@cortexkit/aft-opencode 0.17.0 → 0.17.2

package/dist/index.js

@@ -7803,10 +7803,10 @@ var require_src2 = __commonJS((exports, module) => {
 });
 
 // src/index.ts
-import { existsSync as existsSync12, mkdirSync as mkdirSync10, readFileSync as readFileSync6, writeFileSync as writeFileSync6 } from "fs";
+import { existsSync as existsSync13, mkdirSync as mkdirSync10, readFileSync as readFileSync9, writeFileSync as writeFileSync9 } from "fs";
 import { createRequire as createRequire2 } from "module";
-import { homedir as homedir8 } from "os";
-import { join as join16 } from "path";
+import { homedir as homedir10 } from "os";
+import { join as join19 } from "path";
 
 // src/config.ts
 var import_comment_json = __toESM(require_src2(), 1);
@@ -21481,7 +21481,8 @@ var AftConfigSchema = exports_external.object({
   lsp: LspConfigSchema.optional(),
   url_fetch_allow_private: exports_external.boolean().optional(),
   semantic: SemanticConfigSchema.optional(),
-  max_callgraph_files: exports_external.number().int().positive().optional()
+  max_callgraph_files: exports_external.number().int().positive().optional(),
+  auto_update: exports_external.boolean().optional()
 });
 function normalizeLspExtension(extension) {
   return extension.trim().replace(/^\.+/, "");
@@ -21665,6 +21666,8 @@ function getStrippedTopLevelKeys(override) {
     stripped.push("url_fetch_allow_private");
   if (override.max_callgraph_files !== undefined)
     stripped.push("max_callgraph_files");
+  if (override.auto_update !== undefined)
+    stripped.push("auto_update");
   return stripped;
 }
 function mergeConfigs(base, override) {
@@ -21869,52 +21872,565 @@ async function fetchLatestTag() {
   }
 }
 
-// src/lsp-auto-install.ts
+// src/hooks/auto-update-checker/cache.ts
+var import_comment_json3 = __toESM(require_src2(), 1);
 import { spawn } from "child_process";
+import { existsSync as existsSync4, readFileSync as readFileSync3, rmSync, writeFileSync as writeFileSync2 } from "fs";
+import { basename, dirname as dirname2, join as join6 } from "path";
+
+// src/hooks/auto-update-checker/checker.ts
+var import_comment_json2 = __toESM(require_src2(), 1);
+import { existsSync as existsSync3, readFileSync as readFileSync2, statSync, writeFileSync } from "fs";
+import { homedir as homedir4 } from "os";
+import { dirname, isAbsolute, join as join5, resolve } from "path";
+import { fileURLToPath } from "url";
+
+// src/hooks/auto-update-checker/constants.ts
+import { homedir as homedir3, platform } from "os";
+import { join as join4 } from "path";
+var PACKAGE_NAME = "@cortexkit/aft-opencode";
+var NPM_REGISTRY_URL = "https://registry.npmjs.org";
+var NPM_FETCH_TIMEOUT = 1e4;
+function getOpenCodeCacheRoot() {
+  if (platform() === "win32") {
+    return join4(process.env.LOCALAPPDATA ?? homedir3(), "opencode");
+  }
+  return join4(homedir3(), ".cache", "opencode");
+}
+function getOpenCodeConfigRoot() {
+  if (platform() === "win32") {
+    return join4(process.env.APPDATA ?? join4(homedir3(), "AppData", "Roaming"), "opencode");
+  }
+  return join4(process.env.XDG_CONFIG_HOME ?? join4(homedir3(), ".config"), "opencode");
+}
+var CACHE_DIR = join4(getOpenCodeCacheRoot(), "packages");
+var USER_OPENCODE_CONFIG = join4(getOpenCodeConfigRoot(), "opencode.json");
+var USER_OPENCODE_CONFIG_JSONC = join4(getOpenCodeConfigRoot(), "opencode.jsonc");
+
+// src/hooks/auto-update-checker/types.ts
+var NpmPackageEnvelopeSchema = exports_external.object({
+  "dist-tags": exports_external.record(exports_external.string(), exports_external.string()).optional().default({})
+});
+var OpencodePluginTupleSchema = exports_external.tuple([exports_external.string(), exports_external.record(exports_external.string(), exports_external.unknown())]);
+var OpencodeConfigSchema = exports_external.object({
+  plugin: exports_external.array(exports_external.union([exports_external.string(), OpencodePluginTupleSchema])).optional()
+});
+var PackageJsonSchema = exports_external.object({
+  name: exports_external.string().optional(),
+  version: exports_external.string().optional(),
+  dependencies: exports_external.record(exports_external.string(), exports_external.string()).optional()
+}).passthrough();
+
+// src/hooks/auto-update-checker/checker.ts
+function isString(value) {
+  return typeof value === "string";
+}
+function pluginSpecifier(entry) {
+  return typeof entry === "string" ? entry : entry[0];
+}
+function getPluginEntries(config2) {
+  const parsed = OpencodeConfigSchema.safeParse(config2);
+  if (!parsed.success)
+    return [];
+  return (parsed.data.plugin ?? []).map(pluginSpecifier).filter(isString);
+}
+function parseJsonConfig(content) {
+  try {
+    return import_comment_json2.parse(content);
+  } catch (err) {
+    warn(`[auto-update-checker] Failed to parse OpenCode config: ${String(err)}`);
+    return null;
+  }
+}
+function isPrereleaseVersion(version2) {
+  return version2.includes("-");
+}
+function isDistTag(version2) {
+  return !/^\d/.test(version2);
+}
+function extractChannel(version2) {
+  if (!version2)
+    return "latest";
+  if (isDistTag(version2))
+    return version2;
+  if (isPrereleaseVersion(version2)) {
+    const prereleasePart = version2.split("-")[1];
+    const channelMatch = prereleasePart?.match(/^(alpha|beta|rc|canary|next)/);
+    if (channelMatch?.[1])
+      return channelMatch[1];
+  }
+  return "latest";
+}
+function getConfigPaths(directory) {
+  return [
+    join5(directory, ".opencode", "opencode.json"),
+    join5(directory, ".opencode", "opencode.jsonc"),
+    USER_OPENCODE_CONFIG,
+    USER_OPENCODE_CONFIG_JSONC
+  ];
+}
+function resolvePathPluginSpec(spec, configPath) {
+  if (spec.startsWith("file://")) {
+    try {
+      return fileURLToPath(spec);
+    } catch {
+      return spec.replace(/^file:\/\//, "");
+    }
+  }
+  if (isAbsolute(spec) || /^[A-Za-z]:[\\/]/.test(spec))
+    return spec;
+  return resolve(dirname(configPath), spec);
+}
+function getLocalDevPath(directory) {
+  for (const configPath of getConfigPaths(directory)) {
+    try {
+      if (!existsSync3(configPath))
+        continue;
+      const rawConfig = parseJsonConfig(readFileSync2(configPath, "utf-8"));
+      const plugins = getPluginEntries(rawConfig);
+      for (const entry of plugins) {
+        if (entry === PACKAGE_NAME || entry.startsWith(`${PACKAGE_NAME}@`))
+          continue;
+        if (entry.startsWith("file://") || entry.startsWith(".") || isAbsolute(entry)) {
+          const localPath = resolvePathPluginSpec(entry, configPath);
+          const pkgPath = findPackageJsonUp(localPath);
+          if (!pkgPath)
+            continue;
+          const pkg = PackageJsonSchema.safeParse(JSON.parse(readFileSync2(pkgPath, "utf-8")));
+          if (pkg.success && pkg.data.name === PACKAGE_NAME)
+            return localPath;
+        }
+      }
+    } catch {}
+  }
+  return null;
+}
+function findPackageJsonUp(startPath) {
+  try {
+    const stat = statSync(startPath);
+    let dir = stat.isDirectory() ? startPath : dirname(startPath);
+    for (let i = 0;i < 10; i++) {
+      const pkgPath = join5(dir, "package.json");
+      if (existsSync3(pkgPath)) {
+        try {
+          const pkg = PackageJsonSchema.safeParse(JSON.parse(readFileSync2(pkgPath, "utf-8")));
+          if (pkg.success && pkg.data.name === PACKAGE_NAME)
+            return pkgPath;
+        } catch {}
+      }
+      const parent = dirname(dir);
+      if (parent === dir)
+        break;
+      dir = parent;
+    }
+  } catch {}
+  return null;
+}
+function getLocalDevVersion(directory) {
+  const localPath = getLocalDevPath(directory);
+  if (!localPath)
+    return null;
+  try {
+    const pkgPath = findPackageJsonUp(localPath);
+    if (!pkgPath)
+      return null;
+    const pkg = PackageJsonSchema.safeParse(JSON.parse(readFileSync2(pkgPath, "utf-8")));
+    return pkg.success ? pkg.data.version ?? null : null;
+  } catch {
+    return null;
+  }
+}
+function getCurrentRuntimePackageJsonPath(currentModuleUrl = import.meta.url) {
+  try {
+    return findPackageJsonUp(dirname(fileURLToPath(currentModuleUrl)));
+  } catch (err) {
+    warn(`[auto-update-checker] Failed to resolve runtime package path: ${String(err)}`);
+    return null;
+  }
+}
+function findPluginEntry(directory) {
+  for (const configPath of getConfigPaths(directory)) {
+    try {
+      if (!existsSync3(configPath))
+        continue;
+      const rawConfig = parseJsonConfig(readFileSync2(configPath, "utf-8"));
+      const plugins = getPluginEntries(rawConfig);
+      for (const entry of plugins) {
+        if (entry === PACKAGE_NAME) {
+          return { entry, isPinned: false, pinnedVersion: null, configPath };
+        }
+        if (entry.startsWith(`${PACKAGE_NAME}@`)) {
+          const pinnedVersion = entry.slice(PACKAGE_NAME.length + 1);
+          const isPinned = pinnedVersion !== "latest";
+          return { entry, isPinned, pinnedVersion: isPinned ? pinnedVersion : null, configPath };
+        }
+      }
+    } catch {}
+  }
+  return null;
+}
+var cachedPackageVersion = null;
+function getSpecCachePackageJsonPath(spec) {
+  return join5(CACHE_DIR, spec, "node_modules", PACKAGE_NAME, "package.json");
+}
+function getCachedVersion(spec) {
+  if (!spec && cachedPackageVersion)
+    return cachedPackageVersion;
+  const candidates = [
+    getCurrentRuntimePackageJsonPath(),
+    spec ? getSpecCachePackageJsonPath(spec) : null,
+    getSpecCachePackageJsonPath(`${PACKAGE_NAME}@latest`),
+    join5(homedir4(), ".cache", "opencode", "node_modules", PACKAGE_NAME, "package.json")
+  ].filter(isString);
+  for (const packageJsonPath of candidates) {
+    try {
+      if (!existsSync3(packageJsonPath))
+        continue;
+      const pkg = PackageJsonSchema.safeParse(JSON.parse(readFileSync2(packageJsonPath, "utf-8")));
+      if (pkg.success && pkg.data.version) {
+        if (!spec)
+          cachedPackageVersion = pkg.data.version;
+        return pkg.data.version;
+      }
+    } catch {}
+  }
+  return null;
+}
+function buildRegistryUrl(registryUrl) {
+  return `${registryUrl.replace(/\/+$/, "")}/${encodeURIComponent(PACKAGE_NAME).replace("%2F", "/")}`;
+}
+async function getLatestVersion(channel = "latest", options = {}) {
+  const controller = new AbortController;
+  const timeoutId = setTimeout(() => controller.abort(), options.timeoutMs ?? NPM_FETCH_TIMEOUT);
+  const abortHandler = () => controller.abort();
+  options.signal?.addEventListener("abort", abortHandler, { once: true });
+  try {
+    if (options.signal?.aborted)
+      return null;
+    const response = await fetch(buildRegistryUrl(options.registryUrl ?? NPM_REGISTRY_URL), {
+      signal: controller.signal,
+      headers: { Accept: "application/json" }
+    });
+    if (!response.ok)
+      return null;
+    const data = NpmPackageEnvelopeSchema.safeParse(await response.json());
+    if (!data.success)
+      return null;
+    return data.data["dist-tags"][channel] ?? data.data["dist-tags"].latest ?? null;
+  } catch {
+    return null;
+  } finally {
+    options.signal?.removeEventListener("abort", abortHandler);
+    clearTimeout(timeoutId);
+  }
+}
+
+// src/hooks/auto-update-checker/cache.ts
+function stripPackageNameFromPath(pathValue, packageName) {
+  let current = pathValue;
+  for (const segment of [...packageName.split("/")].reverse()) {
+    if (basename(current) !== segment)
+      return null;
+    current = dirname2(current);
+  }
+  return current;
+}
+function removeFromBunLock(installDir, packageName) {
+  const lockPath = join6(installDir, "bun.lock");
+  if (!existsSync4(lockPath))
+    return false;
+  try {
+    const lock = import_comment_json3.parse(readFileSync3(lockPath, "utf-8"));
+    let modified = false;
+    if (lock.workspaces?.[""]?.dependencies?.[packageName]) {
+      delete lock.workspaces[""].dependencies[packageName];
+      modified = true;
+    }
+    if (lock.packages?.[packageName]) {
+      delete lock.packages[packageName];
+      modified = true;
+    }
+    if (modified) {
+      writeFileSync2(lockPath, JSON.stringify(lock, null, 2));
+      log(`[auto-update-checker] Removed from bun.lock: ${packageName}`);
+    }
+    return modified;
+  } catch {
+    return false;
+  }
+}
+function ensureDependencyVersion(packageJsonPath, packageName, version2) {
+  if (!existsSync4(packageJsonPath))
+    return false;
+  try {
+    const raw = import_comment_json3.parse(readFileSync3(packageJsonPath, "utf-8"));
+    const pkgJson = PackageJsonSchema.safeParse(raw);
+    if (!pkgJson.success)
+      return false;
+    const nextPackageJson = { ...pkgJson.data };
+    const dependencies = { ...nextPackageJson.dependencies ?? {} };
+    if (dependencies[packageName] === version2)
+      return true;
+    dependencies[packageName] = version2;
+    nextPackageJson.dependencies = dependencies;
+    writeFileSync2(packageJsonPath, JSON.stringify(nextPackageJson, null, 2));
+    log(`[auto-update-checker] Updated dependency in package.json: ${packageName} \u2192 ${version2}`);
+    return true;
+  } catch (err) {
+    warn(`[auto-update-checker] Failed to update package.json dependency: ${String(err)}`);
+    return false;
+  }
+}
+function removeInstalledPackage(installDir, packageName) {
+  const packageDir = join6(installDir, "node_modules", packageName);
+  if (!existsSync4(packageDir))
+    return false;
+  rmSync(packageDir, { recursive: true, force: true });
+  log(`[auto-update-checker] Package removed: ${packageDir}`);
+  return true;
+}
+function resolveInstallContext(runtimePackageJsonPath = getCurrentRuntimePackageJsonPath()) {
+  if (runtimePackageJsonPath) {
+    const packageDir = dirname2(runtimePackageJsonPath);
+    const nodeModulesDir = stripPackageNameFromPath(packageDir, PACKAGE_NAME);
+    if (nodeModulesDir && basename(nodeModulesDir) === "node_modules") {
+      const installDir = dirname2(nodeModulesDir);
+      const packageJsonPath = join6(installDir, "package.json");
+      if (existsSync4(packageJsonPath))
+        return { installDir, packageJsonPath };
+    }
+    return null;
+  }
+  const legacyPackageJsonPath = join6(dirname2(CACHE_DIR), "package.json");
+  if (existsSync4(legacyPackageJsonPath)) {
+    return { installDir: dirname2(CACHE_DIR), packageJsonPath: legacyPackageJsonPath };
+  }
+  return null;
+}
+function preparePackageUpdate(version2, packageName = PACKAGE_NAME, runtimePackageJsonPath = getCurrentRuntimePackageJsonPath()) {
+  try {
+    const installContext = resolveInstallContext(runtimePackageJsonPath);
+    if (!installContext) {
+      warn("[auto-update-checker] No install context found for auto-update");
+      return null;
+    }
+    if (!ensureDependencyVersion(installContext.packageJsonPath, packageName, version2))
+      return null;
+    const packageRemoved = removeInstalledPackage(installContext.installDir, packageName);
+    const lockRemoved = removeFromBunLock(installContext.installDir, packageName);
+    if (!packageRemoved && !lockRemoved) {
+      log(`[auto-update-checker] No cached package artifacts removed for ${packageName}; continuing with updated dependency spec`);
+    }
+    return installContext.installDir;
+  } catch (err) {
+    warn(`[auto-update-checker] Failed to prepare package update: ${String(err)}`);
+    return null;
+  }
+}
+async function runBunInstallSafe(installDir, options = {}) {
+  let timeout = null;
+  try {
+    if (options.signal?.aborted)
+      return false;
+    const proc = spawn("bun", ["install"], {
+      cwd: installDir,
+      stdio: "pipe"
+    });
+    const abortProcess = () => {
+      try {
+        proc.kill();
+      } catch {}
+    };
+    options.signal?.addEventListener("abort", abortProcess, { once: true });
+    const exitPromise = new Promise((resolveExit) => {
+      proc.on("error", () => resolveExit(false));
+      proc.on("exit", (code) => resolveExit(code === 0));
+    });
+    const timeoutPromise = new Promise((resolveTimeout) => {
+      timeout = setTimeout(() => resolveTimeout("timeout"), options.timeoutMs ?? 60000);
+    });
+    const result = await Promise.race([exitPromise, timeoutPromise]);
+    options.signal?.removeEventListener("abort", abortProcess);
+    if (result === "timeout" || options.signal?.aborted) {
+      abortProcess();
+      return false;
+    }
+    return result;
+  } catch (err) {
+    warn(`[auto-update-checker] bun install error: ${String(err)}`);
+    return false;
+  } finally {
+    if (timeout)
+      clearTimeout(timeout);
+  }
+}
+
+// src/hooks/auto-update-checker/index.ts
+function createAutoUpdateCheckerHook(ctx, options = {}) {
+  const {
+    enabled = true,
+    showStartupToast = true,
+    autoUpdate = true,
+    npmRegistryUrl = NPM_REGISTRY_URL,
+    fetchTimeoutMs = NPM_FETCH_TIMEOUT,
+    signal = new AbortController().signal
+  } = options;
+  let hasChecked = false;
+  return async ({ event }) => {
+    if (!enabled)
+      return;
+    if (event.type !== "session.created")
+      return;
+    if (hasChecked)
+      return;
+    if (getParentId(event.properties))
+      return;
+    hasChecked = true;
+    setTimeout(() => {
+      runStartupCheck(ctx, {
+        showStartupToast,
+        autoUpdate,
+        npmRegistryUrl,
+        fetchTimeoutMs,
+        signal
+      }).catch((err) => {
+        warn(`[auto-update-checker] Background update check failed: ${String(err)}`);
+      });
+    }, 0);
+  };
+}
+function getParentId(properties) {
+  if (!properties || typeof properties !== "object" || Array.isArray(properties))
+    return null;
+  const info = properties.info;
+  if (!info || typeof info !== "object" || Array.isArray(info))
+    return null;
+  const parentID = info.parentID;
+  return typeof parentID === "string" && parentID.length > 0 ? parentID : null;
+}
+async function runStartupCheck(ctx, options) {
+  if (options.signal.aborted)
+    return;
+  const cachedVersion = getCachedVersion();
+  const localDevVersion = getLocalDevVersion(ctx.directory);
+  const displayVersion = localDevVersion ?? cachedVersion;
+  if (localDevVersion) {
+    if (options.showStartupToast) {
+      showToast(ctx, `AFT ${displayVersion} (dev)`, "Running in local development mode.", "info");
+    }
+    log("[auto-update-checker] Local development mode");
+    return;
+  }
+  if (options.showStartupToast) {
+    showToast(ctx, `AFT ${displayVersion ?? "unknown"}`, "@cortexkit/aft-opencode is active.", "info");
+  }
+  await runBackgroundUpdateCheck(ctx, options);
+}
+async function runBackgroundUpdateCheck(ctx, options) {
+  if (options.signal.aborted)
+    return;
+  const pluginInfo = findPluginEntry(ctx.directory);
+  if (!pluginInfo) {
+    log("[auto-update-checker] Plugin not found in config");
+    return;
+  }
+  const cachedVersion = getCachedVersion(pluginInfo.entry);
+  const currentVersion = cachedVersion ?? pluginInfo.pinnedVersion;
+  if (!currentVersion) {
+    log("[auto-update-checker] No version found (cached or pinned)");
+    return;
+  }
+  const channel = extractChannel(pluginInfo.pinnedVersion ?? currentVersion);
+  const latestVersion = await getLatestVersion(channel, {
+    registryUrl: options.npmRegistryUrl,
+    timeoutMs: options.fetchTimeoutMs,
+    signal: options.signal
+  });
+  if (!latestVersion) {
+    warn(`[auto-update-checker] Failed to fetch latest version for channel: ${channel}`);
+    showToast(ctx, "AFT update check failed", "Could not check npm for @cortexkit/aft-opencode updates. Continuing with the cached version.", "warning", 8000);
+    return;
+  }
+  if (currentVersion === latestVersion) {
+    log(`[auto-update-checker] Already on latest version for channel: ${channel}`);
+    return;
+  }
+  log(`[auto-update-checker] Update available (${channel}): ${currentVersion} \u2192 ${latestVersion}`);
+  if (pluginInfo.isPinned) {
+    showToast(ctx, `AFT ${latestVersion}`, `v${latestVersion} available. Version is pinned; update your OpenCode plugin config to upgrade.`, "info", 8000);
+    log("[auto-update-checker] Version is pinned; skipping auto-update");
+    return;
+  }
+  if (!options.autoUpdate) {
+    showToast(ctx, `AFT ${latestVersion}`, `v${latestVersion} available. Auto-update is disabled.`, "info", 8000);
+    log("[auto-update-checker] Auto-update disabled, notification only");
+    return;
+  }
+  const installDir = preparePackageUpdate(latestVersion, PACKAGE_NAME);
+  if (!installDir) {
+    showToast(ctx, `AFT ${latestVersion}`, `v${latestVersion} available. Auto-update could not prepare the active install.`, "warning", 8000);
+    warn("[auto-update-checker] Failed to prepare install root for auto-update");
+    return;
+  }
+  const installSuccess = await runBunInstallSafe(installDir, { signal: options.signal });
+  if (installSuccess) {
+    showToast(ctx, "AFT Updated!", `v${currentVersion} \u2192 v${latestVersion}
+Restart OpenCode to apply.`, "success", 8000);
+    log(`[auto-update-checker] Update installed: ${currentVersion} \u2192 ${latestVersion}`);
+    return;
+  }
+  showToast(ctx, `AFT ${latestVersion}`, `v${latestVersion} available, but auto-update failed to install it. Check logs or retry manually.`, "error", 8000);
+  warn("[auto-update-checker] bun install failed; update not installed");
+}
+function showToast(ctx, title, message, variant = "info", duration3 = 3000) {
+  ctx.client.tui.showToast({ body: { title, message, variant, duration: duration3 } }).catch(() => {});
+}
+
+// src/lsp-auto-install.ts
+import { spawn as spawn2 } from "child_process";
 import { createHash } from "crypto";
-import { createReadStream, statSync as statSync2 } from "fs";
+import { createReadStream, statSync as statSync3 } from "fs";
 
 // src/lsp-cache.ts
 import {
   closeSync,
-  existsSync as existsSync3,
   mkdirSync as mkdirSync2,
   openSync,
-  readFileSync as readFileSync2,
-  statSync,
+  readFileSync as readFileSync4,
+  statSync as statSync2,
   unlinkSync as unlinkSync2,
-  writeFileSync
+  writeFileSync as writeFileSync3
 } from "fs";
-import { homedir as homedir3 } from "os";
-import { join as join4 } from "path";
+import { homedir as homedir5 } from "os";
+import { join as join7 } from "path";
 function aftCacheBase() {
   const override = process.env.AFT_CACHE_DIR;
   if (override && override.length > 0)
     return override;
   if (process.platform === "win32") {
     const localAppData = process.env.LOCALAPPDATA || process.env.APPDATA;
-    const base2 = localAppData || join4(homedir3(), "AppData", "Local");
-    return join4(base2, "aft");
+    const base2 = localAppData || join7(homedir5(), "AppData", "Local");
+    return join7(base2, "aft");
   }
-  const base = process.env.XDG_CACHE_HOME || join4(homedir3(), ".cache");
-  return join4(base, "aft");
+  const base = process.env.XDG_CACHE_HOME || join7(homedir5(), ".cache");
+  return join7(base, "aft");
 }
 function lspCacheRoot() {
-  return join4(aftCacheBase(), "lsp-packages");
+  return join7(aftCacheBase(), "lsp-packages");
 }
 function lspPackageDir(npmPackage) {
-  return join4(lspCacheRoot(), encodeURIComponent(npmPackage));
+  return join7(lspCacheRoot(), encodeURIComponent(npmPackage));
 }
 function lspBinaryPath(npmPackage, binary) {
-  return join4(lspPackageDir(npmPackage), "node_modules", ".bin", binary);
+  return join7(lspPackageDir(npmPackage), "node_modules", ".bin", binary);
 }
 function lspBinDir(npmPackage) {
-  return join4(lspPackageDir(npmPackage), "node_modules", ".bin");
+  return join7(lspPackageDir(npmPackage), "node_modules", ".bin");
 }
 function isInstalled(npmPackage, binary) {
   for (const candidate of lspBinaryCandidates(binary)) {
     try {
-      if (statSync(join4(lspBinDir(npmPackage), candidate)).isFile())
+      if (statSync2(join7(lspBinDir(npmPackage), candidate)).isFile())
         return true;
     } catch {}
   }
@@ -21934,17 +22450,17 @@ function writeInstalledMetaIn(installDir, version2, sha256) {
       installedAt: new Date().toISOString(),
       ...sha256 ? { sha256 } : {}
     };
-    writeFileSync(join4(installDir, INSTALLED_META_FILE), JSON.stringify(meta3), "utf8");
+    writeFileSync3(join7(installDir, INSTALLED_META_FILE), JSON.stringify(meta3), "utf8");
   } catch (err) {
     log(`[lsp-cache] failed to write installed-meta in ${installDir}: ${err}`);
   }
 }
 function readInstalledMetaIn(installDir) {
-  const path2 = join4(installDir, INSTALLED_META_FILE);
+  const path2 = join7(installDir, INSTALLED_META_FILE);
   try {
-    if (!statSync(path2).isFile())
+    if (!statSync2(path2).isFile())
       return null;
-    const raw = readFileSync2(path2, "utf8");
+    const raw = readFileSync4(path2, "utf8");
     const parsed = JSON.parse(raw);
     if (typeof parsed.version !== "string" || parsed.version.length === 0)
       return null;
@@ -21964,7 +22480,7 @@ function readInstalledMeta(packageKey) {
   return readInstalledMetaIn(lspPackageDir(packageKey));
 }
 function lockPath(npmPackage) {
-  return join4(lspPackageDir(npmPackage), ".aft-installing");
+  return join7(lspPackageDir(npmPackage), ".aft-installing");
 }
 var STALE_LOCK_MS = 30 * 60 * 1000;
 function acquireInstallLock(lockKey) {
@@ -21974,7 +22490,7 @@ function acquireInstallLock(lockKey) {
     try {
       const fd = openSync(lock, "wx");
       try {
-        writeFileSync(fd, `${process.pid}
+        writeFileSync3(fd, `${process.pid}
 ${new Date().toISOString()}
 `);
       } finally {
@@ -21994,12 +22510,12 @@ ${new Date().toISOString()}
   let owningPid = null;
   let lockMtimeMs = 0;
   try {
-    const raw = readFileSync2(lock, "utf8");
+    const raw = readFileSync4(lock, "utf8");
     const firstLine = raw.split(/\r?\n/, 1)[0]?.trim() ?? "";
     const parsed = Number.parseInt(firstLine, 10);
     if (Number.isFinite(parsed) && parsed > 0)
       owningPid = parsed;
-    lockMtimeMs = statSync(lock).mtimeMs;
+    lockMtimeMs = statSync2(lock).mtimeMs;
   } catch {
     return tryClaim();
   }
@@ -22030,11 +22546,34 @@ function isProcessAlive(pid) {
 function releaseInstallLock(lockKey) {
   const lock = lockPath(lockKey);
   try {
-    if (existsSync3(lock)) {
+    let owningPid = null;
+    try {
+      const raw = readFileSync4(lock, "utf8");
+      const firstLine = raw.split(/\r?\n/, 1)[0]?.trim() ?? "";
+      const parsed = Number.parseInt(firstLine, 10);
+      if (Number.isFinite(parsed) && parsed > 0)
+        owningPid = parsed;
+    } catch (readErr) {
+      const code = readErr.code;
+      if (code === "ENOENT")
+        return;
+      warn(`[lsp] could not read install lock for ${lockKey} during release: ${readErr}`);
+      return;
+    }
+    if (owningPid !== process.pid) {
+      log(`[lsp] not releasing install lock for ${lockKey}: owned by pid ${owningPid ?? "unknown"} (we are ${process.pid})`);
+      return;
+    }
+    try {
       unlinkSync2(lock);
+    } catch (unlinkErr) {
+      const code = unlinkErr.code;
+      if (code !== "ENOENT") {
+        warn(`[lsp] failed to release install lock for ${lockKey}: ${unlinkErr}`);
+      }
     }
   } catch (err) {
-    warn(`[lsp] failed to release install lock for ${lockKey}: ${err}`);
+    warn(`[lsp] unexpected error releasing install lock for ${lockKey}: ${err}`);
   }
 }
 async function withInstallLock(lockKey, task) {
@@ -22048,9 +22587,9 @@ async function withInstallLock(lockKey, task) {
 }
 var VERSION_CHECK_FILE = ".aft-version-check";
 function readVersionCheck(npmPackage) {
-  const file2 = join4(lspPackageDir(npmPackage), VERSION_CHECK_FILE);
+  const file2 = join7(lspPackageDir(npmPackage), VERSION_CHECK_FILE);
   try {
-    const raw = readFileSync2(file2, "utf8");
+    const raw = readFileSync4(file2, "utf8");
     const parsed = JSON.parse(raw);
     if (typeof parsed.last_checked === "string") {
       return {
@@ -22065,12 +22604,12 @@ function readVersionCheck(npmPackage) {
 }
 function writeVersionCheck(npmPackage, latest) {
   mkdirSync2(lspPackageDir(npmPackage), { recursive: true });
-  const file2 = join4(lspPackageDir(npmPackage), VERSION_CHECK_FILE);
+  const file2 = join7(lspPackageDir(npmPackage), VERSION_CHECK_FILE);
   const record2 = {
     last_checked: new Date().toISOString(),
     latest_eligible: latest
   };
-  writeFileSync(file2, JSON.stringify(record2, null, 2));
+  writeFileSync3(file2, JSON.stringify(record2, null, 2));
 }
 function shouldRecheckVersion(record2, weeklyCheckIntervalMs = 7 * 24 * 60 * 60 * 1000) {
   if (!record2)
@@ -22136,6 +22675,9 @@ function assertSafeVersion(version2) {
     throw new Error(`unsafe version/tag string ${JSON.stringify(version2)}: must match ${SAFE_VERSION_RE.source}`);
   }
 }
+function isSafeVersion(version2) {
+  return typeof version2 === "string" && version2.length > 0 && SAFE_VERSION_RE.test(version2);
+}
 function stripTagV(tag) {
   assertSafeVersion(tag);
   return tag.startsWith("v") ? tag.slice(1) : tag;
@@ -22210,8 +22752,8 @@ var NPM_LSP_TABLE = [
 ];
 
 // src/lsp-project-relevance.ts
-import { existsSync as existsSync4, readdirSync } from "fs";
-import { join as join5 } from "path";
+import { existsSync as existsSync5, readdirSync } from "fs";
+import { join as join8 } from "path";
 var MAX_WALK_DIRS = 200;
 var MAX_WALK_DEPTH = 4;
 var NOISE_DIRS = new Set([
@@ -22228,7 +22770,7 @@ function hasRootMarker(projectRoot, rootMarkers) {
   if (!rootMarkers)
     return false;
   for (const marker of rootMarkers) {
-    if (existsSync4(join5(projectRoot, marker)))
+    if (existsSync5(join8(projectRoot, marker)))
       return true;
   }
   return false;
@@ -22254,7 +22796,7 @@ function relevantExtensionsInProject(projectRoot, extToServer) {
     for (const entry of entries) {
       if (entry.isDirectory()) {
         if (current.depth < MAX_WALK_DEPTH && !NOISE_DIRS.has(entry.name.toLowerCase())) {
-          queue.push({ dir: join5(current.dir, entry.name), depth: current.depth + 1 });
+          queue.push({ dir: join8(current.dir, entry.name), depth: current.depth + 1 });
         }
         continue;
       }
@@ -22362,13 +22904,14 @@ async function resolveTargetVersion(spec, config2, fetchImpl = fetch) {
   }
   const cached2 = readVersionCheck(spec.npm);
   const weeklyMs = config2.graceDays * 24 * 60 * 60 * 1000;
-  if (!shouldRecheckVersion(cached2, weeklyMs) && cached2?.latest_eligible) {
+  const cachedSafe = isSafeVersion(cached2?.latest_eligible ?? null);
+  if (cached2 && !shouldRecheckVersion(cached2, weeklyMs) && cachedSafe) {
     return { version: cached2.latest_eligible, pinned: false, probe: null };
   }
   const probe = await probeRegistry(spec.npm, config2.graceDays, fetchImpl);
   if (!probe) {
     return {
-      version: cached2?.latest_eligible ?? null,
+      version: cachedSafe ? cached2?.latest_eligible ?? null : null,
       pinned: false,
       probe: null
     };
@@ -22377,15 +22920,15 @@ async function resolveTargetVersion(spec, config2, fetchImpl = fetch) {
   return { version: probe.version, pinned: false, probe };
 }
 function runInstall(spec, version2, cwd, signal) {
-  return new Promise((resolve) => {
+  return new Promise((resolve2) => {
     const target = `${spec.npm}@${version2}`;
     log(`[lsp] installing ${target} to ${cwd}`);
     if (signal?.aborted) {
       warn(`[lsp] install ${target} aborted before spawn`);
-      resolve(false);
+      resolve2(false);
       return;
     }
-    const child = spawn("bun", ["add", target, "--cwd", cwd, "--ignore-scripts", "--silent"], {
+    const child = spawn2("bun", ["add", target, "--cwd", cwd, "--ignore-scripts", "--silent"], {
       stdio: ["ignore", "pipe", "pipe"]
     });
     child.unref();
@@ -22402,7 +22945,7 @@ function runInstall(spec, version2, cwd, signal) {
         return;
       settled = true;
       cleanup();
-      resolve(ok);
+      resolve2(ok);
     };
     const onAbort = () => {
       warn(`[lsp] install ${target} aborted during shutdown`);
@@ -22503,7 +23046,7 @@ function cachedPackageDir(npmPackage) {
   return lspBinDir(npmPackage).replace(/[\\/]node_modules[\\/]\.bin[\\/]?$/, "");
 }
 function hashInstalledBinary(spec) {
-  return new Promise((resolve, reject) => {
+  return new Promise((resolve2, reject) => {
     const candidates = process.platform === "win32" ? [
       lspBinaryPath(spec.npm, spec.binary),
       lspBinaryPath(spec.npm, `${spec.binary}.cmd`),
@@ -22513,7 +23056,7 @@ function hashInstalledBinary(spec) {
     let pathToHash = null;
     for (const p of candidates) {
       try {
-        if (statSync2(p).isFile()) {
+        if (statSync3(p).isFile()) {
           pathToHash = p;
           break;
         }
@@ -22527,7 +23070,7 @@ function hashInstalledBinary(spec) {
     const stream = createReadStream(pathToHash);
     stream.on("error", reject);
     stream.on("data", (chunk) => hash2.update(chunk));
-    stream.on("end", () => resolve(hash2.digest("hex")));
+    stream.on("end", () => resolve2(hash2.digest("hex")));
   });
 }
 function runAutoInstall(projectRoot, config2, fetchImpl = fetch) {
@@ -22589,85 +23132,85 @@ import {
   copyFileSync,
   createReadStream as createReadStream2,
   createWriteStream,
-  existsSync as existsSync5,
+  existsSync as existsSync6,
   lstatSync,
   mkdirSync as mkdirSync3,
   readdirSync as readdirSync2,
   readlinkSync,
   realpathSync,
   renameSync,
-  rmSync,
-  statSync as statSync3,
+  rmSync as rmSync2,
+  statSync as statSync4,
   unlinkSync as unlinkSync3
 } from "fs";
-import { dirname, join as join6, relative, resolve } from "path";
+import { dirname as dirname3, join as join9, relative, resolve as resolve2 } from "path";
 import { Readable } from "stream";
 import { pipeline } from "stream/promises";
 
 // src/lsp-github-table.ts
-function exe(platform, name) {
-  return platform === "win32" ? `${name}.exe` : name;
+function exe(platform2, name) {
+  return platform2 === "win32" ? `${name}.exe` : name;
 }
 var CLANGD = {
   id: "clangd",
   githubRepo: "clangd/clangd",
   binary: "clangd",
-  resolveAsset: (platform, _arch, version2) => {
-    const platformName = platform === "darwin" ? "mac" : platform === "linux" ? "linux" : "windows";
+  resolveAsset: (platform2, _arch, version2) => {
+    const platformName = platform2 === "darwin" ? "mac" : platform2 === "linux" ? "linux" : "windows";
     return { name: `clangd-${platformName}-${version2}.zip`, archive: "zip" };
   },
-  binaryPathInArchive: (platform, _arch, version2) => `clangd_${version2}/bin/${exe(platform, "clangd")}`
+  binaryPathInArchive: (platform2, _arch, version2) => `clangd_${version2}/bin/${exe(platform2, "clangd")}`
 };
 var LUA_LS = {
   id: "lua-ls",
   githubRepo: "LuaLS/lua-language-server",
   binary: "lua-language-server",
-  resolveAsset: (platform, arch, version2) => {
-    const ext = platform === "win32" ? "zip" : "tar.gz";
-    const platformName = platform === "darwin" ? "darwin" : platform === "linux" ? "linux" : "win32";
+  resolveAsset: (platform2, arch, version2) => {
+    const ext = platform2 === "win32" ? "zip" : "tar.gz";
+    const platformName = platform2 === "darwin" ? "darwin" : platform2 === "linux" ? "linux" : "win32";
     const archName = arch === "arm64" ? "arm64" : "x64";
     return {
       name: `lua-language-server-${version2}-${platformName}-${archName}.${ext}`,
       archive: ext
     };
   },
-  binaryPathInArchive: (platform, _arch, _version) => `bin/${exe(platform, "lua-language-server")}`
+  binaryPathInArchive: (platform2, _arch, _version) => `bin/${exe(platform2, "lua-language-server")}`
 };
 var ZLS = {
   id: "zls",
   githubRepo: "zigtools/zls",
   binary: "zls",
-  resolveAsset: (platform, arch, _version) => {
-    const ext = platform === "win32" ? "zip" : "tar.xz";
+  resolveAsset: (platform2, arch, _version) => {
+    const ext = platform2 === "win32" ? "zip" : "tar.xz";
     const archName = arch === "arm64" ? "aarch64" : "x86_64";
-    const platformName = platform === "darwin" ? "macos" : platform === "linux" ? "linux" : "windows";
+    const platformName = platform2 === "darwin" ? "macos" : platform2 === "linux" ? "linux" : "windows";
     return { name: `zls-${archName}-${platformName}.${ext}`, archive: ext };
   },
-  binaryPathInArchive: (platform, _arch, _version) => exe(platform, "zls")
+  binaryPathInArchive: (platform2, _arch, _version) => exe(platform2, "zls")
 };
 var TINYMIST = {
   id: "tinymist",
   githubRepo: "Myriad-Dreamin/tinymist",
   binary: "tinymist",
-  resolveAsset: (platform, arch, _version) => {
+  resolveAsset: (platform2, arch, _version) => {
     const archName = arch === "arm64" ? "aarch64" : "x86_64";
-    const triple = platform === "darwin" ? "apple-darwin" : platform === "linux" ? "unknown-linux-gnu" : "pc-windows-msvc";
-    const ext = platform === "win32" ? "zip" : "tar.gz";
+    const triple = platform2 === "darwin" ? "apple-darwin" : platform2 === "linux" ? "unknown-linux-gnu" : "pc-windows-msvc";
+    const ext = platform2 === "win32" ? "zip" : "tar.gz";
     return { name: `tinymist-${archName}-${triple}.${ext}`, archive: ext };
   },
-  binaryPathInArchive: (platform, _arch, _version) => exe(platform, "tinymist")
+  binaryPathInArchive: (platform2, _arch, _version) => exe(platform2, "tinymist")
 };
 var TEXLAB = {
   id: "texlab",
   githubRepo: "latex-lsp/texlab",
   binary: "texlab",
-  resolveAsset: (platform, arch, _version) => {
+  resolveAsset: (platform2, arch, _version) => {
     const archName = arch === "arm64" ? "aarch64" : "x86_64";
-    const platformName = platform === "darwin" ? "macos" : platform === "linux" ? "linux" : "windows";
-    const ext = platform === "win32" ? "zip" : "tar.gz";
+    const platformName = platform2 === "darwin" ? "macos" : platform2 === "linux" ? "linux" : "windows";
+    const ext = platform2 === "win32" ? "zip" : "tar.gz";
     return { name: `texlab-${archName}-${platformName}.${ext}`, archive: ext };
   },
-  binaryPathInArchive: (platform, _arch, _version) => exe(platform, "texlab")
+  binaryPathInArchive: (platform2, _arch, _version) => exe(platform2, "texlab")
 };
 var GITHUB_LSP_TABLE = [
   CLANGD,
@@ -22677,57 +23220,57 @@ var GITHUB_LSP_TABLE = [
   TEXLAB
 ];
 function detectHostPlatform() {
-  const platform = process.platform;
-  if (platform !== "darwin" && platform !== "linux" && platform !== "win32")
+  const platform2 = process.platform;
+  if (platform2 !== "darwin" && platform2 !== "linux" && platform2 !== "win32")
     return null;
   const arch = process.arch;
   if (arch === "x64")
-    return { platform, arch: "x64" };
+    return { platform: platform2, arch: "x64" };
   if (arch === "arm64")
-    return { platform, arch: "arm64" };
+    return { platform: platform2, arch: "arm64" };
   return null;
 }
 
 // src/lsp-github-install.ts
 function ghCacheRoot() {
-  return join6(aftCacheBase(), "lsp-binaries");
+  return join9(aftCacheBase(), "lsp-binaries");
 }
 function ghPackageDir(spec) {
-  return join6(ghCacheRoot(), spec.id);
+  return join9(ghCacheRoot(), spec.id);
 }
 function ghBinDir(spec) {
-  return join6(ghPackageDir(spec), "bin");
+  return join9(ghPackageDir(spec), "bin");
 }
 function ghExtractDir(spec) {
-  return join6(ghPackageDir(spec), "extracted");
+  return join9(ghPackageDir(spec), "extracted");
 }
-function ghBinaryPath(spec, platform) {
-  const ext = platform === "win32" ? ".exe" : "";
-  return join6(ghBinDir(spec), `${spec.binary}${ext}`);
+function ghBinaryPath(spec, platform2) {
+  const ext = platform2 === "win32" ? ".exe" : "";
+  return join9(ghBinDir(spec), `${spec.binary}${ext}`);
 }
-function isGithubInstalled(spec, platform) {
-  for (const candidate of ghBinaryCandidates(spec, platform)) {
+function isGithubInstalled(spec, platform2) {
+  for (const candidate of ghBinaryCandidates(spec, platform2)) {
     try {
-      if (statSync3(join6(ghBinDir(spec), candidate)).isFile())
+      if (statSync4(join9(ghBinDir(spec), candidate)).isFile())
         return true;
     } catch {}
   }
   return false;
 }
-function ghBinaryCandidates(spec, platform) {
-  if (platform !== "win32")
+function ghBinaryCandidates(spec, platform2) {
+  if (platform2 !== "win32")
     return [spec.binary];
   return [spec.binary, `${spec.binary}.cmd`, `${spec.binary}.exe`, `${spec.binary}.bat`];
 }
 var MAX_DOWNLOAD_BYTES = 256 * 1024 * 1024;
 var MAX_EXTRACT_BYTES = 1024 * 1024 * 1024;
 function sha256OfFile(path2) {
-  return new Promise((resolve2, reject) => {
+  return new Promise((resolve3, reject) => {
     const hash2 = createHash2("sha256");
     const stream = createReadStream2(path2);
     stream.on("error", reject);
     stream.on("data", (chunk) => hash2.update(chunk));
-    stream.on("end", () => resolve2(hash2.digest("hex")));
+    stream.on("end", () => resolve3(hash2.digest("hex")));
   });
 }
 async function fetchReleaseByTag(githubRepo, tag, fetchImpl, signal) {
@@ -22814,8 +23357,10 @@ async function resolveTargetTag(spec, config2, fetchImpl, signal) {
   }
   const cached2 = readVersionCheck(spec.githubRepo);
   const weeklyMs = config2.graceDays * 24 * 60 * 60 * 1000;
-  if (!shouldRecheckVersion(cached2, weeklyMs) && cached2?.latest_eligible) {
-    const release = await fetchReleaseByTag(spec.githubRepo, cached2.latest_eligible, fetchImpl);
+  const cachedTag = cached2?.latest_eligible ?? null;
+  const cachedSafe = isSafeVersion(cachedTag);
+  if (cached2 && !shouldRecheckVersion(cached2, weeklyMs) && cachedSafe) {
+    const release = await fetchReleaseByTag(spec.githubRepo, cachedTag, fetchImpl);
     if (release) {
       return {
         tag: release.tag,
@@ -22852,7 +23397,31 @@ function controlledTimeoutSignal(timeoutMs, parent) {
     }
   };
 }
+var ALLOWED_DOWNLOAD_HOSTS = new Set([
+  "github.com",
+  "api.github.com",
+  "objects.githubusercontent.com",
+  "release-assets.githubusercontent.com",
+  "raw.githubusercontent.com",
+  "codeload.github.com"
+]);
+function assertAllowedDownloadUrl(rawUrl) {
+  let parsed;
+  try {
+    parsed = new URL(rawUrl);
+  } catch {
+    throw new Error(`download url is not a valid URL: ${rawUrl}`);
+  }
+  if (parsed.protocol !== "https:") {
+    throw new Error(`download url must be https (got ${parsed.protocol}): ${rawUrl}`);
+  }
+  if (!ALLOWED_DOWNLOAD_HOSTS.has(parsed.hostname.toLowerCase())) {
+    throw new Error(`download url host ${parsed.hostname} is not in the GitHub allowlist: ${rawUrl}`);
+  }
+  return parsed;
+}
 async function downloadFile(url2, destPath, fetchImpl, assetSize, signal) {
+  assertAllowedDownloadUrl(url2);
   if (assetSize !== undefined && assetSize > MAX_DOWNLOAD_BYTES) {
     throw new Error(`asset size ${assetSize} exceeds max ${MAX_DOWNLOAD_BYTES} (set lsp.versions to pin a smaller release if this is wrong)`);
   }
@@ -22870,7 +23439,7 @@ async function downloadFile(url2, destPath, fetchImpl, assetSize, signal) {
     if (Number.isFinite(advertised) && advertised > MAX_DOWNLOAD_BYTES) {
       throw new Error(`Content-Length ${advertised} exceeds max ${MAX_DOWNLOAD_BYTES}`);
     }
-    mkdirSync3(dirname(destPath), { recursive: true });
+    mkdirSync3(dirname3(destPath), { recursive: true });
     let bytesWritten = 0;
     const guard = new TransformStream({
       transform(chunk, controller) {
@@ -22905,7 +23474,7 @@ function validateExtraction(stagingRoot) {
       throw new Error(`failed to read staging dir ${dir}: ${err}`);
     }
     for (const entry of entries) {
-      const full = join6(dir, entry);
+      const full = join9(dir, entry);
       let lst;
       try {
         lst = lstatSync(full);
@@ -22926,7 +23495,7 @@ function validateExtraction(stagingRoot) {
         throw new Error(`failed to realpath ${full}: ${err}`);
       }
       const rel = relative(realStagingRoot, realFull);
-      if (rel.startsWith("..") || resolve(realStagingRoot, rel) !== realFull) {
+      if (rel.startsWith("..") || resolve2(realStagingRoot, rel) !== realFull) {
         throw new Error(`archive entry escapes staging root: ${full} \u2192 ${realFull} (zip-slip defense)`);
       }
       if (lst.isDirectory()) {
@@ -22947,19 +23516,19 @@ function extractArchiveSafely(archivePath, destDir, archiveType) {
   const suffix = randomBytes(8).toString("hex");
   const stagingDir = `${destDir}.staging-${suffix}`;
   try {
-    rmSync(stagingDir, { recursive: true, force: true });
+    rmSync2(stagingDir, { recursive: true, force: true });
   } catch {}
   mkdirSync3(stagingDir, { recursive: true });
   try {
     runPlatformExtractor(archivePath, stagingDir, archiveType);
     validateExtraction(stagingDir);
     try {
-      rmSync(destDir, { recursive: true, force: true });
+      rmSync2(destDir, { recursive: true, force: true });
     } catch {}
     renameSync(stagingDir, destDir);
   } catch (err) {
     try {
-      rmSync(stagingDir, { recursive: true, force: true });
+      rmSync2(stagingDir, { recursive: true, force: true });
     } catch {}
     throw err;
   }
@@ -22995,11 +23564,11 @@ function runPlatformExtractor(archivePath, destDir, archiveType) {
   }
   throw new Error(`unsupported archive type: ${archiveType}`);
 }
-async function downloadAndInstall(spec, tag, assets, platform, arch, fetchImpl, signal) {
+async function downloadAndInstall(spec, tag, assets, platform2, arch, fetchImpl, signal) {
   const version2 = stripTagV(tag);
-  const expected = spec.resolveAsset(platform, arch, version2);
+  const expected = spec.resolveAsset(platform2, arch, version2);
   if (!expected) {
-    warn(`[lsp] ${spec.id}: unsupported platform/arch combo ${platform}/${arch}`);
+    warn(`[lsp] ${spec.id}: unsupported platform/arch combo ${platform2}/${arch}`);
     return null;
   }
   const matchingAsset = assets.find((a) => a.name === expected.name);
@@ -23009,7 +23578,7 @@ async function downloadAndInstall(spec, tag, assets, platform, arch, fetchImpl,
   }
   const pkgDir = ghPackageDir(spec);
   const extractDir = ghExtractDir(spec);
-  const archivePath = join6(pkgDir, expected.name);
+  const archivePath = join9(pkgDir, expected.name);
   log(`[lsp] downloading ${spec.id} ${tag} \u2192 ${matchingAsset.url}`);
   try {
     await downloadFile(matchingAsset.url, archivePath, fetchImpl, matchingAsset.size, signal);
@@ -23048,16 +23617,16 @@ async function downloadAndInstall(spec, tag, assets, platform, arch, fetchImpl,
       unlinkSync3(archivePath);
     } catch {}
   }
-  const innerBinaryPath = join6(extractDir, spec.binaryPathInArchive(platform, arch, version2));
-  if (!existsSync5(innerBinaryPath)) {
+  const innerBinaryPath = join9(extractDir, spec.binaryPathInArchive(platform2, arch, version2));
+  if (!existsSync6(innerBinaryPath)) {
     error48(`[lsp] ${spec.id}: extracted binary not found at ${innerBinaryPath}`);
     return null;
   }
-  const targetBinary = ghBinaryPath(spec, platform);
-  mkdirSync3(dirname(targetBinary), { recursive: true });
+  const targetBinary = ghBinaryPath(spec, platform2);
+  mkdirSync3(dirname3(targetBinary), { recursive: true });
   try {
     copyFileSync(innerBinaryPath, targetBinary);
-    if (platform !== "win32") {
+    if (platform2 !== "win32") {
       const { chmodSync: chmodSync2 } = await import("fs");
       chmodSync2(targetBinary, 493);
     }
@@ -23068,11 +23637,11 @@ async function downloadAndInstall(spec, tag, assets, platform, arch, fetchImpl,
   log(`[lsp] installed ${spec.id} ${tag} at ${targetBinary}`);
   return archiveSha256;
 }
-async function ensureGithubInstalled(spec, config2, fetchImpl, platform, arch, signal) {
+async function ensureGithubInstalled(spec, config2, fetchImpl, platform2, arch, signal) {
   const outcome = await withInstallLock(spec.githubRepo, async () => {
     const { tag, assets, blockedByGrace, reason } = await resolveTargetTag(spec, config2, fetchImpl, signal);
     if (!tag) {
-      const installed = isGithubInstalled(spec, platform);
+      const installed = isGithubInstalled(spec, platform2);
       if (installed) {
         warn(`[lsp] no eligible release of ${spec.githubRepo} (grace=${config2.graceDays}d); keeping existing install`);
         return { started: false, reason: "kept existing install" };
@@ -23081,7 +23650,7 @@ async function ensureGithubInstalled(spec, config2, fetchImpl, platform, arch, s
       warn(`[lsp] skipping ${spec.id}: ${fallbackReason}`);
       return { started: false, reason: fallbackReason };
     }
-    if (isGithubInstalled(spec, platform)) {
+    if (isGithubInstalled(spec, platform2)) {
       const installedMeta = readInstalledMetaIn(ghPackageDir(spec));
       if (installedMeta && installedMeta.version === tag) {
         return { started: false, reason: "already installed" };
@@ -23092,7 +23661,7 @@ async function ensureGithubInstalled(spec, config2, fetchImpl, platform, arch, s
         log(`[lsp] reinstalling ${spec.id}@${tag}: no installed-version metadata recorded`);
       }
     }
-    const archiveSha256 = await downloadAndInstall(spec, tag, assets, platform, arch, fetchImpl, signal).catch((err) => {
+    const archiveSha256 = await downloadAndInstall(spec, tag, assets, platform2, arch, fetchImpl, signal).catch((err) => {
       error48(`[lsp] github install ${spec.id} crashed: ${err}`);
       return null;
     });
@@ -23130,7 +23699,7 @@ function runGithubAutoInstall(relevantServers, config2, fetchImpl = fetch) {
   if (!host) {
     for (const spec of GITHUB_LSP_TABLE) {
       try {
-        if (existsSync5(ghBinDir(spec))) {
+        if (existsSync6(ghBinDir(spec))) {
           cachedBinDirs.push(ghBinDir(spec));
         }
       } catch {}
@@ -23290,9 +23859,9 @@ function normalizeToolMap(tools) {
 }
 
 // src/notifications.ts
-import { existsSync as existsSync6, mkdirSync as mkdirSync4, readFileSync as readFileSync3, writeFileSync as writeFileSync2 } from "fs";
-import { homedir as homedir4, platform } from "os";
-import { join as join7 } from "path";
+import { existsSync as existsSync7, mkdirSync as mkdirSync4, readFileSync as readFileSync5, writeFileSync as writeFileSync4 } from "fs";
+import { homedir as homedir6, platform as platform2 } from "os";
+import { join as join10 } from "path";
 function isTuiMode() {
   return process.env.OPENCODE_CLIENT === "cli";
 }
@@ -23313,28 +23882,28 @@ var WARNING_MARKER = `${AFT_MARKER} \u26A0\uFE0F`;
 var STATUS_MARKER = `${AFT_MARKER} \u2705`;
 var WARNED_TOOLS_FILE = "warned_tools.json";
 function getDesktopStatePath() {
-  const os2 = platform();
-  const home = homedir4();
+  const os2 = platform2();
+  const home = homedir6();
   if (os2 === "darwin") {
-    return join7(home, "Library", "Application Support", "ai.opencode.desktop", "opencode.global.dat");
+    return join10(home, "Library", "Application Support", "ai.opencode.desktop", "opencode.global.dat");
   }
   if (os2 === "linux") {
-    const xdgConfig = process.env.XDG_CONFIG_HOME || join7(home, ".config");
-    return join7(xdgConfig, "ai.opencode.desktop", "opencode.global.dat");
+    const xdgConfig = process.env.XDG_CONFIG_HOME || join10(home, ".config");
+    return join10(xdgConfig, "ai.opencode.desktop", "opencode.global.dat");
   }
   if (os2 === "win32") {
-    const appData = process.env.APPDATA || join7(home, "AppData", "Roaming");
-    return join7(appData, "ai.opencode.desktop", "opencode.global.dat");
+    const appData = process.env.APPDATA || join10(home, "AppData", "Roaming");
+    return join10(appData, "ai.opencode.desktop", "opencode.global.dat");
   }
   return null;
 }
 function readDesktopState(directory) {
   const statePath = getDesktopStatePath();
-  if (!statePath || !existsSync6(statePath)) {
+  if (!statePath || !existsSync7(statePath)) {
     return { sessionId: null, serverUrl: null };
   }
   try {
-    const raw = readFileSync3(statePath, "utf-8");
+    const raw = readFileSync5(statePath, "utf-8");
     const state = JSON.parse(raw);
     let serverUrl = null;
     const serverStr = state.server;
@@ -23428,10 +23997,10 @@ async function sendWarning(opts, message) {
 }
 async function sendFeatureAnnouncement(opts, version2, features, storageDir) {
   if (storageDir) {
-    const versionFile = join7(storageDir, "last_announced_version");
+    const versionFile = join10(storageDir, "last_announced_version");
     try {
-      if (existsSync6(versionFile)) {
-        const lastVersion = readFileSync3(versionFile, "utf-8").trim();
+      if (existsSync7(versionFile)) {
+        const lastVersion = readFileSync5(versionFile, "utf-8").trim();
         if (lastVersion === version2)
           return;
       }
@@ -23452,16 +24021,16 @@ async function sendFeatureAnnouncement(opts, version2, features, storageDir) {
   if (storageDir) {
     try {
       mkdirSync4(storageDir, { recursive: true });
-      writeFileSync2(join7(storageDir, "last_announced_version"), version2);
+      writeFileSync4(join10(storageDir, "last_announced_version"), version2);
     } catch {}
   }
 }
 function readWarnedTools(storageDir) {
   try {
-    const warnedToolsPath = join7(storageDir, WARNED_TOOLS_FILE);
-    if (!existsSync6(warnedToolsPath))
+    const warnedToolsPath = join10(storageDir, WARNED_TOOLS_FILE);
+    if (!existsSync7(warnedToolsPath))
       return {};
-    const parsed = JSON.parse(readFileSync3(warnedToolsPath, "utf-8"));
+    const parsed = JSON.parse(readFileSync5(warnedToolsPath, "utf-8"));
     if (!parsed || typeof parsed !== "object" || Array.isArray(parsed))
       return {};
     const warned = {};
@@ -23478,8 +24047,8 @@ function readWarnedTools(storageDir) {
 function writeWarnedTools(storageDir, warned) {
   try {
     mkdirSync4(storageDir, { recursive: true });
-    const warnedToolsPath = join7(storageDir, WARNED_TOOLS_FILE);
-    writeFileSync2(warnedToolsPath, `${JSON.stringify(warned, null, 2)}
+    const warnedToolsPath = join10(storageDir, WARNED_TOOLS_FILE);
+    writeFileSync4(warnedToolsPath, `${JSON.stringify(warned, null, 2)}
 `);
   } catch {}
 }
@@ -23570,10 +24139,37 @@ async function cleanupWarnings(opts) {
 }
 
 // src/onnx-runtime.ts
-import { chmodSync as chmodSync2, existsSync as existsSync7, mkdirSync as mkdirSync5, readdirSync as readdirSync3, unlinkSync as unlinkSync4 } from "fs";
-import { join as join8 } from "path";
+import { execFileSync as execFileSync2 } from "child_process";
+import { createHash as createHash3 } from "crypto";
+import {
+  chmodSync as chmodSync2,
+  closeSync as closeSync2,
+  copyFileSync as copyFileSync2,
+  createWriteStream as createWriteStream2,
+  existsSync as existsSync8,
+  lstatSync as lstatSync2,
+  mkdirSync as mkdirSync5,
+  openSync as openSync2,
+  readdirSync as readdirSync3,
+  readFileSync as readFileSync6,
+  readlinkSync as readlinkSync2,
+  realpathSync as realpathSync2,
+  rmSync as rmSync3,
+  statSync as statSync5,
+  symlinkSync,
+  unlinkSync as unlinkSync4,
+  writeFileSync as writeFileSync5
+} from "fs";
+import { dirname as dirname4, join as join11, relative as relative2, resolve as resolve3 } from "path";
+import { Readable as Readable2 } from "stream";
+import { pipeline as pipeline2 } from "stream/promises";
 var ORT_VERSION = "1.24.4";
 var ORT_REPO = "microsoft/onnxruntime";
+var MAX_DOWNLOAD_BYTES2 = 256 * 1024 * 1024;
+var MAX_EXTRACT_BYTES2 = 1 * 1024 * 1024 * 1024;
+var ONNX_LOCK_FILE = ".aft-onnx-installing";
+var ONNX_INSTALLED_META_FILE = ".aft-onnx-installed";
+var STALE_LOCK_MS2 = 30 * 60 * 1000;
 var ORT_PLATFORM_MAP = {
   darwin: {
     arm64: {
@@ -23627,11 +24223,27 @@ function getManualInstallHint() {
 }
 async function ensureOnnxRuntime(storageDir) {
   const info = getPlatformInfo();
-  const ortDir = join8(storageDir, "onnxruntime", ORT_VERSION);
-  const libPath = join8(ortDir, info?.libName ?? "libonnxruntime.dylib");
-  if (existsSync7(libPath)) {
-    log(`ONNX Runtime found at ${ortDir}`);
-    return ortDir;
+  const ortDir = join11(storageDir, "onnxruntime", ORT_VERSION);
+  const libPath = join11(ortDir, info?.libName ?? "libonnxruntime.dylib");
+  if (existsSync8(libPath)) {
+    const meta3 = readOnnxInstalledMeta(ortDir);
+    if (meta3?.sha256) {
+      try {
+        const currentHash = sha256File(libPath);
+        if (currentHash !== meta3.sha256) {
+          error48(`ONNX Runtime at ${ortDir}: TOFU sha256 mismatch \u2014 refusing to use ` + `tampered binary. Recorded ${meta3.sha256}, current ${currentHash}. ` + `Run \`aft doctor --clear\` to re-download from scratch.`);
+        } else {
+          log(`ONNX Runtime found at ${ortDir} (TOFU verified)`);
+          return ortDir;
+        }
+      } catch (err) {
+        warn(`Could not verify ONNX Runtime hash at ${ortDir}: ${err}`);
+        return ortDir;
+      }
+    } else {
+      log(`ONNX Runtime found at ${ortDir} (no recorded hash, accepting)`);
+      return ortDir;
+    }
   }
   const systemPath = findSystemOnnxRuntime(info?.libName);
   if (systemPath) {
@@ -23642,7 +24254,18 @@ async function ensureOnnxRuntime(storageDir) {
     warn(`ONNX Runtime auto-download not available for ${process.platform}/${process.arch}. Install manually: ${getManualInstallHint()}`);
     return null;
   }
-  return downloadOnnxRuntime(info, ortDir);
+  const onnxBaseDir = join11(storageDir, "onnxruntime");
+  mkdirSync5(onnxBaseDir, { recursive: true });
+  const lockPath2 = join11(onnxBaseDir, ONNX_LOCK_FILE);
+  if (!acquireLock(lockPath2)) {
+    warn(`ONNX Runtime install already in progress in another process (lock: ${lockPath2}). Skipping.`);
+    return null;
+  }
+  try {
+    return await downloadOnnxRuntime(info, ortDir);
+  } finally {
+    releaseLock(lockPath2);
+  }
 }
 function findSystemOnnxRuntime(libName) {
   if (!libName)
@@ -23654,40 +24277,119 @@ function findSystemOnnxRuntime(libName) {
     searchPaths.push("/usr/lib", "/usr/lib/x86_64-linux-gnu", "/usr/lib/aarch64-linux-gnu", "/usr/local/lib");
   }
   for (const dir of searchPaths) {
-    if (existsSync7(join8(dir, libName))) {
+    if (existsSync8(join11(dir, libName))) {
       return dir;
     }
   }
   return null;
 }
+async function downloadFileWithCap(url2, destPath) {
+  const controller = new AbortController;
+  const timeout = setTimeout(() => controller.abort(), 300000);
+  try {
+    const res = await fetch(url2, {
+      headers: { accept: "application/octet-stream" },
+      redirect: "follow",
+      signal: controller.signal
+    });
+    if (!res.ok || !res.body) {
+      throw new Error(`download failed (HTTP ${res.status})`);
+    }
+    const advertised = Number.parseInt(res.headers.get("content-length") ?? "", 10);
+    if (Number.isFinite(advertised) && advertised > MAX_DOWNLOAD_BYTES2) {
+      throw new Error(`Content-Length ${advertised} exceeds max ${MAX_DOWNLOAD_BYTES2}`);
+    }
+    mkdirSync5(dirname4(destPath), { recursive: true });
+    let bytesWritten = 0;
+    const guard = new TransformStream({
+      transform(chunk, transformController) {
+        bytesWritten += chunk.byteLength;
+        if (bytesWritten > MAX_DOWNLOAD_BYTES2) {
+          transformController.error(new Error(`download exceeded ${MAX_DOWNLOAD_BYTES2} bytes after streaming (server lied about size or sent unbounded body)`));
+          return;
+        }
+        transformController.enqueue(chunk);
+      }
+    });
+    const guarded = res.body.pipeThrough(guard);
+    const nodeStream = Readable2.fromWeb(guarded);
+    await pipeline2(nodeStream, createWriteStream2(destPath), { signal: controller.signal });
+  } catch (err) {
+    try {
+      unlinkSync4(destPath);
+    } catch {}
+    throw err;
+  } finally {
+    clearTimeout(timeout);
+  }
+}
+function validateExtractedTree(stagingRoot) {
+  const realRoot = realpathSync2(stagingRoot);
+  let totalBytes = 0;
+  const walk = (dir) => {
+    const entries = readdirSync3(dir);
+    for (const entry of entries) {
+      const fullPath = join11(dir, entry);
+      const lst = lstatSync2(fullPath);
+      if (lst.isSymbolicLink()) {
+        const linkTarget = readlinkSync2(fullPath);
+        const resolvedTarget = resolve3(dirname4(fullPath), linkTarget);
+        const rel2 = relative2(realRoot, resolvedTarget);
+        if (rel2.startsWith("..") || process.platform !== "win32" && rel2.startsWith("/")) {
+          throw new Error(`extracted symlink ${fullPath} points outside staging root: ${linkTarget}`);
+        }
+        continue;
+      }
+      const rel = relative2(realRoot, fullPath);
+      if (rel.startsWith("..") || process.platform !== "win32" && rel.startsWith("/")) {
+        throw new Error(`extracted entry ${fullPath} escapes staging root`);
+      }
+      if (lst.isDirectory()) {
+        walk(fullPath);
+        continue;
+      }
+      if (lst.isFile()) {
+        totalBytes += lst.size;
+        if (totalBytes > MAX_EXTRACT_BYTES2) {
+          throw new Error(`extracted size ${totalBytes} exceeds max ${MAX_EXTRACT_BYTES2} (decompression bomb defense)`);
+        }
+      }
+    }
+  };
+  walk(realRoot);
+}
 async function downloadOnnxRuntime(info, targetDir) {
   const url2 = `https://github.com/${ORT_REPO}/releases/download/v${ORT_VERSION}/${info.assetName}.${info.archiveType === "tgz" ? "tgz" : "zip"}`;
   log(`Downloading ONNX Runtime v${ORT_VERSION} for ${process.platform}/${process.arch}...`);
+  const tmpDir = `${targetDir}.tmp.${process.pid}.${Date.now().toString(36)}`;
   try {
-    const tmpDir = `${targetDir}.tmp.${process.pid}`;
     mkdirSync5(tmpDir, { recursive: true });
-    const archivePath = join8(tmpDir, `onnxruntime.${info.archiveType}`);
-    const { execFileSync: execFileSync2 } = await import("child_process");
-    execFileSync2("curl", ["-fsSL", url2, "-o", archivePath], {
-      stdio: "pipe",
-      timeout: 120000
-    });
+    const archivePath = join11(tmpDir, `onnxruntime.${info.archiveType}`);
+    await downloadFileWithCap(url2, archivePath);
+    const archiveSha256 = sha256File(archivePath);
+    log(`ONNX Runtime archive sha256=${archiveSha256}`);
     if (info.archiveType === "tgz") {
-      execFileSync2("tar", ["xzf", archivePath, "-C", tmpDir], { stdio: "pipe" });
+      execFileSync2("tar", ["xzf", archivePath, "-C", tmpDir], {
+        stdio: "pipe",
+        timeout: 120000
+      });
     } else {
       await extractZipArchive(archivePath, tmpDir);
     }
-    const extractedDir = join8(tmpDir, info.assetName, "lib");
-    if (!existsSync7(extractedDir)) {
+    try {
+      unlinkSync4(archivePath);
+    } catch {}
+    validateExtractedTree(tmpDir);
+    const extractedDir = join11(tmpDir, info.assetName, "lib");
+    if (!existsSync8(extractedDir)) {
       throw new Error(`Expected directory not found: ${extractedDir}`);
     }
     mkdirSync5(targetDir, { recursive: true });
     const libFiles = readdirSync3(extractedDir).filter((f) => f.startsWith("libonnxruntime") || f.startsWith("onnxruntime"));
-    const { lstatSync: lstatSync2, symlinkSync, readlinkSync: readlinkSync2, copyFileSync: cpFile } = await import("fs");
     const realFiles = [];
     const symlinks = [];
     for (const libFile of libFiles) {
-      const src = join8(extractedDir, libFile);
+      const src = join11(extractedDir, libFile);
       try {
         const stat = lstatSync2(src);
         log(`ORT extract: ${libFile} \u2014 isSymlink=${stat.isSymbolicLink()}, isFile=${stat.isFile()}, size=${stat.size}`);
@@ -23702,10 +24404,10 @@ async function downloadOnnxRuntime(info, targetDir) {
       }
     }
     for (const libFile of realFiles) {
-      const src = join8(extractedDir, libFile);
-      const dst = join8(targetDir, libFile);
+      const src = join11(extractedDir, libFile);
+      const dst = join11(targetDir, libFile);
       try {
-        cpFile(src, dst);
+        copyFileSync2(src, dst);
         if (process.platform !== "win32") {
           chmodSync2(dst, 493);
         }
@@ -23714,27 +24416,35 @@ async function downloadOnnxRuntime(info, targetDir) {
       }
     }
     for (const link of symlinks) {
-      const dst = join8(targetDir, link.name);
+      const dst = join11(targetDir, link.name);
       try {
         unlinkSync4(dst);
       } catch {}
       symlinkSync(link.target, dst);
     }
-    const { rmSync: rmSync2 } = await import("fs");
-    rmSync2(tmpDir, { recursive: true, force: true });
+    const libPath = join11(targetDir, info.libName);
+    let libHash = null;
+    try {
+      libHash = sha256File(libPath);
+    } catch (err) {
+      warn(`Could not hash newly-installed ONNX library at ${libPath}: ${err}`);
+    }
+    writeOnnxInstalledMeta(targetDir, ORT_VERSION, libHash, archiveSha256);
+    rmSync3(tmpDir, { recursive: true, force: true });
     log(`ONNX Runtime v${ORT_VERSION} installed to ${targetDir}`);
     return targetDir;
   } catch (err) {
     error48(`Failed to download ONNX Runtime: ${err}`);
     try {
-      const { rmSync: rmSync2 } = await import("fs");
-      rmSync2(`${targetDir}.tmp.${process.pid}`, { recursive: true, force: true });
+      rmSync3(tmpDir, { recursive: true, force: true });
+    } catch {}
+    try {
+      rmSync3(targetDir, { recursive: true, force: true });
     } catch {}
     return null;
   }
 }
 async function extractZipArchive(archivePath, destinationDir) {
-  const { execFileSync: execFileSync2 } = await import("child_process");
   if (process.platform === "win32") {
     execFileSync2("tar.exe", ["-xf", archivePath, "-C", destinationDir], {
       stdio: "pipe",
@@ -23747,11 +24457,138 @@ async function extractZipArchive(archivePath, destinationDir) {
     timeout: 120000
   });
 }
+function writeOnnxInstalledMeta(installDir, version2, sha256, archiveSha256) {
+  try {
+    const meta3 = {
+      version: version2,
+      installedAt: new Date().toISOString(),
+      ...sha256 ? { sha256 } : {},
+      archiveSha256
+    };
+    writeFileSync5(join11(installDir, ONNX_INSTALLED_META_FILE), JSON.stringify(meta3), "utf8");
+  } catch (err) {
+    log(`[onnx] failed to write installed-meta in ${installDir}: ${err}`);
+  }
+}
+function readOnnxInstalledMeta(installDir) {
+  const path2 = join11(installDir, ONNX_INSTALLED_META_FILE);
+  try {
+    if (!statSync5(path2).isFile())
+      return null;
+    const raw = readFileSync6(path2, "utf8");
+    const parsed = JSON.parse(raw);
+    if (typeof parsed.version !== "string" || parsed.version.length === 0)
+      return null;
+    return {
+      version: parsed.version,
+      installedAt: typeof parsed.installedAt === "string" ? parsed.installedAt : "",
+      ...typeof parsed.sha256 === "string" && parsed.sha256.length > 0 ? { sha256: parsed.sha256 } : {},
+      ...typeof parsed.archiveSha256 === "string" && parsed.archiveSha256.length > 0 ? { archiveSha256: parsed.archiveSha256 } : {}
+    };
+  } catch {
+    return null;
+  }
+}
+function sha256File(path2) {
+  const hash2 = createHash3("sha256");
+  hash2.update(readFileSync6(path2));
+  return hash2.digest("hex");
+}
+function acquireLock(lockPath2) {
+  const tryClaim = () => {
+    try {
+      const fd = openSync2(lockPath2, "wx");
+      try {
+        writeFileSync5(fd, `${process.pid}
+${new Date().toISOString()}
+`);
+      } finally {
+        closeSync2(fd);
+      }
+      return true;
+    } catch (err) {
+      const code = err.code;
+      if (code === "EEXIST")
+        return false;
+      warn(`[onnx] unexpected error acquiring lock ${lockPath2}: ${err}`);
+      return false;
+    }
+  };
+  if (tryClaim())
+    return true;
+  let owningPid = null;
+  let lockMtimeMs = 0;
+  try {
+    const raw = readFileSync6(lockPath2, "utf8");
+    const firstLine = raw.split(/\r?\n/, 1)[0]?.trim() ?? "";
+    const parsed = Number.parseInt(firstLine, 10);
+    if (Number.isFinite(parsed) && parsed > 0)
+      owningPid = parsed;
+    lockMtimeMs = statSync5(lockPath2).mtimeMs;
+  } catch {
+    return tryClaim();
+  }
+  const age = Date.now() - lockMtimeMs;
+  const ageWithinFresh = Math.abs(age) < STALE_LOCK_MS2;
+  const skipLiveness = process.platform === "win32";
+  const ownerAlive = !skipLiveness && owningPid !== null && isProcessAlive2(owningPid);
+  if (skipLiveness ? ageWithinFresh : ownerAlive && ageWithinFresh) {
+    return false;
+  }
+  log(`[onnx] reclaiming install lock (owner_pid=${owningPid ?? "unknown"}, alive=${ownerAlive}, age_ms=${age})`);
+  try {
+    unlinkSync4(lockPath2);
+  } catch {}
+  return tryClaim();
+}
+function releaseLock(lockPath2) {
+  try {
+    let owningPid = null;
+    try {
+      const raw = readFileSync6(lockPath2, "utf8");
+      const firstLine = raw.split(/\r?\n/, 1)[0]?.trim() ?? "";
+      const parsed = Number.parseInt(firstLine, 10);
+      if (Number.isFinite(parsed) && parsed > 0)
+        owningPid = parsed;
+    } catch (readErr) {
+      const code = readErr.code;
+      if (code === "ENOENT")
+        return;
+      warn(`[onnx] could not read lock ${lockPath2} during release: ${readErr}`);
+      return;
+    }
+    if (owningPid !== process.pid) {
+      log(`[onnx] not releasing lock ${lockPath2}: owned by pid ${owningPid ?? "unknown"} (we are ${process.pid})`);
+      return;
+    }
+    try {
+      unlinkSync4(lockPath2);
+    } catch (unlinkErr) {
+      const code = unlinkErr.code;
+      if (code !== "ENOENT") {
+        warn(`[onnx] failed to release lock ${lockPath2}: ${unlinkErr}`);
+      }
+    }
+  } catch (err) {
+    warn(`[onnx] unexpected error releasing lock ${lockPath2}: ${err}`);
+  }
+}
+function isProcessAlive2(pid) {
+  try {
+    process.kill(pid, 0);
+    return true;
+  } catch (err) {
+    const code = err.code;
+    if (code === "ESRCH")
+      return false;
+    return true;
+  }
+}
 
 // src/bridge.ts
-import { spawn as spawn2 } from "child_process";
-import { homedir as homedir5 } from "os";
-import { join as join9 } from "path";
+import { spawn as spawn3 } from "child_process";
+import { homedir as homedir7 } from "os";
+import { join as join12 } from "path";
 var DEFAULT_BRIDGE_TIMEOUT_MS = 30000;
 var SEMANTIC_TIMEOUT_SAFETY_MARGIN_MS = 5000;
 var MAX_STDOUT_BUFFER = 64 * 1024 * 1024;
@@ -23893,14 +24730,14 @@ class BinaryBridge {
     const line = `${JSON.stringify(request)}
 `;
     const effectiveTimeoutMs = options?.timeoutMs ?? this.timeoutMs;
-    return new Promise((resolve2, reject) => {
+    return new Promise((resolve4, reject) => {
       const timer = setTimeout(() => {
         this.pending.delete(id);
         warn(`Request "${command}" (id=${id}) timed out after ${effectiveTimeoutMs}ms \u2014 restarting bridge`);
         reject(new Error(`[aft-plugin] Request "${command}" (id=${id}) timed out after ${effectiveTimeoutMs}ms`));
         this.handleTimeout();
       }, effectiveTimeoutMs);
-      this.pending.set(id, { resolve: resolve2, reject, timer });
+      this.pending.set(id, { resolve: resolve4, reject, timer });
       if (!this.process?.stdin?.writable) {
         this.pending.delete(id);
         clearTimeout(timer);
@@ -23943,15 +24780,15 @@ class BinaryBridge {
     if (this.process) {
       const proc = this.process;
       this.process = null;
-      return new Promise((resolve2) => {
+      return new Promise((resolve4) => {
         const forceKillTimer = setTimeout(() => {
           proc.kill("SIGKILL");
-          resolve2();
+          resolve4();
         }, 5000);
         proc.once("exit", () => {
           clearTimeout(forceKillTimer);
           log("Process exited during shutdown");
-          resolve2();
+          resolve4();
         });
         proc.kill("SIGTERM");
       });
@@ -23993,19 +24830,19 @@ class BinaryBridge {
     })();
     const useFastembedBackend = semanticBackend === undefined || semanticBackend === "fastembed" || semanticBackend === "";
     const ortDir = typeof this.configOverrides._ort_dylib_dir === "string" && useFastembedBackend ? this.configOverrides._ort_dylib_dir : null;
-    const ortLibraryPath = ortDir == null ? null : join9(ortDir, process.platform === "win32" ? "onnxruntime.dll" : process.platform === "darwin" ? "libonnxruntime.dylib" : "libonnxruntime.so");
+    const ortLibraryPath = ortDir == null ? null : join12(ortDir, process.platform === "win32" ? "onnxruntime.dll" : process.platform === "darwin" ? "libonnxruntime.dylib" : "libonnxruntime.so");
     const envPath = process.platform === "win32" && ortDir ? `${ortDir};${process.env.PATH ?? ""}` : process.env.PATH;
     const env = {
       ...process.env,
       ...envPath ? { PATH: envPath } : {}
     };
     if (useFastembedBackend) {
-      env.FASTEMBED_CACHE_DIR = process.env.FASTEMBED_CACHE_DIR || (typeof this.configOverrides.storage_dir === "string" ? join9(this.configOverrides.storage_dir, "semantic", "models") : join9(homedir5() || "", ".cache", "fastembed"));
+      env.FASTEMBED_CACHE_DIR = process.env.FASTEMBED_CACHE_DIR || (typeof this.configOverrides.storage_dir === "string" ? join12(this.configOverrides.storage_dir, "semantic", "models") : join12(homedir7() || "", ".cache", "fastembed"));
       if (ortLibraryPath) {
         env.ORT_DYLIB_PATH = ortLibraryPath;
       }
     }
-    const child = spawn2(this.binaryPath, [], {
+    const child = spawn3(this.binaryPath, [], {
       cwd: this.cwd,
       stdio: ["pipe", "pipe", "pipe"],
       env
@@ -24266,10 +25103,10 @@ function normalizeKey(projectRoot) {
 
 // src/resolver.ts
 import { execSync, spawnSync } from "child_process";
-import { chmodSync as chmodSync3, copyFileSync as copyFileSync2, existsSync as existsSync8, mkdirSync as mkdirSync6, renameSync as renameSync2 } from "fs";
+import { chmodSync as chmodSync3, copyFileSync as copyFileSync3, existsSync as existsSync9, mkdirSync as mkdirSync6, renameSync as renameSync2 } from "fs";
 import { createRequire } from "module";
-import { homedir as homedir6 } from "os";
-import { join as join10 } from "path";
+import { homedir as homedir8 } from "os";
+import { join as join13 } from "path";
 function copyToVersionedCache(npmBinaryPath) {
   try {
     const result = spawnSync(npmBinaryPath, ["--version"], {
@@ -24283,14 +25120,14 @@ function copyToVersionedCache(npmBinaryPath) {
     const version2 = rawVersion.replace(/^aft\s+/, "");
     const tag = version2.startsWith("v") ? version2 : `v${version2}`;
     const cacheDir = getCacheDir();
-    const versionedDir = join10(cacheDir, tag);
+    const versionedDir = join13(cacheDir, tag);
     const ext = process.platform === "win32" ? ".exe" : "";
-    const cachedPath = join10(versionedDir, `aft${ext}`);
-    if (existsSync8(cachedPath))
+    const cachedPath = join13(versionedDir, `aft${ext}`);
+    if (existsSync9(cachedPath))
       return cachedPath;
     mkdirSync6(versionedDir, { recursive: true });
     const tmpPath = `${cachedPath}.tmp`;
-    copyFileSync2(npmBinaryPath, tmpPath);
+    copyFileSync3(npmBinaryPath, tmpPath);
     if (process.platform !== "win32") {
       chmodSync3(tmpPath, 493);
     }
@@ -24302,14 +25139,14 @@ function copyToVersionedCache(npmBinaryPath) {
     return null;
   }
 }
-function platformKey(platform2 = process.platform, arch = process.arch) {
-  const archMap = PLATFORM_ARCH_MAP[platform2];
+function platformKey(platform3 = process.platform, arch = process.arch) {
+  const archMap = PLATFORM_ARCH_MAP[platform3];
   if (!archMap) {
-    throw new Error(`Unsupported platform: ${platform2} (arch: ${arch}). ` + `Supported platforms: ${Object.keys(PLATFORM_ARCH_MAP).join(", ")}`);
+    throw new Error(`Unsupported platform: ${platform3} (arch: ${arch}). ` + `Supported platforms: ${Object.keys(PLATFORM_ARCH_MAP).join(", ")}`);
   }
   const key = archMap[arch];
   if (!key) {
-    throw new Error(`Unsupported architecture: ${arch} on platform ${platform2}. ` + `Supported architectures for ${platform2}: ${Object.keys(archMap).join(", ")}`);
+    throw new Error(`Unsupported architecture: ${arch} on platform ${platform3}. ` + `Supported architectures for ${platform3}: ${Object.keys(archMap).join(", ")}`);
   }
   return key;
 }
@@ -24333,7 +25170,7 @@ function findBinarySync() {
     const packageBin = `@cortexkit/aft-${key}/bin/aft${ext}`;
     const req = createRequire(import.meta.url);
     const resolved = req.resolve(packageBin);
-    if (existsSync8(resolved)) {
+    if (existsSync9(resolved)) {
       const copied = copyToVersionedCache(resolved);
       return copied ?? resolved;
     }
@@ -24347,8 +25184,8 @@ function findBinarySync() {
     if (result)
       return result;
   } catch {}
-  const cargoPath = join10(homedir6(), ".cargo", "bin", `aft${ext}`);
-  if (existsSync8(cargoPath))
+  const cargoPath = join13(homedir8(), ".cargo", "bin", `aft${ext}`);
+  if (existsSync9(cargoPath))
     return cargoPath;
   return null;
 }
@@ -24384,20 +25221,20 @@ async function findBinary() {
 
 // src/shared/rpc-server.ts
 import { randomBytes as randomBytes2 } from "crypto";
-import { mkdirSync as mkdirSync7, renameSync as renameSync3, unlinkSync as unlinkSync5, writeFileSync as writeFileSync3 } from "fs";
+import { mkdirSync as mkdirSync7, renameSync as renameSync3, unlinkSync as unlinkSync5, writeFileSync as writeFileSync6 } from "fs";
 import { createServer } from "http";
-import { dirname as dirname2 } from "path";
+import { dirname as dirname5 } from "path";
 
 // src/shared/rpc-utils.ts
-import { createHash as createHash3 } from "crypto";
-import { join as join11 } from "path";
+import { createHash as createHash4 } from "crypto";
+import { join as join14 } from "path";
 function projectHash(directory) {
   const normalized = directory.replace(/\/+$/, "");
-  return createHash3("sha256").update(normalized).digest("hex").slice(0, 16);
+  return createHash4("sha256").update(normalized).digest("hex").slice(0, 16);
 }
 function rpcPortFilePath(storageDir, directory) {
   const hash2 = projectHash(directory);
-  return join11(storageDir, "rpc", hash2, "port");
+  return join14(storageDir, "rpc", hash2, "port");
 }
 
 // src/shared/rpc-server.ts
@@ -24414,7 +25251,7 @@ class AftRpcServer {
     this.handlers.set(method, handler);
   }
   async start() {
-    return new Promise((resolve2, reject) => {
+    return new Promise((resolve4, reject) => {
       const server = createServer((req, res) => this.dispatch(req, res));
       server.on("error", (err) => {
         warn(`RPC server error: ${err.message}`);
@@ -24430,16 +25267,16 @@ class AftRpcServer {
         this.token = randomBytes2(32).toString("hex");
         this.server = server;
         try {
-          const dir = dirname2(this.portFilePath);
+          const dir = dirname5(this.portFilePath);
           mkdirSync7(dir, { recursive: true });
           const tmpPath = `${this.portFilePath}.tmp`;
-          writeFileSync3(tmpPath, JSON.stringify({ port: this.port, token: this.token }), "utf-8");
+          writeFileSync6(tmpPath, JSON.stringify({ port: this.port, token: this.token }), "utf-8");
           renameSync3(tmpPath, this.portFilePath);
           log(`RPC server listening on 127.0.0.1:${this.port}`);
         } catch (err) {
           warn(`Failed to write RPC port file: ${err}`);
         }
-        resolve2(this.port);
+        resolve4(this.port);
       });
       server.unref();
     });
@@ -24672,22 +25509,22 @@ function formatStatusMarkdown(status) {
 }
 
 // src/shared/tui-config.ts
-var import_comment_json2 = __toESM(require_src2(), 1);
-import { existsSync as existsSync9, mkdirSync as mkdirSync8, readFileSync as readFileSync4, writeFileSync as writeFileSync4 } from "fs";
-import { dirname as dirname3, join as join13 } from "path";
+var import_comment_json4 = __toESM(require_src2(), 1);
+import { existsSync as existsSync10, mkdirSync as mkdirSync8, readFileSync as readFileSync7, writeFileSync as writeFileSync7 } from "fs";
+import { dirname as dirname6, join as join16 } from "path";
 
 // src/shared/opencode-config-dir.ts
-import { homedir as homedir7 } from "os";
-import { join as join12, resolve as resolve2 } from "path";
+import { homedir as homedir9 } from "os";
+import { join as join15, resolve as resolve4 } from "path";
 function getCliConfigDir() {
   const envConfigDir = process.env.OPENCODE_CONFIG_DIR?.trim();
   if (envConfigDir) {
-    return resolve2(envConfigDir);
+    return resolve4(envConfigDir);
   }
   if (process.platform === "win32") {
-    return join12(homedir7(), ".config", "opencode");
+    return join15(homedir9(), ".config", "opencode");
   }
-  return join12(process.env.XDG_CONFIG_HOME || join12(homedir7(), ".config"), "opencode");
+  return join15(process.env.XDG_CONFIG_HOME || join15(homedir9(), ".config"), "opencode");
 }
 function getOpenCodeConfigDir2(_options) {
   return getCliConfigDir();
@@ -24696,10 +25533,10 @@ function getOpenCodeConfigPaths(options) {
   const configDir = getOpenCodeConfigDir2(options);
   return {
     configDir,
-    configJson: join12(configDir, "opencode.json"),
-    configJsonc: join12(configDir, "opencode.jsonc"),
-    packageJson: join12(configDir, "package.json"),
-    omoConfig: join12(configDir, "magic-context.jsonc")
+    configJson: join15(configDir, "opencode.json"),
+    configJsonc: join15(configDir, "opencode.jsonc"),
+    packageJson: join15(configDir, "package.json"),
+    omoConfig: join15(configDir, "magic-context.jsonc")
   };
 }
 
@@ -24708,11 +25545,11 @@ var PLUGIN_NAME = "@cortexkit/aft-opencode";
 var PLUGIN_ENTRY = `${PLUGIN_NAME}@latest`;
 function resolveTuiConfigPath() {
   const configDir = getOpenCodeConfigPaths({ binary: "opencode" }).configDir;
-  const jsoncPath = join13(configDir, "tui.jsonc");
-  const jsonPath = join13(configDir, "tui.json");
-  if (existsSync9(jsoncPath))
+  const jsoncPath = join16(configDir, "tui.jsonc");
+  const jsonPath = join16(configDir, "tui.json");
+  if (existsSync10(jsoncPath))
     return jsoncPath;
-  if (existsSync9(jsonPath))
+  if (existsSync10(jsonPath))
     return jsonPath;
   return jsonPath;
 }
@@ -24720,8 +25557,8 @@ function ensureTuiPluginEntry() {
   try {
     const configPath = resolveTuiConfigPath();
     let config2 = {};
-    if (existsSync9(configPath)) {
-      config2 = import_comment_json2.parse(readFileSync4(configPath, "utf-8")) ?? {};
+    if (existsSync10(configPath)) {
+      config2 = import_comment_json4.parse(readFileSync7(configPath, "utf-8")) ?? {};
     }
     const plugins = Array.isArray(config2.plugin) ? config2.plugin.filter((value) => typeof value === "string") : [];
     if (plugins.some((plugin) => plugin === PLUGIN_NAME || plugin.startsWith(`${PLUGIN_NAME}@`) || plugin.includes("opencode-plugin") || plugin.includes("aft-opencode"))) {
@@ -24729,8 +25566,8 @@ function ensureTuiPluginEntry() {
     }
     plugins.push(PLUGIN_ENTRY);
     config2.plugin = plugins;
-    mkdirSync8(dirname3(configPath), { recursive: true });
-    writeFileSync4(configPath, `${import_comment_json2.stringify(config2, null, 2)}
+    mkdirSync8(dirname6(configPath), { recursive: true });
+    writeFileSync7(configPath, `${import_comment_json4.stringify(config2, null, 2)}
 `);
     log(`[aft-plugin] added TUI plugin entry to ${configPath}`);
     return true;
@@ -24741,33 +25578,33 @@ function ensureTuiPluginEntry() {
 }
 
 // src/shared/url-fetch.ts
-import { createHash as createHash4 } from "crypto";
+import { createHash as createHash5 } from "crypto";
 import { lookup } from "dns/promises";
 import {
-  existsSync as existsSync10,
+  existsSync as existsSync11,
   mkdirSync as mkdirSync9,
   readdirSync as readdirSync4,
-  readFileSync as readFileSync5,
+  readFileSync as readFileSync8,
   unlinkSync as unlinkSync6,
-  writeFileSync as writeFileSync5
+  writeFileSync as writeFileSync8
 } from "fs";
 import { isIP } from "net";
-import { join as join14 } from "path";
+import { join as join17 } from "path";
 var MAX_RESPONSE_BYTES = 10 * 1024 * 1024;
 var CACHE_TTL_MS = 24 * 60 * 60 * 1000;
 var FETCH_TIMEOUT_MS = 30000;
 var MAX_REDIRECTS = 5;
 function cacheDir(storageDir) {
-  return join14(storageDir, "url_cache");
+  return join17(storageDir, "url_cache");
 }
 function hashUrl(url2) {
-  return createHash4("sha256").update(url2).digest("hex").slice(0, 16);
+  return createHash5("sha256").update(url2).digest("hex").slice(0, 16);
 }
 function metaPath(storageDir, hash2) {
-  return join14(cacheDir(storageDir), `${hash2}.meta.json`);
+  return join17(cacheDir(storageDir), `${hash2}.meta.json`);
 }
 function contentPath(storageDir, hash2, extension) {
-  return join14(cacheDir(storageDir), `${hash2}${extension}`);
+  return join17(cacheDir(storageDir), `${hash2}${extension}`);
 }
 function _isPrivateIpv4(address) {
   const parts = address.split(".").map((part) => Number.parseInt(part, 10));
@@ -24929,12 +25766,12 @@ async function fetchUrlToTempFile(url2, storageDir, options = {}) {
   mkdirSync9(dir, { recursive: true });
   const hash2 = hashUrl(url2);
   const metaFile = metaPath(storageDir, hash2);
-  if (existsSync10(metaFile)) {
+  if (existsSync11(metaFile)) {
     try {
-      const meta4 = JSON.parse(readFileSync5(metaFile, "utf8"));
+      const meta4 = JSON.parse(readFileSync8(metaFile, "utf8"));
       const age = Date.now() - meta4.fetchedAt;
       const cached2 = contentPath(storageDir, hash2, meta4.extension);
-      if (age < CACHE_TTL_MS && existsSync10(cached2)) {
+      if (age < CACHE_TTL_MS && existsSync11(cached2)) {
         log(`URL cache hit: ${url2} (${Math.round(age / 1000)}s old)`);
         return cached2;
       }
@@ -24979,7 +25816,7 @@ async function fetchUrlToTempFile(url2, storageDir, options = {}) {
   const body = Buffer.concat(chunks);
   const contentFile = contentPath(storageDir, hash2, extension);
   const tmpContent = `${contentFile}.tmp-${process.pid}`;
-  writeFileSync5(tmpContent, body);
+  writeFileSync8(tmpContent, body);
   const { renameSync: renameSync4 } = await import("fs");
   renameSync4(tmpContent, contentFile);
   const meta3 = {
@@ -24989,28 +25826,28 @@ async function fetchUrlToTempFile(url2, storageDir, options = {}) {
     fetchedAt: Date.now()
   };
   const tmpMeta = `${metaFile}.tmp-${process.pid}`;
-  writeFileSync5(tmpMeta, JSON.stringify(meta3));
+  writeFileSync8(tmpMeta, JSON.stringify(meta3));
   renameSync4(tmpMeta, metaFile);
   log(`URL cached (${total} bytes): ${url2}`);
   return contentFile;
 }
 function cleanupUrlCache(storageDir) {
   const dir = cacheDir(storageDir);
-  if (!existsSync10(dir))
+  if (!existsSync11(dir))
     return;
   let removed = 0;
   try {
     for (const entry of readdirSync4(dir)) {
       if (!entry.endsWith(".meta.json"))
         continue;
-      const metaFile = join14(dir, entry);
+      const metaFile = join17(dir, entry);
       try {
-        const meta3 = JSON.parse(readFileSync5(metaFile, "utf8"));
+        const meta3 = JSON.parse(readFileSync8(metaFile, "utf8"));
         const age = Date.now() - meta3.fetchedAt;
         if (age > CACHE_TTL_MS) {
           const hash2 = entry.slice(0, -".meta.json".length);
           const content = contentPath(storageDir, hash2, meta3.extension);
-          if (existsSync10(content))
+          if (existsSync11(content))
             unlinkSync6(content);
           unlinkSync6(metaFile);
           removed++;
@@ -26056,11 +26893,11 @@ LSP errors detected, please fix:
   };
 }
 function getEditDescription(writeToolName) {
-  return `Edit a file by finding and replacing text, or by targeting named symbols.
+  return `Edit a file by finding and replacing text, or by targeting named symbols. To write or overwrite a whole file, use the \`${writeToolName}\` tool \u2014 \`edit\` requires an explicit edit mode and will not silently overwrite a file from \`content\` alone.
 
 **Modes** (determined by which parameters you provide):
 
-Mode priority: operations > edits > symbol (without oldString) > oldString (find/replace) > content-only (${writeToolName})
+Mode priority: operations > edits > symbol (without oldString) > oldString (find/replace). If none match, the call is rejected \u2014 there is no implicit "write" fallback.
 
 1. **Multi-file transaction** \u2014 pass \`operations\` array
    Edits across multiple files with checkpoint-based rollback on failure.
@@ -26123,6 +26960,10 @@ function createEditTool(ctx, writeToolName = "write") {
       dryRun: z3.boolean().optional().describe("Preview changes without applying (returns diff, default: false)")
     },
     execute: async (args, context) => {
+      const argsRecord = args;
+      if (argsRecord.startLine !== undefined || argsRecord.endLine !== undefined) {
+        throw new Error("edit: 'startLine'/'endLine' are not top-level parameters. For line-range edits, nest them inside the `edits` array: `edits: [{ startLine: N, endLine: M, content: \"...\" }]`. For find/replace, use `oldString`/`newString` instead.");
+      }
       if (Array.isArray(args.operations)) {
         const ops = args.operations;
         const files = ops.map((op) => op.file).filter(Boolean);
@@ -26185,12 +27026,9 @@ function createEditTool(ctx, writeToolName = "write") {
           params.replace_all = args.replaceAll;
         if (args.occurrence !== undefined)
           params.occurrence = args.occurrence;
-      } else if (typeof args.content === "string") {
-        command = "write";
-        params.content = args.content;
-        params.create_dirs = true;
       } else {
-        throw new Error("Provide 'oldString' + 'newString', 'symbol' + 'content', 'edits' array, or 'content' for write");
+        const hint = typeof args.content === "string" ? ` To write the whole file, use the '${writeToolName}' tool. To edit existing content, provide 'oldString' (and optionally 'newString'), 'symbol' + 'content', or an 'edits' array.` : " Provide 'oldString' (+ optional 'newString'), 'symbol' + 'content', 'edits' array, or 'operations' array.";
+        throw new Error(`edit: no edit mode resolved from arguments.${hint}`);
       }
       if (args.dryRun)
         params.dry_run = true;
@@ -26590,7 +27428,29 @@ function aftPrefixedTools(ctx) {
       ...aftEditTool,
       execute: async (args, context) => {
         const argRecord = args;
-        const normalizedArgs = argRecord.mode !== undefined && argRecord.filePath === undefined && typeof argRecord.file === "string" ? { ...argRecord, filePath: argRecord.file } : argRecord;
+        const normalizedArgs = argRecord.mode !== undefined && argRecord.filePath === undefined && typeof argRecord.file === "string" ? { ...argRecord, filePath: argRecord.file } : { ...argRecord };
+        if (normalizedArgs.mode === "write" && typeof normalizedArgs.filePath === "string" && typeof normalizedArgs.content === "string") {
+          const file2 = normalizedArgs.filePath;
+          const filePath = path4.isAbsolute(file2) ? file2 : path4.resolve(context.directory, file2);
+          const relPath = path4.relative(context.worktree, filePath);
+          await context.ask({
+            permission: "edit",
+            patterns: [relPath],
+            always: ["*"],
+            metadata: { filepath: filePath }
+          });
+          const writeParams = {
+            file: filePath,
+            content: normalizedArgs.content,
+            create_dirs: normalizedArgs.create_dirs !== false,
+            diagnostics: true
+          };
+          if (normalizedArgs.dryRun === true || normalizedArgs.dry_run === true) {
+            writeParams.dry_run = true;
+          }
+          const data = await callBridge(ctx, context, "write", writeParams);
+          return JSON.stringify(data);
+        }
         return aftEditTool.execute(normalizedArgs, context);
       }
     },
@@ -26692,7 +27552,8 @@ function lspTools(ctx) {
 ` + `}
 ` + `
 ` + `**Reading the response honestly:**
-` + "- `total: 0, complete: true, lsp_servers_used: [{status: 'pull_ok'}]` \u2192 file is genuinely clean.\n" + "- `total: 0, lsp_servers_used: []` \u2192 no server registered for this extension; nothing was checked.\n" + "- `lsp_servers_used: [{status: 'binary_not_installed: bash-language-server'}]` \u2192 install the server to get diagnostics.\n" + "- `complete: false` (directory mode) \u2192 some files in the directory weren't checked; see `unchecked_files`.",
+` + "- `total: 0, complete: true, lsp_servers_used: [{status: 'pull_ok'}]` \u2192 file is genuinely clean.\n" + "- `total: 0, lsp_servers_used: []` \u2192 **nothing was checked** (no server registered for this extension). Tell the user, don't claim 'no errors'.\n" + "- `lsp_servers_used: [{status: 'binary_not_installed: <name>'}]` \u2192 server matched the extension but its binary isn't on PATH. Tell the user to install it.\n" + "- `lsp_servers_used: [{status: 'no_root_marker (...)'}]` \u2192 server is registered but couldn't find a workspace root marker walking up from this file. The user's project layout doesn't match what the server expects.\n" + "- `complete: false` (directory mode) \u2192 some files in the directory weren't checked; see `unchecked_files`.\n" + `
+` + "**When this tool gives an unhelpful answer**, run `bunx --bun @cortexkit/aft doctor lsp <filePath>` from a terminal to get a full per-server breakdown (registered servers, binary resolution, root-marker resolution, spawn outcome).",
     args: {
       filePath: z5.string().optional().describe("Path to a file to check. Mutually exclusive with 'directory'. Omit both to dump all cached diagnostics."),
       directory: z5.string().optional().describe("Path to a directory. Returns cached diagnostics + workspace pull from active servers; lists files we have no info for in 'unchecked_files'. Capped at 200 walked files."),
@@ -26776,7 +27637,7 @@ function navigationTools(ctx) {
 
 // src/tools/reading.ts
 import { readdir } from "fs/promises";
-import { extname as extname2, join as join15, resolve as resolve6 } from "path";
+import { extname as extname2, join as join18, resolve as resolve8 } from "path";
 import { tool as tool7 } from "@opencode-ai/plugin";
 var OUTLINE_EXTENSIONS = new Set([
   ".ts",
@@ -26854,7 +27715,7 @@ function readingTools(ctx) {
         if (!dirArg && typeof args.filePath === "string" && !Array.isArray(args.files)) {
           try {
             const { stat } = await import("fs/promises");
-            const resolved = resolve6(context.directory, args.filePath);
+            const resolved = resolve8(context.directory, args.filePath);
             const st = await stat(resolved);
             if (st.isDirectory()) {
               dirArg = args.filePath;
@@ -26862,7 +27723,7 @@ function readingTools(ctx) {
           } catch {}
         }
         if (dirArg) {
-          const dirPath = resolve6(context.directory, dirArg);
+          const dirPath = resolve8(context.directory, dirArg);
           const files = await discoverSourceFiles(dirPath);
           if (files.length === 0) {
             return JSON.stringify({
@@ -26970,12 +27831,12 @@ async function discoverSourceFiles(dir, maxFiles = 200) {
         return;
       if (entry.isDirectory()) {
         if (!SKIP_DIRS.has(entry.name) && !entry.name.startsWith(".")) {
-          await walk(join15(current, entry.name));
+          await walk(join18(current, entry.name));
         }
       } else if (entry.isFile()) {
         const ext = extname2(entry.name).toLowerCase();
         if (OUTLINE_EXTENSIONS.has(ext)) {
-          files.push(join15(current, entry.name));
+          files.push(join18(current, entry.name));
         }
       }
     }
@@ -27548,6 +28409,7 @@ var ANNOUNCEMENT_FEATURES = [];
 var plugin = async (input) => {
   const binaryPath = await findBinary();
   const aftConfig = loadAftConfig(input.directory);
+  const autoUpdateAbort = new AbortController;
   const configOverrides = {};
   if (aftConfig.format_on_edit !== undefined)
     configOverrides.format_on_edit = aftConfig.format_on_edit;
@@ -27568,8 +28430,8 @@ var plugin = async (input) => {
   if (aftConfig.max_callgraph_files !== undefined)
     configOverrides.max_callgraph_files = aftConfig.max_callgraph_files;
   const isFastembedSemanticBackend = (aftConfig.semantic?.backend ?? "fastembed") === "fastembed";
-  const dataHome = process.env.XDG_DATA_HOME || join16(homedir8(), ".local", "share");
-  configOverrides.storage_dir = join16(dataHome, "opencode", "storage", "plugin", "aft");
+  const dataHome = process.env.XDG_DATA_HOME || join19(homedir10(), ".local", "share");
+  configOverrides.storage_dir = join19(dataHome, "opencode", "storage", "plugin", "aft");
   if (aftConfig.experimental_semantic_search && isFastembedSemanticBackend) {
     const storageDir2 = configOverrides.storage_dir;
     const ortDylibDir = await ensureOnnxRuntime(storageDir2).catch((err) => {
@@ -27703,10 +28565,10 @@ ${lines}
       return { show: false };
     }
     if (storageDir) {
-      const versionFile = join16(storageDir, "last_announced_version");
+      const versionFile = join19(storageDir, "last_announced_version");
       try {
-        if (existsSync12(versionFile)) {
-          const lastVersion = readFileSync6(versionFile, "utf-8").trim();
+        if (existsSync13(versionFile)) {
+          const lastVersion = readFileSync9(versionFile, "utf-8").trim();
           if (lastVersion === ANNOUNCEMENT_VERSION)
             return { show: false };
         }
@@ -27718,7 +28580,7 @@ ${lines}
     if (storageDir && ANNOUNCEMENT_VERSION) {
       try {
         mkdirSync10(storageDir, { recursive: true });
-        writeFileSync6(join16(storageDir, "last_announced_version"), ANNOUNCEMENT_VERSION);
+        writeFileSync9(join19(storageDir, "last_announced_version"), ANNOUNCEMENT_VERSION);
       } catch {}
     }
     return { success: true };
@@ -27801,6 +28663,11 @@ Install: ${getManualInstallHint()}`).catch(() => {});
   }
   return {
     tool: allTools,
+    event: createAutoUpdateCheckerHook(input, {
+      enabled: true,
+      autoUpdate: aftConfig.auto_update ?? true,
+      signal: autoUpdateAbort.signal
+    }),
     "command.execute.before": async (commandInput, _output) => {
       if (isTuiMode2() || commandInput.command !== STATUS_COMMAND) {
         return;
@@ -27849,6 +28716,7 @@ Install: ${getManualInstallHint()}`).catch(() => {});
       };
     },
     dispose: async () => {
+      autoUpdateAbort.abort();
       unregisterShutdown();
       await Promise.allSettled([abortInFlightAutoInstalls(), abortInFlightGithubInstalls()]);
       rpcServer.stop();