {
 ` + `}
 ` + `
 ` + `**Reading the response honestly:**
-` + "- `total: 0, complete: true, lsp_servers_used: [{status: 'pull_ok'}]` \u2192 file is genuinely clean.\n" + "- `total: 0, lsp_servers_used: []` \u2192 no server registered for this extension; nothing was checked.\n" + "- `lsp_servers_used: [{status: 'binary_not_installed: bash-language-server'}]` \u2192 install the server to get diagnostics.\n" + "- `complete: false` (directory mode) \u2192 some files in the directory weren't checked; see `unchecked_files`.",
+` + "- `total: 0, complete: true, lsp_servers_used: [{status: 'pull_ok'}]` \u2192 file is genuinely clean.\n" + "- `total: 0, lsp_servers_used: []` \u2192 **nothing was checked** (no server registered for this extension). Tell the user, don't claim 'no errors'.\n" + "- `lsp_servers_used: [{status: 'binary_not_installed: <name>'}]` \u2192 server matched the extension but its binary isn't on PATH. Tell the user to install it.\n" + "- `lsp_servers_used: [{status: 'no_root_marker (...)'}]` \u2192 server is registered but couldn't find a workspace root marker walking up from this file. The user's project layout doesn't match what the server expects.\n" + "- `complete: false` (directory mode) \u2192 some files in the directory weren't checked; see `unchecked_files`.\n" + `
+` + "**When this tool gives an unhelpful answer**, run `bunx --bun @cortexkit/aft doctor lsp <filePath>` from a terminal to get a full per-server breakdown (registered servers, binary resolution, root-marker resolution, spawn outcome).",
     args: {
       filePath: z5.string().optional().describe("Path to a file to check. Mutually exclusive with 'directory'. Omit both to dump all cached diagnostics."),
       directory: z5.string().optional().describe("Path to a directory. Returns cached diagnostics + workspace pull from active servers; lists files we have no info for in 'unchecked_files'. Capped at 200 walked files."),
@@ -25375,7 +27614,7 @@ function navigationTools(ctx) {
 
 // src/tools/reading.ts
 import { readdir } from "fs/promises";
-import { extname as extname2, join as join12, resolve as resolve5 } from "path";
+import { extname as extname2, join as join18, resolve as resolve8 } from "path";
 import { tool as tool7 } from "@opencode-ai/plugin";
 var OUTLINE_EXTENSIONS = new Set([
   ".ts",
@@ -25453,7 +27692,7 @@ function readingTools(ctx) {
         if (!dirArg && typeof args.filePath === "string" && !Array.isArray(args.files)) {
           try {
             const { stat } = await import("fs/promises");
-            const resolved = resolve5(context.directory, args.filePath);
+            const resolved = resolve8(context.directory, args.filePath);
             const st = await stat(resolved);
             if (st.isDirectory()) {
               dirArg = args.filePath;
@@ -25461,7 +27700,7 @@ function readingTools(ctx) {
           } catch {}
         }
         if (dirArg) {
-          const dirPath = resolve5(context.directory, dirArg);
+          const dirPath = resolve8(context.directory, dirArg);
           const files = await discoverSourceFiles(dirPath);
           if (files.length === 0) {
             return JSON.stringify({
@@ -25569,12 +27808,12 @@ async function discoverSourceFiles(dir, maxFiles = 200) {
         return;
       if (entry.isDirectory()) {
         if (!SKIP_DIRS.has(entry.name) && !entry.name.startsWith(".")) {
-          await walk(join12(current, entry.name));
+          await walk(join18(current, entry.name));
         }
       } else if (entry.isFile()) {
         const ext = extname2(entry.name).toLowerCase();
         if (OUTLINE_EXTENSIONS.has(ext)) {
-          files.push(join12(current, entry.name));
+          files.push(join18(current, entry.name));
         }
       }
     }
@@ -26147,6 +28386,7 @@ var ANNOUNCEMENT_FEATURES = [];
 var plugin = async (input) => {
   const binaryPath = await findBinary();
   const aftConfig = loadAftConfig(input.directory);
+  const autoUpdateAbort = new AbortController;
   const configOverrides = {};
   if (aftConfig.format_on_edit !== undefined)
     configOverrides.format_on_edit = aftConfig.format_on_edit;
@@ -26167,8 +28407,8 @@ var plugin = async (input) => {
   if (aftConfig.max_callgraph_files !== undefined)
     configOverrides.max_callgraph_files = aftConfig.max_callgraph_files;
   const isFastembedSemanticBackend = (aftConfig.semantic?.backend ?? "fastembed") === "fastembed";
-  const dataHome = process.env.XDG_DATA_HOME || join13(homedir7(), ".local", "share");
-  configOverrides.storage_dir = join13(dataHome, "opencode", "storage", "plugin", "aft");
+  const dataHome = process.env.XDG_DATA_HOME || join19(homedir10(), ".local", "share");
+  configOverrides.storage_dir = join19(dataHome, "opencode", "storage", "plugin", "aft");
   if (aftConfig.experimental_semantic_search && isFastembedSemanticBackend) {
     const storageDir2 = configOverrides.storage_dir;
     const ortDylibDir = await ensureOnnxRuntime(storageDir2).catch((err) => {
@@ -26181,6 +28421,63 @@ var plugin = async (input) => {
       warn(`Semantic search requires ONNX Runtime. Install: ${getManualInstallHint()}`);
     }
   }
+  try {
+    const lspAutoInstall = aftConfig.lsp?.auto_install ?? true;
+    const lspGraceDays = aftConfig.lsp?.grace_days ?? 7;
+    const lspVersions = aftConfig.lsp?.versions ?? {};
+    const lspDisabled = new Set(aftConfig.lsp?.disabled ?? []);
+    const npmResult = runAutoInstall(input.directory, {
+      autoInstall: lspAutoInstall,
+      graceDays: lspGraceDays,
+      versions: lspVersions,
+      disabled: lspDisabled
+    });
+    const relevantGithub = discoverRelevantGithubServers(input.directory);
+    const ghResult = runGithubAutoInstall(relevantGithub, {
+      autoInstall: lspAutoInstall,
+      graceDays: lspGraceDays,
+      versions: lspVersions,
+      disabled: lspDisabled
+    });
+    const mergedBinDirs = [...npmResult.cachedBinDirs, ...ghResult.cachedBinDirs];
+    if (mergedBinDirs.length > 0) {
+      configOverrides.lsp_paths_extra = mergedBinDirs;
+    }
+    if (npmResult.installsStarted > 0 || ghResult.installsStarted > 0) {
+      log(`[lsp] auto-install: ${npmResult.installsStarted} npm + ${ghResult.installsStarted} github install(s) running in background`);
+    }
+    Promise.all([npmResult.installsComplete, ghResult.installsComplete]).then(() => {
+      const actionable = [...npmResult.skipped, ...ghResult.skipped].filter((s) => {
+        const r = s.reason.toLowerCase();
+        if (r === "auto_install: false")
+          return false;
+        if (r === "disabled by config")
+          return false;
+        if (r === "not relevant to project")
+          return false;
+        if (r === "already installed")
+          return false;
+        if (r === "another install in progress")
+          return false;
+        return true;
+      });
+      if (actionable.length === 0)
+        return;
+      const lines = actionable.map((s) => `  \u2022 ${s.id}: ${s.reason}`).join(`
+`);
+      const message = `AFT skipped or failed to install ${actionable.length} LSP server(s):
+${lines}
+
+` + "See `/aft-status` for details, or check the plugin log. " + 'Pin a working version with `lsp.versions: { "<package>": "<version>" }` if grace is blocking, ' + "or set `lsp.auto_install: false` to suppress this entirely.";
+      sendWarning({ client: input.client, directory: input.directory }, message).catch((err) => {
+        warn(`[lsp] failed to deliver install summary: ${err}`);
+      });
+    }).catch((err) => {
+      warn(`[lsp] install-summary aggregation failed: ${err}`);
+    });
+  } catch (err) {
+    warn(`[lsp] auto-install setup failed: ${err instanceof Error ? err.message : String(err)}`);
+  }
   let versionUpgradeAttempted = null;
   const pool = new BridgePool(binaryPath, {
     minVersion: PLUGIN_VERSION,
@@ -26228,6 +28525,7 @@ var plugin = async (input) => {
   setSharedBridgePool(pool);
   const rpcServer = new AftRpcServer(configOverrides.storage_dir, input.directory);
   const unregisterShutdown = registerShutdownCleanup(async () => {
+    await Promise.allSettled([abortInFlightAutoInstalls(), abortInFlightGithubInstalls()]);
     try {
       rpcServer.stop();
     } catch {}
@@ -26244,10 +28542,10 @@ var plugin = async (input) => {
       return { show: false };
     }
     if (storageDir) {
-      const versionFile = join13(storageDir, "last_announced_version");
+      const versionFile = join19(storageDir, "last_announced_version");
       try {
-        if (existsSync9(versionFile)) {
-          const lastVersion = readFileSync5(versionFile, "utf-8").trim();
+        if (existsSync13(versionFile)) {
+          const lastVersion = readFileSync9(versionFile, "utf-8").trim();
           if (lastVersion === ANNOUNCEMENT_VERSION)
             return { show: false };
         }
@@ -26258,8 +28556,8 @@ var plugin = async (input) => {
   rpcServer.handle("mark-announced", async () => {
     if (storageDir && ANNOUNCEMENT_VERSION) {
       try {
-        mkdirSync8(storageDir, { recursive: true });
-        writeFileSync5(join13(storageDir, "last_announced_version"), ANNOUNCEMENT_VERSION);
+        mkdirSync10(storageDir, { recursive: true });
+        writeFileSync9(join19(storageDir, "last_announced_version"), ANNOUNCEMENT_VERSION);
       } catch {}
     }
     return { success: true };
@@ -26342,6 +28640,11 @@ Install: ${getManualInstallHint()}`).catch(() => {});
   }
   return {
     tool: allTools,
+    event: createAutoUpdateCheckerHook(input, {
+      enabled: true,
+      autoUpdate: aftConfig.auto_update ?? true,
+      signal: autoUpdateAbort.signal
+    }),
     "command.execute.before": async (commandInput, _output) => {
       if (isTuiMode2() || commandInput.command !== STATUS_COMMAND) {
         return;
@@ -26389,11 +28692,13 @@ Install: ${getManualInstallHint()}`).catch(() => {});
         }
       };
     },
-    dispose: () => {
+    dispose: async () => {
+      autoUpdateAbort.abort();
       unregisterShutdown();
+      await Promise.allSettled([abortInFlightAutoInstalls(), abortInFlightGithubInstalls()]);
       rpcServer.stop();
       clearSharedBridgePool();
-      return pool.shutdown();
+      await pool.shutdown();
     }
   };
 };