@cortexkit/aft-opencode 0.39.2 → 0.39.4

package/dist/index.js

@@ -12101,6 +12101,21 @@ class BridgeReplacedDuringVersionCheck extends Error {
   }
 }
 
+class BridgeTransportTimeoutError extends Error {
+  command;
+  timeoutMs;
+  code = "transport_timeout";
+  constructor(command, timeoutMs, message) {
+    super(message);
+    this.command = command;
+    this.timeoutMs = timeoutMs;
+    this.name = "BridgeTransportTimeoutError";
+  }
+}
+function isBridgeTransportTimeout(err) {
+  return err instanceof Error && err.code === "transport_timeout";
+}
+
 class BinaryBridge {
   static RESTART_RESET_MS = 5 * 60 * 1000;
   static STDERR_TAIL_MAX = 20;
@@ -12328,7 +12343,7 @@ class BinaryBridge {
             } else {
               this.warnVia(timeoutMsg2);
             }
-            entry.reject(new Error(`${this.errorPrefix} Request "${command}" (id=${id}) timed out after ${effectiveTimeoutMs}ms`));
+            entry.reject(new BridgeTransportTimeoutError(command, effectiveTimeoutMs, `${this.errorPrefix} Request "${command}" (id=${id}) timed out after ${effectiveTimeoutMs}ms`));
             return;
           }
           const childActiveSinceRequest = this.lastChildActivityAt > requestSentAt;
@@ -12864,6 +12879,220 @@ class BinaryBridge {
     }
   }
 }
+// ../aft-bridge/dist/callgraph-format.js
+import { homedir as homedir3 } from "node:os";
+var PLAIN_CALLGRAPH_THEME = {
+  fg: (_role, text) => text
+};
+function asRecord(value) {
+  if (!value || typeof value !== "object" || Array.isArray(value))
+    return;
+  return value;
+}
+function asRecords(value) {
+  return Array.isArray(value) ? value.map(asRecord).filter(Boolean) : [];
+}
+function asString(value) {
+  return typeof value === "string" ? value : undefined;
+}
+function asNumber(value) {
+  return typeof value === "number" && Number.isFinite(value) ? value : undefined;
+}
+function asBoolean(value) {
+  return typeof value === "boolean" ? value : undefined;
+}
+function shortenPath(path2) {
+  const home = homedir3();
+  if (path2.startsWith(home))
+    return `~${path2.slice(home.length)}`;
+  return path2;
+}
+function joinNonEmpty(parts, separator = " · ") {
+  return parts.filter((part) => Boolean(part && part.length > 0)).join(separator);
+}
+function treeLine(depth, text) {
+  return `${"  ".repeat(depth)}${depth === 0 ? "" : "↳ "}${text}`;
+}
+function nameMatchEdgeMarker(record, theme) {
+  return asString(record.resolved_by) === "name_match" ? ` ${theme.fg("warning", "~")}` : "";
+}
+function renderCallTreeNode(node, depth, lines, theme) {
+  const name = asString(node.name) ?? "(unknown)";
+  const file = shortenPath(asString(node.file) ?? "(unknown file)");
+  const line = asNumber(node.line);
+  const unresolved = node.resolved === false ? ` ${theme.fg("warning", "[unresolved]")}` : "";
+  const nameMatch = nameMatchEdgeMarker(node, theme);
+  const location = line !== undefined ? `[${file}:${line}]` : `[${file}]`;
+  lines.push(treeLine(depth, `${name} ${location}${unresolved}${nameMatch}`));
+  asRecords(node.children).forEach((child) => {
+    renderCallTreeNode(child, depth + 1, lines, theme);
+  });
+}
+function depthWarning(response, theme, depthField = "depth_limited", truncatedField = "truncated") {
+  const limited = asBoolean(response[depthField]);
+  const truncated = asNumber(response[truncatedField]) ?? 0;
+  if (!limited && truncated === 0)
+    return "";
+  const detail = truncated > 0 ? `, ${truncated} truncated` : "";
+  return theme.fg("warning", `(depth limited${detail})`);
+}
+function renderTracePath(path2, index, lines, theme) {
+  lines.push(`Path ${index + 1}`);
+  asRecords(path2.hops).forEach((hop, hopIndex) => {
+    const symbol = asString(hop.symbol) ?? "(unknown)";
+    const file = shortenPath(asString(hop.file) ?? "(unknown file)");
+    const line = asNumber(hop.line);
+    const entry = hop.is_entry_point === true ? " [entry]" : "";
+    const nameMatch = nameMatchEdgeMarker(hop, theme);
+    lines.push(treeLine(hopIndex + 1, `${symbol}${entry} ${line !== undefined ? `[${file}:${line}]` : `[${file}]`}${nameMatch}`));
+  });
+}
+function renderCallersGroupLines(group, theme) {
+  const file = shortenPath(asString(group.file) ?? "(unknown file)");
+  const lines = [theme.fg("accent", file)];
+  const callers = asRecords(group.callers);
+  const bySymbolProvenance = new Map;
+  for (const caller of callers) {
+    const symbol = asString(caller.symbol) ?? "(unknown)";
+    const provenanceKey = asString(caller.resolved_by) === "name_match" ? `${symbol}\x00name_match` : `${symbol}\x00exact`;
+    const line = asNumber(caller.line);
+    const bucket = bySymbolProvenance.get(provenanceKey) ?? [];
+    if (line !== undefined)
+      bucket.push(line);
+    bySymbolProvenance.set(provenanceKey, bucket);
+  }
+  const keys = [...bySymbolProvenance.keys()].sort((a, b) => a.localeCompare(b));
+  for (const key of keys) {
+    const symbol = key.split("\x00")[0] ?? "(unknown)";
+    const isNameMatch = key.endsWith("\x00name_match");
+    const lineNums = (bySymbolProvenance.get(key) ?? []).sort((a, b) => a - b);
+    const linePart = lineNums.length > 0 ? lineNums.map(String).join(", ") : "?";
+    const marker = isNameMatch ? ` ${theme.fg("warning", "~")}` : "";
+    lines.push(`  ↳ ${symbol}:${linePart}${marker}`);
+  }
+  return lines;
+}
+function formatCallgraphSections(op, response, theme = PLAIN_CALLGRAPH_THEME) {
+  const record = asRecord(response);
+  if (!record)
+    return [theme.fg("muted", "No navigation result.")];
+  if (op === "call_tree") {
+    const lines = [];
+    renderCallTreeNode(record, 0, lines, theme);
+    const warning = depthWarning(record, theme);
+    if (warning)
+      lines.push(warning);
+    return lines.length > 0 ? lines : [theme.fg("muted", "No call tree available.")];
+  }
+  if (op === "callers") {
+    const groups = asRecords(record.callers);
+    const warning = depthWarning(record, theme);
+    const total = asNumber(record.total_callers) ?? 0;
+    const sections2 = [
+      joinNonEmpty([
+        theme.fg("success", `${total} caller${total === 1 ? "" : "s"}`),
+        theme.fg("muted", `${groups.length} file group${groups.length === 1 ? "" : "s"}`),
+        warning
+      ])
+    ];
+    groups.forEach((group) => {
+      sections2.push(renderCallersGroupLines(group, theme).join(`
+`));
+    });
+    return sections2;
+  }
+  if (op === "trace_to_symbol") {
+    const path2 = asRecords(record.path);
+    const complete = asBoolean(record.complete);
+    const reason = asString(record.reason);
+    if (path2.length === 0) {
+      const prefix = complete === false ? theme.fg("warning", "No complete path") : theme.fg("muted", "No path");
+      return [`${prefix}${reason ? ` (${reason})` : ""}`];
+    }
+    const lines = [theme.fg("success", `${path2.length} hop${path2.length === 1 ? "" : "s"}`)];
+    path2.forEach((hop, index) => {
+      const symbol = asString(hop.symbol) ?? "(unknown)";
+      const file = shortenPath(asString(hop.file) ?? "(unknown file)");
+      const line = asNumber(hop.line);
+      const nameMatch = nameMatchEdgeMarker(hop, theme);
+      lines.push(treeLine(index + 1, `${symbol} ${line !== undefined ? `[${file}:${line}]` : `[${file}]`}${nameMatch}`));
+    });
+    return lines;
+  }
+  if (op === "trace_to") {
+    const paths = asRecords(record.paths);
+    const warning = depthWarning(record, theme, "max_depth_reached", "truncated_paths");
+    const totalPaths = asNumber(record.total_paths) ?? paths.length;
+    const entryPoints = asNumber(record.entry_points_found) ?? 0;
+    const sections2 = [
+      joinNonEmpty([
+        theme.fg("success", `${totalPaths} path${totalPaths === 1 ? "" : "s"}`),
+        theme.fg("muted", `${entryPoints} entry point${entryPoints === 1 ? "" : "s"}`),
+        warning
+      ])
+    ];
+    if (paths.length === 0)
+      sections2.push(theme.fg("muted", "No entry paths found."));
+    paths.forEach((path2, index) => {
+      const lines = [];
+      renderTracePath(path2, index, lines, theme);
+      sections2.push(lines.join(`
+`));
+    });
+    return sections2;
+  }
+  if (op === "impact") {
+    const callers = asRecords(record.callers);
+    const warning = depthWarning(record, theme);
+    const totalAffected = asNumber(record.total_affected) ?? callers.length;
+    const affectedFiles = asNumber(record.affected_files) ?? 0;
+    const sections2 = [
+      joinNonEmpty([
+        theme.fg("warning", `${totalAffected} affected call site${totalAffected === 1 ? "" : "s"}`),
+        theme.fg("muted", `${affectedFiles} file${affectedFiles === 1 ? "" : "s"}`),
+        warning
+      ])
+    ];
+    if (callers.length === 0)
+      sections2.push(theme.fg("muted", "No impacted callers found."));
+    callers.forEach((caller) => {
+      const file = shortenPath(asString(caller.caller_file) ?? "(unknown file)");
+      const symbol = asString(caller.caller_symbol) ?? "(unknown)";
+      const line = asNumber(caller.line) ?? 0;
+      const entry = caller.is_entry_point === true ? ` ${theme.fg("warning", "[entry]")}` : "";
+      const nameMatch = nameMatchEdgeMarker(caller, theme);
+      const expression = asString(caller.call_expression);
+      const params = Array.isArray(caller.parameters) ? caller.parameters.map(String).join(", ") : "";
+      sections2.push([
+        `${theme.fg("accent", file)}:${line}`,
+        `  ↳ ${symbol}${entry}${nameMatch}`,
+        expression ? `  ${theme.fg("muted", expression)}` : undefined,
+        params ? `  ${theme.fg("muted", `params: ${params}`)}` : undefined
+      ].filter(Boolean).join(`
+`));
+    });
+    return sections2;
+  }
+  const hops = asRecords(record.hops);
+  const sections = [
+    joinNonEmpty([
+      theme.fg("success", `${hops.length} hop${hops.length === 1 ? "" : "s"}`),
+      asBoolean(record.depth_limited) ? theme.fg("warning", "(depth limited)") : undefined
+    ])
+  ];
+  if (hops.length === 0)
+    sections.push(theme.fg("muted", "No data-flow hops found."));
+  hops.forEach((hop, index) => {
+    const file = shortenPath(asString(hop.file) ?? "(unknown file)");
+    const symbol = asString(hop.symbol) ?? "(unknown)";
+    const variable = asString(hop.variable) ?? "(unknown)";
+    const line = asNumber(hop.line) ?? 0;
+    const approximate = hop.approximate === true ? ` ${theme.fg("warning", "[approx]")}` : "";
+    const nameMatch = nameMatchEdgeMarker(hop, theme);
+    sections.push(treeLine(index, `${variable} ${theme.fg("muted", `${asString(hop.flow_type) ?? "flow"}`)} ${symbol} [${file}:${line}]${approximate}${nameMatch}`));
+  });
+  return sections;
+}
 // ../aft-bridge/dist/coerce.js
 function coerceStringArray(value) {
   if (Array.isArray(value)) {
@@ -12900,7 +13129,7 @@ function isEmptyParam(value) {
 import { spawnSync } from "node:child_process";
 import { createHash, randomUUID } from "node:crypto";
 import { chmodSync, closeSync, copyFileSync, createWriteStream, existsSync, mkdirSync, openSync, readFileSync, renameSync, rmSync, statSync, unlinkSync, writeSync } from "node:fs";
-import { homedir as homedir3 } from "node:os";
+import { homedir as homedir4 } from "node:os";
 import { join as join3 } from "node:path";
 import { Readable } from "node:stream";
 import { pipeline } from "node:stream/promises";
@@ -12958,10 +13187,10 @@ function isExpectedCachedBinary(binaryPath, tag) {
 function getCacheDir() {
   if (process.platform === "win32") {
     const localAppData = process.env.LOCALAPPDATA || process.env.APPDATA;
-    const base2 = localAppData || join3(homedir3(), "AppData", "Local");
+    const base2 = localAppData || join3(homedir4(), "AppData", "Local");
     return join3(base2, "aft", "bin");
   }
-  const base = process.env.XDG_CACHE_HOME || join3(homedir3(), ".cache");
+  const base = process.env.XDG_CACHE_HOME || join3(homedir4(), ".cache");
   return join3(base, "aft", "bin");
 }
 function getBinaryName() {
@@ -13203,7 +13432,7 @@ function formatEditSummary(data) {
   if (data.created === true) {
     let s2 = `Created file (${counts}).`;
     if (data.formatted)
-      s2 += " Auto-formatted.";
+      s2 += formatAutoFormattedSuffix(data);
     return s2;
   }
   let detail = counts;
@@ -13214,9 +13443,21 @@ function formatEditSummary(data) {
   }
   let s = `Edited (${detail}).`;
   if (data.formatted)
-    s += " Auto-formatted.";
+    s += formatAutoFormattedSuffix(data);
   return s;
 }
+function formatAutoFormattedSuffix(data) {
+  const reflowText = data.reformatted?.text;
+  if (typeof reflowText === "string" && reflowText.length > 0) {
+    return `
+Auto-formatted — the formatter reflowed your edit. On disk now:
+${reflowText}`;
+  }
+  if (data.reformatted?.extensive === true) {
+    return " Auto-formatted — extensive reflow; re-read the file before your next anchored edit.";
+  }
+  return " Auto-formatted.";
+}
 // ../aft-bridge/dist/jsonc.js
 function stripJsoncSymbols(value) {
   if (Array.isArray(value)) {
@@ -13234,7 +13475,7 @@ function stripJsoncSymbols(value) {
 // ../aft-bridge/dist/migration.js
 import { spawnSync as spawnSync2 } from "node:child_process";
 import { existsSync as existsSync4, mkdirSync as mkdirSync4 } from "node:fs";
-import { homedir as homedir5, tmpdir } from "node:os";
+import { homedir as homedir6, tmpdir } from "node:os";
 import { dirname as dirname2, join as join6 } from "node:path";
 
 // ../aft-bridge/dist/paths.js
@@ -13291,7 +13532,7 @@ function markAnnouncementSeen(storageRoot, harness, currentVersion) {
 import { execSync } from "node:child_process";
 import { chmodSync as chmodSync2, closeSync as closeSync2, copyFileSync as copyFileSync2, existsSync as existsSync3, mkdirSync as mkdirSync3, openSync as openSync2, readSync, renameSync as renameSync3, unlinkSync as unlinkSync2 } from "node:fs";
 import { createRequire as createRequire2 } from "node:module";
-import { homedir as homedir4 } from "node:os";
+import { homedir as homedir5 } from "node:os";
 import { join as join5 } from "node:path";
 var ensureBinaryForResolver = ensureBinary;
 function copyToVersionedCache(npmBinaryPath, knownVersion) {
@@ -13333,7 +13574,7 @@ function normalizeBareVersion(version) {
   return version.startsWith("v") ? version.slice(1) : version;
 }
 function homeDirFromEnv(env) {
-  return (process.platform === "win32" ? env.USERPROFILE || env.HOME : env.HOME) || homedir4();
+  return (process.platform === "win32" ? env.USERPROFILE || env.HOME : env.HOME) || homedir5();
 }
 function cacheDirFromEnv(env) {
   if (process.platform === "win32") {
@@ -13515,8 +13756,8 @@ function dataHome() {
 }
 function homeDir() {
   if (process.platform === "win32")
-    return process.env.USERPROFILE || process.env.HOME || homedir5();
-  return process.env.HOME || homedir5();
+    return process.env.USERPROFILE || process.env.HOME || homedir6();
+  return process.env.HOME || homedir6();
 }
 function resolveLegacyStorageRoot(harness) {
   if (harness === "pi")
@@ -13606,13 +13847,13 @@ async function ensureStorageMigrated(opts) {
 }
 // ../aft-bridge/dist/npm-resolver.js
 import { readdirSync, statSync as statSync2 } from "node:fs";
-import { homedir as homedir6 } from "node:os";
+import { homedir as homedir7 } from "node:os";
 import { delimiter, dirname as dirname3, isAbsolute as isAbsolute2, join as join7 } from "node:path";
 function defaultDeps() {
   return {
     platform: process.platform,
     env: process.env,
-    home: homedir6(),
+    home: homedir7(),
     execPath: process.execPath
   };
 }
@@ -15379,9 +15620,6 @@ function write(level, message, data, sessionId) {
 function log2(message, data) {
   write("INFO", message, data);
 }
-function debug(message, data) {
-  write("DEBUG", message, data);
-}
 function warn2(message, data) {
   write("WARN", message, data);
 }
@@ -15391,9 +15629,6 @@ function error2(message, data) {
 function sessionLog(sessionId, message, data) {
   write("INFO", message, data, sessionId);
 }
-function sessionDebug(sessionId, message, data) {
-  write("DEBUG", message, data, sessionId);
-}
 function sessionWarn(sessionId, message, data) {
   write("WARN", message, data, sessionId);
 }
@@ -15487,84 +15722,6 @@ async function resolvePromptContext(client, sessionId) {
   return result;
 }
 
-// src/shared/live-server-client.ts
-import { createOpencodeClient } from "@opencode-ai/sdk";
-var clientCache = new Map;
-function cacheKey(serverUrl, directory) {
-  return `${serverUrl}|${directory}`;
-}
-function normalizeServerUrl(serverUrl) {
-  try {
-    return new URL(serverUrl).toString();
-  } catch {
-    return serverUrl;
-  }
-}
-function serverAuthHeaders() {
-  const password = process.env.OPENCODE_SERVER_PASSWORD;
-  if (!password)
-    return;
-  const username = process.env.OPENCODE_SERVER_USERNAME ?? "opencode";
-  return {
-    Authorization: `Basic ${Buffer.from(`${username}:${password}`).toString("base64")}`
-  };
-}
-function getLiveServerClient(serverUrl, directory) {
-  const key = cacheKey(serverUrl, directory);
-  const cached = clientCache.get(key);
-  if (cached)
-    return cached;
-  const client = createOpencodeClient({
-    baseUrl: serverUrl,
-    directory,
-    headers: serverAuthHeaders(),
-    fetch: globalThis.fetch
-  });
-  clientCache.set(key, client);
-  return client;
-}
-var liveServerWakeAvailableByServerUrl = new Map;
-var legacyLiveServerWakeAvailable = false;
-async function probeServerReachable(serverUrl, timeoutMs = 1500) {
-  if (!serverUrl)
-    return false;
-  const normalizedServerUrl = normalizeServerUrl(serverUrl);
-  const controller = new AbortController;
-  const timer = setTimeout(() => controller.abort(), timeoutMs);
-  let reachable = false;
-  try {
-    const probeUrl = new URL("/session", serverUrl).toString();
-    const res = await globalThis.fetch(probeUrl, {
-      method: "GET",
-      headers: serverAuthHeaders(),
-      signal: controller.signal
-    });
-    reachable = res.ok || res.status === 401 || res.status === 403;
-  } catch {
-    reachable = false;
-  } finally {
-    clearTimeout(timer);
-    liveServerWakeAvailableByServerUrl.set(normalizedServerUrl, reachable);
-  }
-  return reachable;
-}
-function setLiveServerWakeAvailable(serverUrlOrAvailable, available) {
-  if (typeof serverUrlOrAvailable === "boolean") {
-    legacyLiveServerWakeAvailable = serverUrlOrAvailable;
-    return;
-  }
-  if (!serverUrlOrAvailable) {
-    legacyLiveServerWakeAvailable = available ?? false;
-    return;
-  }
-  liveServerWakeAvailableByServerUrl.set(normalizeServerUrl(serverUrlOrAvailable), available ?? false);
-}
-function useLiveServerWake(serverUrl) {
-  if (!serverUrl)
-    return legacyLiveServerWakeAvailable;
-  return liveServerWakeAvailableByServerUrl.get(normalizeServerUrl(serverUrl)) ?? false;
-}
-
 // src/bg-notifications.ts
 function hashReminder(text) {
   return createHash3("sha256").update(text).digest("hex").slice(0, 16);
@@ -15791,15 +15948,15 @@ async function triggerWakeIfPending(drainContext, skipDrain, includeDeferredComp
           directory: drainContext.directory,
           attempt: state.wakeRetryAttempts + 1
         });
-        throw new Error("no wake transport available: live-server unreachable and input.client absent");
+        throw new Error("in-process wake client unavailable: input.client absent");
       }
       return drainContext.client;
     };
-    const sendPrompt = async (client, clientPath) => {
-      if (typeof client.session?.promptAsync !== "function") {
-        throw new Error(`wake client.session.promptAsync is unavailable (path=${clientPath})`);
+    const sendPrompt = async (client2) => {
+      if (typeof client2.session?.promptAsync !== "function") {
+        throw new Error("wake client.session.promptAsync is unavailable");
       }
-      const promptContext = await resolvePromptContext(client, drainContext.sessionID);
+      const promptContext = await resolvePromptContext(client2, drainContext.sessionID);
       const body = {
         noReply: false,
         parts: [{ type: "text", text: reminder, synthetic: true }]
@@ -15822,7 +15979,6 @@ async function triggerWakeIfPending(drainContext, skipDrain, includeDeferredComp
         directory: drainContext.directory,
         reminder_sha256: hashReminder(reminder),
         reminder_chars: reminder.length,
-        wake_client_path: clientPath,
         prompt_context: promptContext ? {
           agent: promptContext.agent,
           model: promptContext.model ? {
@@ -15837,18 +15993,16 @@ async function triggerWakeIfPending(drainContext, skipDrain, includeDeferredComp
         ...wakeMeta
       });
       try {
-        await client.session.promptAsync({
+        await client2.session.promptAsync({
           path: { id: drainContext.sessionID },
           body
         });
       } catch (err) {
-        const logPromptError = clientPath === "live-server" ? sessionDebug : sessionWarn;
-        logPromptError(drainContext.sessionID, `${LOG_PREFIX} wake promptAsync error`, {
+        sessionWarn(drainContext.sessionID, `${LOG_PREFIX} wake promptAsync error`, {
           event: "bash_completion_wake_prompt_async_error",
           delivery_id: deliveryID2,
           attempt: state.wakeRetryAttempts + 1,
           task_ids: taskIDs,
-          wake_client_path: clientPath,
           error: err instanceof Error ? err.message : String(err)
         });
         throw err;
@@ -15857,38 +16011,12 @@ async function triggerWakeIfPending(drainContext, skipDrain, includeDeferredComp
         event: "bash_completion_wake_prompt_async_ok",
         delivery_id: deliveryID2,
         attempt: state.wakeRetryAttempts + 1,
-        task_ids: taskIDs,
-        wake_client_path: clientPath
+        task_ids: taskIDs
       });
       return deliveryID2;
     };
-    if (useLiveServerWake(drainContext.serverUrl) && drainContext.serverUrl) {
-      try {
-        const liveClient = getLiveServerClient(drainContext.serverUrl, drainContext.directory);
-        const deliveryID2 = await sendPrompt(liveClient, "live-server");
-        await ackCompletions(drainContext, deliveredCompletions, deliveryID2);
-        return;
-      } catch (err) {
-        setLiveServerWakeAvailable(drainContext.serverUrl, false);
-        sessionDebug(drainContext.sessionID, `${LOG_PREFIX} live-server wake failed; falling back`, {
-          event: "bash_completion_wake_live_server_fallback",
-          task_ids: taskIDs,
-          directory: drainContext.directory,
-          server_url: drainContext.serverUrl,
-          attempt: state.wakeRetryAttempts + 1,
-          error: err instanceof Error ? err.message : String(err)
-        });
-        const fallbackClient2 = getInProcessClient();
-        const deliveryID2 = await sendPrompt(fallbackClient2, "in-process-fallback");
-        state.retryDelayMs = null;
-        state.wakeRetryAttempts = 0;
-        state.wakeHardStopped = false;
-        await ackCompletions(drainContext, deliveredCompletions, deliveryID2);
-        return;
-      }
-    }
-    const fallbackClient = getInProcessClient();
-    const deliveryID = await sendPrompt(fallbackClient, "in-process-fallback");
+    const client = getInProcessClient();
+    const deliveryID = await sendPrompt(client);
     await ackCompletions(drainContext, deliveredCompletions, deliveryID);
   }, (err, hardStopped) => {
     sessionWarn(drainContext.sessionID, hardStopped ? `${LOG_PREFIX} wake send failed ${MAX_WAKE_SEND_ATTEMPTS} times; stopping retries: ${err instanceof Error ? err.message : String(err)}` : `${LOG_PREFIX} wake send failed: ${err instanceof Error ? err.message : String(err)}`);
@@ -16271,7 +16399,7 @@ function formatDuration(completion) {
 
 // src/config.ts
 import { existsSync as existsSync6, readFileSync as readFileSync4, renameSync as renameSync4, unlinkSync as unlinkSync4, writeFileSync as writeFileSync3 } from "node:fs";
-import { homedir as homedir7 } from "node:os";
+import { homedir as homedir8 } from "node:os";
 import { join as join10 } from "node:path";
 var import_comment_json = __toESM(require_src2(), 1);
 
@@ -29922,6 +30050,8 @@ var AftConfigSchema = exports_external.object({
   restrict_to_project_root: exports_external.boolean().optional(),
   search_index: exports_external.boolean().optional(),
   semantic_search: exports_external.boolean().optional(),
+  callgraph_store: exports_external.boolean().optional(),
+  callgraph_chunk_size: exports_external.number().optional(),
   inspect: InspectConfigSchema.optional(),
   bash: BashConfigSchema.optional(),
   experimental: ExperimentalConfigSchema.optional(),
@@ -30000,6 +30130,10 @@ function resolveProjectOverridesForConfigure(config2) {
     overrides.search_index = config2.search_index;
   if (config2.semantic_search !== undefined)
     overrides.semantic_search = config2.semantic_search;
+  if (config2.callgraph_store !== undefined)
+    overrides.callgraph_store = config2.callgraph_store;
+  if (config2.callgraph_chunk_size !== undefined)
+    overrides.callgraph_chunk_size = config2.callgraph_chunk_size;
   Object.assign(overrides, resolveExperimentalConfigForConfigure(config2));
   Object.assign(overrides, resolveLspConfigForConfigure(config2));
   if (config2.semantic !== undefined)
@@ -30274,6 +30408,17 @@ function parseConfigPartially(rawConfig) {
   }
   return partialConfig;
 }
+var configLoadErrors = [];
+function getConfigLoadErrors() {
+  return configLoadErrors;
+}
+function formatConfigParseFailureMessage(configPath, errorMessage) {
+  return `AFT config at ${configPath} failed to parse and was ignored (running on defaults): ${errorMessage}. ` + "Fix the syntax or run `npx @cortexkit/aft doctor`.";
+}
+function recordConfigParseFailure(configPath, errorMessage) {
+  configLoadErrors.push({ path: configPath, message: errorMessage });
+  warn2(formatConfigParseFailureMessage(configPath, errorMessage));
+}
 function loadConfigFromPath(configPath) {
   try {
     if (!existsSync6(configPath)) {
@@ -30294,6 +30439,7 @@ function loadConfigFromPath(configPath) {
   } catch (err) {
     const errorMsg = err instanceof Error ? err.message : String(err);
     error2(`Error loading config from ${configPath}: ${errorMsg}`);
+    recordConfigParseFailure(configPath, errorMsg);
     return null;
   }
 }
@@ -30417,6 +30563,8 @@ var PROJECT_SAFE_TOP_LEVEL_FIELDS = new Set([
   "configure_warnings_delivery",
   "search_index",
   "semantic_search",
+  "callgraph_store",
+  "callgraph_chunk_size",
   "inspect",
   "experimental",
   "bash"
@@ -30484,10 +30632,11 @@ function getOpenCodeConfigDir() {
   if (envDir) {
     return envDir;
   }
-  const xdgConfig = process.env.XDG_CONFIG_HOME || join10(homedir7(), ".config");
+  const xdgConfig = process.env.XDG_CONFIG_HOME || join10(homedir8(), ".config");
   return join10(xdgConfig, "opencode");
 }
 function loadAftConfig(projectDirectory) {
+  configLoadErrors = [];
   const configDir = getOpenCodeConfigDir();
   const userBasePath = join10(configDir, "aft");
   migrateAftConfigFile(`${userBasePath}.jsonc`);
@@ -30520,7 +30669,7 @@ function loadAftConfig(projectDirectory) {
 
 // src/notifications.ts
 import { existsSync as existsSync7, readFileSync as readFileSync5 } from "node:fs";
-import { homedir as homedir8, platform } from "node:os";
+import { homedir as homedir9, platform } from "node:os";
 import { join as join11 } from "node:path";
 function isTuiMode() {
   return process.env.OPENCODE_CLIENT === "cli";
@@ -30542,7 +30691,7 @@ var WARNING_MARKER = `${AFT_MARKER} ⚠️`;
 var STATUS_MARKER = `${AFT_MARKER} ✅`;
 function getDesktopStatePath() {
   const os3 = platform();
-  const home = homedir8();
+  const home = homedir9();
   if (os3 === "darwin") {
     return join11(home, "Library", "Application Support", "ai.opencode.desktop", "opencode.global.dat");
   }
@@ -30821,6 +30970,8 @@ function warningTitle(warning) {
       return "Checker is not installed";
     case "lsp_binary_missing":
       return "LSP binary is missing";
+    case "config_parse_failed":
+      return "Config failed to parse";
   }
 }
 function formatConfigureWarningLine(warning) {
@@ -30942,12 +31093,36 @@ async function cleanupWarnings(opts) {
 
 // src/configure-warnings.ts
 var pendingEagerWarnings = new Map;
+var pendingConfigParseWarnings = new Map;
 var pendingBySession = new Map;
 function isConfigureWarning(value) {
   if (!value || typeof value !== "object" || Array.isArray(value))
     return false;
   const warning = value;
-  return (warning.kind === "formatter_not_installed" || warning.kind === "checker_not_installed" || warning.kind === "lsp_binary_missing") && typeof warning.hint === "string";
+  return (warning.kind === "formatter_not_installed" || warning.kind === "checker_not_installed" || warning.kind === "lsp_binary_missing" || warning.kind === "config_parse_failed") && typeof warning.hint === "string";
+}
+function configParseWarningsFromErrors(errors3) {
+  return errors3.map((entry) => ({
+    kind: "config_parse_failed",
+    hint: formatConfigParseFailureMessage(entry.path, entry.message)
+  }));
+}
+function enqueueConfigParseWarnings(projectRoot, errors3) {
+  if (!projectRoot || errors3.length === 0)
+    return;
+  const incoming = configParseWarningsFromErrors(errors3);
+  const existing = pendingConfigParseWarnings.get(projectRoot) ?? [];
+  for (const warning of incoming) {
+    if (!existing.some((item) => item.hint === warning.hint)) {
+      existing.push(warning);
+    }
+  }
+  pendingConfigParseWarnings.set(projectRoot, existing);
+}
+function drainPendingConfigParseWarnings(projectRoot) {
+  const pending = pendingConfigParseWarnings.get(projectRoot) ?? [];
+  pendingConfigParseWarnings.delete(projectRoot);
+  return pending;
 }
 function coerceConfigureWarnings(warnings) {
   return warnings.filter(isConfigureWarning);
@@ -30958,7 +31133,10 @@ function drainPendingEagerWarnings(projectRoot) {
   return pending;
 }
 function enqueueConfigureWarningsForSession(context) {
-  const validWarnings = coerceConfigureWarnings(context.warnings);
+  const validWarnings = [
+    ...drainPendingConfigParseWarnings(context.projectRoot),
+    ...coerceConfigureWarnings(context.warnings)
+  ];
   if (!context.sessionId) {
     if (validWarnings.length === 0)
       return;
@@ -31028,27 +31206,27 @@ var import_comment_json3 = __toESM(require_src2(), 1);
 // src/hooks/auto-update-checker/checker.ts
 var import_comment_json2 = __toESM(require_src2(), 1);
 import { existsSync as existsSync8, readFileSync as readFileSync6, statSync as statSync4, writeFileSync as writeFileSync4 } from "node:fs";
-import { homedir as homedir10 } from "node:os";
+import { homedir as homedir11 } from "node:os";
 import { dirname as dirname5, isAbsolute as isAbsolute4, join as join13, resolve as resolve3 } from "node:path";
 import { fileURLToPath } from "node:url";
 
 // src/hooks/auto-update-checker/constants.ts
-import { homedir as homedir9, platform as platform2 } from "node:os";
+import { homedir as homedir10, platform as platform2 } from "node:os";
 import { join as join12 } from "node:path";
 var PACKAGE_NAME = "@cortexkit/aft-opencode";
 var NPM_REGISTRY_URL = "https://registry.npmjs.org";
 var NPM_FETCH_TIMEOUT = 1e4;
 function getOpenCodeCacheRoot() {
   if (platform2() === "win32") {
-    return join12(process.env.LOCALAPPDATA ?? homedir9(), "opencode");
+    return join12(process.env.LOCALAPPDATA ?? homedir10(), "opencode");
   }
-  return join12(homedir9(), ".cache", "opencode");
+  return join12(homedir10(), ".cache", "opencode");
 }
 function getOpenCodeConfigRoot() {
   if (platform2() === "win32") {
-    return join12(process.env.APPDATA ?? join12(homedir9(), "AppData", "Roaming"), "opencode");
+    return join12(process.env.APPDATA ?? join12(homedir10(), "AppData", "Roaming"), "opencode");
   }
-  return join12(process.env.XDG_CONFIG_HOME ?? join12(homedir9(), ".config"), "opencode");
+  return join12(process.env.XDG_CONFIG_HOME ?? join12(homedir10(), ".config"), "opencode");
 }
 var CACHE_DIR = join12(getOpenCodeCacheRoot(), "packages");
 var USER_OPENCODE_CONFIG = join12(getOpenCodeConfigRoot(), "opencode.json");
@@ -31227,7 +31405,7 @@ function getCachedVersion(spec) {
     getCurrentRuntimePackageJsonPath(),
     spec ? getSpecCachePackageJsonPath(spec) : null,
     getSpecCachePackageJsonPath(`${PACKAGE_NAME}@latest`),
-    join13(homedir10(), ".cache", "opencode", "node_modules", PACKAGE_NAME, "package.json")
+    join13(homedir11(), ".cache", "opencode", "node_modules", PACKAGE_NAME, "package.json")
   ].filter(isString);
   for (const packageJsonPath of candidates) {
     try {
@@ -31730,7 +31908,7 @@ import {
   unlinkSync as unlinkSync5,
   writeFileSync as writeFileSync7
 } from "node:fs";
-import { homedir as homedir11 } from "node:os";
+import { homedir as homedir12 } from "node:os";
 import { join as join15 } from "node:path";
 function aftCacheBase() {
   const override = process.env.AFT_CACHE_DIR;
@@ -31738,10 +31916,10 @@ function aftCacheBase() {
     return override;
   if (process.platform === "win32") {
     const localAppData = process.env.LOCALAPPDATA || process.env.APPDATA;
-    const base2 = localAppData || join15(homedir11(), "AppData", "Local");
+    const base2 = localAppData || join15(homedir12(), "AppData", "Local");
     return join15(base2, "aft");
   }
-  const base = process.env.XDG_CACHE_HOME || join15(homedir11(), ".cache");
+  const base = process.env.XDG_CACHE_HOME || join15(homedir12(), ".cache");
   return join15(base, "aft");
 }
 function lspCacheRoot() {
@@ -33416,6 +33594,34 @@ function normalizeToolMap(tools) {
   }
   return tools;
 }
+// src/shared/ignored-message.ts
+async function sendIgnoredMessage2(client, sessionID, text) {
+  const typedClient = client;
+  let agent;
+  try {
+    const ctx = await resolvePromptContext(client, sessionID);
+    agent = ctx?.agent;
+  } catch {
+    agent = undefined;
+  }
+  const body = {
+    noReply: true,
+    parts: [{ type: "text", text, ignored: true }]
+  };
+  if (agent)
+    body.agent = agent;
+  const promptInput = { path: { id: sessionID }, body };
+  if (typeof typedClient.session?.prompt === "function") {
+    await Promise.resolve(typedClient.session.prompt(promptInput));
+    return;
+  }
+  if (typeof typedClient.session?.promptAsync === "function") {
+    await typedClient.session.promptAsync(promptInput);
+    return;
+  }
+  throw new Error("[aft-plugin] client.session.prompt is unavailable");
+}
+
 // src/shared/pty-cache.ts
 var import_headless = __toESM(require_xterm_headless(), 1);
 import * as fs2 from "node:fs/promises";
@@ -33824,7 +34030,7 @@ async function verifySessionDirectory(client, sessionId) {
 }
 
 // src/shared/status.ts
-function asRecord(value) {
+function asRecord2(value) {
   return typeof value === "object" && value !== null ? value : {};
 }
 function readString(value, fallback = "") {
@@ -33843,7 +34049,7 @@ function readOptionalNumber(value) {
   return typeof value === "number" && Number.isFinite(value) ? value : null;
 }
 function readCompressionAggregate(value) {
-  const aggregate = asRecord(value);
+  const aggregate = asRecord2(value);
   return {
     events: readNumber(aggregate.events),
     original_tokens: readNumber(aggregate.original_tokens),
@@ -33854,7 +34060,7 @@ function readCompressionAggregate(value) {
 function readCompression(value) {
   if (typeof value !== "object" || value === null)
     return;
-  const compression = asRecord(value);
+  const compression = asRecord2(value);
   return {
     project: readCompressionAggregate(compression.project),
     session: readCompressionAggregate(compression.session)
@@ -33863,7 +34069,7 @@ function readCompression(value) {
 function readStatusBar(value) {
   if (typeof value !== "object" || value === null)
     return;
-  const bar = asRecord(value);
+  const bar = asRecord2(value);
   return {
     errors: readNumber(bar.errors),
     warnings: readNumber(bar.warnings),
@@ -33907,16 +34113,16 @@ function formatBytes(bytes) {
   return `${value.toFixed(decimals)} ${units[unitIndex]}`;
 }
 function coerceAftStatus(response) {
-  const features = asRecord(response.features);
-  const searchIndex = asRecord(response.search_index);
-  const semanticIndex = asRecord(response.semantic_index);
+  const features = asRecord2(response.features);
+  const searchIndex = asRecord2(response.search_index);
+  const semanticIndex = asRecord2(response.semantic_index);
   const semanticConfig = {
-    ...asRecord(response.semantic),
-    ...asRecord(response.semantic_config)
+    ...asRecord2(response.semantic),
+    ...asRecord2(response.semantic_config)
   };
-  const disk = asRecord(response.disk);
-  const symbolCache = asRecord(response.symbol_cache);
-  const session = asRecord(response.session);
+  const disk = asRecord2(response.disk);
+  const symbolCache = asRecord2(response.symbol_cache);
+  const session = asRecord2(response.session);
   return {
     version: readString(response.version, "unknown"),
     project_root: readNullableString(response.project_root),
@@ -34038,7 +34244,7 @@ import { existsSync as existsSync15, mkdirSync as mkdirSync11, readFileSync as r
 import { dirname as dirname10, join as join22 } from "node:path";
 
 // src/shared/opencode-config-dir.ts
-import { homedir as homedir12 } from "node:os";
+import { homedir as homedir13 } from "node:os";
 import { join as join21, resolve as resolve5 } from "node:path";
 function getCliConfigDir() {
   const envConfigDir = process.env.OPENCODE_CONFIG_DIR?.trim();
@@ -34046,9 +34252,9 @@ function getCliConfigDir() {
     return resolve5(envConfigDir);
   }
   if (process.platform === "win32") {
-    return join21(homedir12(), ".config", "opencode");
+    return join21(homedir13(), ".config", "opencode");
   }
-  return join21(process.env.XDG_CONFIG_HOME || join21(homedir12(), ".config"), "opencode");
+  return join21(process.env.XDG_CONFIG_HOME || join21(homedir13(), ".config"), "opencode");
 }
 function getOpenCodeConfigDir2(_options) {
   return getCliConfigDir();
@@ -34356,6 +34562,27 @@ async function callBashBridge(ctx, runtime, command, params = {}, options) {
 import * as fs4 from "node:fs";
 import * as path4 from "node:path";
 var UNSUPPORTED_ASK_HOST = "AFT requires OpenCode 1.15.5 or newer for permission asks; please upgrade OpenCode";
+var RESTRICT_NOTICE_THROTTLE_MS = 5 * 60 * 1000;
+var restrictNoticeLastSentAt = new Map;
+function restrictNoticeWording(target) {
+  return `AFT blocked access to a path outside the project:
+  ${target}
+` + "`restrict_to_project_root` is enabled (full isolation), so AFT does not access paths " + "outside the project root. To allow external paths, set `restrict_to_project_root: false` " + "in your aft.jsonc.";
+}
+function notifyRestrictBlocked(ctx, context, target) {
+  const sessionID = context.sessionID;
+  if (!sessionID)
+    return;
+  const now = Date.now();
+  const last = restrictNoticeLastSentAt.get(sessionID);
+  if (last !== undefined && now - last < RESTRICT_NOTICE_THROTTLE_MS)
+    return;
+  restrictNoticeLastSentAt.set(sessionID, now);
+  sendIgnoredMessage2(ctx.client, sessionID, restrictNoticeWording(target)).catch(() => {});
+}
+function restrictDenialMessage(target) {
+  return `Blocked: '${target}' is outside the project root and restrict_to_project_root is enabled ` + "(AFT full isolation). Not overridable per-call; set restrict_to_project_root: false in " + "aft.jsonc to allow external paths.";
+}
 async function runAsk(maybe) {
   await maybe;
 }
@@ -34435,11 +34662,9 @@ function normalizePathPattern(p) {
   const dir = /^[A-Za-z]:$/.test(match[1]) ? `${match[1]}\\` : match[1];
   return path4.join(normalizePath(dir), match[2]);
 }
-async function assertExternalDirectoryPermission(context, target, options) {
+async function assertExternalDirectoryPermission(ctx, context, target, options) {
   if (!target)
     return;
-  if (typeof context.ask !== "function")
-    return UNSUPPORTED_ASK_HOST;
   const resolved = resolveAbsolutePath(context, target);
   const absoluteTarget = normalizePath(resolved);
   const root = projectRootFor(context);
@@ -34451,6 +34676,12 @@ async function assertExternalDirectoryPermission(context, target, options) {
   if (worktree && worktree !== "/" && worktree !== directory && containsPath(worktree, absoluteTarget)) {
     return;
   }
+  if (ctx.config.restrict_to_project_root === true) {
+    notifyRestrictBlocked(ctx, context, absoluteTarget);
+    return restrictDenialMessage(absoluteTarget);
+  }
+  if (typeof context.ask !== "function")
+    return UNSUPPORTED_ASK_HOST;
   const kind = options?.kind ?? "file";
   const parentDir = kind === "directory" ? absoluteTarget : path4.dirname(absoluteTarget);
   const rawGlob = process.platform === "win32" ? normalizePathPattern(path4.join(parentDir, "*")) : path4.join(parentDir, "*").replaceAll("\\", "/");
@@ -34547,12 +34778,12 @@ async function resolveAstPaths(ctx, context, paths) {
   const resolved = await Promise.all(paths.filter((p) => typeof p === "string" && p.length > 0).map((p) => resolvePathArg(ctx, context, p)));
   return resolved.length > 0 ? resolved : undefined;
 }
-async function checkAstPathsPermission(context, paths) {
+async function checkAstPathsPermission(ctx, context, paths) {
   if (paths === undefined)
     return;
   const uniquePaths = Array.from(new Set(paths));
   for (const p of uniquePaths) {
-    const denial = await assertExternalDirectoryPermission(context, p, { kind: "directory" });
+    const denial = await assertExternalDirectoryPermission(ctx, context, p, { kind: "directory" });
     if (denial)
       return denial;
   }
@@ -34586,7 +34817,7 @@ function astTools(ctx) {
     },
     execute: async (args, context) => {
       const paths = await resolveAstPaths(ctx, context, args.paths);
-      const externalDenied = await checkAstPathsPermission(context, paths);
+      const externalDenied = await checkAstPathsPermission(ctx, context, paths);
       if (externalDenied)
         return permissionDeniedResponse(externalDenied);
       const params = {
@@ -34684,13 +34915,13 @@ ${hint}`;
     execute: async (args, context) => {
       const isDryRun = args.dryRun === true;
       const paths = await resolveAstPaths(ctx, context, args.paths);
-      const externalDenied = await checkAstPathsPermission(context, paths);
+      const externalDenied = await checkAstPathsPermission(ctx, context, paths);
       if (externalDenied)
         return permissionDeniedResponse(externalDenied);
       if (!isDryRun) {
         if (!Array.isArray(args.paths)) {
           const targetPath = await resolvePathArg(ctx, context, ".");
-          const denial = await assertExternalDirectoryPermission(context, targetPath, {
+          const denial = await assertExternalDirectoryPermission(ctx, context, targetPath, {
             kind: "directory"
           });
           if (denial)
@@ -34888,18 +35119,43 @@ function resolveForegroundWaitMs(configured) {
 function bashToolDescription(aftSearchRegistered, compressionOn, backgroundOn) {
   const searchSteer = aftSearchRegistered ? "use aft_search (concepts, identifiers, regex, literals), read, aft_outline, or aft_zoom instead" : "use the grep tool, read, aft_outline, or aft_zoom instead";
   const compression = compressionOn ? " Output is compressed by default; pass compressed: false for raw output." : "";
-  const tasks = backgroundOn ? ' Pass background: true to run in the background and get a taskId for bash_status/bash_kill. Pass pty: true for interactive programs (REPLs, TUIs) and drive them with bash_status({ outputMode: "screen" }) plus bash_write (pty implies background automatically).' : " Commands that outlive the foreground wait window are promoted to background tasks; inspect them with bash_status({ taskId }) or terminate with bash_kill.";
-  return `Execute shell commands.${compression}${tasks} Use bash_watch to wait for output patterns or exit events.
+  const tasks = backgroundOn ? ' Pass background: true to run in the background and get a taskId for bash_status/bash_watch/bash_kill. Pass pty: true for interactive programs (REPLs, TUIs) and drive them with bash_status({ outputMode: "screen" }) plus bash_write (pty implies background automatically). Use bash_watch to wait for exit or output patterns (sync blocks, async notifies). Do not loop bash_status to wait.' : " Commands run in the foreground to completion; timeout is the hard kill cap (default 30 minutes).";
+  return `Execute shell commands.${compression}${tasks}
 
 DO NOT use bash for code search or code exploration. If you are about to run grep, rg, sed, awk, find, or cat through bash to locate or read code: STOP — ${searchSteer}.`;
 }
+function pushUnique(target, values) {
+  for (const value of values) {
+    if (!target.includes(value))
+      target.push(value);
+  }
+}
+function groupBashPermissionAsks(asks) {
+  const grouped = [];
+  let bashAsk;
+  for (const ask of asks) {
+    if (ask.kind === "bash") {
+      if (!bashAsk) {
+        bashAsk = { kind: "bash", patterns: [], always: [] };
+        grouped.push(bashAsk);
+      }
+      pushUnique(bashAsk.patterns, ask.patterns);
+      pushUnique(bashAsk.always, ask.always);
+      continue;
+    }
+    grouped.push(ask);
+  }
+  return grouped;
+}
+function permissionsGrantedForRetry(asks) {
+  return asks.flatMap((ask) => ask.always.length > 0 ? ask.always : ask.patterns);
+}
 async function withPermissionLoop(ctx, runtime, params, bridgeCall, options) {
   const first = await bridgeCall(ctx, runtime, "bash", params, options);
   if (first.success !== false || first.code !== "permission_required")
     return first;
   const asks = Array.isArray(first.asks) ? first.asks : [];
-  const permissionsGranted = [];
-  for (const ask of asks) {
+  for (const ask of groupBashPermissionAsks(asks)) {
     const permission = ask.kind === "external_directory" ? "external_directory" : "bash";
     await runAsk(runtime.ask({
       permission,
@@ -34907,54 +35163,60 @@ async function withPermissionLoop(ctx, runtime, params, bridgeCall, options) {
       always: ask.always,
       metadata: {}
     }));
-    permissionsGranted.push(...ask.always.length > 0 ? ask.always : ask.patterns);
   }
-  const second = await bridgeCall(ctx, runtime, "bash", { ...params, permissions_granted: permissionsGranted }, options);
+  const second = await bridgeCall(ctx, runtime, "bash", { ...params, permissions_granted: permissionsGrantedForRetry(asks) }, options);
   if (second.success === false && second.code === "permission_required") {
     throw new Error("bash permission retry failed");
   }
   return second;
 }
 function createBashTool(ctx, aftSearchRegisteredOverride) {
+  const initialBashCfg = resolveBashConfig(ctx.config);
+  const backgroundFlagArg = initialBashCfg.background ? {
+    background: z4.boolean().optional().describe("When true, spawn the command in the background and return a taskId for bash_status/bash_kill instead of waiting for completion. Defaults to false.")
+  } : {};
+  const ptyArgs = initialBashCfg.background ? {
+    pty: z4.boolean().optional().describe('When true, spawn the command in a real PTY for interactive programs (python/node/bash REPLs, vim). Implies background: true automatically. Unavailable in subagent sessions. Inspect with bash_status({ taskId, outputMode: "screen" }) and drive interactively with bash_write — its input accepts either a string OR an array like [ "iHello", { key: "esc" }, ":wq", { key: "enter" } ] for atomic text+key sequences.'),
+    ptyRows: optionalInt(1, 60).describe("PTY terminal height in rows — ignored when pty is false. Defaults to 24 when pty: true. Minimum 1, maximum 60."),
+    ptyCols: optionalInt(1, 140).describe("PTY terminal width in columns — ignored when pty is false. Defaults to 80 when pty: true. Minimum 1, maximum 140.")
+  } : {};
+  const args = {
+    command: z4.string().describe("Shell command to execute. Supports pipes, redirection, and normal shell syntax."),
+    timeout: optionalInt(1, Number.MAX_SAFE_INTEGER).describe(initialBashCfg.background ? "Hard kill cap in milliseconds (positive integer). When omitted, the task can run up to 30 minutes. Foreground bash returns inline if the command finishes within ~8s (configurable via bash.foreground_wait_window_ms); otherwise it's automatically promoted to background and a completion reminder is delivered when the task actually finishes." : "Hard kill cap in milliseconds (positive integer). When omitted, the foreground command can run up to 30 minutes and returns inline when it finishes."),
+    workdir: z4.string().optional().describe("Working directory for command execution. Relative paths resolve through the bridge; defaults to the current tool context/project root when omitted."),
+    description: z4.string().optional().describe("Short 5-10 word human-readable summary shown in OpenCode UI metadata instead of raw shell syntax."),
+    ...backgroundFlagArg,
+    compressed: z4.boolean().optional().describe("When true or omitted, return compressed output with noisy terminal control sequences reduced. Set to false for raw output."),
+    ...ptyArgs
+  };
   return {
-    description: (() => {
-      const cfg = resolveBashConfig(ctx.config);
-      return bashToolDescription(false, cfg.compress, cfg.background);
-    })(),
-    args: {
-      command: z4.string().describe("Shell command to execute. Supports pipes, redirection, and normal shell syntax."),
-      timeout: optionalInt(1, Number.MAX_SAFE_INTEGER).describe("Hard kill cap in milliseconds (positive integer). When omitted, the task can run up to 30 minutes. Foreground bash returns inline if the command finishes within ~8s (configurable via bash.foreground_wait_window_ms); otherwise it's automatically promoted to background and a completion reminder is delivered when the task actually finishes."),
-      workdir: z4.string().optional().describe("Working directory for command execution. Relative paths resolve through the bridge; defaults to the current tool context/project root when omitted."),
-      description: z4.string().optional().describe("Short 5-10 word human-readable summary shown in OpenCode UI metadata instead of raw shell syntax."),
-      background: z4.boolean().optional().describe("When true, spawn the command in the background and return a taskId for bash_status/bash_kill instead of waiting for completion. Defaults to false."),
-      compressed: z4.boolean().optional().describe("When true or omitted, return compressed output with noisy terminal control sequences reduced. Set to false for raw output."),
-      pty: z4.boolean().optional().describe('When true, spawn the command in a real PTY for interactive programs (python/node/bash REPLs, vim). Implies background: true automatically. Unavailable in subagent sessions. Inspect with bash_status({ taskId, outputMode: "screen" }) and drive interactively with bash_write — its input accepts either a string OR an array like [ "iHello", { key: "esc" }, ":wq", { key: "enter" } ] for atomic text+key sequences.'),
-      ptyRows: optionalInt(1, 60).describe("PTY terminal height in rows — ignored when pty is false. Defaults to 24 when pty: true. Minimum 1, maximum 60."),
-      ptyCols: optionalInt(1, 140).describe("PTY terminal width in columns — ignored when pty is false. Defaults to 80 when pty: true. Minimum 1, maximum 140.")
-    },
-    execute: async (args, context) => {
+    description: bashToolDescription(false, initialBashCfg.compress, initialBashCfg.background),
+    args,
+    execute: async (args2, context) => {
       const bashCfg = resolveBashConfig(ctx.config);
       const ctxAftSearchRegistered = ctx.aftSearchRegistered === true;
       const aftSearchRegistered = aftSearchRegisteredOverride ?? ctxAftSearchRegistered;
       let accumulatedOutput = "";
-      const description = args.description;
+      const description = args2.description;
       const metadata = context.metadata;
-      const rawCommand = args.command;
-      const compressionEnabled = bashCfg.compress && args.compressed !== false;
+      const rawCommand = args2.command;
+      const compressionEnabled = bashCfg.compress && args2.compressed !== false;
       const pipeStrip = maybeStripCompressorPipe(rawCommand, compressionEnabled);
       const command = pipeStrip.command;
-      const cwd = args.workdir ?? context.directory;
+      const cwd = args2.workdir ?? context.directory;
       const isSubagent = await resolveIsSubagent(ctx.client, context.sessionID, context.directory);
-      const requestedPty = args.pty === true;
-      const requestedBackground = args.background === true || requestedPty;
+      const backgroundDisabled = !bashCfg.background;
+      const requestedPty = !backgroundDisabled && args2.pty === true;
+      const requestedBackground = !backgroundDisabled && (args2.background === true || requestedPty);
       if (requestedPty && isSubagent) {
         throw new Error("PTY mode is not available in subagent sessions; subagents cannot drive interactive terminals.");
       }
       const allowSubagentBg = bashCfg.subagent_background;
       const subagentForcedForeground = isSubagent && !allowSubagentBg;
-      const effectiveBackground = subagentForcedForeground ? false : requestedBackground;
-      const rawTimeout = args.timeout;
-      const effectiveTimeout = effectiveBackground ? rawTimeout : resolveBashKillTimeout(rawTimeout, bashCfg.foreground_wait_window_ms);
+      const blockToCompletion = subagentForcedForeground || backgroundDisabled;
+      const effectiveBackground = blockToCompletion ? false : requestedBackground;
+      const rawTimeout = args2.timeout;
+      const effectiveTimeout = effectiveBackground || backgroundDisabled ? rawTimeout : resolveBashKillTimeout(rawTimeout, bashCfg.foreground_wait_window_ms);
       if (subagentForcedForeground && requestedBackground) {
         sessionLog(context.sessionID, "[bash] subagent + background:true → converting to foreground (subagent would lose task_id)");
       }
@@ -34962,15 +35224,15 @@ function createBashTool(ctx, aftSearchRegisteredOverride) {
       const data = await withPermissionLoop(ctx, context, {
         command,
         timeout: effectiveTimeout,
-        workdir: args.workdir,
+        workdir: args2.workdir,
         env: shellEnv?.env ?? {},
         description,
         background: effectiveBackground,
         notify_on_completion: effectiveBackground,
-        compressed: args.compressed,
+        compressed: args2.compressed,
         pty: requestedPty,
-        pty_rows: args.ptyRows,
-        pty_cols: args.ptyCols,
+        pty_rows: args2.ptyRows,
+        pty_cols: args2.ptyCols,
         permissions_requested: true
       }, callBashBridge, {
         onProgress: ({ text }) => {
@@ -34995,7 +35257,7 @@ function createBashTool(ctx, aftSearchRegisteredOverride) {
           return { output: startedLine, title: uiTitle, metadata: metadataPayload2 };
         }
         const foregroundWaitMs = resolveForegroundWaitMs(bashCfg.foreground_wait_window_ms);
-        const waitTimeoutMs = subagentForcedForeground ? effectiveTimeout ?? DEFAULT_HARD_TIMEOUT_MS : effectiveTimeout !== undefined ? Math.min(effectiveTimeout, foregroundWaitMs) : foregroundWaitMs;
+        const waitTimeoutMs = blockToCompletion ? effectiveTimeout ?? DEFAULT_HARD_TIMEOUT_MS : effectiveTimeout !== undefined ? Math.min(effectiveTimeout, foregroundWaitMs) : foregroundWaitMs;
         const startedAt = Date.now();
         while (true) {
           const status = await callBashBridge(ctx, context, "bash_status", { task_id: taskId });
@@ -35009,7 +35271,7 @@ function createBashTool(ctx, aftSearchRegisteredOverride) {
             return { output: rendered2, title: uiTitle, metadata: metadataPayload2 };
           }
           if (Date.now() - startedAt >= waitTimeoutMs) {
-            if (subagentForcedForeground) {
+            if (blockToCompletion) {
               await sleep(FOREGROUND_POLL_INTERVAL_MS);
               continue;
             }
@@ -35069,7 +35331,7 @@ function createBashTool(ctx, aftSearchRegisteredOverride) {
 }
 function createBashStatusTool(ctx) {
   return {
-    description: "Read-only snapshot of a background or PTY bash task's current state and output. Returns immediately. Never waits. Use bash_watch to block on or register for pattern matches and exit events.",
+    description: "Read-only snapshot of a background or PTY bash task's current state and output. Returns immediately. Never waits. One look to check on a task is fine — never loop it to wait for completion. To wait, use bash_watch.",
     args: {
       taskId: z4.string().describe("Background task ID returned by bash({ background: true }), e.g. bash-6b454047."),
       outputMode: z4.enum(["screen", "raw", "both"]).optional().describe("PTY output rendering mode. Defaults to screen for PTY tasks and preserves existing behavior for piped tasks when omitted.")
@@ -35221,7 +35483,7 @@ function conflictTools(ctx) {
           const expanded = expandTilde2(String(args.path));
           const projectRoot = await resolveProjectRoot(ctx, context);
           const resolved = resolvePathFromProjectRoot(projectRoot, expanded);
-          const denied = await assertExternalDirectoryPermission(context, resolved, {
+          const denied = await assertExternalDirectoryPermission(ctx, context, resolved, {
             kind: "directory"
           });
           if (denied)
@@ -35547,16 +35809,19 @@ import { tool as tool6 } from "@opencode-ai/plugin";
 var z6 = tool6.schema;
 var BASH_WAIT_POLL_INTERVAL_MS = 100;
 var DEFAULT_BASH_STATUS_WAIT_TIMEOUT_MS = 30000;
-var MAX_BASH_STATUS_WAIT_TIMEOUT_MS = 300000;
+var MAX_BASH_STATUS_WAIT_TIMEOUT_MS = 30 * 60 * 1000;
 var REGEX_WAIT_SCAN_WINDOW_BYTES = 64 * 1024;
+function unavailableSnapshot() {
+  return { status: "unknown" };
+}
 function createBashWatchTool(ctx) {
   return {
-    description: "Watch a background bash task. Two modes. Async (background:true, requires pattern) registers a non-blocking notification and returns immediately — use this to be pinged when a specific line appears or the task exits, without freezing your turn. Sync (default) blocks until a pattern matches/the task exits/timeout, and is ONLY for short bounded waits (seconds, e.g. a dev server printing a readiness line). Do NOT sync-wait for a long task (build/test/install): blocking locks the user out until it ends — instead end your turn and let the automatic completion reminder arrive, or use async mode.",
+    description: "Watch a background bash task. Sync (default) blocks until a pattern matches, the task exits, or timeout — use it when the result is the next thing you need, even for long builds/tests/installs (pass timeoutMs up to 30 min for those). The user can interrupt anytime; the wait auto-converts to an async notification. Async (background:true, requires pattern) registers a non-blocking notification and returns immediately — use when you have parallel work or want to end your turn. Never loop bash_status to wait.",
     args: {
       taskId: z6.string().describe("Background task ID returned by bash({ background: true })."),
       pattern: z6.union([z6.string(), z6.object({ regex: z6.string() })]).optional().describe("Substring or regex pattern. Optional in sync mode; required with background:true. Sync substring watches keep only the overlap tail needed for boundary matches; sync regex watches use a 64 KB rolling output window."),
       background: z6.boolean().optional().describe("When true, register an async watch and return immediately. Defaults to false (sync wait)."),
-      timeoutMs: optionalInt(1, MAX_BASH_STATUS_WAIT_TIMEOUT_MS).describe("Sync-only timeout in milliseconds. Default 30000, max 300000."),
+      timeoutMs: optionalInt(1, MAX_BASH_STATUS_WAIT_TIMEOUT_MS).describe("Sync-only timeout in milliseconds. Default 30000, max 1800000 (30 min)."),
       once: z6.boolean().optional().describe("Async-only. Defaults true; false keeps the watch sticky until task exit.")
     },
     execute: async (args, context) => {
@@ -35653,6 +35918,9 @@ Waited ${waited.elapsed_ms}ms; matched ${JSON.stringify(waited.match ?? "")} at
     } else if (waited.reason === "timeout") {
       text += `
 Waited ${waited.elapsed_ms}ms; timeout reached without match.`;
+    } else if (waited.reason === "unavailable") {
+      text += `
+Waited ${waited.elapsed_ms}ms; the bridge stayed busy and status couldn't be read. The task may still be running — check with bash_status({ taskId }).`;
     } else {
       const stat = String(data.status ?? "unknown");
       const e = typeof data.exit_code === "number" ? `, exit ${data.exit_code}` : "";
@@ -35686,9 +35954,31 @@ async function waitForBashStatus(ctx, runtime, taskId, outputMode, waitFor, effe
   clearSyncWatchAbort(runtime.sessionID);
   markTaskWaiting(runtime.sessionID, taskId);
   let sawTerminal = false;
+  let lastData;
   try {
     while (true) {
-      const data = await bashStatusSnapshot2(ctx, runtime, taskId, outputMode, bridgeOptions);
+      let data;
+      try {
+        data = await bashStatusSnapshot2(ctx, runtime, taskId, outputMode, bridgeOptions);
+      } catch (err) {
+        if (!isBridgeTransportTimeout(err))
+          throw err;
+        if (isSyncWatchAborted(runtime.sessionID)) {
+          return withWaited(lastData ?? unavailableSnapshot(), {
+            reason: "user_message",
+            elapsed_ms: Date.now() - startedAt
+          });
+        }
+        if (Date.now() >= deadline) {
+          return withWaited(lastData ?? unavailableSnapshot(), {
+            reason: "unavailable",
+            elapsed_ms: Date.now() - startedAt
+          });
+        }
+        await sleep(Math.min(BASH_WAIT_POLL_INTERVAL_MS, Math.max(0, deadline - Date.now())));
+        continue;
+      }
+      lastData = data;
       const terminal = isTerminalStatus(data.status);
       if (waitFor) {
         const scan = await readNewTaskOutput(runtime, taskId, data, spillCursor);
@@ -36222,7 +36512,7 @@ function createReadTool(ctx) {
       const projectRoot = await resolveProjectRoot(ctx, context);
       const filePath = resolvePathFromProjectRoot(projectRoot, file2);
       {
-        const denial = await assertExternalDirectoryPermission(context, filePath);
+        const denial = await assertExternalDirectoryPermission(ctx, context, filePath);
         if (denial)
           return permissionDeniedResponse(denial);
       }
@@ -36333,7 +36623,7 @@ function createWriteTool(ctx, editToolName = "edit") {
       const filePath = resolvePathFromProjectRoot(projectRoot, file2);
       const relPath = path5.relative(projectRoot, filePath);
       {
-        const denial2 = await assertExternalDirectoryPermission(context, filePath);
+        const denial2 = await assertExternalDirectoryPermission(ctx, context, filePath);
         if (denial2)
           return permissionDeniedResponse(denial2);
       }
@@ -36484,7 +36774,7 @@ function createEditTool(ctx, writeToolName = "write") {
       const filePath = resolvePathFromProjectRoot(projectRoot, file2);
       const relPath = path5.relative(projectRoot, filePath);
       {
-        const denial2 = await assertExternalDirectoryPermission(context, filePath);
+        const denial2 = await assertExternalDirectoryPermission(ctx, context, filePath);
         if (denial2)
           return permissionDeniedResponse(denial2);
       }
@@ -36720,7 +37010,7 @@ function createApplyPatchTool(ctx) {
           if (asked.has(filePath))
             continue;
           asked.add(filePath);
-          const denial2 = await assertExternalDirectoryPermission(context, filePath);
+          const denial2 = await assertExternalDirectoryPermission(ctx, context, filePath);
           if (denial2)
             return permissionDeniedResponse(denial2);
         }
@@ -37031,7 +37321,7 @@ function createDeleteTool(ctx) {
           if (asked.has(filePath))
             continue;
           asked.add(filePath);
-          const denial = await assertExternalDirectoryPermission(context, filePath);
+          const denial = await assertExternalDirectoryPermission(ctx, context, filePath);
           if (denial)
             return permissionDeniedResponse(denial);
         }
@@ -37079,13 +37369,13 @@ function createMoveTool(ctx) {
       const filePath = resolvePathFromProjectRoot(projectRoot, args.filePath);
       const destPath = resolvePathFromProjectRoot(projectRoot, args.destination);
       {
-        const sourceDenial = await assertExternalDirectoryPermission(context, filePath, {
+        const sourceDenial = await assertExternalDirectoryPermission(ctx, context, filePath, {
           kind: "file"
         });
         if (sourceDenial)
           return permissionDeniedResponse(sourceDenial);
         if (destPath !== filePath) {
-          const destDenial = await assertExternalDirectoryPermission(context, destPath);
+          const destDenial = await assertExternalDirectoryPermission(ctx, context, destPath);
           if (destDenial)
             return permissionDeniedResponse(destDenial);
         }
@@ -37116,12 +37406,15 @@ function hoistedTools(ctx) {
     aft_delete: createDeleteTool(ctx),
     aft_move: createMoveTool(ctx)
   };
-  if (resolveBashConfig(ctx.config).enabled) {
+  const bashCfg = resolveBashConfig(ctx.config);
+  if (bashCfg.enabled) {
     tools.bash = createBashTool(ctx);
-    tools.bash_status = createBashStatusTool(ctx);
-    tools.bash_write = createBashWriteTool(ctx);
-    tools.bash_watch = createBashWatchTool(ctx);
-    tools.bash_kill = createBashKillTool(ctx);
+    if (bashCfg.background) {
+      tools.bash_status = createBashStatusTool(ctx);
+      tools.bash_write = createBashWriteTool(ctx);
+      tools.bash_watch = createBashWatchTool(ctx);
+      tools.bash_kill = createBashKillTool(ctx);
+    }
   }
   return tools;
 }
@@ -37144,7 +37437,7 @@ function aftPrefixedTools(ctx) {
           const filePath = resolvePathFromProjectRoot(projectRoot, file2);
           const relPath = path5.relative(projectRoot, filePath);
           {
-            const denial2 = await assertExternalDirectoryPermission(context, filePath);
+            const denial2 = await assertExternalDirectoryPermission(ctx, context, filePath);
             if (denial2)
               return permissionDeniedResponse(denial2);
           }
@@ -37175,12 +37468,15 @@ function aftPrefixedTools(ctx) {
     aft_delete: createDeleteTool(ctx),
     aft_move: createMoveTool(ctx)
   };
-  if (resolveBashConfig(ctx.config).enabled) {
+  const bashCfg = resolveBashConfig(ctx.config);
+  if (bashCfg.enabled) {
     tools.aft_bash = createBashTool(ctx);
-    tools.bash_status = createBashStatusTool(ctx);
-    tools.bash_write = createBashWriteTool(ctx);
-    tools.bash_watch = createBashWatchTool(ctx);
-    tools.bash_kill = createBashKillTool(ctx);
+    if (bashCfg.background) {
+      tools.bash_status = createBashStatusTool(ctx);
+      tools.bash_write = createBashWriteTool(ctx);
+      tools.bash_watch = createBashWatchTool(ctx);
+      tools.bash_kill = createBashKillTool(ctx);
+    }
   }
   return tools;
 }
@@ -37218,7 +37514,7 @@ function importTools(ctx) {
         }
         const filePath = await resolvePathArg(ctx, context, args.filePath);
         {
-          const denial = await assertExternalDirectoryPermission(context, filePath);
+          const denial = await assertExternalDirectoryPermission(ctx, context, filePath);
           if (denial)
             return permissionDeniedResponse(denial);
         }
@@ -37264,15 +37560,15 @@ function importTools(ctx) {
 // src/tools/inspect.ts
 import { tool as tool10 } from "@opencode-ai/plugin";
 var z10 = tool10.schema;
-function asRecord2(value) {
+function asRecord3(value) {
   if (!value || typeof value !== "object" || Array.isArray(value))
     return;
   return value;
 }
-function asNumber(value) {
+function asNumber2(value) {
   return typeof value === "number" && Number.isFinite(value) ? value : undefined;
 }
-function asString(value) {
+function asString2(value) {
   return typeof value === "string" ? value : undefined;
 }
 function asStringArray(value) {
@@ -37289,16 +37585,16 @@ function diagnosticsServerSummary(section) {
   return parts.length > 0 ? parts.join("; ") : "none reported";
 }
 function formatDiagnosticsSummary(summary) {
-  const section = asRecord2(summary?.diagnostics);
+  const section = asRecord3(summary?.diagnostics);
   if (!section)
     return;
-  const errors3 = asNumber(section.errors);
-  const warnings = asNumber(section.warnings);
-  const info = asNumber(section.info);
-  const hints = asNumber(section.hints);
+  const errors3 = asNumber2(section.errors);
+  const warnings = asNumber2(section.warnings);
+  const info = asNumber2(section.info);
+  const hints = asNumber2(section.hints);
   const hasCounts = [errors3, warnings, info, hints].some((value) => value !== undefined);
   const counts = `${errors3 ?? 0} errors, ${warnings ?? 0} warnings, ${info ?? 0} info, ${hints ?? 0} hints`;
-  const status = asString(section.status);
+  const status = asString2(section.status);
   if (status === "pending") {
     return hasCounts ? `diagnostics: ${counts} so far — still pending (servers: ${diagnosticsServerSummary(section)})` : `diagnostics: pending (servers: ${diagnosticsServerSummary(section)})`;
   }
@@ -37311,9 +37607,9 @@ function formatDiagnosticsSummary(summary) {
   return;
 }
 function formatDiagnosticLocation(diagnostic) {
-  const file2 = asString(diagnostic.file) ?? "(unknown file)";
-  const line = asNumber(diagnostic.line);
-  const column = asNumber(diagnostic.column);
+  const file2 = asString2(diagnostic.file) ?? "(unknown file)";
+  const line = asNumber2(diagnostic.line);
+  const column = asNumber2(diagnostic.column);
   if (line === undefined)
     return file2;
   if (column === undefined)
@@ -37321,21 +37617,21 @@ function formatDiagnosticLocation(diagnostic) {
   return `${file2}:${line}:${column}`;
 }
 function formatDiagnosticsDetails(details) {
-  const diagnostics = Array.isArray(details?.diagnostics) ? details.diagnostics.map(asRecord2).filter(Boolean) : [];
+  const diagnostics = Array.isArray(details?.diagnostics) ? details.diagnostics.map(asRecord3).filter(Boolean) : [];
   return diagnostics.map((diagnostic) => {
-    const severity = asString(diagnostic.severity) ?? "information";
-    const message = asString(diagnostic.message) ?? "(no message)";
-    const source = asString(diagnostic.source);
+    const severity = asString2(diagnostic.severity) ?? "information";
+    const message = asString2(diagnostic.message) ?? "(no message)";
+    const source = asString2(diagnostic.source);
     const suffix = source ? ` [${source}]` : "";
     return `${formatDiagnosticLocation(diagnostic)} ${severity} ${message}${suffix}`;
   });
 }
 function renderInspectDiagnostics(response) {
   const lines = [];
-  const summaryLine = formatDiagnosticsSummary(asRecord2(response.summary));
+  const summaryLine = formatDiagnosticsSummary(asRecord3(response.summary));
   if (summaryLine)
     lines.push(summaryLine);
-  const detailLines = formatDiagnosticsDetails(asRecord2(response.details));
+  const detailLines = formatDiagnosticsDetails(asRecord3(response.details));
   if (detailLines.length > 0) {
     lines.push("diagnostics details:", ...detailLines.map((line) => `- ${line}`));
   }
@@ -37368,7 +37664,7 @@ async function resolveAndGateScope(ctx, context, scope) {
     if (checked.has(target))
       continue;
     checked.add(target);
-    const denial = await assertExternalDirectoryPermission(context, target);
+    const denial = await assertExternalDirectoryPermission(ctx, context, target);
     if (denial)
       return { scope: undefined, denial };
   }
@@ -37465,6 +37761,7 @@ function navigationTools(ctx) {
 
 ` + `All ops require both 'filePath' and 'symbol'. 'expression' is additionally required for trace_data; 'toSymbol' for trace_to_symbol.
 
+` + `Markers: ~ = edge resolved by name only (may point at the wrong same-named symbol); [unresolved] = callee not resolved to a definition, so the location shown is the call site. Unmarked edges are resolved exactly.
 `,
       args: {
         op: z11.enum(["call_tree", "callers", "trace_to", "trace_to_symbol", "impact", "trace_data"]).describe("Navigation operation"),
@@ -37495,7 +37792,7 @@ function navigationTools(ctx) {
           if (checked.has(target))
             continue;
           checked.add(target);
-          const denial = await assertExternalDirectoryPermission(context, target);
+          const denial = await assertExternalDirectoryPermission(ctx, context, target);
           if (denial)
             return permissionDeniedResponse(denial);
         }
@@ -37520,7 +37817,8 @@ function navigationTools(ctx) {
           }
           throw new Error(message);
         }
-        return JSON.stringify(response);
+        return formatCallgraphSections(args.op, response).join(`
+`);
       }
     }
   };
@@ -37571,7 +37869,7 @@ function readingTools(ctx) {
               throw new Error("'target' must be a non-empty string or array of strings");
             }
             const resolvedTargets = await Promise.all(target.map((entry) => resolvePathArg(ctx, context, entry)));
-            const permissionDenied3 = await assertPathExternalPermissions(context, resolvedTargets, "directory");
+            const permissionDenied3 = await assertPathExternalPermissions(ctx, context, resolvedTargets, "directory");
             if (permissionDenied3)
               return permissionDeniedResponse(permissionDenied3);
             const response3 = await callBridge(ctx, context, "outline", {
@@ -37593,7 +37891,7 @@ function readingTools(ctx) {
             const st = await stat(resolvedPath);
             isDirectory2 = st.isDirectory();
           } catch {}
-          const permissionDenied2 = await assertPathExternalPermissions(context, resolvedPath, isDirectory2 ? "directory" : "file");
+          const permissionDenied2 = await assertPathExternalPermissions(ctx, context, resolvedPath, isDirectory2 ? "directory" : "file");
           if (permissionDenied2)
             return permissionDeniedResponse(permissionDenied2);
           const params = isDirectory2 ? { directory: resolvedPath, files: true } : { file: resolvedPath, files: true };
@@ -37612,7 +37910,7 @@ function readingTools(ctx) {
         }
         if (isArray) {
           const resolvedTargets = await Promise.all(target.map((entry) => resolvePathArg(ctx, context, entry)));
-          const permissionDenied2 = await assertPathExternalPermissions(context, resolvedTargets);
+          const permissionDenied2 = await assertPathExternalPermissions(ctx, context, resolvedTargets);
           if (permissionDenied2)
             return permissionDeniedResponse(permissionDenied2);
           const response2 = await callBridge(ctx, context, "outline", {
@@ -37633,7 +37931,7 @@ function readingTools(ctx) {
           const st = await stat(resolvedTarget);
           isDirectory = st.isDirectory();
         } catch {}
-        const permissionDenied = await assertPathExternalPermissions(context, resolvedTarget, isDirectory ? "directory" : "file");
+        const permissionDenied = await assertPathExternalPermissions(ctx, context, resolvedTarget, isDirectory ? "directory" : "file");
         if (permissionDenied)
           return permissionDeniedResponse(permissionDenied);
         if (isDirectory) {
@@ -37728,7 +38026,7 @@ function readingTools(ctx) {
             }
           }
           const resolvedTargets = await Promise.all(targets.map((t) => resolvePathArg(ctx, context, t.filePath)));
-          const permissionDenied = await assertPathExternalPermissions(context, resolvedTargets);
+          const permissionDenied = await assertPathExternalPermissions(ctx, context, resolvedTargets);
           if (permissionDenied)
             return permissionDeniedResponse(permissionDenied);
           const responses = await Promise.all(targets.map((t, index) => {
@@ -37760,7 +38058,7 @@ function readingTools(ctx) {
         }
         const file2 = hasUrl ? args.url : await resolvePathArg(ctx, context, args.filePath);
         if (!hasUrl) {
-          const permissionDenied = await assertPathExternalPermissions(context, file2);
+          const permissionDenied = await assertPathExternalPermissions(ctx, context, file2);
           if (permissionDenied)
             return permissionDeniedResponse(permissionDenied);
         }
@@ -37832,7 +38130,7 @@ function formatZoomBatchResult(targetLabel, symbols, responses) {
 `) };
 }
 var MAX_UNCHECKED_FILES_IN_FOOTER = 10;
-async function assertPathExternalPermissions(context, target, kind = "file") {
+async function assertPathExternalPermissions(ctx, context, target, kind = "file") {
   const targets = Array.isArray(target) ? target : [target];
   const checked = new Set;
   for (const resolvedPath of targets) {
@@ -37842,7 +38140,7 @@ async function assertPathExternalPermissions(context, target, kind = "file") {
     if (checked.has(key))
       continue;
     checked.add(key);
-    const denial = await assertExternalDirectoryPermission(context, resolvedPath, { kind });
+    const denial = await assertExternalDirectoryPermission(ctx, context, resolvedPath, { kind });
     if (denial)
       return denial;
   }
@@ -38008,7 +38306,7 @@ function refactoringTools(ctx) {
             if (asked.has(affectedPath))
               continue;
             asked.add(affectedPath);
-            const denial = await assertExternalDirectoryPermission(context, affectedPath);
+            const denial = await assertExternalDirectoryPermission(ctx, context, affectedPath);
             if (denial)
               return permissionDeniedResponse(denial);
           }
@@ -38116,7 +38414,7 @@ function safetyTools(ctx) {
           }
           const previewPaths = Array.from(new Set(responsePaths(preview2)));
           for (const filePath2 of previewPaths) {
-            const denial = await assertExternalDirectoryPermission(context, filePath2);
+            const denial = await assertExternalDirectoryPermission(ctx, context, filePath2);
             if (denial)
               return permissionDeniedResponse(denial);
           }
@@ -38140,7 +38438,7 @@ function safetyTools(ctx) {
               if (uniqueParents.has(parent))
                 continue;
               uniqueParents.add(parent);
-              const denial = await assertExternalDirectoryPermission(context, abs, {
+              const denial = await assertExternalDirectoryPermission(ctx, context, abs, {
                 kind: "file"
               });
               if (denial)
@@ -38154,7 +38452,7 @@ function safetyTools(ctx) {
             throw new Error(bridgeErrorMessage(preview2, "checkpoint path preview failed"));
           }
           for (const filePath of new Set(responsePaths(preview2))) {
-            const denial = await assertExternalDirectoryPermission(context, filePath);
+            const denial = await assertExternalDirectoryPermission(ctx, context, filePath);
             if (denial)
               return permissionDeniedResponse(denial);
           }
@@ -38349,7 +38647,7 @@ function searchTools(ctx) {
         return permissionDeniedResponse(grepDenied);
       if (pathSplit) {
         for (const target of searchPathTargets(projectRoot, pathSplit, "file")) {
-          const externalDenied = await assertExternalDirectoryPermission(context, target.target, {
+          const externalDenied = await assertExternalDirectoryPermission(ctx, context, target.target, {
             kind: target.kind
           });
           if (externalDenied)
@@ -38402,7 +38700,7 @@ function searchTools(ctx) {
         return permissionDeniedResponse(globDenied);
       if (pathSplit) {
         for (const target of searchPathTargets(projectRoot, pathSplit, "directory")) {
-          const externalDenied = await assertExternalDirectoryPermission(context, target.target, {
+          const externalDenied = await assertExternalDirectoryPermission(ctx, context, target.target, {
             kind: target.kind
           });
           if (externalDenied)
@@ -38568,11 +38866,11 @@ function buildWorkflowHints(opts) {
   }
   if (hasBash && hasBgBash) {
     sections.push([
-      `**Long-running commands** (builds, installs, full test suites): \`${bashName}({ background: true })\` returns a \`taskId\` immediately. Then do ONE of these:`,
-      "1. Keep working on something independent of the result.",
-      "2. End your turn — a completion reminder with the result arrives automatically.",
-      `3. Need to react to a specific output line early? Register \`bash_watch({ taskId, pattern, background: true })\`, then end your turn — it pings you the moment the pattern appears.`,
-      `\`${bashStatusName}({ taskId })\` is for inspecting output AFTER the reminder arrives, or one quick look at a live task — never call it repeatedly to wait: the reminder already delivers the result, and each poll wastes a turn. Sync \`bash_watch\` (without \`background: true\`) blocks your turn and locks the user out — reserve it for waits of a few seconds (a dev server printing its ready line), never for builds or test suites.`
+      `**Long-running commands** (builds, installs, full test suites): \`${bashName}({ background: true })\` returns a \`taskId\` immediately.`,
+      "1. Nothing else useful to do (a build/test/validation whose result is the next thing you need) → sync `bash_watch` to block until it exits (pass a longer timeoutMs for long commands; the user can interrupt).",
+      "2. Useful parallel work available → end your turn; the completion reminder delivers the result. (Or spawn a subagent for the side work.)",
+      "3. Want to react to a specific early output line → async `bash_watch` (background:true + pattern).",
+      "Never loop `bash_status` to wait — it's a one-shot inspector, not a wait primitive."
     ].join(`
 `));
     sections.push(`**PTY / interactive commands**: PTY mode is for interactive REPLs and terminal apps (python, node, bash itself, vim). Start with \`${bashName}({ command: "python", pty: true, background: true })\`, read the screen with \`${bashStatusName}({ taskId, outputMode: "screen" })\`, and send input with \`${bashWriteName}({ taskId, input: "..." })\`.`);
@@ -38610,32 +38908,6 @@ function isTuiMode2() {
 function throwSentinel(command) {
   throw new Error(`${SENTINEL_PREFIX}${command.toUpperCase().replace(/-/g, "_")}_HANDLED__`);
 }
-async function sendIgnoredMessage2(client, sessionID, text) {
-  const typedClient = client;
-  let agent;
-  try {
-    const ctx = await resolvePromptContext(client, sessionID);
-    agent = ctx?.agent;
-  } catch {
-    agent = undefined;
-  }
-  const body = {
-    noReply: true,
-    parts: [{ type: "text", text, ignored: true }]
-  };
-  if (agent)
-    body.agent = agent;
-  const promptInput = { path: { id: sessionID }, body };
-  if (typeof typedClient.session?.prompt === "function") {
-    await Promise.resolve(typedClient.session.prompt(promptInput));
-    return;
-  }
-  if (typeof typedClient.session?.promptAsync === "function") {
-    await typedClient.session.promptAsync(promptInput);
-    return;
-  }
-  throw new Error("[aft-plugin] client.session.prompt is unavailable");
-}
 var PLUGIN_VERSION = (() => {
   try {
     const req = createRequire3(import.meta.url);
@@ -38657,6 +38929,7 @@ async function initializePluginForDirectory(input) {
   const binaryPath = await findBinary(PLUGIN_VERSION);
   await ensureStorageMigrated({ harness: "opencode", binaryPath, logger: bridgeLogger });
   const aftConfig = loadAftConfig(input.directory);
+  enqueueConfigParseWarnings(input.directory, getConfigLoadErrors());
   const autoUpdateAbort = new AbortController;
   const configOverrides = {
     ...resolveProjectOverridesForConfigure(aftConfig),
@@ -38747,6 +39020,7 @@ ${lines}
     projectConfigLoader: (projectRoot) => {
       try {
         const projectConfig = loadAftConfig(projectRoot);
+        enqueueConfigParseWarnings(projectRoot, getConfigLoadErrors());
         return resolveProjectOverridesForConfigure(projectConfig);
       } catch (err) {
         warn2(`loadAftConfig(${projectRoot}) failed; falling back to plugin-init config: ${err instanceof Error ? err.message : String(err)}`);
@@ -38805,8 +39079,7 @@ ${lines}
         ctx,
         directory: sessionDir,
         sessionID: completion.session_id,
-        client: input.client,
-        serverUrl: input.serverUrl?.toString()
+        client: input.client
       }, completion);
     },
     onBashLongRunning: (reminder, bridge) => {
@@ -38815,8 +39088,7 @@ ${lines}
         ctx,
         directory: sessionDir,
         sessionID: reminder.session_id,
-        client: input.client,
-        serverUrl: input.serverUrl?.toString()
+        client: input.client
       }, reminder);
     },
     onBashPatternMatch: (frame, bridge) => {
@@ -38825,8 +39097,7 @@ ${lines}
         ctx,
         directory: sessionDir,
         sessionID: frame.session_id,
-        client: input.client,
-        serverUrl: input.serverUrl?.toString()
+        client: input.client
       }, frame);
     }
   };
@@ -38839,16 +39110,6 @@ ${lines}
     config: aftConfig,
     storageDir: configOverrides.storage_dir
   };
-  probeServerReachable(input.serverUrl?.toString()).then((reachable) => {
-    setLiveServerWakeAvailable(reachable);
-    if (reachable) {
-      log2("Live OpenCode HTTP listener reachable; bg-notifications wake path = live-server (anomalyco/opencode#28202 workaround active).");
-    } else {
-      debug("Live OpenCode HTTP listener unreachable; bg-notifications wake path = in-process-fallback. Wakes will still arrive but the upstream duplicate-runner bug (anomalyco/opencode#28202) is not worked around. Launch with `opencode --port 0` in TUI mode to activate the workaround.");
-    }
-  }).catch(() => {
-    setLiveServerWakeAvailable(false);
-  });
   if (onnxRuntimePromise) {
     onnxRuntimePromise.then((ortDylibDir) => {
       if (ortDylibDir) {
@@ -39083,9 +39344,24 @@ Install: ${getManualInstallHint()}`).catch(() => {});
         ctx,
         directory: sessionDir,
         sessionID,
-        client: input.client,
-        serverUrl: input.serverUrl?.toString()
+        client: input.client
       });
+      const configParseWarnings = drainPendingConfigParseWarnings(sessionDir);
+      if (configParseWarnings.length > 0) {
+        const bridge = pool.getActiveBridgeForRoot(sessionDir) ?? pool.getBridge(sessionDir);
+        enqueueConfigureWarningsForSession({
+          projectRoot: sessionDir,
+          sessionId: sessionID,
+          client: input.client,
+          bridge,
+          warnings: configParseWarnings,
+          fallbackClient: input.client,
+          storageDir: configOverrides.storage_dir,
+          pluginVersion: PLUGIN_VERSION,
+          serverUrl: input.serverUrl?.toString(),
+          delivery: aftConfig.configure_warnings_delivery ?? "toast"
+        });
+      }
       await flushConfigureWarningsOnIdle(sessionID);
     },
     "chat.message": async (messageInput) => {