@cortexkit/aft-opencode 0.26.0 → 0.26.1

package/dist/index.js

@@ -7803,7 +7803,7 @@ var require_src2 = __commonJS((exports, module) => {
 });
 
 // src/index.ts
-import { existsSync as existsSync14, mkdirSync as mkdirSync12, readFileSync as readFileSync12, writeFileSync as writeFileSync11 } from "fs";
+import { existsSync as existsSync14, mkdirSync as mkdirSync12, readFileSync as readFileSync12, writeFileSync as writeFileSync12 } from "fs";
 import { createRequire as createRequire2 } from "module";
 import { homedir as homedir11 } from "os";
 import { join as join21 } from "path";
@@ -7820,12 +7820,22 @@ function getActiveLogger() {
   return loggerGlobal()[ACTIVE_LOGGER_SYMBOL];
 }
 function getLogFilePath() {
-  return getActiveLogger()?.getLogFilePath?.();
+  try {
+    return getActiveLogger()?.getLogFilePath?.();
+  } catch (err) {
+    console.error(`[aft-bridge] ERROR: active logger getLogFilePath threw: ${err instanceof Error ? err.message : String(err)}`);
+    return;
+  }
 }
 function log(message, meta) {
   const active = getActiveLogger();
   if (active) {
-    active.log(message, meta);
+    try {
+      active.log(message, meta);
+    } catch (err) {
+      console.error(`[aft-bridge] ERROR: active logger log threw: ${err instanceof Error ? err.message : String(err)}`);
+      console.error(`[aft-bridge] ${message}`);
+    }
   } else {
     console.error(`[aft-bridge] ${message}`);
   }
@@ -7833,7 +7843,12 @@ function log(message, meta) {
 function warn(message, meta) {
   const active = getActiveLogger();
   if (active) {
-    active.warn(message, meta);
+    try {
+      active.warn(message, meta);
+    } catch (err) {
+      console.error(`[aft-bridge] ERROR: active logger warn threw: ${err instanceof Error ? err.message : String(err)}`);
+      console.error(`[aft-bridge] WARN: ${message}`);
+    }
   } else {
     console.error(`[aft-bridge] WARN: ${message}`);
   }
@@ -7841,20 +7856,16 @@ function warn(message, meta) {
 function error(message, meta) {
   const active = getActiveLogger();
   if (active) {
-    active.error(message, meta);
+    try {
+      active.error(message, meta);
+    } catch (err) {
+      console.error(`[aft-bridge] ERROR: active logger error threw: ${err instanceof Error ? err.message : String(err)}`);
+      console.error(`[aft-bridge] ERROR: ${message}`);
+    }
   } else {
     console.error(`[aft-bridge] ERROR: ${message}`);
   }
 }
-function sessionLog(sessionId, message) {
-  log(message, sessionId ? { sessionId } : undefined);
-}
-function sessionWarn(sessionId, message) {
-  warn(message, sessionId ? { sessionId } : undefined);
-}
-function sessionError(sessionId, message) {
-  error(message, sessionId ? { sessionId } : undefined);
-}
 // ../aft-bridge/dist/bridge.js
 import { spawn } from "child_process";
 import { homedir } from "os";
@@ -7949,6 +7960,7 @@ class BinaryBridge {
   pending = new Map;
   nextId = 1;
   stdoutBuffer = "";
+  stderrBuffer = "";
   stderrTail = [];
   _restartCount = 0;
   _shuttingDown = false;
@@ -7984,24 +7996,62 @@ class BinaryBridge {
   }
   logVia(message, meta) {
     const logger = this.logger ?? getActiveLogger();
-    if (logger)
-      logger.log(message, meta);
-    else
+    if (logger) {
+      try {
+        logger.log(message, meta);
+      } catch (err) {
+        console.error(`[aft-bridge] ERROR: logger log threw: ${err instanceof Error ? err.message : String(err)}`);
+        console.error(`[aft-bridge] ${message}`);
+      }
+    } else {
       log(message, meta);
+    }
   }
   warnVia(message, meta) {
     const logger = this.logger ?? getActiveLogger();
-    if (logger)
-      logger.warn(message, meta);
-    else
+    if (logger) {
+      try {
+        logger.warn(message, meta);
+      } catch (err) {
+        console.error(`[aft-bridge] ERROR: logger warn threw: ${err instanceof Error ? err.message : String(err)}`);
+        console.error(`[aft-bridge] WARN: ${message}`);
+      }
+    } else {
       warn(message, meta);
+    }
   }
   errorVia(message, meta) {
     const logger = this.logger ?? getActiveLogger();
-    if (logger)
-      logger.error(message, meta);
-    else
+    if (logger) {
+      try {
+        logger.error(message, meta);
+      } catch (err) {
+        console.error(`[aft-bridge] ERROR: logger error threw: ${err instanceof Error ? err.message : String(err)}`);
+        console.error(`[aft-bridge] ERROR: ${message}`);
+      }
+    } else {
       error(message, meta);
+    }
+  }
+  getLogFilePathVia() {
+    if (this.logger?.getLogFilePath) {
+      try {
+        return this.logger.getLogFilePath();
+      } catch (err) {
+        console.error(`[aft-bridge] ERROR: logger getLogFilePath threw: ${err instanceof Error ? err.message : String(err)}`);
+        return;
+      }
+    }
+    return getLogFilePath();
+  }
+  sessionLogVia(sessionId, message) {
+    this.logVia(message, sessionId ? { sessionId } : undefined);
+  }
+  sessionWarnVia(sessionId, message) {
+    this.warnVia(message, sessionId ? { sessionId } : undefined);
+  }
+  sessionErrorVia(sessionId, message) {
+    this.errorVia(message, sessionId ? { sessionId } : undefined);
   }
   get restartCount() {
     return this._restartCount;
@@ -8060,7 +8110,7 @@ class BinaryBridge {
                 await this.deliverConfigureWarnings(configResult, params, options);
                 await this.checkVersion();
                 if (!this.isAlive()) {
-                  throw new Error(`${this.errorPrefix} Bridge died during version check. Check logs: ${getLogFilePath()}`);
+                  throw new Error(`${this.errorPrefix} Bridge died during version check. Check logs: ${this.getLogFilePathVia()}`);
                 }
                 this.configured = true;
               } finally {
@@ -8096,9 +8146,9 @@ class BinaryBridge {
           const restartSuffix = keepBridgeOnTimeout ? "" : " \u2014 restarting bridge";
           const timeoutMsg = `Request "${command}" (id=${id}) timed out after ${effectiveTimeoutMs}ms${restartSuffix}`;
           if (requestSessionId) {
-            sessionWarn(requestSessionId, timeoutMsg);
+            this.sessionWarnVia(requestSessionId, timeoutMsg);
           } else {
-            warn(timeoutMsg);
+            this.warnVia(timeoutMsg);
           }
           reject(new Error(`${this.errorPrefix} Request "${command}" (id=${id}) timed out after ${effectiveTimeoutMs}ms`));
           if (!keepBridgeOnTimeout) {
@@ -8125,7 +8175,7 @@ class BinaryBridge {
       });
     } catch (err) {
       if (err instanceof BridgeReplacedDuringVersionCheck && canRetryAfterVersionSwap && command !== "configure" && command !== "version") {
-        log(`Retrying request "${command}" once after coordinated binary replacement: ${err.newBinaryPath}`);
+        this.logVia(`Retrying request "${command}" once after coordinated binary replacement: ${err.newBinaryPath}`);
         return this.sendWithVersionMismatchRetry(command, params, options, false);
       }
       throw err;
@@ -8145,7 +8195,7 @@ class BinaryBridge {
         warnings: configResult.warnings
       });
     } catch (err) {
-      warn(`configure warning delivery failed: ${err instanceof Error ? err.message : String(err)}`);
+      this.warnVia(`configure warning delivery failed: ${err instanceof Error ? err.message : String(err)}`);
     } finally {
       if (sessionId) {
         this.configureWarningClients.delete(sessionId);
@@ -8179,7 +8229,7 @@ class BinaryBridge {
     if (!snapshot || typeof snapshot !== "object" || Array.isArray(snapshot))
       return;
     this.cachedStatus = snapshot;
-    log("Received status_changed push frame; cached AFT status snapshot");
+    this.logVia("Received status_changed push frame; cached AFT status snapshot");
     for (const listener of this.statusListeners) {
       this.deliverStatusSnapshot(listener, this.cachedStatus);
     }
@@ -8188,7 +8238,7 @@ class BinaryBridge {
     try {
       listener(snapshot);
     } catch (err) {
-      warn(`status listener threw: ${err instanceof Error ? err.message : String(err)}`);
+      this.warnVia(`status listener threw: ${err instanceof Error ? err.message : String(err)}`);
     }
   }
   async shutdown() {
@@ -8206,7 +8256,7 @@ class BinaryBridge {
         }, 5000);
         proc.once("exit", () => {
           clearTimeout(forceKillTimer);
-          log("Process exited during shutdown");
+          this.logVia("Process exited during shutdown");
           resolve();
         });
         proc.kill("SIGTERM");
@@ -8225,9 +8275,9 @@ class BinaryBridge {
       if (typeof binaryVersion !== "string") {
         throw new Error(`Binary did not report a version \u2014 likely too old (minVersion: ${this.minVersion})`);
       }
-      log(`Binary version: ${binaryVersion}`);
+      this.logVia(`Binary version: ${binaryVersion}`);
       if (compareSemver(binaryVersion, this.minVersion) < 0) {
-        warn(`Binary version ${binaryVersion} is older than required ${this.minVersion}`);
+        this.warnVia(`Binary version ${binaryVersion} is older than required ${this.minVersion}`);
         const replacementPath = await this.onVersionMismatch?.(binaryVersion, this.minVersion);
         if (replacementPath === undefined) {
           return;
@@ -8239,7 +8289,7 @@ class BinaryBridge {
         throw new BridgeReplacedDuringVersionCheck(replacementPath);
       }
     } catch (err) {
-      warn(`Version check failed: ${err.message}`);
+      this.warnVia(`Version check failed: ${err.message}`);
       throw err;
     }
   }
@@ -8259,7 +8309,7 @@ class BinaryBridge {
       }, 5000);
       proc.once("exit", () => {
         clearTimeout(forceKillTimer);
-        log("Process exited during coordinated binary replacement");
+        this.logVia("Process exited during coordinated binary replacement");
         resolve();
       });
       proc.kill("SIGTERM");
@@ -8272,9 +8322,9 @@ class BinaryBridge {
   }
   spawnProcess(triggeringSessionId) {
     if (triggeringSessionId) {
-      sessionLog(triggeringSessionId, `Spawning binary: ${this.binaryPath} (cwd: ${this.cwd})`);
+      this.sessionLogVia(triggeringSessionId, `Spawning binary: ${this.binaryPath} (cwd: ${this.cwd})`);
     } else {
-      log(`Spawning binary: ${this.binaryPath} (cwd: ${this.cwd})`);
+      this.logVia(`Spawning binary: ${this.binaryPath} (cwd: ${this.cwd})`);
     }
     const semantic = this.configOverrides.semantic;
     const semanticBackend = (() => {
@@ -8321,11 +8371,12 @@ class BinaryBridge {
       const remaining = stderrDecoder.end();
       if (remaining)
         this.onStderrData(remaining);
+      this.flushStderrBuffer();
     });
     child.on("error", (err) => {
       if (this.process !== currentChild)
         return;
-      error(`Process error: ${err.message}${this.formatStderrTail()}`);
+      this.errorVia(`Process error: ${err.message}${this.formatStderrTail()}`);
       this.handleCrash();
     });
     child.on("exit", (code, signal) => {
@@ -8333,7 +8384,7 @@ class BinaryBridge {
         return;
       if (this._shuttingDown)
         return;
-      log(`Process exited: code=${code}, signal=${signal}`);
+      this.logVia(`Process exited: code=${code}, signal=${signal}`);
       if (signal === "SIGTERM" || signal === "SIGKILL" || signal === "SIGHUP" || signal === "SIGINT") {
         this.process = null;
         this.configured = false;
@@ -8345,6 +8396,7 @@ class BinaryBridge {
     });
     this.process = child;
     this.stdoutBuffer = "";
+    this.stderrBuffer = "";
     this.stderrTail = [];
   }
   pushStderrLine(line) {
@@ -8354,16 +8406,28 @@ class BinaryBridge {
     }
   }
   onStderrData(data) {
-    const lines = data.trimEnd().split(`
-`);
-    for (const line of lines) {
+    this.stderrBuffer += data;
+    let newlineIdx;
+    while ((newlineIdx = this.stderrBuffer.indexOf(`
+`)) !== -1) {
+      const line = this.stderrBuffer.slice(0, newlineIdx).replace(/\r$/, "");
+      this.stderrBuffer = this.stderrBuffer.slice(newlineIdx + 1);
       if (!line)
         continue;
       const tagged = tagStderrLine(line);
-      log(tagged);
+      this.logVia(tagged);
       this.pushStderrLine(tagged);
     }
   }
+  flushStderrBuffer() {
+    const line = this.stderrBuffer.replace(/\r$/, "");
+    this.stderrBuffer = "";
+    if (!line)
+      return;
+    const tagged = tagStderrLine(line);
+    this.logVia(tagged);
+    this.pushStderrLine(tagged);
+  }
   formatStderrTail() {
     if (this.stderrTail.length === 0)
       return "";
@@ -8421,7 +8485,7 @@ class BinaryBridge {
         }
         if (response.type === "configure_warnings") {
           this.handleConfigureWarningsFrame(response).catch((err) => {
-            warn(`configure warning delivery failed: ${err instanceof Error ? err.message : String(err)}`);
+            this.warnVia(`configure warning delivery failed: ${err instanceof Error ? err.message : String(err)}`);
           });
           continue;
         }
@@ -8439,10 +8503,10 @@ class BinaryBridge {
           this.scheduleRestartCountReset();
           entry.resolve(response);
         } else if (typeof response.type === "string") {
-          log(`Ignoring unknown stdout push frame type: ${response.type}`);
+          this.logVia(`Ignoring unknown stdout push frame type: ${response.type}`);
         }
       } catch (_err) {
-        warn(`Failed to parse stdout line: ${line}`);
+        this.warnVia(`Failed to parse stdout line: ${line}`);
       }
     }
   }
@@ -8456,17 +8520,17 @@ class BinaryBridge {
     this.configured = false;
     const tail = this.formatStderrTail();
     this.stderrTail = [];
-    const killedMsg = tail ? `Bridge killed after timeout.${tail}` : `Bridge killed after timeout (see ${getLogFilePath()})`;
+    const killedMsg = tail ? `Bridge killed after timeout.${tail}` : `Bridge killed after timeout (see ${this.getLogFilePathVia()})`;
     if (tail) {
       if (triggeringSessionId) {
-        sessionError(triggeringSessionId, killedMsg);
+        this.sessionErrorVia(triggeringSessionId, killedMsg);
       } else {
-        error(killedMsg);
+        this.errorVia(killedMsg);
       }
     } else if (triggeringSessionId) {
-      sessionWarn(triggeringSessionId, killedMsg);
+      this.sessionWarnVia(triggeringSessionId, killedMsg);
     } else {
-      warn(killedMsg);
+      this.warnVia(killedMsg);
     }
   }
   handleCrash(cause) {
@@ -8479,25 +8543,25 @@ class BinaryBridge {
     this.configured = false;
     const tail = this.formatStderrTail();
     if (tail) {
-      error(`Binary crashed (restarts: ${this._restartCount})${cause ? `: ${cause.message}` : ""}.${tail}`);
+      this.errorVia(`Binary crashed (restarts: ${this._restartCount})${cause ? `: ${cause.message}` : ""}.${tail}`);
     }
-    this.rejectAllPending(new Error(`${this.errorPrefix} Binary crashed (restarts: ${this._restartCount})${cause ? `: ${cause.message}` : ""} (see ${getLogFilePath()})`));
+    this.rejectAllPending(new Error(`${this.errorPrefix} Binary crashed (restarts: ${this._restartCount})${cause ? `: ${cause.message}` : ""} (see ${this.getLogFilePathVia()})`));
     if (this._restartCount < this.maxRestarts) {
       const delay = 100 * 2 ** this._restartCount;
       this._restartCount++;
-      log(`Auto-restart #${this._restartCount} in ${delay}ms`);
+      this.logVia(`Auto-restart #${this._restartCount} in ${delay}ms`);
       setTimeout(() => {
         if (!this._shuttingDown && !this.isAlive()) {
           try {
             this.spawnProcess();
           } catch (err) {
-            error(`Failed to restart: ${err.message}`);
+            this.errorVia(`Failed to restart: ${err.message}`);
           }
         }
       }, delay);
       this.scheduleRestartCountReset();
     } else {
-      error(`Max restarts (${this.maxRestarts}) reached, giving up. Logs: ${getLogFilePath()}${tail}`);
+      this.errorVia(`Max restarts (${this.maxRestarts}) reached, giving up. Logs: ${this.getLogFilePathVia()}${tail}`);
       this.scheduleRestartCountReset();
     }
   }
@@ -8523,9 +8587,12 @@ class BinaryBridge {
   }
 }
 // ../aft-bridge/dist/downloader.js
-import { chmodSync, existsSync, mkdirSync, unlinkSync } from "fs";
+import { createHash } from "crypto";
+import { chmodSync, closeSync, createWriteStream, existsSync, mkdirSync, openSync, renameSync, rmSync, statSync, unlinkSync } from "fs";
 import { homedir as homedir2 } from "os";
 import { join as join2 } from "path";
+import { Readable } from "stream";
+import { pipeline } from "stream/promises";
 
 // ../aft-bridge/dist/platform.js
 var PLATFORM_ARCH_MAP = {
@@ -8543,6 +8610,11 @@ var PLATFORM_ASSET_MAP = {
 
 // ../aft-bridge/dist/downloader.js
 var REPO = "cortexkit/aft";
+var DOWNLOAD_TIMEOUT_MS = 300000;
+var LATEST_TAG_TIMEOUT_MS = 30000;
+var MAX_DOWNLOAD_BYTES = 200 * 1024 * 1024;
+var DOWNLOAD_LOCK_TIMEOUT_MS = 120000;
+var DOWNLOAD_LOCK_STALE_MS = 10 * 60000;
 function getCacheDir() {
   if (process.platform === "win32") {
     const localAppData = process.env.LOCALAPPDATA || process.env.APPDATA;
@@ -8584,54 +8656,101 @@ async function downloadBinary(version) {
   const downloadUrl = `https://github.com/${REPO}/releases/download/${tag}/${assetName}`;
   const checksumUrl = `https://github.com/${REPO}/releases/download/${tag}/checksums.sha256`;
   log(`Downloading AFT binary (${tag}) for ${platformKey}...`);
+  const lockPath = join2(versionedCacheDir, ".download.lock");
+  let releaseLock = null;
+  let binaryController = null;
+  let checksumController = null;
+  let binaryTimeout = null;
+  let checksumTimeout = null;
+  const tmpPath = `${binaryPath}.${process.pid}.${Date.now()}.${Math.random().toString(16).slice(2)}.tmp`;
   try {
     if (!existsSync(versionedCacheDir)) {
       mkdirSync(versionedCacheDir, { recursive: true });
     }
+    releaseLock = await acquireDownloadLock(lockPath);
+    if (existsSync(binaryPath)) {
+      return binaryPath;
+    }
+    binaryController = new AbortController;
+    checksumController = new AbortController;
+    const activeBinaryController = binaryController;
+    const activeChecksumController = checksumController;
+    binaryTimeout = setTimeout(() => activeBinaryController.abort(), DOWNLOAD_TIMEOUT_MS);
+    checksumTimeout = setTimeout(() => activeChecksumController.abort(), DOWNLOAD_TIMEOUT_MS);
     const [binaryResponse, checksumResponse] = await Promise.all([
-      fetch(downloadUrl, { redirect: "follow" }),
-      fetch(checksumUrl, { redirect: "follow" })
+      fetch(downloadUrl, { redirect: "follow", signal: activeBinaryController.signal }),
+      fetch(checksumUrl, { redirect: "follow", signal: activeChecksumController.signal })
     ]);
     if (!binaryResponse.ok) {
       throw new Error(`HTTP ${binaryResponse.status}: ${binaryResponse.statusText} (${downloadUrl})`);
     }
-    const arrayBuffer = await binaryResponse.arrayBuffer();
+    if (!binaryResponse.body) {
+      throw new Error(`Download response for ${assetName} had no body`);
+    }
+    const advertised = Number.parseInt(binaryResponse.headers.get("content-length") ?? "", 10);
+    if (Number.isFinite(advertised) && advertised > MAX_DOWNLOAD_BYTES) {
+      throw new Error(`Content-Length ${advertised} exceeds max ${MAX_DOWNLOAD_BYTES}`);
+    }
     if (!checksumResponse.ok) {
       warn(`Checksum verification failed: no checksums.sha256 found for ${tag}. ` + "Binary download aborted for security reasons.");
       return null;
     }
     const checksumText = await checksumResponse.text();
+    clearTimeout(checksumTimeout);
+    checksumTimeout = null;
     const expectedHash = parseChecksumForAsset(checksumText, assetName);
     if (!expectedHash) {
       warn(`Checksum verification failed: checksums.sha256 found but no entry for ${assetName}. ` + "Binary download aborted for security reasons.");
       return null;
     }
-    const { createHash } = await import("crypto");
-    const actualHash = createHash("sha256").update(Buffer.from(arrayBuffer)).digest("hex");
+    const hash = createHash("sha256");
+    let bytesWritten = 0;
+    const guard = new TransformStream({
+      transform(chunk, controller) {
+        bytesWritten += chunk.byteLength;
+        if (bytesWritten > MAX_DOWNLOAD_BYTES) {
+          controller.error(new Error(`download exceeded ${MAX_DOWNLOAD_BYTES} bytes after streaming (server lied about size or sent unbounded body)`));
+          return;
+        }
+        hash.update(chunk);
+        controller.enqueue(chunk);
+      }
+    });
+    const guarded = binaryResponse.body.pipeThrough(guard);
+    const nodeStream = Readable.fromWeb(guarded);
+    await pipeline(nodeStream, createWriteStream(tmpPath), { signal: binaryController.signal });
+    clearTimeout(binaryTimeout);
+    binaryTimeout = null;
+    const actualHash = hash.digest("hex");
     if (actualHash !== expectedHash) {
-      throw new Error(`Checksum mismatch for ${assetName}: expected ${expectedHash}, got ${actualHash}. The binary may have been tampered with.`);
+      throw new Error(`Checksum mismatch for ${assetName}: expected ${expectedHash}, got ${actualHash}. ` + "The binary may have been tampered with.");
     }
     log(`Checksum verified (SHA-256: ${actualHash.slice(0, 16)}...)`);
-    const tmpPath = `${binaryPath}.tmp`;
-    const { writeFileSync } = await import("fs");
-    writeFileSync(tmpPath, Buffer.from(arrayBuffer));
     if (process.platform !== "win32") {
       chmodSync(tmpPath, 493);
     }
-    const { renameSync } = await import("fs");
     renameSync(tmpPath, binaryPath);
     log(`AFT binary ready at ${binaryPath}`);
     return binaryPath;
   } catch (err) {
     const msg = err instanceof Error ? err.message : String(err);
     error(`Failed to download AFT binary: ${msg}`);
-    const tmpPath = `${binaryPath}.tmp`;
     if (existsSync(tmpPath)) {
       try {
         unlinkSync(tmpPath);
       } catch {}
     }
     return null;
+  } finally {
+    if (binaryTimeout) {
+      binaryController?.abort();
+      clearTimeout(binaryTimeout);
+    }
+    if (checksumTimeout) {
+      checksumController?.abort();
+      clearTimeout(checksumTimeout);
+    }
+    releaseLock?.();
   }
 }
 async function ensureBinary(version) {
@@ -8648,6 +8767,39 @@ async function ensureBinary(version) {
   log("No cached binary found, downloading latest...");
   return downloadBinary();
 }
+async function acquireDownloadLock(lockPath) {
+  const startedAt = Date.now();
+  while (true) {
+    try {
+      const fd = openSync(lockPath, "wx");
+      return () => {
+        try {
+          closeSync(fd);
+        } catch {}
+        try {
+          rmSync(lockPath, { force: true });
+        } catch {}
+      };
+    } catch (err) {
+      const code = err.code;
+      if (code !== "EEXIST")
+        throw err;
+      try {
+        const ageMs = Date.now() - statSync(lockPath).mtimeMs;
+        if (ageMs > DOWNLOAD_LOCK_STALE_MS) {
+          rmSync(lockPath, { force: true });
+          continue;
+        }
+      } catch {
+        continue;
+      }
+      if (Date.now() - startedAt > DOWNLOAD_LOCK_TIMEOUT_MS) {
+        throw new Error(`Timed out waiting for download lock: ${lockPath}`);
+      }
+      await new Promise((resolve) => setTimeout(resolve, 100));
+    }
+  }
+}
 function parseChecksumForAsset(checksumText, assetName) {
   for (const line of checksumText.split(`
 `)) {
@@ -8662,9 +8814,12 @@ function parseChecksumForAsset(checksumText, assetName) {
   return null;
 }
 async function fetchLatestTag() {
+  const controller = new AbortController;
+  const timeout = setTimeout(() => controller.abort(), LATEST_TAG_TIMEOUT_MS);
   try {
     const response = await fetch(`https://api.github.com/repos/${REPO}/releases/latest`, {
-      headers: { Accept: "application/vnd.github.v3+json" }
+      headers: { Accept: "application/vnd.github.v3+json" },
+      signal: controller.signal
     });
     if (!response.ok)
       return null;
@@ -8672,18 +8827,20 @@ async function fetchLatestTag() {
     return data.tag_name ?? null;
   } catch {
     return null;
+  } finally {
+    clearTimeout(timeout);
   }
 }
 // ../aft-bridge/dist/onnx-runtime.js
 import { execFileSync } from "child_process";
-import { createHash } from "crypto";
-import { chmodSync as chmodSync2, closeSync, copyFileSync, createWriteStream, existsSync as existsSync2, lstatSync, mkdirSync as mkdirSync2, openSync, readdirSync, readFileSync, readlinkSync, realpathSync, rmSync, statSync, symlinkSync, unlinkSync as unlinkSync2, writeFileSync } from "fs";
+import { createHash as createHash2 } from "crypto";
+import { chmodSync as chmodSync2, closeSync as closeSync2, copyFileSync, createWriteStream as createWriteStream2, existsSync as existsSync2, lstatSync, mkdirSync as mkdirSync2, openSync as openSync2, readdirSync, readFileSync, readlinkSync, realpathSync, rmSync as rmSync2, statSync as statSync2, symlinkSync, unlinkSync as unlinkSync2, writeFileSync } from "fs";
 import { dirname, join as join3, relative, resolve } from "path";
-import { Readable } from "stream";
-import { pipeline } from "stream/promises";
+import { Readable as Readable2 } from "stream";
+import { pipeline as pipeline2 } from "stream/promises";
 var ORT_VERSION = "1.24.4";
 var ORT_REPO = "microsoft/onnxruntime";
-var MAX_DOWNLOAD_BYTES = 256 * 1024 * 1024;
+var MAX_DOWNLOAD_BYTES2 = 256 * 1024 * 1024;
 var MAX_EXTRACT_BYTES = 1 * 1024 * 1024 * 1024;
 var ONNX_LOCK_FILE = ".aft-onnx-installing";
 var ONNX_INSTALLED_META_FILE = ".aft-onnx-installed";
@@ -8804,7 +8961,7 @@ function cleanupAbandonedStagingDirs(onnxBaseDir) {
       if (Number.isFinite(pid) && pid > 0) {
         if (process.platform === "win32") {
           try {
-            const ageMs = Date.now() - statSync(stagingDir).mtimeMs;
+            const ageMs = Date.now() - statSync2(stagingDir).mtimeMs;
             abandoned = ageMs > STALE_LOCK_MS;
           } catch {
             abandoned = true;
@@ -8818,7 +8975,7 @@ function cleanupAbandonedStagingDirs(onnxBaseDir) {
       if (abandoned) {
         log(`[onnx] removing abandoned staging dir ${stagingDir}`);
         try {
-          rmSync(stagingDir, { recursive: true, force: true });
+          rmSync2(stagingDir, { recursive: true, force: true });
         } catch (err) {
           warn(`[onnx] failed to remove ${stagingDir}: ${err}`);
         }
@@ -8830,7 +8987,7 @@ function cleanupIncompleteTargetIfUnowned(ortDir) {
   try {
     if (existsSync2(ortDir) && !existsSync2(join3(ortDir, ONNX_INSTALLED_META_FILE))) {
       log(`[onnx] removing half-populated install dir ${ortDir} (no meta file)`);
-      rmSync(ortDir, { recursive: true, force: true });
+      rmSync2(ortDir, { recursive: true, force: true });
     }
   } catch (err) {
     warn(`[onnx] failed to sweep ${ortDir}: ${err}`);
@@ -8910,24 +9067,24 @@ async function downloadFileWithCap(url, destPath) {
       throw new Error(`download failed (HTTP ${res.status})`);
     }
     const advertised = Number.parseInt(res.headers.get("content-length") ?? "", 10);
-    if (Number.isFinite(advertised) && advertised > MAX_DOWNLOAD_BYTES) {
-      throw new Error(`Content-Length ${advertised} exceeds max ${MAX_DOWNLOAD_BYTES}`);
+    if (Number.isFinite(advertised) && advertised > MAX_DOWNLOAD_BYTES2) {
+      throw new Error(`Content-Length ${advertised} exceeds max ${MAX_DOWNLOAD_BYTES2}`);
     }
     mkdirSync2(dirname(destPath), { recursive: true });
     let bytesWritten = 0;
     const guard = new TransformStream({
       transform(chunk, transformController) {
         bytesWritten += chunk.byteLength;
-        if (bytesWritten > MAX_DOWNLOAD_BYTES) {
-          transformController.error(new Error(`download exceeded ${MAX_DOWNLOAD_BYTES} bytes after streaming (server lied about size or sent unbounded body)`));
+        if (bytesWritten > MAX_DOWNLOAD_BYTES2) {
+          transformController.error(new Error(`download exceeded ${MAX_DOWNLOAD_BYTES2} bytes after streaming (server lied about size or sent unbounded body)`));
           return;
         }
         transformController.enqueue(chunk);
       }
     });
     const guarded = res.body.pipeThrough(guard);
-    const nodeStream = Readable.fromWeb(guarded);
-    await pipeline(nodeStream, createWriteStream(destPath), { signal: controller.signal });
+    const nodeStream = Readable2.fromWeb(guarded);
+    await pipeline2(nodeStream, createWriteStream2(destPath), { signal: controller.signal });
   } catch (err) {
     try {
       unlinkSync2(destPath);
@@ -9026,16 +9183,16 @@ async function downloadOnnxRuntime(info, targetDir) {
       warn(`Could not hash newly-installed ONNX library at ${libPath}: ${err}`);
     }
     writeOnnxInstalledMeta(targetDir, ORT_VERSION, libHash, archiveSha256);
-    rmSync(tmpDir, { recursive: true, force: true });
+    rmSync2(tmpDir, { recursive: true, force: true });
     log(`ONNX Runtime v${ORT_VERSION} installed to ${targetDir}`);
     return targetDir;
   } catch (err) {
     error(`Failed to download ONNX Runtime: ${err}`);
     try {
-      rmSync(tmpDir, { recursive: true, force: true });
+      rmSync2(tmpDir, { recursive: true, force: true });
     } catch {}
     try {
-      rmSync(targetDir, { recursive: true, force: true });
+      rmSync2(targetDir, { recursive: true, force: true });
     } catch {}
     return null;
   }
@@ -9052,7 +9209,7 @@ function copyOnnxLibraries(info, extractedDir, targetDir, realFiles, symlinks, c
       }
     } catch (copyErr) {
       if (requiredLibs.has(libFile)) {
-        rmSync(targetDir, { recursive: true, force: true });
+        rmSync2(targetDir, { recursive: true, force: true });
         throw copyErr;
       }
       log(`ORT extract: failed to copy optional ${libFile}: ${copyErr}`);
@@ -9067,7 +9224,7 @@ function copyOnnxLibraries(info, extractedDir, targetDir, realFiles, symlinks, c
       symlinkSync(link.target, dst);
     } catch (symlinkErr) {
       if (requiredLibs.has(link.name)) {
-        rmSync(targetDir, { recursive: true, force: true });
+        rmSync2(targetDir, { recursive: true, force: true });
         throw symlinkErr;
       }
       log(`ORT extract: failed to symlink optional ${link.name}: ${symlinkErr}`);
@@ -9075,7 +9232,7 @@ function copyOnnxLibraries(info, extractedDir, targetDir, realFiles, symlinks, c
   }
   const requiredPath = join3(targetDir, info.libName);
   if (!existsSync2(requiredPath)) {
-    rmSync(targetDir, { recursive: true, force: true });
+    rmSync2(targetDir, { recursive: true, force: true });
     throw new Error(`Required ONNX Runtime library missing after install: ${requiredPath}`);
   }
 }
@@ -9108,7 +9265,7 @@ function writeOnnxInstalledMeta(installDir, version, sha256, archiveSha256) {
 function readOnnxInstalledMeta(installDir) {
   const path = join3(installDir, ONNX_INSTALLED_META_FILE);
   try {
-    if (!statSync(path).isFile())
+    if (!statSync2(path).isFile())
       return null;
     const raw = readFileSync(path, "utf8");
     const parsed = JSON.parse(raw);
@@ -9125,20 +9282,20 @@ function readOnnxInstalledMeta(installDir) {
   }
 }
 function sha256File(path) {
-  const hash = createHash("sha256");
+  const hash = createHash2("sha256");
   hash.update(readFileSync(path));
   return hash.digest("hex");
 }
 function acquireLock(lockPath) {
   const tryClaim = () => {
     try {
-      const fd = openSync(lockPath, "wx");
+      const fd = openSync2(lockPath, "wx");
       try {
         writeFileSync(fd, `${process.pid}
 ${new Date().toISOString()}
 `);
       } finally {
-        closeSync(fd);
+        closeSync2(fd);
       }
       return true;
     } catch (err) {
@@ -9159,7 +9316,7 @@ ${new Date().toISOString()}
     const parsed = Number.parseInt(firstLine, 10);
     if (Number.isFinite(parsed) && parsed > 0)
       owningPid = parsed;
-    lockMtimeMs = statSync(lockPath).mtimeMs;
+    lockMtimeMs = statSync2(lockPath).mtimeMs;
   } catch {
     return tryClaim();
   }
@@ -9276,7 +9433,9 @@ class BridgePool {
       onVersionMismatch: options.onVersionMismatch,
       onConfigureWarnings: options.onConfigureWarnings,
       onBashCompletion: options.onBashCompletion,
-      onBashLongRunning: options.onBashLongRunning
+      onBashLongRunning: options.onBashLongRunning,
+      errorPrefix: options.errorPrefix,
+      logger: options.logger
     };
     this.configOverrides = configOverrides;
     if (Number.isFinite(this.idleTimeoutMs)) {
@@ -9348,24 +9507,32 @@ class BridgePool {
   }
   async replaceBinary(newPath) {
     this.binaryPath = newPath;
-    const shutdowns = Array.from(this.bridges.values()).map((entry) => entry.bridge.shutdown());
     this.bridges.clear();
-    await Promise.allSettled(shutdowns);
     this.log(`Binary path updated to ${newPath}. All bridges cleared \u2014 next calls will use the new binary.`);
     return newPath;
   }
   log(message, meta) {
     const logger = this.logger ?? getActiveLogger();
-    if (logger)
-      logger.log(message, meta);
-    else
+    if (logger) {
+      try {
+        logger.log(message, meta);
+      } catch (err) {
+        console.error(`[aft-bridge] ERROR: pool logger log threw: ${err instanceof Error ? err.message : String(err)}`);
+        console.error(`[aft-bridge] ${message}`);
+      }
+    } else
       log(message, meta);
   }
   error(message, meta) {
     const logger = this.logger ?? getActiveLogger();
-    if (logger)
-      logger.error(message, meta);
-    else
+    if (logger) {
+      try {
+        logger.error(message, meta);
+      } catch (err) {
+        console.error(`[aft-bridge] ERROR: pool logger error threw: ${err instanceof Error ? err.message : String(err)}`);
+        console.error(`[aft-bridge] ERROR: ${message}`);
+      }
+    } else
       error(message, meta);
   }
   setConfigureOverride(key, value) {
@@ -9392,7 +9559,7 @@ function normalizeKey(projectRoot) {
 }
 // ../aft-bridge/dist/resolver.js
 import { execSync, spawnSync } from "child_process";
-import { chmodSync as chmodSync3, copyFileSync as copyFileSync2, existsSync as existsSync3, mkdirSync as mkdirSync3, renameSync } from "fs";
+import { chmodSync as chmodSync3, copyFileSync as copyFileSync2, existsSync as existsSync3, mkdirSync as mkdirSync3, renameSync as renameSync2 } from "fs";
 import { createRequire } from "module";
 import { homedir as homedir4 } from "os";
 import { join as join4 } from "path";
@@ -9423,15 +9590,19 @@ function copyToVersionedCache(npmBinaryPath, knownVersion) {
     const versionedDir = join4(cacheDir, tag);
     const ext = process.platform === "win32" ? ".exe" : "";
     const cachedPath = join4(versionedDir, `aft${ext}`);
-    if (existsSync3(cachedPath))
-      return cachedPath;
+    if (existsSync3(cachedPath)) {
+      const cachedVersion = readBinaryVersion(cachedPath);
+      if (cachedVersion === version)
+        return cachedPath;
+      warn(`Cached binary at ${cachedPath} reports ${cachedVersion ?? "no version"}, expected ${version}; refreshing from npm package`);
+    }
     mkdirSync3(versionedDir, { recursive: true });
-    const tmpPath = `${cachedPath}.tmp`;
+    const tmpPath = `${cachedPath}.${process.pid}.${Date.now()}.tmp`;
     copyFileSync2(npmBinaryPath, tmpPath);
     if (process.platform !== "win32") {
       chmodSync3(tmpPath, 493);
     }
-    renameSync(tmpPath, cachedPath);
+    renameSync2(tmpPath, cachedPath);
     log(`Copied npm binary to versioned cache: ${cachedPath}`);
     return cachedPath;
   } catch (err) {
@@ -9439,6 +9610,17 @@ function copyToVersionedCache(npmBinaryPath, knownVersion) {
     return null;
   }
 }
+function normalizeBareVersion(version) {
+  return version.startsWith("v") ? version.slice(1) : version;
+}
+function isExpectedCachedBinary(binaryPath, expectedVersion) {
+  const expected = normalizeBareVersion(expectedVersion);
+  const actual = readBinaryVersion(binaryPath);
+  if (actual === expected)
+    return true;
+  warn(`Cached binary at ${binaryPath} reports ${actual ?? "no version"}, expected ${expected}; skipping cache candidate`);
+  return false;
+}
 function platformKey(platform = process.platform, arch = process.arch) {
   const archMap = PLATFORM_ARCH_MAP[platform];
   if (!archMap) {
@@ -9463,7 +9645,7 @@ function findBinarySync(expectedVersion) {
   if (pluginVersion) {
     const tag = pluginVersion.startsWith("v") ? pluginVersion : `v${pluginVersion}`;
     const versionCached = getCachedBinaryPath(tag);
-    if (versionCached)
+    if (versionCached && isExpectedCachedBinary(versionCached, pluginVersion))
       return versionCached;
   }
   try {
@@ -9473,10 +9655,12 @@ function findBinarySync(expectedVersion) {
     const resolved = req.resolve(packageBin);
     if (existsSync3(resolved)) {
       const npmVersion = readBinaryVersion(resolved);
-      if (pluginVersion && npmVersion && npmVersion !== pluginVersion) {
+      if (npmVersion === null) {
+        warn(`npm platform package binary at ${resolved} did not report a version; skipping (continuing to PATH lookup)`);
+      } else if (pluginVersion && npmVersion !== normalizeBareVersion(pluginVersion)) {
         warn(`npm platform package binary v${npmVersion} does not match plugin v${pluginVersion}; skipping (continuing to PATH lookup)`);
       } else {
-        const copied = copyToVersionedCache(resolved, npmVersion ?? undefined);
+        const copied = copyToVersionedCache(resolved, npmVersion);
         return copied ?? resolved;
       }
     }
@@ -9525,7 +9709,7 @@ async function findBinary(expectedVersion) {
 `));
 }
 // ../aft-bridge/dist/url-fetch.js
-import { createHash as createHash2 } from "crypto";
+import { createHash as createHash3 } from "crypto";
 import { lookup } from "dns/promises";
 import { existsSync as existsSync4, mkdirSync as mkdirSync4, readdirSync as readdirSync2, readFileSync as readFileSync2, unlinkSync as unlinkSync3, writeFileSync as writeFileSync2 } from "fs";
 import { isIP } from "net";
@@ -9539,7 +9723,7 @@ function cacheDir(storageDir) {
   return join5(storageDir, "url_cache");
 }
 function hashUrl(url) {
-  return createHash2("sha256").update(url).digest("hex").slice(0, 16);
+  return createHash3("sha256").update(url).digest("hex").slice(0, 16);
 }
 function metaPath(storageDir, hash) {
   return join5(cacheDir(storageDir), `${hash}.meta.json`);
@@ -9797,8 +9981,8 @@ async function fetchUrlToTempFile(url, storageDir, options = {}) {
   const contentFile = contentPath(storageDir, hash, extension);
   const tmpContent = `${contentFile}.tmp-${process.pid}`;
   writeFileSync2(tmpContent, body);
-  const { renameSync: renameSync2 } = await import("fs");
-  renameSync2(tmpContent, contentFile);
+  const { renameSync: renameSync3 } = await import("fs");
+  renameSync3(tmpContent, contentFile);
   const meta = {
     url,
     contentType,
@@ -9807,7 +9991,7 @@ async function fetchUrlToTempFile(url, storageDir, options = {}) {
   };
   const tmpMeta = `${metaFile}.tmp-${process.pid}`;
   writeFileSync2(tmpMeta, JSON.stringify(meta));
-  renameSync2(tmpMeta, metaFile);
+  renameSync3(tmpMeta, metaFile);
   log(`URL cached (${total} bytes): ${url}`);
   return contentFile;
 }
@@ -9961,24 +10145,24 @@ function warn2(message, data) {
 function error2(message, data) {
   write("ERROR", message, data);
 }
-function sessionLog2(sessionId, message, data) {
+function sessionLog(sessionId, message, data) {
   write("INFO", message, data, sessionId);
 }
-function sessionWarn2(sessionId, message, data) {
+function sessionWarn(sessionId, message, data) {
   write("WARN", message, data, sessionId);
 }
-function sessionError2(sessionId, message, data) {
+function sessionError(sessionId, message, data) {
   write("ERROR", message, data, sessionId);
 }
 var bridgeLogger = {
   log(message, meta) {
-    sessionLog2(meta?.sessionId, message);
+    sessionLog(meta?.sessionId, message);
   },
   warn(message, meta) {
-    sessionWarn2(meta?.sessionId, message);
+    sessionWarn(meta?.sessionId, message);
   },
   error(message, meta) {
-    sessionError2(meta?.sessionId, message);
+    sessionError(meta?.sessionId, message);
   },
   getLogFilePath: () => logFile
 };
@@ -10073,6 +10257,7 @@ var sessionBgStates = new Map;
 var SESSION_BG_STATE_IDLE_TTL_MS = 60 * 60 * 1000;
 var DEBOUNCE_STEP_MS = 200;
 var DEBOUNCE_CAP_MS = 1000;
+var MAX_WAKE_SEND_ATTEMPTS = 5;
 var UNKNOWN_COMPLETION_TTL_MS = 5000;
 var UNKNOWN_COMPLETION_CAP = 32;
 var DEFAULT_SESSION_ID = "__default__";
@@ -10125,17 +10310,24 @@ async function appendInTurnBgCompletions(drainContext, output) {
     return;
   const state = stateFor(drainContext.sessionID);
   if (state.outstandingTaskIds.size === 0 && state.pendingCompletions.length === 0 && state.pendingLongRunning.length === 0) {
-    return;
+    await drainCompletions(drainContext);
+    if (state.outstandingTaskIds.size === 0 && state.pendingCompletions.length === 0 && state.pendingLongRunning.length === 0) {
+      return;
+    }
   }
-  if (state.outstandingTaskIds.size > 0) {
+  if (state.outstandingTaskIds.size > 0 || !state.forcedDrainCompleted) {
     await drainCompletions(drainContext);
   }
   if (state.pendingCompletions.length === 0 && state.pendingLongRunning.length === 0)
     return;
+  const deliveredCompletions = [...state.pendingCompletions];
   const reminder = formatCombinedSystemReminder(state.pendingCompletions, state.pendingLongRunning);
   output.output = appendReminder(output.output ?? "", reminder);
   state.pendingCompletions = [];
   state.pendingLongRunning = [];
+  state.wakeRetryAttempts = 0;
+  state.wakeHardStopped = false;
+  await ackCompletions(drainContext, deliveredCompletions);
   if (state.debounceTimer) {
     clearTimeout(state.debounceTimer);
     state.debounceTimer = null;
@@ -10149,12 +10341,12 @@ async function handleIdleBgCompletions(drainContext) {
 }
 async function triggerWakeIfPending(drainContext, skipDrain) {
   const state = stateFor(drainContext.sessionID);
-  if (!skipDrain && state.outstandingTaskIds.size > 0) {
+  if (!skipDrain && (state.outstandingTaskIds.size > 0 || !state.forcedDrainCompleted)) {
     await drainCompletions(drainContext);
   }
   if (state.pendingCompletions.length === 0 && state.pendingLongRunning.length === 0)
     return;
-  scheduleWake(state, async (reminder) => {
+  scheduleWake(state, async (reminder, deliveredCompletions) => {
     const client = drainContext.client;
     if (typeof client.session?.promptAsync !== "function") {
       throw new Error("client.session.promptAsync is unavailable");
@@ -10178,8 +10370,9 @@ async function triggerWakeIfPending(drainContext, skipDrain) {
       path: { id: drainContext.sessionID },
       body
     });
-  }, (err) => {
-    sessionWarn2(drainContext.sessionID, `${LOG_PREFIX} wake send failed: ${err instanceof Error ? err.message : String(err)}`);
+    await ackCompletions(drainContext, deliveredCompletions);
+  }, (err, hardStopped) => {
+    sessionWarn(drainContext.sessionID, hardStopped ? `${LOG_PREFIX} wake send failed ${MAX_WAKE_SEND_ATTEMPTS} times; stopping retries: ${err instanceof Error ? err.message : String(err)}` : `${LOG_PREFIX} wake send failed: ${err instanceof Error ? err.message : String(err)}`);
   });
 }
 function formatSystemReminder(completions) {
@@ -10230,19 +10423,40 @@ function extractSessionID(value) {
   return;
 }
 async function drainCompletions({ ctx, directory, sessionID }) {
+  const state = stateFor(sessionID);
   try {
     const bridge = ctx.pool.getActiveBridgeForRoot(directory) ?? ctx.pool.getBridge(directory);
     const response = await bridge.send("bash_drain_completions", { session_id: sessionID });
     if (response.success === false) {
-      sessionWarn2(sessionID, `${LOG_PREFIX} drain failed: ${String(response.message ?? "unknown error")}`);
+      sessionWarn(sessionID, `${LOG_PREFIX} drain failed: ${String(response.message ?? "unknown error")}`);
       return;
     }
-    ingestBgCompletions(sessionID, response.bg_completions);
+    state.forcedDrainCompleted = true;
+    ingestDrainedBgCompletions(sessionID, response.bg_completions);
+  } catch (err) {
+    sessionWarn(sessionID, `${LOG_PREFIX} drain failed: ${err instanceof Error ? err.message : String(err)}`);
+  }
+}
+async function ackCompletions({ ctx, directory, sessionID }, completions) {
+  const taskIds = [...new Set(completions.map((completion) => completion.task_id))];
+  if (taskIds.length === 0)
+    return;
+  try {
+    const bridge = ctx.pool.getActiveBridgeForRoot(directory) ?? ctx.pool.getBridge(directory);
+    const response = await bridge.send("bash_ack_completions", {
+      session_id: sessionID,
+      task_ids: taskIds
+    });
+    if (response.success === false) {
+      sessionWarn(sessionID, `${LOG_PREFIX} ack failed: ${String(response.message ?? "unknown error")}`);
+    }
   } catch (err) {
-    sessionWarn2(sessionID, `${LOG_PREFIX} drain failed: ${err instanceof Error ? err.message : String(err)}`);
+    sessionWarn(sessionID, `${LOG_PREFIX} ack failed: ${err instanceof Error ? err.message : String(err)}`);
   }
 }
 function scheduleWake(state, sendWake, onSendFailure) {
+  if (state.wakeHardStopped)
+    return;
   const now = Date.now();
   const pendingCount = state.pendingCompletions.length + state.pendingLongRunning.length;
   if (state.debounceTimer && pendingCount <= state.scheduledCompletionCount) {
@@ -10271,13 +10485,22 @@ function scheduleWake(state, sendWake, onSendFailure) {
     const reminder = formatCombinedSystemReminder(pending, pendingLongRunning);
     state.pendingCompletions = [];
     state.pendingLongRunning = [];
-    sendWake(reminder).then(() => {
+    sendWake(reminder, pending).then(() => {
       state.retryDelayMs = null;
+      state.wakeRetryAttempts = 0;
+      state.wakeHardStopped = false;
     }).catch((err) => {
       state.pendingCompletions = [...pending, ...state.pendingCompletions];
       state.pendingLongRunning = [...pendingLongRunning, ...state.pendingLongRunning];
+      state.wakeRetryAttempts += 1;
+      if (state.wakeRetryAttempts >= MAX_WAKE_SEND_ATTEMPTS) {
+        state.retryDelayMs = null;
+        state.wakeHardStopped = true;
+        onSendFailure(err, true);
+        return;
+      }
       state.retryDelayMs = Math.min((delay || DEBOUNCE_STEP_MS) * 2, DEBOUNCE_CAP_MS);
-      onSendFailure(err);
+      onSendFailure(err, false);
       scheduleWake(state, sendWake, onSendFailure);
     });
   }, delay);
@@ -10298,6 +10521,9 @@ function stateFor(sessionID) {
       scheduledFireAt: null,
       scheduledCompletionCount: 0,
       retryDelayMs: null,
+      wakeRetryAttempts: 0,
+      wakeHardStopped: false,
+      forcedDrainCompleted: false,
       unknownCompletions: [],
       lastSeenAt: now
     };
@@ -10307,6 +10533,22 @@ function stateFor(sessionID) {
   }
   return state;
 }
+function ingestDrainedBgCompletions(sessionID, completions) {
+  if (!Array.isArray(completions) || completions.length === 0)
+    return [];
+  const state = stateFor(sessionID);
+  const accepted = [];
+  for (const completion of completions) {
+    if (!isBgCompletion(completion))
+      continue;
+    state.outstandingTaskIds.delete(completion.task_id);
+    if (!state.pendingCompletions.some((pending) => pending.task_id === completion.task_id) && !accepted.some((pending) => pending.task_id === completion.task_id)) {
+      accepted.push(completion);
+    }
+  }
+  state.pendingCompletions.push(...accepted);
+  return accepted;
+}
 function cleanupIdleSessionStates(now) {
   const cutoff = now - SESSION_BG_STATE_IDLE_TTL_MS;
   for (const [sessionID, state] of sessionBgStates) {
@@ -10397,7 +10639,7 @@ function formatDuration(completion) {
 
 // src/config.ts
 var import_comment_json = __toESM(require_src2(), 1);
-import { existsSync as existsSync5, readFileSync as readFileSync3, renameSync as renameSync2, unlinkSync as unlinkSync4, writeFileSync as writeFileSync3 } from "fs";
+import { existsSync as existsSync5, readFileSync as readFileSync3, renameSync as renameSync3, unlinkSync as unlinkSync4, writeFileSync as writeFileSync3 } from "fs";
 import { homedir as homedir5 } from "os";
 import { join as join7 } from "path";
 
@@ -24176,7 +24418,7 @@ function migrateAftConfigFile(configPath, logger = { log: log2, warn: warn2 }) {
 ${serialized}` : serialized;
     tmpPath = `${configPath}.tmp.${process.pid}`;
     writeFileSync3(tmpPath, nextContent, "utf-8");
-    renameSync2(tmpPath, configPath);
+    renameSync3(tmpPath, configPath);
     logger.log(`Migrated config at ${configPath}: removed ${oldKeys.join(", ")}`);
     return { migrated: true, oldKeys };
   } catch (err) {
@@ -24411,19 +24653,19 @@ function loadAftConfig(projectDirectory) {
 }
 
 // src/hooks/auto-update-checker/index.ts
-import { existsSync as existsSync8, mkdirSync as mkdirSync5, readFileSync as readFileSync6, renameSync as renameSync3, writeFileSync as writeFileSync6 } from "fs";
+import { existsSync as existsSync8, mkdirSync as mkdirSync5, readFileSync as readFileSync6, renameSync as renameSync4, writeFileSync as writeFileSync6 } from "fs";
 import { dirname as dirname4, join as join11 } from "path";
 
 // src/hooks/auto-update-checker/cache.ts
 var import_comment_json3 = __toESM(require_src2(), 1);
 import { spawn as spawn2 } from "child_process";
-import { cpSync, existsSync as existsSync7, mkdtempSync, readFileSync as readFileSync5, rmSync as rmSync2, writeFileSync as writeFileSync5 } from "fs";
+import { cpSync, existsSync as existsSync7, mkdtempSync, readFileSync as readFileSync5, rmSync as rmSync3, writeFileSync as writeFileSync5 } from "fs";
 import { tmpdir as tmpdir2 } from "os";
 import { basename, dirname as dirname3, join as join10 } from "path";
 
 // src/hooks/auto-update-checker/checker.ts
 var import_comment_json2 = __toESM(require_src2(), 1);
-import { existsSync as existsSync6, readFileSync as readFileSync4, statSync as statSync2, writeFileSync as writeFileSync4 } from "fs";
+import { existsSync as existsSync6, readFileSync as readFileSync4, statSync as statSync3, writeFileSync as writeFileSync4 } from "fs";
 import { homedir as homedir7 } from "os";
 import { dirname as dirname2, isAbsolute, join as join9, resolve as resolve2 } from "path";
 import { fileURLToPath } from "url";
@@ -24550,7 +24792,7 @@ function getLocalDevPath(directory) {
 }
 function findPackageJsonUp(startPath) {
   try {
-    const stat = statSync2(startPath);
+    const stat = statSync3(startPath);
     let dir = stat.isDirectory() ? startPath : dirname2(startPath);
     for (let i = 0;i < 10; i++) {
       const pkgPath = join9(dir, "package.json");
@@ -24690,19 +24932,19 @@ function createAutoUpdateSnapshot(installDir, packageJsonPath, packageName) {
 function restoreAutoUpdateSnapshot(snapshot) {
   try {
     if (snapshot.packageJson === null)
-      rmSync2(snapshot.packageJsonPath, { force: true });
+      rmSync3(snapshot.packageJsonPath, { force: true });
     else
       writeFileSync5(snapshot.packageJsonPath, snapshot.packageJson);
     if (snapshot.lockfile === null)
-      rmSync2(snapshot.lockfilePath, { force: true });
+      rmSync3(snapshot.lockfilePath, { force: true });
     else
       writeFileSync5(snapshot.lockfilePath, snapshot.lockfile);
-    rmSync2(snapshot.packageDir, { recursive: true, force: true });
+    rmSync3(snapshot.packageDir, { recursive: true, force: true });
     if (snapshot.stagedPackageDir) {
       cpSync(snapshot.stagedPackageDir, snapshot.packageDir, { recursive: true });
     }
   } finally {
-    rmSync2(snapshot.tempDir, { recursive: true, force: true });
+    rmSync3(snapshot.tempDir, { recursive: true, force: true });
   }
 }
 function stripPackageNameFromPath(pathValue, packageName) {
@@ -24767,7 +25009,7 @@ function removeInstalledPackage(installDir, packageName) {
   const packageDir = join10(installDir, "node_modules", packageName);
   if (!existsSync7(packageDir))
     return false;
-  rmSync2(packageDir, { recursive: true, force: true });
+  rmSync3(packageDir, { recursive: true, force: true });
   log2(`[auto-update-checker] Package removed: ${packageDir}`);
   return true;
 }
@@ -24852,7 +25094,7 @@ async function runNpmInstallSafe(installDir, options = {}) {
     if (!result && snapshot) {
       restoreAutoUpdateSnapshot(snapshot);
     } else if (snapshot) {
-      rmSync2(snapshot.tempDir, { recursive: true, force: true });
+      rmSync3(snapshot.tempDir, { recursive: true, force: true });
     }
     return result;
   } catch (err) {
@@ -24936,7 +25178,7 @@ function claimCheckSlot(storageDir, intervalMs) {
     mkdirSync5(dirname4(file2), { recursive: true });
     const tmp = `${file2}.tmp.${process.pid}`;
     writeFileSync6(tmp, JSON.stringify({ lastCheckedMs: Date.now() }), "utf-8");
-    renameSync3(tmp, file2);
+    renameSync4(tmp, file2);
     return true;
   } catch (err) {
     warn2(`[auto-update-checker] Could not coordinate via timestamp file: ${String(err)}`);
@@ -25023,17 +25265,17 @@ function showToast(ctx, title, message, variant = "info", duration3 = 3000) {
 
 // src/lsp-auto-install.ts
 import { spawn as spawn3 } from "child_process";
-import { createHash as createHash3 } from "crypto";
-import { createReadStream, mkdirSync as mkdirSync7, readFileSync as readFileSync8, renameSync as renameSync4, rmSync as rmSync3, statSync as statSync4 } from "fs";
+import { createHash as createHash4 } from "crypto";
+import { createReadStream, mkdirSync as mkdirSync7, readFileSync as readFileSync8, renameSync as renameSync5, rmSync as rmSync4, statSync as statSync5 } from "fs";
 import { join as join14 } from "path";
 
 // src/lsp-cache.ts
 import {
-  closeSync as closeSync2,
+  closeSync as closeSync3,
   mkdirSync as mkdirSync6,
-  openSync as openSync2,
+  openSync as openSync3,
   readFileSync as readFileSync7,
-  statSync as statSync3,
+  statSync as statSync4,
   unlinkSync as unlinkSync5,
   writeFileSync as writeFileSync7
 } from "fs";
@@ -25066,7 +25308,7 @@ function lspBinDir(npmPackage) {
 function isInstalled(npmPackage, binary) {
   for (const candidate of lspBinaryCandidates(binary)) {
     try {
-      if (statSync3(join12(lspBinDir(npmPackage), candidate)).isFile())
+      if (statSync4(join12(lspBinDir(npmPackage), candidate)).isFile())
         return true;
     } catch {}
   }
@@ -25094,7 +25336,7 @@ function writeInstalledMetaIn(installDir, version2, sha256) {
 function readInstalledMetaIn(installDir) {
   const path2 = join12(installDir, INSTALLED_META_FILE);
   try {
-    if (!statSync3(path2).isFile())
+    if (!statSync4(path2).isFile())
       return null;
     const raw = readFileSync7(path2, "utf8");
     const parsed = JSON.parse(raw);
@@ -25124,13 +25366,13 @@ function acquireInstallLock(lockKey) {
   const lock = lockPath(lockKey);
   const tryClaim = () => {
     try {
-      const fd = openSync2(lock, "wx");
+      const fd = openSync3(lock, "wx");
       try {
         writeFileSync7(fd, `${process.pid}
 ${new Date().toISOString()}
 `);
       } finally {
-        closeSync2(fd);
+        closeSync3(fd);
       }
       return true;
     } catch (err) {
@@ -25151,7 +25393,7 @@ ${new Date().toISOString()}
     const parsed = Number.parseInt(firstLine, 10);
     if (Number.isFinite(parsed) && parsed > 0)
       owningPid = parsed;
-    lockMtimeMs = statSync3(lock).mtimeMs;
+    lockMtimeMs = statSync4(lock).mtimeMs;
   } catch {
     return tryClaim();
   }
@@ -25692,7 +25934,7 @@ function hashInstalledBinary(spec) {
     let pathToHash = null;
     for (const p of candidates) {
       try {
-        if (statSync4(p).isFile()) {
+        if (statSync5(p).isFile()) {
           pathToHash = p;
           break;
         }
@@ -25702,7 +25944,7 @@ function hashInstalledBinary(spec) {
       reject(new Error(`installed binary not found at any of: ${candidates.join(", ")}`));
       return;
     }
-    const hash2 = createHash3("sha256");
+    const hash2 = createHash4("sha256");
     const stream = createReadStream(pathToHash);
     stream.on("error", reject);
     stream.on("data", (chunk) => hash2.update(chunk));
@@ -25718,14 +25960,14 @@ function installedBinaryPath(spec) {
   ] : [lspBinaryPath(spec.npm, spec.binary)];
   for (const candidate of candidates) {
     try {
-      if (statSync4(candidate).isFile())
+      if (statSync5(candidate).isFile())
         return candidate;
     } catch {}
   }
   return null;
 }
 function sha256OfFileSync(path2) {
-  return createHash3("sha256").update(readFileSync8(path2)).digest("hex");
+  return createHash4("sha256").update(readFileSync8(path2)).digest("hex");
 }
 function quarantineCachedNpmInstall(spec, reason) {
   const packageDir = lspPackageDir(spec.npm);
@@ -25733,8 +25975,8 @@ function quarantineCachedNpmInstall(spec, reason) {
   warn2(`[lsp] tofu_mismatch ${spec.npm}: ${reason}; quarantining ${packageDir} -> ${dest}`);
   try {
     mkdirSync7(join14(dest, ".."), { recursive: true });
-    rmSync3(dest, { recursive: true, force: true });
-    renameSync4(packageDir, dest);
+    rmSync4(dest, { recursive: true, force: true });
+    renameSync5(packageDir, dest);
   } catch (err) {
     warn2(`[lsp] tofu_mismatch ${spec.npm}: failed to quarantine cache entry: ${err}`);
   }
@@ -25810,11 +26052,11 @@ function runAutoInstall(projectRoot, config2, fetchImpl = fetch) {
 
 // src/lsp-github-install.ts
 import { execFileSync as execFileSync2 } from "child_process";
-import { createHash as createHash4, randomBytes } from "crypto";
+import { createHash as createHash5, randomBytes } from "crypto";
 import {
   copyFileSync as copyFileSync3,
   createReadStream as createReadStream2,
-  createWriteStream as createWriteStream2,
+  createWriteStream as createWriteStream3,
   existsSync as existsSync10,
   lstatSync as lstatSync2,
   mkdirSync as mkdirSync8,
@@ -25822,14 +26064,15 @@ import {
   readFileSync as readFileSync9,
   readlinkSync as readlinkSync2,
   realpathSync as realpathSync3,
-  renameSync as renameSync5,
-  rmSync as rmSync4,
-  statSync as statSync5,
-  unlinkSync as unlinkSync6
+  renameSync as renameSync6,
+  rmSync as rmSync5,
+  statSync as statSync6,
+  unlinkSync as unlinkSync6,
+  writeFileSync as writeFileSync8
 } from "fs";
 import { dirname as dirname5, join as join15, relative as relative2, resolve as resolve3 } from "path";
-import { Readable as Readable2 } from "stream";
-import { pipeline as pipeline2 } from "stream/promises";
+import { Readable as Readable3 } from "stream";
+import { pipeline as pipeline3 } from "stream/promises";
 
 // src/lsp-github-table.ts
 function exe(platform2, name) {
@@ -25928,6 +26171,7 @@ function ghBinDir(spec) {
 function ghExtractDir(spec) {
   return join15(ghPackageDir(spec), "extracted");
 }
+var INSTALLED_META_FILE2 = ".aft-installed";
 function ghBinaryPath(spec, platform2) {
   const ext = platform2 === "win32" ? ".exe" : "";
   return join15(ghBinDir(spec), `${spec.binary}${ext}`);
@@ -25935,7 +26179,7 @@ function ghBinaryPath(spec, platform2) {
 function isGithubInstalled(spec, platform2) {
   for (const candidate of ghBinaryCandidates(spec, platform2)) {
     try {
-      if (statSync5(join15(ghBinDir(spec), candidate)).isFile())
+      if (statSync6(join15(ghBinDir(spec), candidate)).isFile())
         return true;
     } catch {}
   }
@@ -25946,11 +26190,45 @@ function ghBinaryCandidates(spec, platform2) {
     return [spec.binary];
   return [spec.binary, `${spec.binary}.cmd`, `${spec.binary}.exe`, `${spec.binary}.bat`];
 }
-var MAX_DOWNLOAD_BYTES2 = 256 * 1024 * 1024;
+function readGithubInstalledMetaIn(installDir) {
+  try {
+    const path2 = join15(installDir, INSTALLED_META_FILE2);
+    if (!statSync6(path2).isFile())
+      return null;
+    const parsed = JSON.parse(readFileSync9(path2, "utf8"));
+    if (typeof parsed.version !== "string" || parsed.version.length === 0)
+      return null;
+    return {
+      version: parsed.version,
+      installedAt: typeof parsed.installedAt === "string" ? parsed.installedAt : "",
+      ...typeof parsed.sha256 === "string" && parsed.sha256.length > 0 ? { sha256: parsed.sha256 } : {},
+      ...typeof parsed.binarySha256 === "string" && parsed.binarySha256.length > 0 ? { binarySha256: parsed.binarySha256 } : {},
+      ...typeof parsed.archiveSha256 === "string" && parsed.archiveSha256.length > 0 ? { archiveSha256: parsed.archiveSha256 } : {}
+    };
+  } catch {
+    return null;
+  }
+}
+function writeGithubInstalledMetaIn(installDir, version2, binarySha256, archiveSha256) {
+  try {
+    mkdirSync8(installDir, { recursive: true });
+    const meta3 = {
+      version: version2,
+      installedAt: new Date().toISOString(),
+      sha256: binarySha256,
+      binarySha256,
+      ...archiveSha256 ? { archiveSha256 } : {}
+    };
+    writeFileSync8(join15(installDir, INSTALLED_META_FILE2), JSON.stringify(meta3), "utf8");
+  } catch (err) {
+    warn2(`[lsp] failed to write github installed metadata in ${installDir}: ${err}`);
+  }
+}
+var MAX_DOWNLOAD_BYTES3 = 256 * 1024 * 1024;
 var MAX_EXTRACT_BYTES2 = 1024 * 1024 * 1024;
 function sha256OfFile(path2) {
   return new Promise((resolve4, reject) => {
-    const hash2 = createHash4("sha256");
+    const hash2 = createHash5("sha256");
     const stream = createReadStream2(path2);
     stream.on("error", reject);
     stream.on("data", (chunk) => hash2.update(chunk));
@@ -25958,7 +26236,7 @@ function sha256OfFile(path2) {
   });
 }
 function sha256OfFileSync2(path2) {
-  return createHash4("sha256").update(readFileSync9(path2)).digest("hex");
+  return createHash5("sha256").update(readFileSync9(path2)).digest("hex");
 }
 async function fetchReleaseByTag(githubRepo, tag, fetchImpl, signal) {
   const candidates = [];
@@ -26121,8 +26399,8 @@ function assertAllowedDownloadUrl(rawUrl) {
   return parsed;
 }
 async function downloadFile(url2, destPath, fetchImpl, assetSize, signal) {
-  if (assetSize !== undefined && assetSize > MAX_DOWNLOAD_BYTES2) {
-    throw new Error(`asset size ${assetSize} exceeds max ${MAX_DOWNLOAD_BYTES2} (set lsp.versions to pin a smaller release if this is wrong)`);
+  if (assetSize !== undefined && assetSize > MAX_DOWNLOAD_BYTES3) {
+    throw new Error(`asset size ${assetSize} exceeds max ${MAX_DOWNLOAD_BYTES3} (set lsp.versions to pin a smaller release if this is wrong)`);
   }
   const timeout = controlledTimeoutSignal(120000, signal);
   try {
@@ -26131,24 +26409,24 @@ async function downloadFile(url2, destPath, fetchImpl, assetSize, signal) {
       throw new Error(`download failed (${res.status})`);
     }
     const advertised = Number.parseInt(res.headers.get("content-length") ?? "", 10);
-    if (Number.isFinite(advertised) && advertised > MAX_DOWNLOAD_BYTES2) {
-      throw new Error(`Content-Length ${advertised} exceeds max ${MAX_DOWNLOAD_BYTES2}`);
+    if (Number.isFinite(advertised) && advertised > MAX_DOWNLOAD_BYTES3) {
+      throw new Error(`Content-Length ${advertised} exceeds max ${MAX_DOWNLOAD_BYTES3}`);
     }
     mkdirSync8(dirname5(destPath), { recursive: true });
     let bytesWritten = 0;
     const guard = new TransformStream({
       transform(chunk, controller) {
         bytesWritten += chunk.byteLength;
-        if (bytesWritten > MAX_DOWNLOAD_BYTES2) {
-          controller.error(new Error(`download exceeded ${MAX_DOWNLOAD_BYTES2} bytes after streaming (server lied about size or sent unbounded body)`));
+        if (bytesWritten > MAX_DOWNLOAD_BYTES3) {
+          controller.error(new Error(`download exceeded ${MAX_DOWNLOAD_BYTES3} bytes after streaming (server lied about size or sent unbounded body)`));
           return;
         }
         controller.enqueue(chunk);
       }
     });
     const guarded = res.body.pipeThrough(guard);
-    const nodeStream = Readable2.fromWeb(guarded);
-    await pipeline2(nodeStream, createWriteStream2(destPath), { signal: timeout.signal });
+    const nodeStream = Readable3.fromWeb(guarded);
+    await pipeline3(nodeStream, createWriteStream3(destPath), { signal: timeout.signal });
   } catch (err) {
     try {
       unlinkSync6(destPath);
@@ -26228,7 +26506,7 @@ function validateExtraction(stagingRoot) {
   };
   walk(realStagingRoot);
 }
-function precheckArchiveSize(archivePath, archiveType) {
+function precheckArchiveContents(archivePath, archiveType) {
   let totalBytes = 0;
   if (archiveType === "zip") {
     const out = execFileSync2("unzip", ["-l", archivePath], { encoding: "utf8" });
@@ -26239,6 +26517,9 @@ function precheckArchiveSize(archivePath, archiveType) {
     const out = execFileSync2("tar", ["-tvf", archivePath], { encoding: "utf8" });
     for (const line of out.split(`
 `)) {
+      if (line.startsWith("h")) {
+        throw new Error(`archive contains hardlink entry: ${line.trim()}`);
+      }
       const parts = line.trim().split(/\s+/);
       if (parts.length >= 6) {
         const numeric = parts.map((part) => Number.parseInt(part, 10)).filter((value) => Number.isFinite(value) && value >= 0);
@@ -26255,20 +26536,20 @@ function extractArchiveSafely(archivePath, destDir, archiveType) {
   const suffix = randomBytes(8).toString("hex");
   const stagingDir = `${destDir}.staging-${suffix}`;
   try {
-    rmSync4(stagingDir, { recursive: true, force: true });
+    rmSync5(stagingDir, { recursive: true, force: true });
   } catch {}
   mkdirSync8(stagingDir, { recursive: true });
   try {
-    precheckArchiveSize(archivePath, archiveType);
+    precheckArchiveContents(archivePath, archiveType);
     runPlatformExtractor(archivePath, stagingDir, archiveType);
     validateExtraction(stagingDir);
     try {
-      rmSync4(destDir, { recursive: true, force: true });
+      rmSync5(destDir, { recursive: true, force: true });
     } catch {}
-    renameSync5(stagingDir, destDir);
+    renameSync6(stagingDir, destDir);
   } catch (err) {
     try {
-      rmSync4(stagingDir, { recursive: true, force: true });
+      rmSync5(stagingDir, { recursive: true, force: true });
     } catch {}
     throw err;
   }
@@ -26279,28 +26560,44 @@ function quarantineCachedGithubInstall(spec, reason) {
   warn2(`[lsp] tofu_mismatch ${spec.id}: ${reason}; quarantining ${packageDir} -> ${dest}`);
   try {
     mkdirSync8(dirname5(dest), { recursive: true });
-    rmSync4(dest, { recursive: true, force: true });
-    renameSync5(packageDir, dest);
+    rmSync5(dest, { recursive: true, force: true });
+    renameSync6(packageDir, dest);
   } catch (err) {
     warn2(`[lsp] tofu_mismatch ${spec.id}: failed to quarantine cache entry: ${err}`);
   }
 }
 function validateCachedGithubInstall(spec, platform2) {
-  const meta3 = readInstalledMetaIn(ghPackageDir(spec));
+  const packageDir = ghPackageDir(spec);
+  const meta3 = readGithubInstalledMetaIn(packageDir);
   const binaryPath = ghBinaryCandidates(spec, platform2).map((candidate) => join15(ghBinDir(spec), candidate)).find((candidate) => {
     try {
-      return statSync5(candidate).isFile();
+      return statSync6(candidate).isFile();
     } catch {
       return false;
     }
   });
-  if (!meta3?.sha256 || !meta3.version || !isSafeVersion(meta3.version) || !binaryPath) {
+  if (!meta3?.version || !isSafeVersion(meta3.version) || !binaryPath) {
     quarantineCachedGithubInstall(spec, "missing/unsafe metadata or binary");
     return false;
   }
   const currentHash = sha256OfFileSync2(binaryPath);
-  if (currentHash !== meta3.sha256) {
-    quarantineCachedGithubInstall(spec, `recorded ${meta3.sha256}, current ${currentHash}`);
+  const recordedBinaryHash = meta3.binarySha256 ?? meta3.sha256;
+  if (recordedBinaryHash && currentHash === recordedBinaryHash) {
+    if (meta3.sha256 !== currentHash || meta3.binarySha256 !== currentHash) {
+      writeGithubInstalledMetaIn(packageDir, meta3.version, currentHash, meta3.archiveSha256);
+    }
+    return true;
+  }
+  if (meta3.sha256 && !meta3.binarySha256 && !meta3.archiveSha256) {
+    writeGithubInstalledMetaIn(packageDir, meta3.version, currentHash, meta3.sha256);
+    return true;
+  }
+  if (!recordedBinaryHash) {
+    quarantineCachedGithubInstall(spec, "missing binary sha256 metadata");
+    return false;
+  }
+  if (currentHash !== recordedBinaryHash) {
+    quarantineCachedGithubInstall(spec, `recorded ${recordedBinaryHash}, current ${currentHash}`);
     return false;
   }
   return true;
@@ -26369,10 +26666,11 @@ async function downloadAndInstall(spec, tag, assets, platform2, arch, fetchImpl,
     return null;
   }
   log2(`[lsp] ${spec.id} ${tag} sha256=${archiveSha256}`);
-  const previousMeta = readInstalledMetaIn(ghPackageDir(spec));
-  if (previousMeta && previousMeta.version === tag && previousMeta.sha256) {
-    if (previousMeta.sha256 !== archiveSha256) {
-      error2(`[lsp] ${spec.id} ${tag}: TOFU sha256 mismatch \u2014 refusing install. ` + `Previously installed sha256=${previousMeta.sha256}, downloaded sha256=${archiveSha256}. ` + `This means the published release for tag ${tag} changed. Investigate before proceeding. ` + `Run \`aft doctor --clear\` to wipe the cache and force a fresh install if you've verified the change.`);
+  const previousMeta = readGithubInstalledMetaIn(ghPackageDir(spec));
+  const previousArchiveSha256 = previousMeta?.archiveSha256 ?? (previousMeta?.binarySha256 ? undefined : previousMeta?.sha256);
+  if (previousMeta && previousMeta.version === tag && previousArchiveSha256) {
+    if (previousArchiveSha256 !== archiveSha256) {
+      error2(`[lsp] ${spec.id} ${tag}: TOFU sha256 mismatch \u2014 refusing install. ` + `Previously installed archive sha256=${previousArchiveSha256}, downloaded sha256=${archiveSha256}. ` + `This means the published release for tag ${tag} changed. Investigate before proceeding. ` + `Run \`aft doctor --clear\` to wipe the cache and force a fresh install if you've verified the change.`);
       try {
         unlinkSync6(archivePath);
       } catch {}
@@ -26407,7 +26705,9 @@ async function downloadAndInstall(spec, tag, assets, platform2, arch, fetchImpl,
     return null;
   }
   log2(`[lsp] installed ${spec.id} ${tag} at ${targetBinary}`);
-  return archiveSha256;
+  const binarySha256 = await sha256OfFile(targetBinary);
+  log2(`[lsp] ${spec.id} ${tag} binary_sha256=${binarySha256}`);
+  return { archiveSha256, binarySha256 };
 }
 async function ensureGithubInstalled(spec, config2, fetchImpl, platform2, arch, signal) {
   const outcome = await withInstallLock(spec.githubRepo, async () => {
@@ -26433,14 +26733,14 @@ async function ensureGithubInstalled(spec, config2, fetchImpl, platform2, arch,
         log2(`[lsp] reinstalling ${spec.id}@${tag}: no installed-version metadata recorded`);
       }
     }
-    const archiveSha256 = await downloadAndInstall(spec, tag, assets, platform2, arch, fetchImpl, signal).catch((err) => {
+    const hashes = await downloadAndInstall(spec, tag, assets, platform2, arch, fetchImpl, signal).catch((err) => {
       error2(`[lsp] github install ${spec.id} crashed: ${err}`);
       return null;
     });
-    if (!archiveSha256) {
+    if (!hashes) {
       return { started: true, reason: "install failed (see plugin log)" };
     }
-    writeInstalledMetaIn(ghPackageDir(spec), tag, archiveSha256);
+    writeGithubInstalledMetaIn(ghPackageDir(spec), tag, hashes.binarySha256, hashes.archiveSha256);
     return { started: true };
   });
   if (outcome === null) {
@@ -26635,7 +26935,7 @@ function normalizeToolMap(tools) {
 }
 
 // src/notifications.ts
-import { existsSync as existsSync11, mkdirSync as mkdirSync9, readFileSync as readFileSync10, renameSync as renameSync6, rmSync as rmSync5, writeFileSync as writeFileSync8 } from "fs";
+import { existsSync as existsSync11, mkdirSync as mkdirSync9, readFileSync as readFileSync10, renameSync as renameSync7, rmSync as rmSync6, writeFileSync as writeFileSync9 } from "fs";
 import { homedir as homedir9, platform as platform2 } from "os";
 import { join as join16 } from "path";
 function isTuiMode() {
@@ -26742,7 +27042,7 @@ async function sendIgnoredMessage(client, sessionId, text) {
       return true;
     }
   } catch (err) {
-    sessionLog2(sessionId, `[aft-plugin] notification send failed: ${err instanceof Error ? err.message : String(err)}`);
+    sessionLog(sessionId, `[aft-plugin] notification send failed: ${err instanceof Error ? err.message : String(err)}`);
   }
   return false;
 }
@@ -26768,7 +27068,7 @@ async function sendWarning(opts, message) {
   if (!sessionId)
     return;
   const text = `${WARNING_MARKER} ${message}`;
-  sessionLog2(sessionId, `[aft-plugin] sending warning to session ${sessionId}`);
+  sessionLog(sessionId, `[aft-plugin] sending warning to session ${sessionId}`);
   await sendIgnoredMessage(opts.client, sessionId, text);
 }
 async function sendFeatureAnnouncement(opts, version2, features, storageDir) {
@@ -26791,13 +27091,13 @@ async function sendFeatureAnnouncement(opts, version2, features, storageDir) {
       return;
     const text = [`${FEATURE_MARKER} v${version2}:`, ...features.map((f) => `  \u2022 ${f}`)].join(`
 `);
-    sessionLog2(sessionId, `[aft-plugin] sending feature announcement for v${version2}`);
+    sessionLog(sessionId, `[aft-plugin] sending feature announcement for v${version2}`);
     await sendIgnoredMessage(opts.client, sessionId, text);
   }
   if (storageDir) {
     try {
       mkdirSync9(storageDir, { recursive: true });
-      writeFileSync8(join16(storageDir, "last_announced_version"), version2);
+      writeFileSync9(join16(storageDir, "last_announced_version"), version2);
     } catch {}
   }
 }
@@ -26825,9 +27125,9 @@ function writeWarnedTools(storageDir, warned) {
     mkdirSync9(storageDir, { recursive: true });
     const warnedToolsPath = join16(storageDir, WARNED_TOOLS_FILE);
     const tmpPath = join16(storageDir, `${WARNED_TOOLS_FILE}.${process.pid}.${Date.now()}.${Math.random().toString(16).slice(2)}.tmp`);
-    writeFileSync8(tmpPath, `${JSON.stringify(warned, null, 2)}
+    writeFileSync9(tmpPath, `${JSON.stringify(warned, null, 2)}
 `);
-    renameSync6(tmpPath, warnedToolsPath);
+    renameSync7(tmpPath, warnedToolsPath);
   } catch {}
 }
 async function withWarnedToolsLock(storageDir, fn) {
@@ -26839,7 +27139,7 @@ async function withWarnedToolsLock(storageDir, fn) {
       try {
         return await fn();
       } finally {
-        rmSync5(lockDir, { recursive: true, force: true });
+        rmSync6(lockDir, { recursive: true, force: true });
       }
     } catch (err) {
       const code = err.code;
@@ -26940,7 +27240,7 @@ async function cleanupWarnings(opts) {
   }
   if (warningIds.length === 0)
     return;
-  sessionLog2(sessionId, `[aft-plugin] cleaning up ${warningIds.length} stale warning(s)`);
+  sessionLog(sessionId, `[aft-plugin] cleaning up ${warningIds.length} stale warning(s)`);
   for (const id of warningIds) {
     await deleteMessage(effectiveServerUrl, sessionId, id);
   }
@@ -26948,16 +27248,16 @@ async function cleanupWarnings(opts) {
 
 // src/shared/rpc-server.ts
 import { randomBytes as randomBytes2 } from "crypto";
-import { mkdirSync as mkdirSync10, renameSync as renameSync7, unlinkSync as unlinkSync7, writeFileSync as writeFileSync9 } from "fs";
+import { mkdirSync as mkdirSync10, renameSync as renameSync8, unlinkSync as unlinkSync7, writeFileSync as writeFileSync10 } from "fs";
 import { createServer } from "http";
 import { dirname as dirname6 } from "path";
 
 // src/shared/rpc-utils.ts
-import { createHash as createHash5 } from "crypto";
+import { createHash as createHash6 } from "crypto";
 import { join as join17 } from "path";
 function projectHash(directory) {
   const normalized = directory.replace(/\/+$/, "");
-  return createHash5("sha256").update(normalized).digest("hex").slice(0, 16);
+  return createHash6("sha256").update(normalized).digest("hex").slice(0, 16);
 }
 function rpcPortFilePath(storageDir, directory) {
   const hash2 = projectHash(directory);
@@ -26997,11 +27297,11 @@ class AftRpcServer {
           const dir = dirname6(this.portFilePath);
           mkdirSync10(dir, { recursive: true, mode: 448 });
           const tmpPath = `${this.portFilePath}.tmp`;
-          writeFileSync9(tmpPath, JSON.stringify({ port: this.port, token: this.token }), {
+          writeFileSync10(tmpPath, JSON.stringify({ port: this.port, token: this.token }), {
             encoding: "utf-8",
             mode: 384
           });
-          renameSync7(tmpPath, this.portFilePath);
+          renameSync8(tmpPath, this.portFilePath);
           log2(`RPC server listening on 127.0.0.1:${this.port}`);
         } catch (err) {
           warn2(`Failed to write RPC port file: ${err}`);
@@ -27104,7 +27404,7 @@ async function getSessionDirectory(client, sessionId, fallbackDirectory) {
       dir = session.directory;
     }
   } catch (err) {
-    sessionWarn2(sessionId, `[aft-plugin] session.get lookup failed: ${err instanceof Error ? err.message : String(err)}`);
+    sessionWarn(sessionId, `[aft-plugin] session.get lookup failed: ${err instanceof Error ? err.message : String(err)}`);
     return null;
   }
   setCache(sessionId, dir);
@@ -27288,7 +27588,7 @@ function formatStatusMarkdown(status) {
 
 // src/shared/tui-config.ts
 var import_comment_json4 = __toESM(require_src2(), 1);
-import { existsSync as existsSync12, mkdirSync as mkdirSync11, readFileSync as readFileSync11, writeFileSync as writeFileSync10 } from "fs";
+import { existsSync as existsSync12, mkdirSync as mkdirSync11, readFileSync as readFileSync11, writeFileSync as writeFileSync11 } from "fs";
 import { dirname as dirname7, join as join19 } from "path";
 
 // src/shared/opencode-config-dir.ts
@@ -27345,7 +27645,7 @@ function ensureTuiPluginEntry() {
     plugins.push(PLUGIN_ENTRY);
     config2.plugin = plugins;
     mkdirSync11(dirname7(configPath), { recursive: true });
-    writeFileSync10(configPath, `${import_comment_json4.stringify(config2, null, 2)}
+    writeFileSync11(configPath, `${import_comment_json4.stringify(config2, null, 2)}
 `);
     log2(`[aft-plugin] added TUI plugin entry to ${configPath}`);
     return true;
@@ -28224,7 +28524,7 @@ var CACHE_MAX_ENTRIES2 = 200;
 var cache2 = new Map;
 async function resolveIsSubagent(client, sessionId, _fallbackDirectory) {
   if (!sessionId) {
-    sessionLog2(undefined, "[subagent-detect] no sessionId provided \u2192 primary");
+    sessionLog(undefined, "[subagent-detect] no sessionId provided \u2192 primary");
     return false;
   }
   const cached2 = cache2.get(sessionId);
@@ -28236,11 +28536,11 @@ async function resolveIsSubagent(client, sessionId, _fallbackDirectory) {
   const c = client;
   const sessionApi = c?.session;
   if (!sessionApi || typeof sessionApi.get !== "function") {
-    sessionLog2(sessionId, `[subagent-detect] client.session.get unavailable (client=${typeof client}, session=${typeof sessionApi}, get=${typeof sessionApi?.get}) \u2192 caching as primary`);
+    sessionLog(sessionId, `[subagent-detect] client.session.get unavailable (client=${typeof client}, session=${typeof sessionApi}, get=${typeof sessionApi?.get}) \u2192 caching as primary`);
     setCache2(sessionId, false);
     return false;
   }
-  sessionLog2(sessionId, `[subagent-detect] cache miss, calling client.session.get(id=${sessionId})`);
+  sessionLog(sessionId, `[subagent-detect] cache miss, calling client.session.get(id=${sessionId})`);
   let isSubagent = false;
   let parentIdRaw;
   try {
@@ -28250,9 +28550,9 @@ async function resolveIsSubagent(client, sessionId, _fallbackDirectory) {
     const session = result?.data ?? result;
     parentIdRaw = session?.parentID;
     isSubagent = session !== undefined && typeof session.parentID === "string" && session.parentID.length > 0;
-    sessionLog2(sessionId, `[subagent-detect] SDK returned session=${session !== undefined ? "present" : "undefined"}, parentID=${JSON.stringify(parentIdRaw)} \u2192 isSubagent=${isSubagent}`);
+    sessionLog(sessionId, `[subagent-detect] SDK returned session=${session !== undefined ? "present" : "undefined"}, parentID=${JSON.stringify(parentIdRaw)} \u2192 isSubagent=${isSubagent}`);
   } catch (err) {
-    sessionWarn2(sessionId, `[subagent-detect] SDK lookup failed: ${err instanceof Error ? err.message : String(err)}`);
+    sessionWarn(sessionId, `[subagent-detect] SDK lookup failed: ${err instanceof Error ? err.message : String(err)}`);
     return false;
   }
   setCache2(sessionId, isSubagent);
@@ -28320,7 +28620,7 @@ function createBashTool(ctx) {
       const requestedBackground = args.background === true;
       const effectiveBackground = isSubagent ? false : requestedBackground;
       if (isSubagent && requestedBackground) {
-        sessionLog2(context.sessionID, "[bash] subagent + background:true \u2192 converting to foreground (subagent would lose task_id)");
+        sessionLog(context.sessionID, "[bash] subagent + background:true \u2192 converting to foreground (subagent would lose task_id)");
       }
       const shellEnv = await ctx.plugin?.trigger?.("shell.env", { cwd, sessionID: context.sessionID, callID: getCallID(context) }, { env: {} });
       const data = await withPermissionLoop(ctx, context, {
@@ -30098,7 +30398,7 @@ async function queryLspHints(client, symbolName, directory, sessionId) {
     }
     return { symbols: hints };
   } catch (err) {
-    sessionWarn2(sessionId, `LSP query failed for "${symbolName}": ${err.message}`);
+    sessionWarn(sessionId, `LSP query failed for "${symbolName}": ${err.message}`);
     return;
   }
 }
@@ -30887,31 +31187,37 @@ ${lines}
   } catch (err) {
     warn2(`[lsp] auto-install setup failed: ${err instanceof Error ? err.message : String(err)}`);
   }
-  let versionUpgradeAttempted = null;
+  const versionUpgradePromises = new Map;
   const poolOptions = {
     errorPrefix: "[aft-plugin]",
     minVersion: PLUGIN_VERSION,
     onVersionMismatch: async (binaryVersion, minVersion) => {
-      if (versionUpgradeAttempted === binaryVersion) {
-        log2(`Version ${binaryVersion} < ${minVersion} but upgrade already attempted \u2014 continuing`);
-        return null;
+      const existing = versionUpgradePromises.get(minVersion);
+      if (existing) {
+        log2(`Version ${binaryVersion} < ${minVersion}; awaiting in-flight compatible binary upgrade`);
+        return existing;
       }
-      versionUpgradeAttempted = binaryVersion;
-      warn2(`WARNING: aft binary v${binaryVersion} is older than plugin v${minVersion}. ` + "Some features may not work. Attempting to download a compatible binary...");
-      try {
-        const path7 = await ensureBinary(`v${minVersion}`);
-        if (!path7) {
-          warn2(`Could not find or download v${minVersion}. Continuing with v${binaryVersion}.`);
+      const upgradePromise = (async () => {
+        warn2(`WARNING: aft binary v${binaryVersion} is older than plugin v${minVersion}. ` + "Some features may not work. Attempting to download a compatible binary...");
+        try {
+          const path7 = await ensureBinary(`v${minVersion}`);
+          if (!path7) {
+            warn2(`Could not find or download v${minVersion}. Continuing with v${binaryVersion}.`);
+            return null;
+          }
+          log2(`Found/downloaded compatible binary at ${path7}. Replacing running bridges...`);
+          const replaced = await pool.replaceBinary(path7);
+          log2("Binary replaced successfully. New bridges will use the updated binary.");
+          return replaced;
+        } catch (err) {
+          error2(`Auto-download failed: ${err.message}. Install manually: cargo install agent-file-tools@${minVersion}`);
           return null;
+        } finally {
+          versionUpgradePromises.delete(minVersion);
         }
-        log2(`Found/downloaded compatible binary at ${path7}. Replacing running bridges...`);
-        const replaced = await pool.replaceBinary(path7);
-        log2("Binary replaced successfully. New bridges will use the updated binary.");
-        return replaced;
-      } catch (err) {
-        error2(`Auto-download failed: ${err.message}. Install manually: cargo install agent-file-tools@${minVersion}`);
-        return null;
-      }
+      })();
+      versionUpgradePromises.set(minVersion, upgradePromise);
+      return upgradePromise;
     },
     onConfigureWarnings: async ({ projectRoot, sessionId, client, warnings }) => {
       const pendingWarnings = sessionId ? drainPendingEagerWarnings(projectRoot) : [];
@@ -31045,7 +31351,7 @@ ${lines}
     if (storageDir && ANNOUNCEMENT_VERSION) {
       try {
         mkdirSync12(storageDir, { recursive: true });
-        writeFileSync11(join21(storageDir, "last_announced_version"), ANNOUNCEMENT_VERSION);
+        writeFileSync12(join21(storageDir, "last_announced_version"), ANNOUNCEMENT_VERSION);
       } catch {}
     }
     return { success: true };