@cortexkit/aft-opencode 0.20.1 → 0.22.0

package/dist/index.js

@@ -7803,20 +7803,27 @@ var require_src2 = __commonJS((exports, module) => {
 });
 
 // src/index.ts
-import { existsSync as existsSync14, mkdirSync as mkdirSync11, readFileSync as readFileSync10, writeFileSync as writeFileSync11 } from "fs";
+import { existsSync as existsSync14, mkdirSync as mkdirSync12, readFileSync as readFileSync12, writeFileSync as writeFileSync11 } from "fs";
 import { createRequire as createRequire2 } from "module";
 import { homedir as homedir11 } from "os";
-import { join as join19 } from "path";
+import { join as join21 } from "path";
 
 // ../aft-bridge/dist/active-logger.js
-var active;
+var ACTIVE_LOGGER_SYMBOL = Symbol.for("aft-bridge-active-logger");
+function loggerGlobal() {
+  return globalThis;
+}
 function setActiveLogger(logger) {
-  active = logger;
+  loggerGlobal()[ACTIVE_LOGGER_SYMBOL] = logger;
+}
+function getActiveLogger() {
+  return loggerGlobal()[ACTIVE_LOGGER_SYMBOL];
 }
 function getLogFilePath() {
-  return active?.getLogFilePath?.();
+  return getActiveLogger()?.getLogFilePath?.();
 }
 function log(message, meta) {
+  const active = getActiveLogger();
   if (active) {
     active.log(message, meta);
   } else {
@@ -7824,6 +7831,7 @@ function log(message, meta) {
   }
 }
 function warn(message, meta) {
+  const active = getActiveLogger();
   if (active) {
     active.warn(message, meta);
   } else {
@@ -7831,6 +7839,7 @@ function warn(message, meta) {
   }
 }
 function error(message, meta) {
+  const active = getActiveLogger();
   if (active) {
     active.error(message, meta);
   } else {
@@ -7850,6 +7859,7 @@ function sessionError(sessionId, message) {
 import { spawn } from "child_process";
 import { homedir } from "os";
 import { join } from "path";
+import { StringDecoder } from "string_decoder";
 var DEFAULT_BRIDGE_TIMEOUT_MS = 30000;
 var SEMANTIC_TIMEOUT_SAFETY_MARGIN_MS = 5000;
 var MAX_STDOUT_BUFFER = 64 * 1024 * 1024;
@@ -7946,6 +7956,7 @@ class BinaryBridge {
   configureWarningClients = new Map;
   restartResetTimer = null;
   errorPrefix;
+  logger;
   constructor(binaryPath, cwd, options, configOverrides) {
     this.binaryPath = binaryPath;
     this.cwd = cwd;
@@ -7958,6 +7969,28 @@ class BinaryBridge {
     this.onBashCompletion = options?.onBashCompletion;
     this.onBashLongRunning = options?.onBashLongRunning;
     this.errorPrefix = options?.errorPrefix ?? "[aft-bridge]";
+    this.logger = options?.logger;
+  }
+  logVia(message, meta) {
+    const logger = this.logger ?? getActiveLogger();
+    if (logger)
+      logger.log(message, meta);
+    else
+      log(message, meta);
+  }
+  warnVia(message, meta) {
+    const logger = this.logger ?? getActiveLogger();
+    if (logger)
+      logger.warn(message, meta);
+    else
+      warn(message, meta);
+  }
+  errorVia(message, meta) {
+    const logger = this.logger ?? getActiveLogger();
+    if (logger)
+      logger.error(message, meta);
+    else
+      error(message, meta);
   }
   get restartCount() {
     return this._restartCount;
@@ -8066,8 +8099,8 @@ class BinaryBridge {
       return;
     if (configResult.warnings.length === 0)
       return;
+    const sessionId = typeof params.session_id === "string" ? params.session_id : undefined;
     try {
-      const sessionId = typeof params.session_id === "string" ? params.session_id : undefined;
       await this.onConfigureWarnings({
         projectRoot: this.cwd,
         sessionId,
@@ -8076,6 +8109,10 @@ class BinaryBridge {
       });
     } catch (err) {
       warn(`configure warning delivery failed: ${err instanceof Error ? err.message : String(err)}`);
+    } finally {
+      if (sessionId) {
+        this.configureWarningClients.delete(sessionId);
+      }
     }
   }
   async handleConfigureWarningsFrame(frame) {
@@ -8087,16 +8124,23 @@ class BinaryBridge {
     const projectRoot = typeof frame.project_root === "string" ? frame.project_root : this.cwd;
     const rawSessionId = frame.session_id;
     const sessionId = typeof rawSessionId === "string" && rawSessionId.length > 0 ? rawSessionId : null;
-    await this.onConfigureWarnings({
-      projectRoot,
-      sessionId,
-      client: sessionId ? this.configureWarningClients.get(sessionId) : undefined,
-      warnings
-    });
+    try {
+      await this.onConfigureWarnings({
+        projectRoot,
+        sessionId,
+        client: sessionId ? this.configureWarningClients.get(sessionId) : undefined,
+        warnings
+      });
+    } finally {
+      if (sessionId) {
+        this.configureWarningClients.delete(sessionId);
+      }
+    }
   }
   async shutdown() {
     this._shuttingDown = true;
     this.clearRestartResetTimer();
+    this.configureWarningClients.clear();
     this.rejectAllPending(new Error(`${this.errorPrefix} Bridge shutting down`));
     if (this.process) {
       const proc = this.process;
@@ -8120,10 +8164,12 @@ class BinaryBridge {
       return;
     try {
       const resp = await this.send("version");
+      if (resp.success === false) {
+        throw new Error(`Binary version check failed: ${String(resp.code ?? "unknown")} \u2014 likely too old`);
+      }
       const binaryVersion = resp.version;
-      if (!binaryVersion) {
-        log("Binary did not report a version \u2014 skipping version check");
-        return;
+      if (typeof binaryVersion !== "string") {
+        throw new Error(`Binary did not report a version \u2014 likely too old (minVersion: ${this.minVersion})`);
       }
       log(`Binary version: ${binaryVersion}`);
       if (compareSemver(binaryVersion, this.minVersion) < 0) {
@@ -8132,6 +8178,7 @@ class BinaryBridge {
       }
     } catch (err) {
       warn(`Version check failed: ${err.message}`);
+      throw err;
     }
   }
   ensureSpawned(triggeringSessionId) {
@@ -8173,19 +8220,23 @@ class BinaryBridge {
       env
     });
     const currentChild = child;
+    const stdoutDecoder = new StringDecoder("utf8");
     child.stdout?.on("data", (chunk) => {
-      this.onStdoutData(chunk.toString("utf-8"));
+      this.onStdoutData(stdoutDecoder.write(chunk));
     });
+    child.stdout?.on("end", () => {
+      const remaining = stdoutDecoder.end();
+      if (remaining)
+        this.onStdoutData(remaining);
+    });
+    const stderrDecoder = new StringDecoder("utf8");
     child.stderr?.on("data", (chunk) => {
-      const lines = chunk.toString("utf-8").trimEnd().split(`
-`);
-      for (const line of lines) {
-        if (!line)
-          continue;
-        const tagged = tagStderrLine(line);
-        log(tagged);
-        this.pushStderrLine(tagged);
-      }
+      this.onStderrData(stderrDecoder.write(chunk));
+    });
+    child.stderr?.on("end", () => {
+      const remaining = stderrDecoder.end();
+      if (remaining)
+        this.onStderrData(remaining);
     });
     child.on("error", (err) => {
       if (this.process !== currentChild)
@@ -8218,6 +8269,17 @@ class BinaryBridge {
       this.stderrTail.shift();
     }
   }
+  onStderrData(data) {
+    const lines = data.trimEnd().split(`
+`);
+    for (const line of lines) {
+      if (!line)
+        continue;
+      const tagged = tagStderrLine(line);
+      log(tagged);
+      this.pushStderrLine(tagged);
+    }
+  }
   formatStderrTail() {
     if (this.stderrTail.length === 0)
       return "";
@@ -8297,6 +8359,7 @@ class BinaryBridge {
     }
   }
   handleTimeout(triggeringSessionId) {
+    this.rejectAllPending(new Error(`${this.errorPrefix} bridge killed during sibling timeout \u2014 request aborted`));
     if (this.process) {
       this.process.kill("SIGKILL");
       this.process = null;
@@ -8625,23 +8688,23 @@ async function ensureOnnxRuntime(storageDir) {
   const onnxBaseDir = join3(storageDir, "onnxruntime");
   mkdirSync2(onnxBaseDir, { recursive: true });
   const lockPath = join3(onnxBaseDir, ONNX_LOCK_FILE);
-  cleanupAbandonedOnnxAttempts(onnxBaseDir, ortDir);
+  cleanupAbandonedStagingDirs(onnxBaseDir);
   if (!acquireLock(lockPath)) {
     warn(`ONNX Runtime install already in progress in another process (lock: ${lockPath}). Skipping.`);
     return null;
   }
   try {
+    cleanupIncompleteTargetIfUnowned(ortDir);
     return await downloadOnnxRuntime(info, ortDir);
   } finally {
     releaseLock(lockPath);
   }
 }
-function cleanupAbandonedOnnxAttempts(onnxBaseDir, ortDir) {
+function cleanupAbandonedStagingDirs(onnxBaseDir) {
   try {
     const entries = readdirSync(onnxBaseDir);
-    const ortDirBaseName = ortDir.slice(onnxBaseDir.length + 1);
     for (const entry of entries) {
-      if (!entry.startsWith(`${ortDirBaseName}.tmp.`))
+      if (!entry.startsWith(`${ORT_VERSION}.tmp.`))
         continue;
       const stagingDir = join3(onnxBaseDir, entry);
       const parts = entry.split(".");
@@ -8672,6 +8735,8 @@ function cleanupAbandonedOnnxAttempts(onnxBaseDir, ortDir) {
       }
     }
   } catch {}
+}
+function cleanupIncompleteTargetIfUnowned(ortDir) {
   try {
     if (existsSync2(ortDir) && !existsSync2(join3(ortDir, ONNX_INSTALLED_META_FILE))) {
       log(`[onnx] removing half-populated install dir ${ortDir} (no meta file)`);
@@ -8862,25 +8927,7 @@ async function downloadOnnxRuntime(info, targetDir) {
         realFiles.push(libFile);
       }
     }
-    for (const libFile of realFiles) {
-      const src = join3(extractedDir, libFile);
-      const dst = join3(targetDir, libFile);
-      try {
-        copyFileSync(src, dst);
-        if (process.platform !== "win32") {
-          chmodSync2(dst, 493);
-        }
-      } catch (copyErr) {
-        log(`ORT extract: failed to copy ${libFile}: ${copyErr}`);
-      }
-    }
-    for (const link of symlinks) {
-      const dst = join3(targetDir, link.name);
-      try {
-        unlinkSync2(dst);
-      } catch {}
-      symlinkSync(link.target, dst);
-    }
+    copyOnnxLibraries(info, extractedDir, targetDir, realFiles, symlinks);
     const libPath = join3(targetDir, info.libName);
     let libHash = null;
     try {
@@ -8903,6 +8950,45 @@ async function downloadOnnxRuntime(info, targetDir) {
     return null;
   }
 }
+function copyOnnxLibraries(info, extractedDir, targetDir, realFiles, symlinks, copyFile = copyFileSync) {
+  const requiredLibs = new Set([info.libName]);
+  for (const libFile of realFiles) {
+    const src = join3(extractedDir, libFile);
+    const dst = join3(targetDir, libFile);
+    try {
+      copyFile(src, dst);
+      if (process.platform !== "win32") {
+        chmodSync2(dst, 493);
+      }
+    } catch (copyErr) {
+      if (requiredLibs.has(libFile)) {
+        rmSync(targetDir, { recursive: true, force: true });
+        throw copyErr;
+      }
+      log(`ORT extract: failed to copy optional ${libFile}: ${copyErr}`);
+    }
+  }
+  for (const link of symlinks) {
+    const dst = join3(targetDir, link.name);
+    try {
+      unlinkSync2(dst);
+    } catch {}
+    try {
+      symlinkSync(link.target, dst);
+    } catch (symlinkErr) {
+      if (requiredLibs.has(link.name)) {
+        rmSync(targetDir, { recursive: true, force: true });
+        throw symlinkErr;
+      }
+      log(`ORT extract: failed to symlink optional ${link.name}: ${symlinkErr}`);
+    }
+  }
+  const requiredPath = join3(targetDir, info.libName);
+  if (!existsSync2(requiredPath)) {
+    rmSync(targetDir, { recursive: true, force: true });
+    throw new Error(`Required ONNX Runtime library missing after install: ${requiredPath}`);
+  }
+}
 async function extractZipArchive(archivePath, destinationDir) {
   if (process.platform === "win32") {
     execFileSync("tar.exe", ["-xf", archivePath, "-C", destinationDir], {
@@ -9086,11 +9172,13 @@ class BridgePool {
   idleTimeoutMs;
   bridgeOptions;
   configOverrides;
+  logger;
   cleanupTimer = null;
   constructor(binaryPath, options = {}, configOverrides = {}) {
     this.binaryPath = binaryPath;
     this.maxPoolSize = options.maxPoolSize ?? DEFAULT_MAX_POOL_SIZE;
     this.idleTimeoutMs = options.idleTimeoutMs ?? DEFAULT_IDLE_TIMEOUT_MS;
+    this.logger = options.logger;
     this.bridgeOptions = {
       timeoutMs: options.timeoutMs,
       maxRestarts: options.maxRestarts,
@@ -9134,8 +9222,10 @@ class BridgePool {
   cleanup() {
     const now = Date.now();
     for (const [dir, entry] of this.bridges) {
+      if (entry.bridge.hasPendingRequests())
+        continue;
       if (now - entry.lastUsed > this.idleTimeoutMs) {
-        entry.bridge.shutdown().catch((err) => error("cleanup shutdown failed:", err));
+        entry.bridge.shutdown().catch((err) => this.error("cleanup shutdown failed:", err));
         this.bridges.delete(dir);
       }
     }
@@ -9144,6 +9234,8 @@ class BridgePool {
     let oldestDir = null;
     let oldestTime = Infinity;
     for (const [dir, entry] of this.bridges) {
+      if (entry.bridge.hasPendingRequests())
+        continue;
       if (entry.lastUsed < oldestTime) {
         oldestTime = entry.lastUsed;
         oldestDir = dir;
@@ -9151,7 +9243,7 @@ class BridgePool {
     }
     if (oldestDir) {
       const entry = this.bridges.get(oldestDir);
-      entry?.bridge.shutdown().catch((err) => error("eviction shutdown failed:", err));
+      entry?.bridge.shutdown().catch((err) => this.error("eviction shutdown failed:", err));
       this.bridges.delete(oldestDir);
     }
   }
@@ -9169,7 +9261,21 @@ class BridgePool {
     const shutdowns = Array.from(this.bridges.values()).map((entry) => entry.bridge.shutdown());
     this.bridges.clear();
     await Promise.allSettled(shutdowns);
-    log(`Binary path updated to ${newPath}. All bridges cleared \u2014 next calls will use the new binary.`);
+    this.log(`Binary path updated to ${newPath}. All bridges cleared \u2014 next calls will use the new binary.`);
+  }
+  log(message, meta) {
+    const logger = this.logger ?? getActiveLogger();
+    if (logger)
+      logger.log(message, meta);
+    else
+      log(message, meta);
+  }
+  error(message, meta) {
+    const logger = this.logger ?? getActiveLogger();
+    if (logger)
+      logger.error(message, meta);
+    else
+      error(message, meta);
   }
   setConfigureOverride(key, value) {
     if (value === undefined) {
@@ -9289,7 +9395,7 @@ async function findBinary(expectedVersion) {
     return syncResult;
   }
   log("Binary not found locally, attempting auto-download...");
-  const downloaded = await ensureBinary();
+  const downloaded = await ensureBinary(expectedVersion);
   if (downloaded)
     return downloaded;
   throw new Error([
@@ -9853,16 +9959,6 @@ async function resolvePromptContext(client, sessionId) {
     return null;
   return result;
 }
-async function getLastAssistantModel(client, sessionId) {
-  const ctx = await resolvePromptContext(client, sessionId);
-  if (!ctx?.model)
-    return null;
-  return {
-    providerID: ctx.model.providerID,
-    modelID: ctx.model.modelID,
-    ...ctx.variant ? { variant: ctx.variant } : {}
-  };
-}
 
 // src/bg-notifications.ts
 var sessionBgStates = new Map;
@@ -9932,6 +10028,13 @@ async function appendInTurnBgCompletions(drainContext, output) {
   output.output = appendReminder(output.output ?? "", reminder);
   state.pendingCompletions = [];
   state.pendingLongRunning = [];
+  if (state.debounceTimer) {
+    clearTimeout(state.debounceTimer);
+    state.debounceTimer = null;
+    state.firstCompletionAt = null;
+    state.scheduledFireAt = null;
+    state.scheduledCompletionCount = 0;
+  }
 }
 async function handleIdleBgCompletions(drainContext) {
   await triggerWakeIfPending(drainContext, false);
@@ -9973,9 +10076,6 @@ async function triggerWakeIfPending(drainContext, skipDrain) {
     sessionWarn2(drainContext.sessionID, `${LOG_PREFIX} wake send failed: ${err instanceof Error ? err.message : String(err)}`);
   });
 }
-function resetBgWake(sessionID) {
-  stateFor(sessionID).wakeFiredThisIdle = false;
-}
 function formatSystemReminder(completions) {
   const bullets = completions.map((completion) => formatCompletion(completion)).join(`
 `);
@@ -10056,16 +10156,17 @@ function scheduleWake(state, sendWake, onSendFailure) {
   state.debounceTimer = setTimeout(() => {
     const pending = state.pendingCompletions;
     const pendingLongRunning = state.pendingLongRunning;
-    const reminder = formatCombinedSystemReminder(pending, pendingLongRunning);
-    state.pendingCompletions = [];
-    state.pendingLongRunning = [];
     state.debounceTimer = null;
     state.firstCompletionAt = null;
     state.scheduledFireAt = null;
     state.scheduledCompletionCount = 0;
+    if (pending.length === 0 && pendingLongRunning.length === 0)
+      return;
+    const reminder = formatCombinedSystemReminder(pending, pendingLongRunning);
+    state.pendingCompletions = [];
+    state.pendingLongRunning = [];
     sendWake(reminder).then(() => {
       state.retryDelayMs = null;
-      state.wakeFiredThisIdle = true;
     }).catch((err) => {
       state.pendingCompletions = [...pending, ...state.pendingCompletions];
       state.pendingLongRunning = [...pendingLongRunning, ...state.pendingLongRunning];
@@ -10087,7 +10188,6 @@ function stateFor(sessionID) {
       pendingCompletions: [],
       pendingLongRunning: [],
       debounceTimer: null,
-      wakeFiredThisIdle: false,
       firstCompletionAt: null,
       scheduledFireAt: null,
       scheduledCompletionCount: 0,
@@ -21134,7 +21234,7 @@ function finalize(ctx, schema) {
     result.$schema = "http://json-schema.org/draft-07/schema#";
   } else if (ctx.target === "draft-04") {
     result.$schema = "http://json-schema.org/draft-04/schema#";
-  } else if (ctx.target === "openapi-3.0") {} else {}
+  } else if (ctx.target === "openapi-3.0") {}
   if (ctx.external?.uri) {
     const id = ctx.external.registry.get(schema)?.id;
     if (!id)
@@ -21382,7 +21482,7 @@ var literalProcessor = (schema, ctx, json, _params) => {
     if (val === undefined) {
       if (ctx.unrepresentable === "throw") {
         throw new Error("Literal `undefined` cannot be represented in JSON Schema");
-      } else {}
+      }
     } else if (typeof val === "bigint") {
       if (ctx.unrepresentable === "throw") {
         throw new Error("BigInt literals cannot be represented in JSON Schema");
@@ -24211,7 +24311,8 @@ import { dirname as dirname4, join as join11 } from "path";
 // src/hooks/auto-update-checker/cache.ts
 var import_comment_json3 = __toESM(require_src2(), 1);
 import { spawn as spawn2 } from "child_process";
-import { existsSync as existsSync7, readFileSync as readFileSync5, rmSync as rmSync2, writeFileSync as writeFileSync5 } from "fs";
+import { cpSync, existsSync as existsSync7, mkdtempSync, readFileSync as readFileSync5, rmSync as rmSync2, writeFileSync as writeFileSync5 } from "fs";
+import { tmpdir as tmpdir2 } from "os";
 import { basename, dirname as dirname3, join as join10 } from "path";
 
 // src/hooks/auto-update-checker/checker.ts
@@ -24462,6 +24563,42 @@ async function getLatestVersion(channel = "latest", options = {}) {
 }
 
 // src/hooks/auto-update-checker/cache.ts
+var pendingSnapshots = new Map;
+function createAutoUpdateSnapshot(installDir, packageJsonPath, packageName) {
+  const packageDir = join10(installDir, "node_modules", packageName);
+  const lockfilePath = join10(installDir, "package-lock.json");
+  const tempDir = mkdtempSync(join10(tmpdir2(), "aft-auto-update-"));
+  const stagedPackageDir = existsSync7(packageDir) ? join10(tempDir, "package") : null;
+  if (stagedPackageDir)
+    cpSync(packageDir, stagedPackageDir, { recursive: true });
+  return {
+    packageJsonPath,
+    packageJson: existsSync7(packageJsonPath) ? readFileSync5(packageJsonPath, "utf-8") : null,
+    lockfilePath,
+    lockfile: existsSync7(lockfilePath) ? readFileSync5(lockfilePath, "utf-8") : null,
+    packageDir,
+    stagedPackageDir,
+    tempDir
+  };
+}
+function restoreAutoUpdateSnapshot(snapshot) {
+  try {
+    if (snapshot.packageJson === null)
+      rmSync2(snapshot.packageJsonPath, { force: true });
+    else
+      writeFileSync5(snapshot.packageJsonPath, snapshot.packageJson);
+    if (snapshot.lockfile === null)
+      rmSync2(snapshot.lockfilePath, { force: true });
+    else
+      writeFileSync5(snapshot.lockfilePath, snapshot.lockfile);
+    rmSync2(snapshot.packageDir, { recursive: true, force: true });
+    if (snapshot.stagedPackageDir) {
+      cpSync(snapshot.stagedPackageDir, snapshot.packageDir, { recursive: true });
+    }
+  } finally {
+    rmSync2(snapshot.tempDir, { recursive: true, force: true });
+  }
+}
 function stripPackageNameFromPath(pathValue, packageName) {
   let current = pathValue;
   for (const segment of [...packageName.split("/")].reverse()) {
@@ -24553,8 +24690,13 @@ function preparePackageUpdate(version2, packageName = PACKAGE_NAME, runtimePacka
       warn2("[auto-update-checker] No install context found for auto-update");
       return null;
     }
-    if (!ensureDependencyVersion(installContext.packageJsonPath, packageName, version2))
+    const snapshot = createAutoUpdateSnapshot(installContext.installDir, installContext.packageJsonPath, packageName);
+    pendingSnapshots.set(installContext.installDir, snapshot);
+    if (!ensureDependencyVersion(installContext.packageJsonPath, packageName, version2)) {
+      pendingSnapshots.delete(installContext.installDir);
+      restoreAutoUpdateSnapshot(snapshot);
       return null;
+    }
     const packageRemoved = removeInstalledPackage(installContext.installDir, packageName);
     const lockRemoved = removeFromPackageLock(installContext.installDir, packageName);
     if (!packageRemoved && !lockRemoved) {
@@ -24573,7 +24715,7 @@ async function runNpmInstallSafe(installDir, options = {}) {
       return false;
     const proc = spawn2("npm", ["install", "--no-audit", "--no-fund", "--no-progress"], {
       cwd: installDir,
-      stdio: "pipe"
+      stdio: "ignore"
     });
     const abortProcess = () => {
       try {
@@ -24592,10 +24734,27 @@ async function runNpmInstallSafe(installDir, options = {}) {
     options.signal?.removeEventListener("abort", abortProcess);
     if (result === "timeout" || options.signal?.aborted) {
       abortProcess();
+      const snapshot2 = pendingSnapshots.get(installDir);
+      if (snapshot2) {
+        pendingSnapshots.delete(installDir);
+        restoreAutoUpdateSnapshot(snapshot2);
+      }
       return false;
     }
+    const snapshot = pendingSnapshots.get(installDir);
+    pendingSnapshots.delete(installDir);
+    if (!result && snapshot) {
+      restoreAutoUpdateSnapshot(snapshot);
+    } else if (snapshot) {
+      rmSync2(snapshot.tempDir, { recursive: true, force: true });
+    }
     return result;
   } catch (err) {
+    const snapshot = pendingSnapshots.get(installDir);
+    if (snapshot) {
+      pendingSnapshots.delete(installDir);
+      restoreAutoUpdateSnapshot(snapshot);
+    }
     warn2(`[auto-update-checker] npm install error: ${String(err)}`);
     return false;
   } finally {
@@ -24759,7 +24918,8 @@ function showToast(ctx, title, message, variant = "info", duration3 = 3000) {
 // src/lsp-auto-install.ts
 import { spawn as spawn3 } from "child_process";
 import { createHash as createHash3 } from "crypto";
-import { createReadStream, statSync as statSync4 } from "fs";
+import { createReadStream, mkdirSync as mkdirSync7, readFileSync as readFileSync8, renameSync as renameSync4, rmSync as rmSync3, statSync as statSync4 } from "fs";
+import { join as join14 } from "path";
 
 // src/lsp-cache.ts
 import {
@@ -25443,6 +25603,50 @@ function hashInstalledBinary(spec) {
     stream.on("end", () => resolve3(hash2.digest("hex")));
   });
 }
+function installedBinaryPath(spec) {
+  const candidates = process.platform === "win32" ? [
+    lspBinaryPath(spec.npm, spec.binary),
+    lspBinaryPath(spec.npm, `${spec.binary}.cmd`),
+    lspBinaryPath(spec.npm, `${spec.binary}.exe`),
+    lspBinaryPath(spec.npm, `${spec.binary}.bat`)
+  ] : [lspBinaryPath(spec.npm, spec.binary)];
+  for (const candidate of candidates) {
+    try {
+      if (statSync4(candidate).isFile())
+        return candidate;
+    } catch {}
+  }
+  return null;
+}
+function sha256OfFileSync(path2) {
+  return createHash3("sha256").update(readFileSync8(path2)).digest("hex");
+}
+function quarantineCachedNpmInstall(spec, reason) {
+  const packageDir = lspPackageDir(spec.npm);
+  const dest = join14(packageDir, "..", ".quarantine", encodeURIComponent(spec.npm), `${Date.now()}`);
+  warn2(`[lsp] tofu_mismatch ${spec.npm}: ${reason}; quarantining ${packageDir} -> ${dest}`);
+  try {
+    mkdirSync7(join14(dest, ".."), { recursive: true });
+    rmSync3(dest, { recursive: true, force: true });
+    renameSync4(packageDir, dest);
+  } catch (err) {
+    warn2(`[lsp] tofu_mismatch ${spec.npm}: failed to quarantine cache entry: ${err}`);
+  }
+}
+function validateCachedNpmInstall(spec) {
+  const meta3 = readInstalledMeta(spec.npm);
+  const binaryPath = installedBinaryPath(spec);
+  if (!meta3?.sha256 || !meta3.version || !isSafeVersion(meta3.version) || !binaryPath) {
+    quarantineCachedNpmInstall(spec, "missing/unsafe metadata or binary");
+    return false;
+  }
+  const currentHash = sha256OfFileSync(binaryPath);
+  if (currentHash !== meta3.sha256) {
+    quarantineCachedNpmInstall(spec, `recorded ${meta3.sha256}, current ${currentHash}`);
+    return false;
+  }
+  return true;
+}
 function runAutoInstall(projectRoot, config2, fetchImpl = fetch) {
   const cachedBinDirs = [];
   const skipped = [];
@@ -25455,7 +25659,7 @@ function runAutoInstall(projectRoot, config2, fetchImpl = fetch) {
     return projectExtensions;
   };
   for (const spec of NPM_LSP_TABLE) {
-    if (isInstalled(spec.npm, spec.binary)) {
+    if (isInstalled(spec.npm, spec.binary) && validateCachedNpmInstall(spec)) {
       cachedBinDirs.push(lspBinDir(spec.npm));
     }
     if (config2.disabled.has(spec.id)) {
@@ -25507,16 +25711,17 @@ import {
   createWriteStream as createWriteStream2,
   existsSync as existsSync10,
   lstatSync as lstatSync2,
-  mkdirSync as mkdirSync7,
+  mkdirSync as mkdirSync8,
   readdirSync as readdirSync4,
+  readFileSync as readFileSync9,
   readlinkSync as readlinkSync2,
   realpathSync as realpathSync3,
-  renameSync as renameSync4,
-  rmSync as rmSync3,
+  renameSync as renameSync5,
+  rmSync as rmSync4,
   statSync as statSync5,
   unlinkSync as unlinkSync6
 } from "fs";
-import { dirname as dirname5, join as join14, relative as relative2, resolve as resolve3 } from "path";
+import { dirname as dirname5, join as join15, relative as relative2, resolve as resolve3 } from "path";
 import { Readable as Readable2 } from "stream";
 import { pipeline as pipeline2 } from "stream/promises";
 
@@ -25606,25 +25811,25 @@ function detectHostPlatform() {
 
 // src/lsp-github-install.ts
 function ghCacheRoot() {
-  return join14(aftCacheBase(), "lsp-binaries");
+  return join15(aftCacheBase(), "lsp-binaries");
 }
 function ghPackageDir(spec) {
-  return join14(ghCacheRoot(), spec.id);
+  return join15(ghCacheRoot(), spec.id);
 }
 function ghBinDir(spec) {
-  return join14(ghPackageDir(spec), "bin");
+  return join15(ghPackageDir(spec), "bin");
 }
 function ghExtractDir(spec) {
-  return join14(ghPackageDir(spec), "extracted");
+  return join15(ghPackageDir(spec), "extracted");
 }
 function ghBinaryPath(spec, platform2) {
   const ext = platform2 === "win32" ? ".exe" : "";
-  return join14(ghBinDir(spec), `${spec.binary}${ext}`);
+  return join15(ghBinDir(spec), `${spec.binary}${ext}`);
 }
 function isGithubInstalled(spec, platform2) {
   for (const candidate of ghBinaryCandidates(spec, platform2)) {
     try {
-      if (statSync5(join14(ghBinDir(spec), candidate)).isFile())
+      if (statSync5(join15(ghBinDir(spec), candidate)).isFile())
         return true;
     } catch {}
   }
@@ -25646,6 +25851,9 @@ function sha256OfFile(path2) {
     stream.on("end", () => resolve4(hash2.digest("hex")));
   });
 }
+function sha256OfFileSync2(path2) {
+  return createHash4("sha256").update(readFileSync9(path2)).digest("hex");
+}
 async function fetchReleaseByTag(githubRepo, tag, fetchImpl, signal) {
   const candidates = [];
   candidates.push(tag);
@@ -25666,11 +25874,7 @@ async function fetchReleaseByTag(githubRepo, tag, fetchImpl, signal) {
     const url2 = `https://api.github.com/repos/${githubRepo}/releases/tags/${encodeURIComponent(candidate)}`;
     const timeout = controlledTimeoutSignal(15000, signal);
     try {
-      const res = await fetchImpl(url2, {
-        headers,
-        redirect: "follow",
-        signal: timeout.signal
-      });
+      const res = await fetchJsonFollowingRedirects(url2, headers, fetchImpl, timeout.signal);
       if (res.status === 404)
         continue;
       if (!res.ok) {
@@ -25700,6 +25904,23 @@ async function fetchReleaseByTag(githubRepo, tag, fetchImpl, signal) {
   }
   return null;
 }
+async function fetchJsonFollowingRedirects(url2, headers, fetchImpl, signal) {
+  const maxRedirects = 5;
+  let currentUrl = url2;
+  for (let i = 0;i <= maxRedirects; i += 1) {
+    assertAllowedDownloadUrl(currentUrl);
+    const res = await fetchImpl(currentUrl, { headers, redirect: "manual", signal });
+    if (res.status >= 300 && res.status < 400) {
+      const location = res.headers.get("location");
+      if (!location)
+        throw new Error(`redirect status ${res.status} without Location`);
+      currentUrl = new URL(location, currentUrl).toString();
+      continue;
+    }
+    return res;
+  }
+  throw new Error(`too many redirects (>${maxRedirects})`);
+}
 async function resolveTargetTag(spec, config2, fetchImpl, signal) {
   const pinned = config2.versions[spec.githubRepo];
   if (pinned) {
@@ -25794,17 +26015,12 @@ function assertAllowedDownloadUrl(rawUrl) {
   return parsed;
 }
 async function downloadFile(url2, destPath, fetchImpl, assetSize, signal) {
-  assertAllowedDownloadUrl(url2);
   if (assetSize !== undefined && assetSize > MAX_DOWNLOAD_BYTES2) {
     throw new Error(`asset size ${assetSize} exceeds max ${MAX_DOWNLOAD_BYTES2} (set lsp.versions to pin a smaller release if this is wrong)`);
   }
   const timeout = controlledTimeoutSignal(120000, signal);
   try {
-    const res = await fetchImpl(url2, {
-      headers: { accept: "application/octet-stream" },
-      redirect: "follow",
-      signal: timeout.signal
-    });
+    const res = await fetchFollowingRedirects(url2, fetchImpl, timeout.signal);
     if (!res.ok || !res.body) {
       throw new Error(`download failed (${res.status})`);
     }
@@ -25812,7 +26028,7 @@ async function downloadFile(url2, destPath, fetchImpl, assetSize, signal) {
     if (Number.isFinite(advertised) && advertised > MAX_DOWNLOAD_BYTES2) {
       throw new Error(`Content-Length ${advertised} exceeds max ${MAX_DOWNLOAD_BYTES2}`);
     }
-    mkdirSync7(dirname5(destPath), { recursive: true });
+    mkdirSync8(dirname5(destPath), { recursive: true });
     let bytesWritten = 0;
     const guard = new TransformStream({
       transform(chunk, controller) {
@@ -25836,6 +26052,27 @@ async function downloadFile(url2, destPath, fetchImpl, assetSize, signal) {
     timeout.cleanup();
   }
 }
+async function fetchFollowingRedirects(url2, fetchImpl, signal) {
+  const maxRedirects = 5;
+  let currentUrl = url2;
+  for (let i = 0;i <= maxRedirects; i += 1) {
+    assertAllowedDownloadUrl(currentUrl);
+    const res = await fetchImpl(currentUrl, {
+      headers: { accept: "application/octet-stream" },
+      redirect: "manual",
+      signal
+    });
+    if (res.status >= 300 && res.status < 400) {
+      const location = res.headers.get("location");
+      if (!location)
+        throw new Error(`redirect status ${res.status} without Location`);
+      currentUrl = new URL(location, currentUrl).toString();
+      continue;
+    }
+    return res;
+  }
+  throw new Error(`too many redirects (>${maxRedirects})`);
+}
 function validateExtraction(stagingRoot) {
   const realStagingRoot = realpathSync3(stagingRoot);
   let totalBytes = 0;
@@ -25847,7 +26084,7 @@ function validateExtraction(stagingRoot) {
       throw new Error(`failed to read staging dir ${dir}: ${err}`);
     }
     for (const entry of entries) {
-      const full = join14(dir, entry);
+      const full = join15(dir, entry);
       let lst;
       try {
         lst = lstatSync2(full);
@@ -25885,27 +26122,83 @@ function validateExtraction(stagingRoot) {
   };
   walk(realStagingRoot);
 }
+function precheckArchiveSize(archivePath, archiveType) {
+  let totalBytes = 0;
+  if (archiveType === "zip") {
+    const out = execFileSync2("unzip", ["-l", archivePath], { encoding: "utf8" });
+    const match = out.match(/^\s*(\d+)\s+\d+\s+files?\s*$/m);
+    if (match)
+      totalBytes = Number.parseInt(match[1] ?? "0", 10);
+  } else {
+    const out = execFileSync2("tar", ["-tvf", archivePath], { encoding: "utf8" });
+    for (const line of out.split(`
+`)) {
+      const parts = line.trim().split(/\s+/);
+      if (parts.length >= 6) {
+        const numeric = parts.map((part) => Number.parseInt(part, 10)).filter((value) => Number.isFinite(value) && value >= 0);
+        if (numeric.length > 0)
+          totalBytes += Math.max(...numeric);
+      }
+    }
+  }
+  if (totalBytes > MAX_EXTRACT_BYTES2) {
+    throw new Error(`archive uncompressed size ${totalBytes} exceeds ${MAX_EXTRACT_BYTES2}`);
+  }
+}
 function extractArchiveSafely(archivePath, destDir, archiveType) {
   const suffix = randomBytes(8).toString("hex");
   const stagingDir = `${destDir}.staging-${suffix}`;
   try {
-    rmSync3(stagingDir, { recursive: true, force: true });
+    rmSync4(stagingDir, { recursive: true, force: true });
   } catch {}
-  mkdirSync7(stagingDir, { recursive: true });
+  mkdirSync8(stagingDir, { recursive: true });
   try {
+    precheckArchiveSize(archivePath, archiveType);
     runPlatformExtractor(archivePath, stagingDir, archiveType);
     validateExtraction(stagingDir);
     try {
-      rmSync3(destDir, { recursive: true, force: true });
+      rmSync4(destDir, { recursive: true, force: true });
     } catch {}
-    renameSync4(stagingDir, destDir);
+    renameSync5(stagingDir, destDir);
   } catch (err) {
     try {
-      rmSync3(stagingDir, { recursive: true, force: true });
+      rmSync4(stagingDir, { recursive: true, force: true });
     } catch {}
     throw err;
   }
 }
+function quarantineCachedGithubInstall(spec, reason) {
+  const packageDir = ghPackageDir(spec);
+  const dest = join15(ghCacheRoot(), ".quarantine", encodeURIComponent(spec.id), `${Date.now()}`);
+  warn2(`[lsp] tofu_mismatch ${spec.id}: ${reason}; quarantining ${packageDir} -> ${dest}`);
+  try {
+    mkdirSync8(dirname5(dest), { recursive: true });
+    rmSync4(dest, { recursive: true, force: true });
+    renameSync5(packageDir, dest);
+  } catch (err) {
+    warn2(`[lsp] tofu_mismatch ${spec.id}: failed to quarantine cache entry: ${err}`);
+  }
+}
+function validateCachedGithubInstall(spec, platform2) {
+  const meta3 = readInstalledMetaIn(ghPackageDir(spec));
+  const binaryPath = ghBinaryCandidates(spec, platform2).map((candidate) => join15(ghBinDir(spec), candidate)).find((candidate) => {
+    try {
+      return statSync5(candidate).isFile();
+    } catch {
+      return false;
+    }
+  });
+  if (!meta3?.sha256 || !meta3.version || !isSafeVersion(meta3.version) || !binaryPath) {
+    quarantineCachedGithubInstall(spec, "missing/unsafe metadata or binary");
+    return false;
+  }
+  const currentHash = sha256OfFileSync2(binaryPath);
+  if (currentHash !== meta3.sha256) {
+    quarantineCachedGithubInstall(spec, `recorded ${meta3.sha256}, current ${currentHash}`);
+    return false;
+  }
+  return true;
+}
 function runPlatformExtractor(archivePath, destDir, archiveType) {
   if (archiveType === "zip") {
     if (process.platform === "win32") {
@@ -25951,7 +26244,7 @@ async function downloadAndInstall(spec, tag, assets, platform2, arch, fetchImpl,
   }
   const pkgDir = ghPackageDir(spec);
   const extractDir = ghExtractDir(spec);
-  const archivePath = join14(pkgDir, expected.name);
+  const archivePath = join15(pkgDir, expected.name);
   log2(`[lsp] downloading ${spec.id} ${tag} \u2192 ${matchingAsset.url}`);
   try {
     await downloadFile(matchingAsset.url, archivePath, fetchImpl, matchingAsset.size, signal);
@@ -25990,13 +26283,13 @@ async function downloadAndInstall(spec, tag, assets, platform2, arch, fetchImpl,
       unlinkSync6(archivePath);
     } catch {}
   }
-  const innerBinaryPath = join14(extractDir, spec.binaryPathInArchive(platform2, arch, version2));
+  const innerBinaryPath = join15(extractDir, spec.binaryPathInArchive(platform2, arch, version2));
   if (!existsSync10(innerBinaryPath)) {
     error2(`[lsp] ${spec.id}: extracted binary not found at ${innerBinaryPath}`);
     return null;
   }
   const targetBinary = ghBinaryPath(spec, platform2);
-  mkdirSync7(dirname5(targetBinary), { recursive: true });
+  mkdirSync8(dirname5(targetBinary), { recursive: true });
   try {
     copyFileSync3(innerBinaryPath, targetBinary);
     if (platform2 !== "win32") {
@@ -26087,7 +26380,7 @@ function runGithubAutoInstall(relevantServers, config2, fetchImpl = fetch) {
     };
   }
   for (const spec of GITHUB_LSP_TABLE) {
-    if (isGithubInstalled(spec, host.platform)) {
+    if (isGithubInstalled(spec, host.platform) && validateCachedGithubInstall(spec, host.platform)) {
       cachedBinDirs.push(ghBinDir(spec));
     }
     if (config2.disabled.has(spec.id)) {
@@ -26236,9 +26529,9 @@ function normalizeToolMap(tools) {
 }
 
 // src/notifications.ts
-import { existsSync as existsSync11, mkdirSync as mkdirSync8, readFileSync as readFileSync8, writeFileSync as writeFileSync8 } from "fs";
+import { existsSync as existsSync11, mkdirSync as mkdirSync9, readFileSync as readFileSync10, renameSync as renameSync6, rmSync as rmSync5, writeFileSync as writeFileSync8 } from "fs";
 import { homedir as homedir9, platform as platform2 } from "os";
-import { join as join15 } from "path";
+import { join as join16 } from "path";
 function isTuiMode() {
   return process.env.OPENCODE_CLIENT === "cli";
 }
@@ -26262,15 +26555,15 @@ function getDesktopStatePath() {
   const os2 = platform2();
   const home = homedir9();
   if (os2 === "darwin") {
-    return join15(home, "Library", "Application Support", "ai.opencode.desktop", "opencode.global.dat");
+    return join16(home, "Library", "Application Support", "ai.opencode.desktop", "opencode.global.dat");
   }
   if (os2 === "linux") {
-    const xdgConfig = process.env.XDG_CONFIG_HOME || join15(home, ".config");
-    return join15(xdgConfig, "ai.opencode.desktop", "opencode.global.dat");
+    const xdgConfig = process.env.XDG_CONFIG_HOME || join16(home, ".config");
+    return join16(xdgConfig, "ai.opencode.desktop", "opencode.global.dat");
   }
   if (os2 === "win32") {
-    const appData = process.env.APPDATA || join15(home, "AppData", "Roaming");
-    return join15(appData, "ai.opencode.desktop", "opencode.global.dat");
+    const appData = process.env.APPDATA || join16(home, "AppData", "Roaming");
+    return join16(appData, "ai.opencode.desktop", "opencode.global.dat");
   }
   return null;
 }
@@ -26280,7 +26573,7 @@ function readDesktopState(directory) {
     return { sessionId: null, serverUrl: null };
   }
   try {
-    const raw = readFileSync8(statePath, "utf-8");
+    const raw = readFileSync10(statePath, "utf-8");
     const state = JSON.parse(raw);
     let serverUrl = null;
     const serverStr = state.server;
@@ -26374,10 +26667,10 @@ async function sendWarning(opts, message) {
 }
 async function sendFeatureAnnouncement(opts, version2, features, storageDir) {
   if (storageDir) {
-    const versionFile = join15(storageDir, "last_announced_version");
+    const versionFile = join16(storageDir, "last_announced_version");
     try {
       if (existsSync11(versionFile)) {
-        const lastVersion = readFileSync8(versionFile, "utf-8").trim();
+        const lastVersion = readFileSync10(versionFile, "utf-8").trim();
         if (lastVersion === version2)
           return;
       }
@@ -26397,17 +26690,17 @@ async function sendFeatureAnnouncement(opts, version2, features, storageDir) {
   }
   if (storageDir) {
     try {
-      mkdirSync8(storageDir, { recursive: true });
-      writeFileSync8(join15(storageDir, "last_announced_version"), version2);
+      mkdirSync9(storageDir, { recursive: true });
+      writeFileSync8(join16(storageDir, "last_announced_version"), version2);
     } catch {}
   }
 }
 function readWarnedTools(storageDir) {
   try {
-    const warnedToolsPath = join15(storageDir, WARNED_TOOLS_FILE);
+    const warnedToolsPath = join16(storageDir, WARNED_TOOLS_FILE);
     if (!existsSync11(warnedToolsPath))
       return {};
-    const parsed = JSON.parse(readFileSync8(warnedToolsPath, "utf-8"));
+    const parsed = JSON.parse(readFileSync10(warnedToolsPath, "utf-8"));
     if (!parsed || typeof parsed !== "object" || Array.isArray(parsed))
       return {};
     const warned = {};
@@ -26423,12 +26716,34 @@ function readWarnedTools(storageDir) {
 }
 function writeWarnedTools(storageDir, warned) {
   try {
-    mkdirSync8(storageDir, { recursive: true });
-    const warnedToolsPath = join15(storageDir, WARNED_TOOLS_FILE);
-    writeFileSync8(warnedToolsPath, `${JSON.stringify(warned, null, 2)}
+    mkdirSync9(storageDir, { recursive: true });
+    const warnedToolsPath = join16(storageDir, WARNED_TOOLS_FILE);
+    const tmpPath = join16(storageDir, `${WARNED_TOOLS_FILE}.${process.pid}.${Date.now()}.${Math.random().toString(16).slice(2)}.tmp`);
+    writeFileSync8(tmpPath, `${JSON.stringify(warned, null, 2)}
 `);
+    renameSync6(tmpPath, warnedToolsPath);
   } catch {}
 }
+async function withWarnedToolsLock(storageDir, fn) {
+  const lockDir = join16(storageDir, "warned_tools.lock");
+  for (let attempt = 0;attempt < 5; attempt++) {
+    try {
+      mkdirSync9(storageDir, { recursive: true });
+      mkdirSync9(lockDir, { mode: 448 });
+      try {
+        return await fn();
+      } finally {
+        rmSync5(lockDir, { recursive: true, force: true });
+      }
+    } catch (err) {
+      const code = err.code;
+      if (code !== "EEXIST")
+        return null;
+      await new Promise((resolve4) => setTimeout(resolve4, 10 * (attempt + 1)));
+    }
+  }
+  return null;
+}
 function warningKey(warning, projectRoot) {
   const scope = warning.kind === "lsp_binary_missing" ? "_" : projectRoot ?? "_";
   return [
@@ -26467,20 +26782,29 @@ ${warning.hint}`;
 async function deliverConfigureWarnings(opts, warnings) {
   if (warnings.length === 0)
     return;
-  const warned = readWarnedTools(opts.storageDir);
-  let changed = false;
+  const deliveredWithLock = await withWarnedToolsLock(opts.storageDir, async () => {
+    const warned = readWarnedTools(opts.storageDir);
+    let changed = false;
+    for (const warning of warnings) {
+      const key = warningKey(warning, opts.projectRoot);
+      if (Object.hasOwn(warned, key))
+        continue;
+      const delivered = await sendIgnoredMessage(opts.client, opts.sessionId, formatConfigureWarning(warning));
+      if (!delivered)
+        continue;
+      warned[key] = opts.pluginVersion;
+      changed = true;
+    }
+    if (changed) {
+      const merged = { ...readWarnedTools(opts.storageDir), ...warned };
+      writeWarnedTools(opts.storageDir, merged);
+    }
+    return true;
+  });
+  if (deliveredWithLock)
+    return;
   for (const warning of warnings) {
-    const key = warningKey(warning, opts.projectRoot);
-    if (Object.hasOwn(warned, key))
-      continue;
-    const delivered = await sendIgnoredMessage(opts.client, opts.sessionId, formatConfigureWarning(warning));
-    if (!delivered)
-      continue;
-    warned[key] = opts.pluginVersion;
-    changed = true;
-  }
-  if (changed) {
-    writeWarnedTools(opts.storageDir, warned);
+    await sendIgnoredMessage(opts.client, opts.sessionId, formatConfigureWarning(warning));
   }
 }
 async function cleanupWarnings(opts) {
@@ -26518,20 +26842,20 @@ async function cleanupWarnings(opts) {
 
 // src/shared/rpc-server.ts
 import { randomBytes as randomBytes2 } from "crypto";
-import { mkdirSync as mkdirSync9, renameSync as renameSync5, unlinkSync as unlinkSync7, writeFileSync as writeFileSync9 } from "fs";
+import { mkdirSync as mkdirSync10, renameSync as renameSync7, unlinkSync as unlinkSync7, writeFileSync as writeFileSync9 } from "fs";
 import { createServer } from "http";
 import { dirname as dirname6 } from "path";
 
 // src/shared/rpc-utils.ts
 import { createHash as createHash5 } from "crypto";
-import { join as join16 } from "path";
+import { join as join17 } from "path";
 function projectHash(directory) {
   const normalized = directory.replace(/\/+$/, "");
   return createHash5("sha256").update(normalized).digest("hex").slice(0, 16);
 }
 function rpcPortFilePath(storageDir, directory) {
   const hash2 = projectHash(directory);
-  return join16(storageDir, "rpc", hash2, "port");
+  return join17(storageDir, "rpc", hash2, "port");
 }
 
 // src/shared/rpc-server.ts
@@ -26565,10 +26889,13 @@ class AftRpcServer {
         this.server = server;
         try {
           const dir = dirname6(this.portFilePath);
-          mkdirSync9(dir, { recursive: true });
+          mkdirSync10(dir, { recursive: true, mode: 448 });
           const tmpPath = `${this.portFilePath}.tmp`;
-          writeFileSync9(tmpPath, JSON.stringify({ port: this.port, token: this.token }), "utf-8");
-          renameSync5(tmpPath, this.portFilePath);
+          writeFileSync9(tmpPath, JSON.stringify({ port: this.port, token: this.token }), {
+            encoding: "utf-8",
+            mode: 384
+          });
+          renameSync7(tmpPath, this.portFilePath);
           log2(`RPC server listening on 127.0.0.1:${this.port}`);
         } catch (err) {
           warn2(`Failed to write RPC port file: ${err}`);
@@ -26645,18 +26972,6 @@ class AftRpcServer {
   }
 }
 
-// src/shared/runtime.ts
-var GLOBAL_KEY = "__AFT_SHARED_BRIDGE_POOL__";
-function getGlobalState() {
-  return globalThis;
-}
-function setSharedBridgePool(pool) {
-  getGlobalState()[GLOBAL_KEY] = pool;
-}
-function clearSharedBridgePool() {
-  getGlobalState()[GLOBAL_KEY] = null;
-}
-
 // src/shared/session-directory.ts
 var CACHE_MAX_ENTRIES = 200;
 var cache = new Map;
@@ -26863,21 +27178,21 @@ function formatStatusMarkdown(status) {
 
 // src/shared/tui-config.ts
 var import_comment_json4 = __toESM(require_src2(), 1);
-import { existsSync as existsSync12, mkdirSync as mkdirSync10, readFileSync as readFileSync9, writeFileSync as writeFileSync10 } from "fs";
-import { dirname as dirname7, join as join18 } from "path";
+import { existsSync as existsSync12, mkdirSync as mkdirSync11, readFileSync as readFileSync11, writeFileSync as writeFileSync10 } from "fs";
+import { dirname as dirname7, join as join19 } from "path";
 
 // src/shared/opencode-config-dir.ts
 import { homedir as homedir10 } from "os";
-import { join as join17, resolve as resolve4 } from "path";
+import { join as join18, resolve as resolve4 } from "path";
 function getCliConfigDir() {
   const envConfigDir = process.env.OPENCODE_CONFIG_DIR?.trim();
   if (envConfigDir) {
     return resolve4(envConfigDir);
   }
   if (process.platform === "win32") {
-    return join17(homedir10(), ".config", "opencode");
+    return join18(homedir10(), ".config", "opencode");
   }
-  return join17(process.env.XDG_CONFIG_HOME || join17(homedir10(), ".config"), "opencode");
+  return join18(process.env.XDG_CONFIG_HOME || join18(homedir10(), ".config"), "opencode");
 }
 function getOpenCodeConfigDir2(_options) {
   return getCliConfigDir();
@@ -26886,10 +27201,10 @@ function getOpenCodeConfigPaths(options) {
   const configDir = getOpenCodeConfigDir2(options);
   return {
     configDir,
-    configJson: join17(configDir, "opencode.json"),
-    configJsonc: join17(configDir, "opencode.jsonc"),
-    packageJson: join17(configDir, "package.json"),
-    omoConfig: join17(configDir, "magic-context.jsonc")
+    configJson: join18(configDir, "opencode.json"),
+    configJsonc: join18(configDir, "opencode.jsonc"),
+    packageJson: join18(configDir, "package.json"),
+    omoConfig: join18(configDir, "magic-context.jsonc")
   };
 }
 
@@ -26898,8 +27213,8 @@ var PLUGIN_NAME = "@cortexkit/aft-opencode";
 var PLUGIN_ENTRY = `${PLUGIN_NAME}@latest`;
 function resolveTuiConfigPath() {
   const configDir = getOpenCodeConfigPaths({ binary: "opencode" }).configDir;
-  const jsoncPath = join18(configDir, "tui.jsonc");
-  const jsonPath = join18(configDir, "tui.json");
+  const jsoncPath = join19(configDir, "tui.jsonc");
+  const jsonPath = join19(configDir, "tui.json");
   if (existsSync12(jsoncPath))
     return jsoncPath;
   if (existsSync12(jsonPath))
@@ -26911,7 +27226,7 @@ function ensureTuiPluginEntry() {
     const configPath = resolveTuiConfigPath();
     let config2 = {};
     if (existsSync12(configPath)) {
-      config2 = import_comment_json4.parse(readFileSync9(configPath, "utf-8")) ?? {};
+      config2 = import_comment_json4.parse(readFileSync11(configPath, "utf-8")) ?? {};
     }
     const plugins = Array.isArray(config2.plugin) ? config2.plugin.filter((value) => typeof value === "string") : [];
     if (plugins.some((plugin) => plugin === PLUGIN_NAME || plugin.startsWith(`${PLUGIN_NAME}@`) || plugin.includes("opencode-plugin") || plugin.includes("aft-opencode"))) {
@@ -26919,7 +27234,7 @@ function ensureTuiPluginEntry() {
     }
     plugins.push(PLUGIN_ENTRY);
     config2.plugin = plugins;
-    mkdirSync10(dirname7(configPath), { recursive: true });
+    mkdirSync11(dirname7(configPath), { recursive: true });
     writeFileSync10(configPath, `${import_comment_json4.stringify(config2, null, 2)}
 `);
     log2(`[aft-plugin] added TUI plugin entry to ${configPath}`);
@@ -26931,13 +27246,13 @@ function ensureTuiPluginEntry() {
 }
 
 // src/shutdown-hooks.ts
-var GLOBAL_KEY2 = "__aftShutdownHooks__";
+var GLOBAL_KEY = "__aftShutdownHooks__";
 function getState() {
   const g = globalThis;
-  if (!g[GLOBAL_KEY2]) {
-    g[GLOBAL_KEY2] = { cleanups: new Set, installed: false };
+  if (!g[GLOBAL_KEY]) {
+    g[GLOBAL_KEY] = { cleanups: new Set, installed: false };
   }
-  return g[GLOBAL_KEY2];
+  return g[GLOBAL_KEY];
 }
 var shuttingDown = false;
 async function runCleanups(reason) {
@@ -27039,8 +27354,10 @@ async function callBridge(ctx, runtime, command, params = {}, options) {
 }
 
 // src/tools/permissions.ts
+import * as fs3 from "fs";
 import * as path3 from "path";
 import { Effect } from "effect";
+var UNSUPPORTED_ASK_HOST = "AFT requires OpenCode 1.14.39 or newer for permission asks; please upgrade OpenCode";
 async function runAsk(maybe) {
   await Effect.runPromise(maybe);
 }
@@ -27068,6 +27385,8 @@ function workspacePattern(_context) {
   return ".";
 }
 async function askEditPermission(context, patterns, metadata = {}) {
+  if (typeof context.ask !== "function")
+    return UNSUPPORTED_ASK_HOST;
   try {
     await runAsk(context.ask({
       permission: "edit",
@@ -27083,6 +27402,110 @@ async function askEditPermission(context, patterns, metadata = {}) {
     return "Permission denied.";
   }
 }
+function containsPath(parent, child) {
+  if (!parent)
+    return false;
+  const rel = path3.relative(parent, child);
+  return rel === "" || !rel.startsWith("..") && !path3.isAbsolute(rel);
+}
+function windowsPath(p) {
+  if (process.platform !== "win32")
+    return p;
+  return p.replace(/^\/([a-zA-Z]):(?:[\\/]|$)/, (_, drive) => `${drive.toUpperCase()}:/`).replace(/^\/([a-zA-Z])(?:\/|$)/, (_, drive) => `${drive.toUpperCase()}:/`).replace(/^\/cygdrive\/([a-zA-Z])(?:\/|$)/, (_, drive) => `${drive.toUpperCase()}:/`).replace(/^\/mnt\/([a-zA-Z])(?:\/|$)/, (_, drive) => `${drive.toUpperCase()}:/`);
+}
+function normalizePath(p) {
+  if (process.platform !== "win32")
+    return p;
+  const resolved = path3.resolve(windowsPath(p));
+  try {
+    return fs3.realpathSync.native(resolved);
+  } catch {
+    return resolved;
+  }
+}
+function normalizePathPattern(p) {
+  if (process.platform !== "win32")
+    return p;
+  if (p === "*" || p === "**")
+    return p;
+  const match = p.match(/^(.*)[\\/](\*{1,2})$/);
+  if (!match)
+    return normalizePath(p);
+  const dir = /^[A-Za-z]:$/.test(match[1]) ? `${match[1]}\\` : match[1];
+  return path3.join(normalizePath(dir), match[2]);
+}
+async function assertExternalDirectoryPermission(context, target, options) {
+  if (!target)
+    return;
+  if (typeof context.ask !== "function")
+    return UNSUPPORTED_ASK_HOST;
+  const resolved = path3.isAbsolute(target) ? target : path3.resolve(context.directory, target);
+  const absoluteTarget = normalizePath(resolved);
+  const directory = context.directory ? normalizePath(context.directory) : context.directory;
+  const rawWorktree = context.worktree;
+  const worktree = rawWorktree && rawWorktree !== "/" ? normalizePath(rawWorktree) : rawWorktree;
+  if (directory && containsPath(directory, absoluteTarget))
+    return;
+  if (worktree && worktree !== "/" && worktree !== directory && containsPath(worktree, absoluteTarget)) {
+    return;
+  }
+  const kind = options?.kind ?? "file";
+  const parentDir = kind === "directory" ? absoluteTarget : path3.dirname(absoluteTarget);
+  const rawGlob = process.platform === "win32" ? normalizePathPattern(path3.join(parentDir, "*")) : path3.join(parentDir, "*").replaceAll("\\", "/");
+  try {
+    await runAsk(context.ask({
+      permission: "external_directory",
+      patterns: [rawGlob],
+      always: [rawGlob],
+      metadata: {
+        filepath: absoluteTarget,
+        parentDir
+      }
+    }));
+    return;
+  } catch (error50) {
+    if (error50 instanceof Error && error50.message) {
+      return error50.message;
+    }
+    return "Permission denied (external directory).";
+  }
+}
+async function askGrepPermission(context, pattern, metadata = {}) {
+  if (typeof context.ask !== "function")
+    return UNSUPPORTED_ASK_HOST;
+  try {
+    await runAsk(context.ask({
+      permission: "grep",
+      patterns: [pattern],
+      always: ["*"],
+      metadata: { pattern, ...metadata }
+    }));
+    return;
+  } catch (error50) {
+    if (error50 instanceof Error && error50.message) {
+      return error50.message;
+    }
+    return "Permission denied (grep).";
+  }
+}
+async function askGlobPermission(context, pattern, metadata = {}) {
+  if (typeof context.ask !== "function")
+    return UNSUPPORTED_ASK_HOST;
+  try {
+    await runAsk(context.ask({
+      permission: "glob",
+      patterns: [pattern],
+      always: ["*"],
+      metadata: { pattern, ...metadata }
+    }));
+    return;
+  } catch (error50) {
+    if (error50 instanceof Error && error50.message) {
+      return error50.message;
+    }
+    return "Permission denied (glob).";
+  }
+}
 function permissionDeniedResponse(message) {
   return JSON.stringify({
     success: false,
@@ -27102,6 +27525,17 @@ function extractHint(response) {
   const hint = response.hint;
   return typeof hint === "string" && hint.length > 0 ? hint : null;
 }
+async function checkAstPathsPermission(context, paths) {
+  if (!Array.isArray(paths))
+    return;
+  const uniquePaths = Array.from(new Set(paths.filter((p) => typeof p === "string" && p.length > 0)));
+  for (const p of uniquePaths) {
+    const denial = await assertExternalDirectoryPermission(context, p, { kind: "directory" });
+    if (denial)
+      return denial;
+  }
+  return;
+}
 var SUPPORTED_LANGS = ["typescript", "tsx", "javascript", "python", "rust", "go"];
 function astTools(ctx) {
   const searchTool = {
@@ -27122,6 +27556,9 @@ function astTools(ctx) {
       contextLines: z2.number().optional().describe("Number of context lines to show around each match")
     },
     execute: async (args, context) => {
+      const externalDenied = await checkAstPathsPermission(context, args.paths);
+      if (externalDenied)
+        return permissionDeniedResponse(externalDenied);
       const params = {
         pattern: args.pattern,
         lang: args.lang
@@ -27215,16 +27652,32 @@ ${hint}`;
     },
     execute: async (args, context) => {
       const isDryRun = args.dryRun === true;
+      const externalDenied = await checkAstPathsPermission(context, args.paths);
+      if (externalDenied)
+        return permissionDeniedResponse(externalDenied);
       if (!isDryRun) {
+        const paths = Array.isArray(args.paths) ? args.paths : ["."];
+        if (!Array.isArray(args.paths)) {
+          const asked = new Set;
+          for (const targetPath of paths) {
+            const absPath = resolveAbsolutePath(context, targetPath);
+            if (asked.has(absPath))
+              continue;
+            asked.add(absPath);
+            const denial = await assertExternalDirectoryPermission(context, absPath, {
+              kind: "directory"
+            });
+            if (denial)
+              return permissionDeniedResponse(denial);
+          }
+        }
         const explicitPaths = Array.isArray(args.paths) ? resolveRelativePatterns(context, args.paths) : [];
         const positiveGlobs = Array.isArray(args.globs) ? args.globs.filter((glob) => !glob.startsWith("!")) : [];
         const patterns = [...explicitPaths, ...positiveGlobs];
         const metadata = explicitPaths.length === 1 && positiveGlobs.length === 0 && Array.isArray(args.paths) ? { filepath: resolveAbsolutePath(context, args.paths[0]) } : {};
         const permissionError = await askEditPermission(context, patterns.length > 0 ? patterns : [workspacePattern(context)], metadata);
         if (permissionError) {
-          const output2 = `Permission denied: ${permissionError}`;
-          showOutputToUser(context, output2);
-          return output2;
+          return permissionDeniedResponse(permissionError);
         }
       }
       const params = {
@@ -27358,7 +27811,7 @@ function conflictTools(ctx) {
 }
 
 // src/tools/hoisted.ts
-import * as fs3 from "fs";
+import * as fs4 from "fs";
 import * as path4 from "path";
 import { tool as tool4 } from "@opencode-ai/plugin";
 
@@ -27655,11 +28108,65 @@ ${chunk.old_lines.join(`
 
 // src/tools/bash.ts
 import { tool as tool3 } from "@opencode-ai/plugin";
+
+// src/shared/subagent-detect.ts
+var CACHE_MAX_ENTRIES2 = 200;
+var cache2 = new Map;
+async function resolveIsSubagent(client, sessionId, _fallbackDirectory) {
+  if (!sessionId) {
+    sessionLog2(undefined, "[subagent-detect] no sessionId provided \u2192 primary");
+    return false;
+  }
+  const cached2 = cache2.get(sessionId);
+  if (cached2) {
+    cache2.delete(sessionId);
+    cache2.set(sessionId, cached2);
+    sessionLog2(sessionId, `[subagent-detect] cache hit: isSubagent=${cached2.isSubagent}`);
+    return cached2.isSubagent;
+  }
+  const c = client;
+  const sessionApi = c?.session;
+  if (!sessionApi || typeof sessionApi.get !== "function") {
+    sessionLog2(sessionId, `[subagent-detect] client.session.get unavailable (client=${typeof client}, session=${typeof sessionApi}, get=${typeof sessionApi?.get}) \u2192 caching as primary`);
+    setCache2(sessionId, false);
+    return false;
+  }
+  sessionLog2(sessionId, `[subagent-detect] cache miss, calling client.session.get(id=${sessionId})`);
+  let isSubagent = false;
+  let parentIdRaw;
+  try {
+    const result = await sessionApi.get({
+      path: { id: sessionId }
+    });
+    const session = result?.data ?? result;
+    parentIdRaw = session?.parentID;
+    isSubagent = session !== undefined && typeof session.parentID === "string" && session.parentID.length > 0;
+    sessionLog2(sessionId, `[subagent-detect] SDK returned session=${session !== undefined ? "present" : "undefined"}, parentID=${JSON.stringify(parentIdRaw)} \u2192 isSubagent=${isSubagent}`);
+  } catch (err) {
+    sessionWarn2(sessionId, `[subagent-detect] SDK lookup failed: ${err instanceof Error ? err.message : String(err)}`);
+    return false;
+  }
+  setCache2(sessionId, isSubagent);
+  return isSubagent;
+}
+function setCache2(sessionId, isSubagent) {
+  if (cache2.has(sessionId))
+    cache2.delete(sessionId);
+  cache2.set(sessionId, { isSubagent, recordedAt: Date.now() });
+  if (cache2.size > CACHE_MAX_ENTRIES2) {
+    const oldest = cache2.keys().next().value;
+    if (oldest !== undefined)
+      cache2.delete(oldest);
+  }
+}
+
+// src/tools/bash.ts
 var z3 = tool3.schema;
 var METADATA_PREVIEW_LIMIT = 30 * 1024;
 var FOREGROUND_WAIT_WINDOW_MS = 5000;
 var FOREGROUND_POLL_INTERVAL_MS = 100;
 var BASH_TRANSPORT_TIMEOUT_MS = 30000;
+var DEFAULT_HARD_TIMEOUT_MS = 30 * 60 * 1000;
 var BASH_DESCRIPTION = `Hoisted bash tool with output compression, command rewriting to AFT tools, and optional background execution. By default, output is compressed; pass compressed: false for raw output. Pass background: true to spawn in the background and get a task_id for bash_status/bash_kill.`;
 async function withPermissionLoop(ctx, runtime, params, bridgeCall, options) {
   const first = await bridgeCall(ctx, runtime, "bash", params, options);
@@ -27700,6 +28207,13 @@ function createBashTool(ctx) {
       const metadata = context.metadata;
       const command = args.command;
       const cwd = args.workdir ?? context.directory;
+      const isSubagent = await resolveIsSubagent(ctx.client, context.sessionID, context.directory);
+      const requestedBackground = args.background === true;
+      const effectiveBackground = isSubagent ? false : requestedBackground;
+      sessionLog2(context.sessionID, `[bash] subagent gate: isSubagent=${isSubagent}, requestedBackground=${requestedBackground}, effectiveBackground=${effectiveBackground}, hasTimeout=${typeof args.timeout === "number"}`);
+      if (isSubagent && requestedBackground) {
+        sessionLog2(context.sessionID, "[bash] subagent + background:true \u2192 converting to foreground (subagent would lose task_id)");
+      }
       const shellEnv = await ctx.plugin?.trigger?.("shell.env", { cwd, sessionID: context.sessionID, callID: getCallID(context) }, { env: {} });
       const data = await withPermissionLoop(ctx, context, {
         command,
@@ -27707,8 +28221,8 @@ function createBashTool(ctx) {
         workdir: args.workdir,
         env: shellEnv?.env ?? {},
         description,
-        background: args.background,
-        notify_on_completion: args.background === true,
+        background: effectiveBackground,
+        notify_on_completion: effectiveBackground,
         compressed: args.compressed,
         permissions_requested: true
       }, callBridge, {
@@ -27725,7 +28239,7 @@ function createBashTool(ctx) {
       if (data.status === "running" && typeof data.task_id === "string") {
         const callID2 = getCallID(context);
         const taskId = data.task_id;
-        if (args.background === true) {
+        if (effectiveBackground) {
           trackBgTask(context.sessionID, taskId);
           const startedLine = formatBackgroundLaunch(taskId);
           const metadataPayload2 = { description, output: startedLine, status: "running", taskId };
@@ -27739,7 +28253,7 @@ function createBashTool(ctx) {
           return startedLine;
         }
         const argTimeout = args.timeout;
-        const waitTimeoutMs = argTimeout !== undefined ? Math.min(argTimeout, FOREGROUND_WAIT_WINDOW_MS) : FOREGROUND_WAIT_WINDOW_MS;
+        const waitTimeoutMs = isSubagent ? argTimeout ?? DEFAULT_HARD_TIMEOUT_MS : argTimeout !== undefined ? Math.min(argTimeout, FOREGROUND_WAIT_WINDOW_MS) : FOREGROUND_WAIT_WINDOW_MS;
         const startedAt = Date.now();
         while (true) {
           const status = await callBridge(ctx, context, "bash_status", { task_id: taskId });
@@ -27820,7 +28334,7 @@ function createBashStatusTool(ctx) {
   return {
     description: "Check the status and captured output of a background bash task spawned with bash({ background: true }). Returns status (running | completed | failed | killed | timed_out), exit code, duration, and a preview of captured output.",
     args: {
-      taskId: z3.string().describe("Background task ID returned by bash({ background: true }), e.g. bgb-6b454047.")
+      taskId: z3.string().describe("Background task ID returned by bash({ background: true }), e.g. bash-6b454047.")
     },
     execute: async (args, context) => {
       const data = await callBridge(ctx, context, "bash_status", {
@@ -27850,7 +28364,7 @@ function createBashKillTool(ctx) {
   return {
     description: "Terminate a running background bash task spawned with bash({ background: true }). Returns confirmation of kill or an error if the task already finished.",
     args: {
-      taskId: z3.string().describe("Background task ID returned by bash({ background: true }), e.g. bgb-6b454047.")
+      taskId: z3.string().describe("Background task ID returned by bash({ background: true }), e.g. bash-6b454047.")
     },
     execute: async (args, context) => {
       const data = await callBridge(ctx, context, "bash_kill", {
@@ -28161,12 +28675,23 @@ function createReadTool(ctx) {
     execute: async (args, context) => {
       const file2 = args.filePath;
       const filePath = path4.isAbsolute(file2) ? file2 : path4.resolve(context.directory, file2);
-      await runAsk(context.ask({
-        permission: "read",
-        patterns: [filePath],
-        always: ["*"],
-        metadata: {}
-      }));
+      {
+        const denial = await assertExternalDirectoryPermission(context, filePath);
+        if (denial)
+          return permissionDeniedResponse(denial);
+      }
+      try {
+        await runAsk(context.ask({
+          permission: "read",
+          patterns: [filePath],
+          always: ["*"],
+          metadata: {}
+        }));
+      } catch (error50) {
+        if (error50 instanceof Error && error50.message)
+          return permissionDeniedResponse(error50.message);
+        return permissionDeniedResponse("Permission denied.");
+      }
       const ext = path4.extname(filePath).toLowerCase();
       const mimeMap = {
         ".png": "image/png",
@@ -28189,7 +28714,7 @@ function createReadTool(ctx) {
         const label = isImage ? "Image" : "PDF";
         let fileSize = 0;
         try {
-          const stat = await import("fs/promises").then((fs4) => fs4.stat(filePath));
+          const stat = await import("fs/promises").then((fs5) => fs5.stat(filePath));
           fileSize = stat.size;
         } catch {}
         const sizeStr = fileSize > 1048576 ? `${(fileSize / 1048576).toFixed(1)}MB` : fileSize > 1024 ? `${(fileSize / 1024).toFixed(0)}KB` : `${fileSize} bytes`;
@@ -28285,6 +28810,11 @@ function createWriteTool(ctx, editToolName = "edit") {
       const content = args.content;
       const filePath = path4.isAbsolute(file2) ? file2 : path4.resolve(context.directory, file2);
       const relPath = path4.relative(context.worktree, filePath);
+      {
+        const denial = await assertExternalDirectoryPermission(context, filePath);
+        if (denial)
+          return permissionDeniedResponse(denial);
+      }
       await runAsk(context.ask({
         permission: "edit",
         patterns: [relPath],
@@ -28405,9 +28935,9 @@ Note: Modes 6 and 7 are options on mode 5 (find/replace) \u2014 they require \`o
 - Auto-formats using project formatter if configured
 - Tree-sitter syntax validation on all edits
 - Symbol replace includes decorators, attributes, and doc comments in range
-- LSP error-level diagnostics are returned automatically after non-dry-run edits
+- LSP error-level diagnostics are returned automatically after edits
 
-Returns: JSON string for the selected edit mode. Dry runs return diff data; non-dry-run edits may append inline LSP error lines.
+Returns: JSON string for the selected edit mode. Edits may append inline LSP error lines.
 
 Common response fields: success (boolean), diff (object with before/after), backup_id (string), syntax_valid (boolean). Exact fields vary by mode.`;
 }
@@ -28424,8 +28954,7 @@ function createEditTool(ctx, writeToolName = "write") {
       content: z4.string().optional().describe("New content for symbol replace or file write"),
       appendContent: z4.string().optional().describe("Text to append to the end of filePath; creates the file if needed"),
       edits: z4.array(z4.record(z4.string(), z4.unknown())).optional().describe("Batch edits \u2014 array of { oldString: string, newString: string } or { startLine: number (1-based), endLine: number (1-based, inclusive), content: string }"),
-      operations: z4.array(z4.record(z4.string(), z4.unknown())).optional().describe("Transaction \u2014 array of { file: string, command: 'edit_match' | 'write', match?: string, replacement?: string, content?: string } for multi-file edits with rollback. Note: uses 'file'/'match'/'replacement' (not filePath/oldString/newString)"),
-      dryRun: z4.boolean().optional().describe("Preview changes without applying (returns diff, default: false)")
+      operations: z4.array(z4.record(z4.string(), z4.unknown())).optional().describe("Transaction \u2014 array of { file: string, command: 'edit_match' | 'write', match?: string, replacement?: string, content?: string } for multi-file edits with rollback. Note: uses 'file'/'match'/'replacement' (not filePath/oldString/newString)")
     },
     execute: async (args, context) => {
       const argsRecord = args;
@@ -28435,6 +28964,18 @@ function createEditTool(ctx, writeToolName = "write") {
       if (Array.isArray(args.operations)) {
         const ops = args.operations;
         const files = ops.map((op) => op.file).filter(Boolean);
+        {
+          const asked = new Set;
+          for (const file3 of files) {
+            const absPath = path4.isAbsolute(file3) ? file3 : path4.resolve(context.directory, file3);
+            if (asked.has(absPath))
+              continue;
+            asked.add(absPath);
+            const denial = await assertExternalDirectoryPermission(context, absPath);
+            if (denial)
+              return permissionDeniedResponse(denial);
+          }
+        }
         await runAsk(context.ask({
           permission: "edit",
           patterns: files.map((f) => path4.relative(context.worktree, path4.resolve(context.directory, f))),
@@ -28445,9 +28986,7 @@ function createEditTool(ctx, writeToolName = "write") {
           ...op,
           file: path4.isAbsolute(op.file) ? op.file : path4.resolve(context.directory, op.file)
         }));
-        const params2 = { operations: resolvedOps };
-        params2.dry_run = args.dryRun === true;
-        const data2 = await callBridge(ctx, context, "transaction", params2);
+        const data2 = await callBridge(ctx, context, "transaction", { operations: resolvedOps });
         return JSON.stringify(data2);
       }
       const file2 = args.filePath;
@@ -28455,6 +28994,11 @@ function createEditTool(ctx, writeToolName = "write") {
         throw new Error("'filePath' parameter is required");
       const filePath = path4.isAbsolute(file2) ? file2 : path4.resolve(context.directory, file2);
       const relPath = path4.relative(context.worktree, filePath);
+      {
+        const denial = await assertExternalDirectoryPermission(context, filePath);
+        if (denial)
+          return permissionDeniedResponse(denial);
+      }
       await runAsk(context.ask({
         permission: "edit",
         patterns: [relPath],
@@ -28503,14 +29047,10 @@ function createEditTool(ctx, writeToolName = "write") {
         const hint = typeof args.content === "string" ? ` To write the whole file, use the '${writeToolName}' tool. To edit existing content, provide 'oldString' (and optionally 'newString'), 'symbol' + 'content', or an 'edits' array.` : " Provide 'oldString' (+ optional 'newString'), 'symbol' + 'content', 'edits' array, or 'operations' array.";
         throw new Error(`edit: no edit mode resolved from arguments.${hint}`);
       }
-      if (args.dryRun)
-        params.dry_run = true;
-      if (!args.dryRun)
-        params.diagnostics = true;
-      if (!args.dryRun)
-        params.include_diff = true;
+      params.diagnostics = true;
+      params.include_diff = true;
       const data = await callBridge(ctx, context, command, params);
-      if (!args.dryRun && data.success && data.diff) {
+      if (data.success && data.diff) {
         const diff = data.diff;
         const callID = getCallID2(context);
         if (callID) {
@@ -28539,31 +29079,29 @@ function createEditTool(ctx, writeToolName = "write") {
         result += `
 
 ${globSkipNote}`;
-      if (!args.dryRun) {
-        const diags = data.lsp_diagnostics;
-        if (diags && diags.length > 0) {
-          const errors3 = diags.filter((d) => d.severity === "error");
-          if (errors3.length > 0) {
-            const diagLines = errors3.map((d) => `  Line ${d.line}: ${d.message}`).join(`
+      const diags = data.lsp_diagnostics;
+      if (diags && diags.length > 0) {
+        const errors3 = diags.filter((d) => d.severity === "error");
+        if (errors3.length > 0) {
+          const diagLines = errors3.map((d) => `  Line ${d.line}: ${d.message}`).join(`
 `);
-            result += `
+          result += `
 
 LSP errors detected, please fix:
 ${diagLines}`;
-          }
         }
-        const pendingServers = data.lsp_pending_servers;
-        const exitedServers = data.lsp_exited_servers;
-        if (pendingServers && pendingServers.length > 0) {
-          result += `
+      }
+      const pendingServers = data.lsp_pending_servers;
+      const exitedServers = data.lsp_exited_servers;
+      if (pendingServers && pendingServers.length > 0) {
+        result += `
 
 Note: LSP server(s) did not respond in time: ${pendingServers.join(", ")}. Diagnostics may be incomplete; rerun lsp_diagnostics later for a fresh check.`;
-        }
-        if (exitedServers && exitedServers.length > 0) {
-          result += `
+      }
+      if (exitedServers && exitedServers.length > 0) {
+        result += `
 
 Note: LSP server(s) exited during this edit: ${exitedServers.join(", ")}. Their diagnostics could not be collected.`;
-        }
       }
       return result;
     }
@@ -28650,13 +29188,24 @@ function createApplyPatchTool(ctx) {
         if (h.type === "update" && h.move_path) {
           const dstAbs = path4.resolve(context.directory, h.move_path);
           affectedAbs.add(dstAbs);
-          if (!fs3.existsSync(dstAbs)) {
+          if (!fs4.existsSync(dstAbs)) {
             newlyCreatedAbs.add(dstAbs);
           }
         }
       }
       const relPaths = Array.from(affectedAbs).map((abs) => path4.relative(context.worktree, abs));
       const multiFileWritePaths = Array.from(affectedAbs);
+      {
+        const asked = new Set;
+        for (const filePath of multiFileWritePaths) {
+          if (asked.has(filePath))
+            continue;
+          asked.add(filePath);
+          const denial = await assertExternalDirectoryPermission(context, filePath);
+          if (denial)
+            return permissionDeniedResponse(denial);
+        }
+      }
       await runAsk(context.ask({
         permission: "edit",
         patterns: relPaths,
@@ -28682,7 +29231,7 @@ function createApplyPatchTool(ctx) {
         const filePath = path4.resolve(context.directory, hunk.path);
         switch (hunk.type) {
           case "add": {
-            if (fs3.existsSync(filePath)) {
+            if (fs4.existsSync(filePath)) {
               const msg = `Failed to create ${hunk.path}: file already exists. Use *** Update File: to modify, or *** Delete File: first if you want to replace it entirely.`;
               results.push(msg);
               failures.push(hunk.path);
@@ -28714,7 +29263,7 @@ function createApplyPatchTool(ctx) {
               results.push(msg);
               failures.push(hunk.path);
               const filePath2 = path4.resolve(context.directory, hunk.path);
-              if (fs3.existsSync(filePath2)) {
+              if (fs4.existsSync(filePath2)) {
                 try {
                   await callBridge(ctx, context, "delete_file", { file: filePath2 });
                 } catch {}
@@ -28724,7 +29273,7 @@ function createApplyPatchTool(ctx) {
           }
           case "delete": {
             try {
-              const before = await fs3.promises.readFile(filePath, "utf-8").catch(() => "");
+              const before = await fs4.promises.readFile(filePath, "utf-8").catch(() => "");
               await callBridge(ctx, context, "delete_file", { file: filePath });
               perFileDiffs.push({
                 filePath,
@@ -28742,7 +29291,7 @@ function createApplyPatchTool(ctx) {
           }
           case "update": {
             try {
-              const original = await fs3.promises.readFile(filePath, "utf-8");
+              const original = await fs4.promises.readFile(filePath, "utf-8");
               const newContent = applyUpdateChunks(original, filePath, hunk.chunks);
               const targetPath = hunk.move_path ? path4.resolve(context.directory, hunk.move_path) : filePath;
               const writeResult = await callBridge(ctx, context, "write", {
@@ -28797,7 +29346,7 @@ ${diagLines}`);
                     if (rollbackResult.success === false) {
                       throw new Error(rollbackResult.message ?? "checkpoint restore failed");
                     }
-                    if (newlyCreatedAbs.has(targetPath) && fs3.existsSync(targetPath)) {
+                    if (newlyCreatedAbs.has(targetPath) && fs4.existsSync(targetPath)) {
                       const cleanupResult = await callBridge(ctx, context, "delete_file", {
                         file: targetPath
                       });
@@ -28892,6 +29441,17 @@ function createDeleteTool(ctx) {
     execute: async (args, context) => {
       const inputs = args.files;
       const absolutePaths = inputs.map((f) => path4.isAbsolute(f) ? f : path4.resolve(context.directory, f));
+      {
+        const asked = new Set;
+        for (const filePath of absolutePaths) {
+          if (asked.has(filePath))
+            continue;
+          asked.add(filePath);
+          const denial = await assertExternalDirectoryPermission(context, filePath);
+          if (denial)
+            return permissionDeniedResponse(denial);
+        }
+      }
       await runAsk(context.ask({
         permission: "edit",
         patterns: absolutePaths,
@@ -28937,6 +29497,18 @@ function createMoveTool(ctx) {
     execute: async (args, context) => {
       const filePath = path4.isAbsolute(args.filePath) ? args.filePath : path4.resolve(context.directory, args.filePath);
       const destPath = path4.isAbsolute(args.destination) ? args.destination : path4.resolve(context.directory, args.destination);
+      {
+        const sourceDenial = await assertExternalDirectoryPermission(context, filePath, {
+          kind: "file"
+        });
+        if (sourceDenial)
+          return permissionDeniedResponse(sourceDenial);
+        if (destPath !== filePath) {
+          const destDenial = await assertExternalDirectoryPermission(context, destPath);
+          if (destDenial)
+            return permissionDeniedResponse(destDenial);
+        }
+      }
       await runAsk(context.ask({
         permission: "edit",
         patterns: [filePath, destPath],
@@ -28991,6 +29563,11 @@ function aftPrefixedTools(ctx) {
           const file2 = normalizedArgs.filePath;
           const filePath = path4.isAbsolute(file2) ? file2 : path4.resolve(context.directory, file2);
           const relPath = path4.relative(context.worktree, filePath);
+          {
+            const denial = await assertExternalDirectoryPermission(context, filePath);
+            if (denial)
+              return permissionDeniedResponse(denial);
+          }
           await runAsk(context.ask({
             permission: "edit",
             patterns: [relPath],
@@ -29003,9 +29580,6 @@ function aftPrefixedTools(ctx) {
             create_dirs: normalizedArgs.create_dirs !== false,
             diagnostics: true
           };
-          if (normalizedArgs.dryRun === true || normalizedArgs.dry_run === true) {
-            writeParams.dry_run = true;
-          }
           const data = await callBridge(ctx, context, "write", writeParams);
           return JSON.stringify(data);
         }
@@ -29029,10 +29603,9 @@ function importTools(ctx) {
 ` + `Ops:
 ` + `- 'add': Add an import. Auto-detects group (stdlib/external/internal), deduplicates. Requires 'module'. Optional 'names', 'defaultImport', 'typeOnly'.
 ` + `- 'remove': Remove an import or a specific named import. Requires 'module'. Provide 'removeName' to remove a single named import; omit to remove the entire import.
-` + `- 'organize': Re-sort and re-group all imports by language convention, deduplicate. Requires only 'filePath'.
+` + `- 'organize': Re-sort and re-group all imports by language convention, deduplicate. Requires only 'filePath'. Use aft_safety checkpoint/undo for recovery before broad cleanup.
 
 ` + `Returns:
-` + `- Dry run (any op): { ok, dry_run, diff, syntax_valid? }
 ` + `- add: { file, added, module, group?, already_present?, formatted?, syntax_valid?, format_skipped_reason?, validation_errors?, validate_skipped_reason?, backup_id?, lsp_diagnostics? }
 ` + `- remove: { file, removed, module, name?, formatted, syntax_valid?, format_skipped_reason?, validation_errors?, validate_skipped_reason?, backup_id?, lsp_diagnostics? }
 ` + "- organize: { file, groups: [{ name, count }], removed_duplicates, formatted?, syntax_valid?, format_skipped_reason?, validation_errors?, validate_skipped_reason?, backup_id?, lsp_diagnostics? }",
@@ -29044,21 +29617,22 @@ function importTools(ctx) {
         defaultImport: z5.string().optional().describe("Default import name (e.g. 'React')"),
         typeOnly: z5.boolean().optional().describe("Type-only import (TS only, default: false)"),
         removeName: z5.string().optional().describe("Named import to remove for 'remove' op; omit to remove entire import"),
-        validate: z5.enum(["syntax", "full"]).optional().describe("Validation level: 'syntax' (default) or 'full'. Syntax = tree-sitter parse check only. Full = also runs LSP type-checking (slower, catches more errors)"),
-        dryRun: z5.boolean().optional().describe("Preview without modifying the file (default: false)")
+        validate: z5.enum(["syntax", "full"]).optional().describe("Validation level: 'syntax' (default) or 'full'. Syntax = tree-sitter parse check only. Full = also runs LSP type-checking (slower, catches more errors)")
       },
       execute: async (args, context) => {
         const op = args.op;
-        const isDryRun = args.dryRun === true;
         if ((op === "add" || op === "remove") && typeof args.module !== "string") {
           throw new Error(`'module' is required for '${op}' op`);
         }
-        if (!isDryRun) {
-          const filePath = resolveAbsolutePath(context, args.filePath);
-          const permissionError = await askEditPermission(context, [resolveRelativePattern(context, args.filePath)], { filepath: filePath });
-          if (permissionError)
-            return permissionDeniedResponse(permissionError);
+        const filePath = resolveAbsolutePath(context, args.filePath);
+        {
+          const denial = await assertExternalDirectoryPermission(context, filePath);
+          if (denial)
+            return permissionDeniedResponse(denial);
         }
+        const permissionError = await askEditPermission(context, [resolveRelativePattern(context, args.filePath)], { filepath: filePath });
+        if (permissionError)
+          return permissionDeniedResponse(permissionError);
         const commandMap = {
           add: "add_import",
           remove: "remove_import",
@@ -29077,8 +29651,6 @@ function importTools(ctx) {
           params.name = args.removeName;
         if (args.validate !== undefined)
           params.validate = args.validate;
-        if (args.dryRun !== undefined)
-          params.dry_run = args.dryRun;
         const response = await callBridge(ctx, context, commandMap[op], params);
         if (response.success === false) {
           throw new Error(response.message || `${op} failed`);
@@ -29421,9 +29993,9 @@ function refactoringTools(ctx) {
 
 ` + `Each op requires specific parameters \u2014 see parameter descriptions for requirements.
 
-` + `All ops need 'filePath'. Use dryRun to preview before applying.
+` + `All ops need 'filePath'. Use aft_safety checkpoint/undo before risky refactors.
 
-` + "Returns: move dry-run { ok, dry_run, diffs }; move apply { ok, files_modified, consumers_updated, checkpoint_name, results }. extract returns { file, name, parameters, return_type, syntax_valid, formatted, ... }. inline returns { file, symbol, call_context, substitutions, conflicts, syntax_valid, formatted, ... }.",
+` + "Returns: move { ok, files_modified, consumers_updated, checkpoint_name, results }. extract returns { file, name, parameters, return_type, syntax_valid, formatted, ... }. inline returns { file, symbol, call_context, substitutions, conflicts, syntax_valid, formatted, ... }.",
       args: {
         op: z9.enum(["move", "extract", "inline"]).describe("Refactoring operation"),
         filePath: z9.string().describe("Path to the source file (absolute or relative to project root)"),
@@ -29433,8 +30005,7 @@ function refactoringTools(ctx) {
         name: z9.string().optional().describe("New function name \u2014 required for 'extract' op"),
         startLine: z9.number().optional().describe("1-based start line \u2014 required for 'extract' op"),
         endLine: z9.number().optional().describe("1-based end line (inclusive) \u2014 required for 'extract' op"),
-        callSiteLine: z9.number().optional().describe("1-based call site line \u2014 required for 'inline' op"),
-        dryRun: z9.boolean().optional().describe("Preview changes as diff without modifying files (default: false)")
+        callSiteLine: z9.number().optional().describe("1-based call site line \u2014 required for 'inline' op")
       },
       execute: async (args, context) => {
         const op = args.op;
@@ -29462,6 +30033,18 @@ function refactoringTools(ctx) {
           ...typeof args.destination === "string" ? [args.destination] : []
         ]) : [resolveRelativePattern(context, args.filePath)];
         const metadata = patterns.length === 1 ? { filepath: filePath } : {};
+        {
+          const affectedPaths = op === "move" && typeof args.destination === "string" ? [filePath, resolveAbsolutePath(context, args.destination)] : [filePath];
+          const asked = new Set;
+          for (const affectedPath of affectedPaths) {
+            if (asked.has(affectedPath))
+              continue;
+            asked.add(affectedPath);
+            const denial = await assertExternalDirectoryPermission(context, affectedPath);
+            if (denial)
+              return permissionDeniedResponse(denial);
+          }
+        }
         const permissionError = await askEditPermission(context, patterns, metadata);
         if (permissionError)
           return permissionDeniedResponse(permissionError);
@@ -29471,8 +30054,6 @@ function refactoringTools(ctx) {
           inline: "inline_symbol"
         };
         const params = { file: args.filePath };
-        if (args.dryRun !== undefined)
-          params.dry_run = args.dryRun;
         switch (op) {
           case "move":
             params.symbol = args.symbol;
@@ -29504,6 +30085,7 @@ function refactoringTools(ctx) {
 }
 
 // src/tools/safety.ts
+import * as path5 from "path";
 import { tool as tool10 } from "@opencode-ai/plugin";
 var z10 = tool10.schema;
 function safetyTools(ctx) {
@@ -29541,10 +30123,30 @@ function safetyTools(ctx) {
         }
         if (op === "undo" && typeof args.filePath === "string") {
           const filePath = resolveAbsolutePath(context, args.filePath);
+          {
+            const denial = await assertExternalDirectoryPermission(context, filePath);
+            if (denial)
+              return permissionDeniedResponse(denial);
+          }
           const permissionError = await askEditPermission(context, [resolveRelativePattern(context, args.filePath)], { filepath: filePath });
           if (permissionError)
             return permissionDeniedResponse(permissionError);
         }
+        if (op === "checkpoint" && Array.isArray(args.files)) {
+          const uniqueParents = new Set;
+          for (const file2 of args.files) {
+            if (typeof file2 !== "string")
+              continue;
+            const abs = path5.isAbsolute(file2) ? file2 : path5.resolve(context.directory, file2);
+            const parent = path5.dirname(abs);
+            if (uniqueParents.has(parent))
+              continue;
+            uniqueParents.add(parent);
+            const denial = await assertExternalDirectoryPermission(context, file2, { kind: "file" });
+            if (denial)
+              return permissionDeniedResponse(denial);
+          }
+        }
         if (op === "restore") {
           const permissionError = await askEditPermission(context, [workspacePattern(context)], {
             checkpoint: args.name
@@ -29585,6 +30187,8 @@ function safetyTools(ctx) {
 }
 
 // src/tools/search.ts
+import * as fs5 from "fs";
+import * as path6 from "path";
 function arg(schema) {
   return schema;
 }
@@ -29654,11 +30258,33 @@ function searchTools(ctx) {
       path: arg(exports_external.string().optional().describe("Directory to search in, relative to project root"))
     },
     execute: async (args, context) => {
+      const pattern = String(args.pattern);
+      const includeArg = args.include ? String(args.include) : undefined;
+      const pathArg = args.path ? String(args.path) : undefined;
+      const grepDenied = await askGrepPermission(context, pattern, {
+        path: pathArg,
+        include: includeArg
+      });
+      if (grepDenied)
+        return permissionDeniedResponse(grepDenied);
+      if (pathArg) {
+        let kind = "file";
+        try {
+          const abs = path6.isAbsolute(pathArg) ? pathArg : path6.resolve(context.directory, pathArg);
+          if (fs5.lstatSync(abs).isDirectory())
+            kind = "directory";
+        } catch {}
+        const externalDenied = await assertExternalDirectoryPermission(context, pathArg, {
+          kind
+        });
+        if (externalDenied)
+          return permissionDeniedResponse(externalDenied);
+      }
       const response = await callBridge(ctx, context, "grep", {
-        pattern: args.pattern,
+        pattern,
         case_sensitive: true,
-        include: args.include ? splitIncludeArg(String(args.include)).map(normalizeGlob).filter(Boolean) : undefined,
-        path: args.path,
+        include: includeArg ? splitIncludeArg(includeArg).map(normalizeGlob).filter(Boolean) : undefined,
+        path: pathArg,
         max_results: 100
       });
       if (response.success === false) {
@@ -29686,6 +30312,22 @@ function searchTools(ctx) {
           }
         }
       }
+      const globDenied = await askGlobPermission(context, globPattern, { path: globPath });
+      if (globDenied)
+        return permissionDeniedResponse(globDenied);
+      if (globPath) {
+        let kind = "directory";
+        try {
+          const abs = path6.isAbsolute(globPath) ? globPath : path6.resolve(context.directory, globPath);
+          if (fs5.lstatSync(abs).isFile())
+            kind = "file";
+        } catch {}
+        const externalDenied = await assertExternalDirectoryPermission(context, globPath, {
+          kind
+        });
+        if (externalDenied)
+          return permissionDeniedResponse(externalDenied);
+      }
       const response = await callBridge(ctx, context, "glob", {
         pattern: globPattern,
         path: globPath
@@ -29777,10 +30419,9 @@ function structureTools(ctx) {
 ` + `- 'add_decorator': Add Python decorator to function/class. Requires 'target' and 'decorator' (without @). Optional 'position'.
 ` + `- 'add_struct_tags': Add/update Go struct field tags. Requires 'target' (struct name), 'field', 'tag', 'value'.
 
-` + `Each op requires specific parameters \u2014 see parameter descriptions for requirements.
+` + `Each op requires specific parameters \u2014 see parameter descriptions for requirements. Use aft_safety checkpoint/undo before risky transforms.
 
 ` + `Returns:
-` + `- Dry run (any op): { ok, dry_run, diff, syntax_valid? }
 ` + `- add_member: { file, scope, position, formatted, syntax_valid?, format_skipped_reason?, validation_errors?, validate_skipped_reason?, backup_id?, lsp_diagnostics? }
 ` + `- add_derive: { file, target, derives, formatted, syntax_valid?, format_skipped_reason?, validation_errors?, validate_skipped_reason?, backup_id?, lsp_diagnostics? }
 ` + `- wrap_try_catch: { file, target, formatted, syntax_valid?, format_skipped_reason?, validation_errors?, validate_skipped_reason?, backup_id?, lsp_diagnostics? }
@@ -29799,8 +30440,7 @@ function structureTools(ctx) {
         field: z11.string().optional().describe("Struct field name (add_struct_tags)"),
         tag: z11.string().optional().describe("Tag key (add_struct_tags \u2014 e.g. 'json')"),
         value: z11.string().optional().describe("Tag value (add_struct_tags \u2014 e.g. 'user_name,omitempty')"),
-        validate: z11.enum(["syntax", "full"]).optional().describe("Validation level: 'syntax' (default) or 'full'. Syntax = tree-sitter parse check only. Full = also runs LSP type-checking (slower, catches more errors)"),
-        dryRun: z11.boolean().optional().describe("Preview without modifying the file (default: false)")
+        validate: z11.enum(["syntax", "full"]).optional().describe("Validation level: 'syntax' (default) or 'full'. Syntax = tree-sitter parse check only. Full = also runs LSP type-checking (slower, catches more errors)")
       },
       execute: async (args, context) => {
         const op = args.op;
@@ -29829,14 +30469,17 @@ function structureTools(ctx) {
             throw new Error("'value' is required for 'add_struct_tags' op");
         }
         const filePath = resolveAbsolutePath(context, args.filePath);
+        {
+          const denial = await assertExternalDirectoryPermission(context, filePath);
+          if (denial)
+            return permissionDeniedResponse(denial);
+        }
         const permissionError = await askEditPermission(context, [resolveRelativePattern(context, args.filePath)], { filepath: filePath });
         if (permissionError)
           return permissionDeniedResponse(permissionError);
         const params = { file: args.filePath };
         if (args.validate !== undefined)
           params.validate = args.validate;
-        if (args.dryRun !== undefined)
-          params.dry_run = args.dryRun;
         switch (op) {
           case "add_member":
             params.scope = args.container;
@@ -29930,6 +30573,7 @@ function buildHintsFromConfig(config2, disabledTools) {
 }
 
 // src/configure-warnings.ts
+var pendingEagerWarnings = new Map;
 function isConfigureWarning(value) {
   if (!value || typeof value !== "object" || Array.isArray(value))
     return false;
@@ -29939,13 +30583,25 @@ function isConfigureWarning(value) {
 function coerceConfigureWarnings(warnings) {
   return warnings.filter(isConfigureWarning);
 }
+function drainPendingEagerWarnings(projectRoot) {
+  const pending = pendingEagerWarnings.get(projectRoot) ?? [];
+  pendingEagerWarnings.delete(projectRoot);
+  return pending;
+}
 async function handleConfigureWarningsForSession(context) {
+  const validWarnings = coerceConfigureWarnings(context.warnings);
   if (!context.sessionId) {
-    warn2(`[configure] deferred warnings for ${context.projectRoot} arrived without session_id; skipping notification`);
+    if (validWarnings.length === 0)
+      return;
+    const pending = pendingEagerWarnings.get(context.projectRoot) ?? [];
+    pending.push(...validWarnings);
+    pendingEagerWarnings.set(context.projectRoot, pending);
+    warn2(`[configure] deferred warnings for ${context.projectRoot} arrived without session_id; buffering until first session-bound call`);
     return;
   }
-  const validWarnings = coerceConfigureWarnings(context.warnings);
-  if (validWarnings.length === 0)
+  const pendingWarnings = drainPendingEagerWarnings(context.projectRoot);
+  const combinedWarnings = [...pendingWarnings, ...validWarnings];
+  if (combinedWarnings.length === 0)
     return;
   await deliverConfigureWarnings({
     client: context.client ?? context.fallbackClient,
@@ -29953,7 +30609,7 @@ async function handleConfigureWarningsForSession(context) {
     storageDir: context.storageDir,
     pluginVersion: context.pluginVersion,
     projectRoot: context.projectRoot
-  }, validWarnings);
+  }, combinedWarnings);
 }
 
 // src/index.ts
@@ -29968,16 +30624,10 @@ function throwSentinel(command) {
 }
 async function sendIgnoredMessage2(client, sessionID, text) {
   const typedClient = client;
-  const lastModel = await getLastAssistantModel(client, sessionID);
   const body = {
     noReply: true,
     parts: [{ type: "text", text, ignored: true }]
   };
-  if (lastModel) {
-    body.model = { providerID: lastModel.providerID, modelID: lastModel.modelID };
-    if (lastModel.variant)
-      body.variant = lastModel.variant;
-  }
   const promptInput = { path: { id: sessionID }, body };
   if (typeof typedClient.session?.prompt === "function") {
     await Promise.resolve(typedClient.session.prompt(promptInput));
@@ -30007,7 +30657,8 @@ var ANNOUNCEMENT_FEATURES = [
   "Trigram grep/glob and semantic search (aft_search) graduated out of experimental.",
   "Lots of bugfixes and new end-to-end test coverage."
 ];
-var plugin = async (input) => {
+var plugin = async (input) => initializePluginForDirectory(input);
+async function initializePluginForDirectory(input) {
   const binaryPath = await findBinary();
   const aftConfig = loadAftConfig(input.directory);
   const autoUpdateAbort = new AbortController;
@@ -30035,8 +30686,8 @@ var plugin = async (input) => {
   if (aftConfig.max_callgraph_files !== undefined)
     configOverrides.max_callgraph_files = aftConfig.max_callgraph_files;
   const isFastembedSemanticBackend = (aftConfig.semantic?.backend ?? "fastembed") === "fastembed";
-  const dataHome = process.env.XDG_DATA_HOME || join19(homedir11(), ".local", "share");
-  configOverrides.storage_dir = join19(dataHome, "opencode", "storage", "plugin", "aft");
+  const dataHome = process.env.XDG_DATA_HOME || join21(homedir11(), ".local", "share");
+  configOverrides.storage_dir = join21(dataHome, "opencode", "storage", "plugin", "aft");
   let onnxRuntimePromise = null;
   if (aftConfig.semantic_search && isFastembedSemanticBackend) {
     const storageDir2 = configOverrides.storage_dir;
@@ -30122,10 +30773,10 @@ ${lines}
       }
       versionUpgradeAttempted = binaryVersion;
       warn2(`WARNING: aft binary v${binaryVersion} is older than plugin v${minVersion}. ` + "Some features may not work. Attempting to download a compatible binary...");
-      ensureBinary(`v${minVersion}`).then((path5) => {
-        if (path5) {
-          log2(`Found/downloaded compatible binary at ${path5}. Replacing running bridges...`);
-          pool.replaceBinary(path5).then(() => {
+      ensureBinary(`v${minVersion}`).then((path7) => {
+        if (path7) {
+          log2(`Found/downloaded compatible binary at ${path7}. Replacing running bridges...`);
+          pool.replaceBinary(path7).then(() => {
             log2("Binary replaced successfully. New bridges will use the updated binary.");
           }, (err) => error2("Failed to replace binary:", err));
         } else {
@@ -30136,11 +30787,12 @@ ${lines}
       });
     },
     onConfigureWarnings: async ({ projectRoot, sessionId, client, warnings }) => {
+      const pendingWarnings = sessionId ? drainPendingEagerWarnings(projectRoot) : [];
       await handleConfigureWarningsForSession({
         projectRoot,
         sessionId,
         client,
-        warnings,
+        warnings: [...pendingWarnings, ...warnings],
         fallbackClient: input.client,
         storageDir: configOverrides.storage_dir,
         pluginVersion: PLUGIN_VERSION
@@ -30175,7 +30827,6 @@ ${lines}
     config: aftConfig,
     storageDir: configOverrides.storage_dir
   };
-  setSharedBridgePool(pool);
   if (onnxRuntimePromise) {
     onnxRuntimePromise.then((ortDylibDir) => {
       if (ortDylibDir) {
@@ -30197,7 +30848,7 @@ ${lines}
       if (onnxRuntimePromise) {
         await Promise.race([
           onnxRuntimePromise,
-          new Promise((resolve9) => setTimeout(() => resolve9(null), 60000))
+          new Promise((resolve11) => setTimeout(() => resolve11(null), 60000))
         ]);
       }
       const bridge = pool.getBridge(input.directory);
@@ -30243,10 +30894,10 @@ ${lines}
       return { show: false };
     }
     if (storageDir) {
-      const versionFile = join19(storageDir, "last_announced_version");
+      const versionFile = join21(storageDir, "last_announced_version");
       try {
         if (existsSync14(versionFile)) {
-          const lastVersion = readFileSync10(versionFile, "utf-8").trim();
+          const lastVersion = readFileSync12(versionFile, "utf-8").trim();
           if (lastVersion === ANNOUNCEMENT_VERSION)
             return { show: false };
         }
@@ -30257,8 +30908,8 @@ ${lines}
   rpcServer.handle("mark-announced", async () => {
     if (storageDir && ANNOUNCEMENT_VERSION) {
       try {
-        mkdirSync11(storageDir, { recursive: true });
-        writeFileSync11(join19(storageDir, "last_announced_version"), ANNOUNCEMENT_VERSION);
+        mkdirSync12(storageDir, { recursive: true });
+        writeFileSync11(join21(storageDir, "last_announced_version"), ANNOUNCEMENT_VERSION);
       } catch {}
     }
     return { success: true };
@@ -30390,7 +31041,6 @@ Install: ${getManualInstallHint()}`).catch(() => {});
     },
     "chat.message": async (messageInput) => {
       const sid = messageInput.sessionID ?? messageInput.sessionId ?? messageInput.id;
-      resetBgWake(sid);
       warmSessionDirectory(input.client, sid, input.directory);
     },
     "command.execute.before": async (commandInput, _output) => {
@@ -30450,11 +31100,10 @@ Install: ${getManualInstallHint()}`).catch(() => {});
       unregisterShutdown();
       await Promise.allSettled([abortInFlightAutoInstalls(), abortInFlightGithubInstalls()]);
       rpcServer.stop();
-      clearSharedBridgePool();
       await pool.shutdown();
     }
   };
-};
+}
 var src_default = plugin;
 export {
   src_default as default