@cortexkit/aft-opencode 0.43.1 → 0.45.0

package/dist/index.js

@@ -8233,6 +8233,8 @@ function resolveBashKillTimeout(modelTimeout, foregroundWaitMs) {
 }
 // ../aft-bridge/dist/bridge.js
 import { spawn } from "node:child_process";
+import { createHash } from "node:crypto";
+import { readFileSync } from "node:fs";
 import { homedir as homedir2 } from "node:os";
 import { join as join2 } from "node:path";
 import { StringDecoder } from "node:string_decoder";
@@ -8332,6 +8334,22 @@ function bashTaskIdFrom(response) {
     return camelCase;
   return;
 }
+function hashBinaryOnDisk(binaryPath) {
+  try {
+    return createHash("sha256").update(readFileSync(binaryPath)).digest("hex");
+  } catch {
+    return null;
+  }
+}
+var binaryFingerprintReader = hashBinaryOnDisk;
+function readBinaryFingerprint(binaryPath) {
+  try {
+    const fingerprint = binaryFingerprintReader(binaryPath);
+    return typeof fingerprint === "string" && fingerprint.length > 0 ? fingerprint : null;
+  } catch {
+    return null;
+  }
+}
 function tagStderrLine(line) {
   return /^\[aft(-\w+)?\] /.test(line) ? line : `[aft] ${line}`;
 }
@@ -8427,6 +8445,9 @@ class BinaryBridge {
   binaryPath;
   cwd;
   process = null;
+  spawnedBinaryFingerprint = null;
+  lastBinaryFingerprintCheckAt = 0;
+  _retiringDueToBinaryChange = false;
   pending = new Map;
   outstandingBackgroundTaskIds = new Set;
   nextId = 1;
@@ -8546,6 +8567,24 @@ class BinaryBridge {
   hasOutstandingBackgroundTasks() {
     return this.outstandingBackgroundTaskIds.size > 0;
   }
+  maybeScheduleRespawnForUpdatedBinary(checkIntervalMs, now = Date.now()) {
+    if (this._shuttingDown || this._retiringDueToBinaryChange || !this.isAlive())
+      return false;
+    if (this.pending.size > 0 || this.outstandingBackgroundTaskIds.size > 0)
+      return false;
+    if (now - this.lastBinaryFingerprintCheckAt < checkIntervalMs)
+      return false;
+    this.lastBinaryFingerprintCheckAt = now;
+    const spawnedFingerprint = this.spawnedBinaryFingerprint;
+    if (!spawnedFingerprint)
+      return false;
+    const currentFingerprint = readBinaryFingerprint(this.binaryPath);
+    if (!currentFingerprint || currentFingerprint === spawnedFingerprint)
+      return false;
+    this._retiringDueToBinaryChange = true;
+    this.logVia(`Binary contents changed on disk for ${this.binaryPath}; retiring this bridge so the next tool call respawns onto the updated binary.`);
+    return true;
+  }
   getCwd() {
     return this.cwd;
   }
@@ -8578,6 +8617,9 @@ class BinaryBridge {
   }
   async sendWithVersionMismatchRetry(command, params, options, canRetryAfterVersionSwap) {
     try {
+      if (this._retiringDueToBinaryChange) {
+        throw new Error(`${this.errorPrefix} Bridge is retiring after the on-disk binary changed; retry to respawn on the updated binary`);
+      }
       if (this._shuttingDown) {
         throw new Error(`${this.errorPrefix} Bridge is shutting down, cannot send "${command}"`);
       }
@@ -8776,6 +8818,7 @@ class BinaryBridge {
   }
   async shutdown() {
     this._shuttingDown = true;
+    this.spawnedBinaryFingerprint = null;
     this.clearRestartResetTimer();
     this.configureWarningClients.clear();
     this.rejectAllPending(new Error(`${this.errorPrefix} Bridge shutting down`));
@@ -8829,6 +8872,9 @@ class BinaryBridge {
   async replaceCurrentBinary(newBinaryPath) {
     this.binaryPath = newBinaryPath;
     this.configured = false;
+    this.spawnedBinaryFingerprint = null;
+    this.lastBinaryFingerprintCheckAt = 0;
+    this._retiringDueToBinaryChange = false;
     this.clearRestartResetTimer();
     this.rejectAllPending(new Error(`${this.errorPrefix} Bridge restarting with updated binary: ${newBinaryPath}`));
     if (!this.process)
@@ -8854,6 +8900,7 @@ class BinaryBridge {
     this.spawnProcess(triggeringSessionId);
   }
   spawnProcess(triggeringSessionId) {
+    this._retiringDueToBinaryChange = false;
     this.lastStatusBar = undefined;
     if (triggeringSessionId) {
       this.sessionLogVia(triggeringSessionId, `Spawning binary: ${this.binaryPath} (cwd: ${this.cwd})`);
@@ -8944,6 +8991,8 @@ class BinaryBridge {
       this.handleCrash();
     });
     this.process = child;
+    this.spawnedBinaryFingerprint = readBinaryFingerprint(this.binaryPath);
+    this.lastBinaryFingerprintCheckAt = Date.now();
     this.stdoutBuffer = "";
     this.stdoutReadOffset = 0;
     this.stderrBuffer = "";
@@ -9122,6 +9171,7 @@ class BinaryBridge {
   }
   handleTimeout(triggeringSessionId) {
     this.consecutiveRequestTimeouts = 0;
+    this.spawnedBinaryFingerprint = null;
     this.rejectAllPending(new Error(`${this.errorPrefix} bridge killed during sibling timeout — request aborted`));
     this.outstandingBackgroundTaskIds.clear();
     if (this.process) {
@@ -9148,6 +9198,7 @@ class BinaryBridge {
   handleCrash(cause) {
     const proc = this.process;
     this.process = null;
+    this.spawnedBinaryFingerprint = null;
     if (proc && proc.exitCode === null && !proc.killed) {
       proc.kill("SIGKILL");
     }
@@ -9159,6 +9210,10 @@ class BinaryBridge {
       this.errorVia(`Binary crashed (restarts: ${this._restartCount})${cause ? `: ${cause.message}` : ""}.${tail}`);
     }
     this.rejectAllPending(new Error(`${this.errorPrefix} Binary crashed (restarts: ${this._restartCount})${cause ? `: ${cause.message}` : ""} (see ${this.getLogFilePathVia()})`));
+    if (this._retiringDueToBinaryChange) {
+      this.logVia("Binary exited while retiring after an on-disk update; skipping auto-restart");
+      return;
+    }
     if (this._restartCount < this.maxRestarts) {
       const delay = 100 * 2 ** this._restartCount;
       this._restartCount++;
@@ -9288,13 +9343,13 @@ function isEmptyParam(value) {
   return false;
 }
 // ../aft-bridge/dist/config-tiers.js
-import { existsSync, readFileSync } from "node:fs";
+import { existsSync, readFileSync as readFileSync2 } from "node:fs";
 import { resolve as resolve2 } from "node:path";
 function readConfigTiers(opts) {
   const tiers = [];
   try {
     if (existsSync(opts.userConfigPath)) {
-      const doc = readFileSync(opts.userConfigPath, "utf-8");
+      const doc = readFileSync2(opts.userConfigPath, "utf-8");
       tiers.push({
         tier: "user",
         source: resolve2(opts.userConfigPath),
@@ -9304,7 +9359,7 @@ function readConfigTiers(opts) {
   } catch {}
   try {
     if (existsSync(opts.projectConfigPath)) {
-      const doc = readFileSync(opts.projectConfigPath, "utf-8");
+      const doc = readFileSync2(opts.projectConfigPath, "utf-8");
       tiers.push({
         tier: "project",
         source: resolve2(opts.projectConfigPath),
@@ -9322,8 +9377,8 @@ function formatDroppedKeyWarnings(dropped) {
 }
 // ../aft-bridge/dist/downloader.js
 import { spawnSync } from "node:child_process";
-import { createHash, randomUUID } from "node:crypto";
-import { chmodSync, closeSync, copyFileSync, createWriteStream, existsSync as existsSync2, mkdirSync, openSync, readFileSync as readFileSync2, renameSync, rmSync, statSync, unlinkSync, writeSync } from "node:fs";
+import { createHash as createHash2, randomUUID } from "node:crypto";
+import { chmodSync, closeSync, copyFileSync, createWriteStream, existsSync as existsSync2, mkdirSync, openSync, readFileSync as readFileSync3, renameSync, rmSync, statSync, unlinkSync, writeSync } from "node:fs";
 import { homedir as homedir3 } from "node:os";
 import { join as join3 } from "node:path";
 import { Readable } from "node:stream";
@@ -9467,7 +9522,7 @@ async function downloadBinary(version) {
       warn(`Checksum verification failed: checksums.sha256 found but no entry for ${assetName}. ` + "Binary download aborted for security reasons.");
       return null;
     }
-    const hash = createHash("sha256");
+    const hash = createHash2("sha256");
     let bytesWritten = 0;
     const guard = new TransformStream({
       transform(chunk, controller) {
@@ -9551,7 +9606,7 @@ async function acquireDownloadLock(lockPath) {
           closeSync(fd);
         } catch {}
         try {
-          if (readFileSync2(lockPath, "utf-8") === owner) {
+          if (readFileSync3(lockPath, "utf-8") === owner) {
             rmSync(lockPath, { force: true });
           }
         } catch {}
@@ -9623,12 +9678,12 @@ function stripJsoncSymbols(value) {
 }
 // ../aft-bridge/dist/migration.js
 import { spawnSync as spawnSync2 } from "node:child_process";
-import { closeSync as closeSync3, existsSync as existsSync5, mkdirSync as mkdirSync4, openSync as openSync3, readFileSync as readFileSync4, renameSync as renameSync4, rmSync as rmSync2, statSync as statSync2, unlinkSync as unlinkSync3, writeFileSync as writeFileSync2 } from "node:fs";
+import { closeSync as closeSync3, existsSync as existsSync5, mkdirSync as mkdirSync4, openSync as openSync3, readFileSync as readFileSync5, renameSync as renameSync4, rmSync as rmSync2, statSync as statSync2, unlinkSync as unlinkSync3, writeFileSync as writeFileSync2 } from "node:fs";
 import { homedir as homedir6, tmpdir } from "node:os";
 import { basename, dirname as dirname2, join as join6, resolve as resolve4 } from "node:path";
 
 // ../aft-bridge/dist/paths.js
-import { existsSync as existsSync3, mkdirSync as mkdirSync2, readFileSync as readFileSync3, renameSync as renameSync2, writeFileSync } from "node:fs";
+import { existsSync as existsSync3, mkdirSync as mkdirSync2, readFileSync as readFileSync4, renameSync as renameSync2, writeFileSync } from "node:fs";
 import { homedir as homedir4 } from "node:os";
 import { dirname, isAbsolute as isAbsolute2, join as join4, resolve as resolve3 } from "node:path";
 function homeDir() {
@@ -9702,7 +9757,7 @@ function shouldShowAnnouncement(storageRoot, harness, currentVersion) {
   let lastVersion = "";
   try {
     if (existsSync3(versionFile)) {
-      lastVersion = readFileSync3(versionFile, "utf-8").trim();
+      lastVersion = readFileSync4(versionFile, "utf-8").trim();
     }
   } catch {
     return false;
@@ -10099,7 +10154,7 @@ function atomicCopyConfigFile(sourcePath, targetPath) {
   let fd = null;
   try {
     fd = openSync3(tmpPath, "wx", 384);
-    writeFileSync2(fd, readFileSync4(sourcePath));
+    writeFileSync2(fd, readFileSync5(sourcePath));
     closeSync3(fd);
     fd = null;
     renameSync4(tmpPath, targetPath);
@@ -10178,7 +10233,7 @@ function markLegacySourcesMovedAside(sources, targetPath, logger) {
     const desiredMarkerPath = `${source.path}${MOVED_MARKER_SUFFIX}`;
     const markerPath = nonClobberingSidecarPath(desiredMarkerPath);
     try {
-      const original = readFileSync4(source.path, "utf-8");
+      const original = readFileSync5(source.path, "utf-8");
       if (markerPath !== desiredMarkerPath) {
         logger?.warn?.(`Preserving existing legacy AFT marker ${desiredMarkerPath}; writing new marker to ${markerPath}`);
       }
@@ -10247,10 +10302,10 @@ function migrateAftConfigFile(opts) {
   try {
     const sources = existingSources.map((source) => ({
       ...source,
-      content: readFileSync4(source.path, "utf-8")
+      content: readFileSync5(source.path, "utf-8")
     }));
     if (existsSync5(opts.targetPath)) {
-      const targetContent = readFileSync4(opts.targetPath, "utf-8");
+      const targetContent = readFileSync5(opts.targetPath, "utf-8");
       for (const source of sources) {
         if (fileSemanticsMatch(source.content, targetContent))
           continue;
@@ -10484,8 +10539,8 @@ function isNpmAvailable(deps = defaultDeps()) {
 }
 // ../aft-bridge/dist/onnx-runtime.js
 import { execFileSync } from "node:child_process";
-import { createHash as createHash2 } from "node:crypto";
-import { chmodSync as chmodSync3, closeSync as closeSync4, copyFileSync as copyFileSync3, createWriteStream as createWriteStream2, existsSync as existsSync6, lstatSync, mkdirSync as mkdirSync5, openSync as openSync4, readdirSync as readdirSync2, readFileSync as readFileSync5, readlinkSync, realpathSync, rmSync as rmSync3, statSync as statSync4, symlinkSync, unlinkSync as unlinkSync4, writeFileSync as writeFileSync3 } from "node:fs";
+import { createHash as createHash3 } from "node:crypto";
+import { chmodSync as chmodSync3, closeSync as closeSync4, copyFileSync as copyFileSync3, createWriteStream as createWriteStream2, existsSync as existsSync6, lstatSync, mkdirSync as mkdirSync5, openSync as openSync4, readdirSync as readdirSync2, readFileSync as readFileSync6, readlinkSync, realpathSync, rmSync as rmSync3, statSync as statSync4, symlinkSync, unlinkSync as unlinkSync4, writeFileSync as writeFileSync3 } from "node:fs";
 import { basename as basename2, dirname as dirname4, isAbsolute as isAbsolute4, join as join8, relative as relative2, resolve as resolve5, win32 } from "node:path";
 import { Readable as Readable2 } from "node:stream";
 import { pipeline as pipeline2 } from "node:stream/promises";
@@ -11038,7 +11093,7 @@ function readOnnxInstalledMeta(installDir) {
   try {
     if (!statSync4(path2).isFile())
       return null;
-    const raw = readFileSync5(path2, "utf8");
+    const raw = readFileSync6(path2, "utf8");
     const parsed = JSON.parse(raw);
     if (typeof parsed.version !== "string" || parsed.version.length === 0)
       return null;
@@ -11053,8 +11108,8 @@ function readOnnxInstalledMeta(installDir) {
   }
 }
 function sha256File(path2) {
-  const hash = createHash2("sha256");
-  hash.update(readFileSync5(path2));
+  const hash = createHash3("sha256");
+  hash.update(readFileSync6(path2));
   return hash.digest("hex");
 }
 function acquireLock(lockPath) {
@@ -11082,7 +11137,7 @@ ${new Date().toISOString()}
   let owningPid = null;
   let lockMtimeMs = 0;
   try {
-    const raw = readFileSync5(lockPath, "utf8");
+    const raw = readFileSync6(lockPath, "utf8");
     const firstLine = raw.split(/\r?\n/, 1)[0]?.trim() ?? "";
     const parsed = Number.parseInt(firstLine, 10);
     if (Number.isFinite(parsed) && parsed > 0)
@@ -11107,7 +11162,7 @@ function releaseLock(lockPath) {
   try {
     let owningPid = null;
     try {
-      const raw = readFileSync5(lockPath, "utf8");
+      const raw = readFileSync6(lockPath, "utf8");
       const firstLine = raw.split(/\r?\n/, 1)[0]?.trim() ?? "";
       const parsed = Number.parseInt(firstLine, 10);
       if (Number.isFinite(parsed) && parsed > 0)
@@ -11171,7 +11226,7 @@ function isProcessAlive(pid) {
   }
 }
 // ../aft-bridge/dist/project-identity.js
-import { createHash as createHash3 } from "node:crypto";
+import { createHash as createHash4 } from "node:crypto";
 import { realpathSync as realpathSync2 } from "node:fs";
 import { resolve as resolve6 } from "node:path";
 function canonicalizeProjectRoot(dir) {
@@ -11202,7 +11257,7 @@ function normalizeWindowsRoot(p) {
   return s;
 }
 function projectRootKeyHash(dir) {
-  return createHash3("sha256").update(canonicalizeProjectRoot(dir)).digest("hex").slice(0, 16);
+  return createHash4("sha256").update(canonicalizeProjectRoot(dir)).digest("hex").slice(0, 16);
 }
 
 // ../aft-bridge/dist/pool.js
@@ -11286,6 +11341,11 @@ class BridgePool {
     for (const [dir, entry] of this.bridges) {
       if (entry.bridge.hasPendingRequests() || entry.bridge.hasOutstandingBackgroundTasks())
         continue;
+      if (entry.bridge.maybeScheduleRespawnForUpdatedBinary(CLEANUP_INTERVAL_MS, now)) {
+        this.staleBridges.add(entry.bridge);
+        this.bridges.delete(dir);
+        continue;
+      }
       if (now - entry.lastUsed > this.idleTimeoutMs) {
         entry.bridge.shutdown().catch((err) => this.error("cleanup shutdown failed:", err));
         this.bridges.delete(dir);
@@ -11382,10 +11442,11 @@ class BridgePool {
 function normalizeKey(projectRoot) {
   return canonicalizeProjectRoot(projectRoot);
 }
-// ../../node_modules/.bun/@cortexkit+subc-client@0.2.0/node_modules/@cortexkit/subc-client/src/client.ts
+// ../../node_modules/.bun/@cortexkit+subc-client@0.3.0/node_modules/@cortexkit/subc-client/src/client.ts
 import { promises as fs2 } from "node:fs";
+import { debuglog } from "node:util";
 
-// ../../node_modules/.bun/@cortexkit+subc-client@0.2.0/node_modules/@cortexkit/subc-client/src/auth.ts
+// ../../node_modules/.bun/@cortexkit+subc-client@0.3.0/node_modules/@cortexkit/subc-client/src/auth.ts
 import { createHmac, randomBytes, timingSafeEqual } from "node:crypto";
 var NONCE_LEN = 32;
 var MAX_AUTH_MESSAGE_LEN = 4096;
@@ -11449,7 +11510,7 @@ async function authenticateClient(sock, conn, deadlineMs) {
   await writeMessage(sock, { client_auth: Array.from(clientAuth) }, deadlineMs);
 }
 
-// ../../node_modules/.bun/@cortexkit+subc-client@0.2.0/node_modules/@cortexkit/subc-client/src/connection-file.ts
+// ../../node_modules/.bun/@cortexkit+subc-client@0.3.0/node_modules/@cortexkit/subc-client/src/connection-file.ts
 import { promises as fs } from "node:fs";
 var SCHEMA_VERSION = 1;
 var MIN_KEY_LEN = 32;
@@ -11518,7 +11579,7 @@ async function readConnectionFile(path2) {
   return info;
 }
 
-// ../../node_modules/.bun/@cortexkit+subc-client@0.2.0/node_modules/@cortexkit/subc-client/src/envelope.ts
+// ../../node_modules/.bun/@cortexkit+subc-client@0.3.0/node_modules/@cortexkit/subc-client/src/envelope.ts
 var PROTOCOL_VERSION = 1;
 var HEADER_LEN = 17;
 var FROZEN_PREFIX_LEN = 5;
@@ -11625,7 +11686,7 @@ function encodeFrame(frame) {
   return out;
 }
 
-// ../../node_modules/.bun/@cortexkit+subc-client@0.2.0/node_modules/@cortexkit/subc-client/src/socket.ts
+// ../../node_modules/.bun/@cortexkit+subc-client@0.3.0/node_modules/@cortexkit/subc-client/src/socket.ts
 import net from "node:net";
 
 class SocketClosedError extends Error {
@@ -11656,6 +11717,9 @@ class SubcSocket {
   buffered = 0;
   waiter = null;
   closedErr = null;
+  bufferedBytes() {
+    return this.buffered;
+  }
   constructor(sock) {
     this.sock = sock;
     sock.on("data", (chunk) => {
@@ -11672,6 +11736,9 @@ class SubcSocket {
     sock.on("end", () => fail(new SocketClosedError("subc closed the connection")));
     sock.on("close", () => fail(new SocketClosedError("subc connection closed")));
   }
+  localPort() {
+    return this.sock.localPort ?? null;
+  }
   static connect(host, port, deadlineMs) {
     return new Promise((resolve7, reject) => {
       const sock = net.connect({ host, port });
@@ -11811,9 +11878,14 @@ class SubcSocket {
   }
 }
 
-// ../../node_modules/.bun/@cortexkit+subc-client@0.2.0/node_modules/@cortexkit/subc-client/src/client.ts
+// ../../node_modules/.bun/@cortexkit+subc-client@0.3.0/node_modules/@cortexkit/subc-client/src/client.ts
+var debug = debuglog("subc-client");
 var DEFAULT_HANDSHAKE_TIMEOUT_MS = 1e4;
 var DEFAULT_REQUEST_TIMEOUT_MS = 30000;
+var TIMEOUT_ARBITRATION_GRACE_MS = 50;
+var REQUEST_DEADLINE_MARKER = "request_deadline";
+var DEADLINE_NO_DROP_CODE = "deadline_exceeded_no_drop_observed";
+var ROUTE_OPEN_RETRY_DEADLINE_MS = 1e4;
 var BODY_READ_TIMEOUT_MS = 30000;
 var EMPTY_BODY = new Uint8Array(0);
 var DEFAULT_MANAGED_TARGET_KIND = "management_surface";
@@ -11857,6 +11929,7 @@ class SubcClient {
   closeStarted = false;
   reconnecting = null;
   generation = 1;
+  readerActive = false;
   constructor(sock, currentConn, opts) {
     this.sock = sock;
     this.currentConn = currentConn;
@@ -11915,7 +11988,7 @@ class SubcClient {
           }
           continue;
         }
-        if (err.kind === "outcome_unknown") {
+        if (err.kind === "outcome_unknown" && err.code !== DEADLINE_NO_DROP_CODE) {
           this.scheduleReconnectAfterDrop(err);
         }
         throw err;
@@ -12038,7 +12111,7 @@ class SubcClient {
         timer: null
       };
       pending.timer = setTimeout(() => {
-        this.rejectPending(key, pending, new SubcError(`request on channel ${channel} timed out after ${ms}ms`));
+        this.arbitrateTimeout(key, pending, channel, corr, ms);
       }, ms);
       this.pending.set(key, pending);
       this.sock.write(encodeFrame(frame), Date.now() + ms).catch((err) => {
@@ -12048,6 +12121,23 @@ class SubcClient {
       });
     });
   }
+  arbitrateTimeout(key, pending, channel, corr, ms) {
+    const settleAsTimeout = () => {
+      this.rejectPending(key, pending, new SubcError(this.timeoutMessage(channel, corr, ms), REQUEST_DEADLINE_MARKER));
+    };
+    const graceDeadline = Date.now() + this.opts.timeoutArbitrationGraceMs;
+    const arbitrate = () => {
+      if (this.pending.get(key) !== pending)
+        return;
+      const readerDraining = this.readerActive || this.sock.bufferedBytes() > 0;
+      if (readerDraining && Date.now() < graceDeadline) {
+        setImmediate(arbitrate);
+        return;
+      }
+      settleAsTimeout();
+    };
+    setImmediate(arbitrate);
+  }
   async managedRequest(routeChannel, body, opts) {
     const bytes = body instanceof Uint8Array ? body : this.encode(body);
     const priority = opts.priority ?? 1 /* Interactive */;
@@ -12072,6 +12162,9 @@ class SubcClient {
       if (!handedToSocket) {
         return this.notSentCallError("request bytes were not queued to the subc socket", err);
       }
+      if (err instanceof SubcError && err.code === REQUEST_DEADLINE_MARKER) {
+        return new SubcCallError("outcome_unknown", `managed call deadline exceeded after request bytes were queued to the local socket; no terminal response was observed; outcome unknown${causeMessage(err)}`, DEADLINE_NO_DROP_CODE, err);
+      }
       return this.outcomeUnknownCallError("connection dropped before the managed call returned a response", err);
     };
     return new Promise((resolve7, reject) => {
@@ -12085,7 +12178,7 @@ class SubcClient {
         classifyFailure
       };
       pending.timer = setTimeout(() => {
-        this.rejectPending(key, pending, new SubcError(`request on channel ${channel} timed out after ${ms}ms`));
+        this.arbitrateTimeout(key, pending, channel, corr, ms);
       }, ms);
       this.pending.set(key, pending);
       const write = this.sock.writeTracked(encodeFrame(frame), Date.now() + ms);
@@ -12130,6 +12223,9 @@ class SubcClient {
     return cached.opening;
   }
   async openCachedRoute(cached) {
+    const routeRetryDeadline = Date.now() + ROUTE_OPEN_RETRY_DEADLINE_MS;
+    let routeRetryDelay = this.opts.reconnectBackoff.baseMs;
+    let routeRetryAttempt = 0;
     for (;; ) {
       if (cached.closed)
         throw this.routeClosedDuringOpen();
@@ -12163,6 +12259,15 @@ class SubcClient {
           }
           continue;
         }
+        if (!this.closeStarted && err instanceof SubcError && isRetryableRouteOpenCode(err.code)) {
+          routeRetryAttempt += 1;
+          if (routeRetryAttempt < this.opts.reconnectBackoff.maxAttempts && Date.now() < routeRetryDeadline) {
+            await this.opts.sleep(routeRetryDelay);
+            routeRetryDelay = Math.min(routeRetryDelay * 2, this.opts.reconnectBackoff.capMs);
+            continue;
+          }
+          throw this.notSentCallError(`route.open failed for module ${cached.moduleId}: ${err.code} (retry budget exhausted)`, err);
+        }
         throw this.terminalCallError(`route.open failed for module ${cached.moduleId}`, err);
       }
     }
@@ -12233,7 +12338,9 @@ class SubcClient {
     for (const cached of this.routes.values()) {
       if (cached.closed)
         continue;
-      const channel = await this.routeOpen(cached.target, cached.identity);
+      const channel = await this.routeOpen(cached.target, cached.identity, {
+        consumerIdentity: cached.consumerIdentity ?? null
+      });
       if (cached.closed) {
         this.sendRouteGoodbye(channel);
         continue;
@@ -12242,6 +12349,11 @@ class SubcClient {
       cached.generation = this.generation;
     }
   }
+  timeoutMessage(channel, corr, ms) {
+    const port = this.sock.localPort();
+    const where = port === null ? "channel" : `local_port=${port} channel`;
+    return `request on ${where} ${channel} corr ${corr} timed out after ${ms}ms`;
+  }
   routeClosedDuringOpen() {
     return new SubcCallError("not_sent", "route was closed before route.open completed", "route_closed");
   }
@@ -12249,9 +12361,16 @@ class SubcClient {
     try {
       for (;; ) {
         const headerBytes = await sock.readExact(HEADER_LEN, Number.POSITIVE_INFINITY);
-        const header = decodeHeader(headerBytes);
-        const body = header.len === 0 ? new Uint8Array(0) : await sock.readExact(header.len, Date.now() + BODY_READ_TIMEOUT_MS);
-        this.dispatch({ header, body });
+        this.readerActive = true;
+        try {
+          const header = decodeHeader(headerBytes);
+          const body = header.len === 0 ? new Uint8Array(0) : await sock.readExact(header.len, Date.now() + BODY_READ_TIMEOUT_MS);
+          if (this.sock === sock && this.generation === generation) {
+            this.dispatch({ header, body });
+          }
+        } finally {
+          this.readerActive = false;
+        }
       }
     } catch (err) {
       if (this.sock === sock && this.generation === generation) {
@@ -12283,13 +12402,20 @@ class SubcClient {
       this.failChannel(frame.header.channel, new SubcError("route closed by subc (GOODBYE)"));
       return;
     }
+    if (frame.header.ty === 1 /* Response */ || frame.header.ty === 5 /* Error */ || frame.header.ty === 4 /* StreamEnd */) {
+      debug("dropped terminal frame with no waiter: type=%d channel=%d corr=%s port=%s", frame.header.ty, frame.header.channel, frame.header.corr, this.sock.localPort() ?? "?");
+      return;
+    }
   }
   settle(key, pending, run) {
+    if (this.pending.get(key) !== pending)
+      return false;
     this.pending.delete(key);
     if (pending.timer)
       clearTimeout(pending.timer);
     run();
     pending.onSettle?.();
+    return true;
   }
   rejectPending(key, pending, err) {
     this.settle(key, pending, () => pending.reject(pending.classifyFailure?.(err) ?? err));
@@ -12353,6 +12479,9 @@ function isConsumerReconnectTransient(err) {
   const code = errorCode(err);
   return code === "ECONNREFUSED" || code === "ECONNRESET" || code === "EPIPE" || code === "ETIMEDOUT" || code === "ENOENT";
 }
+function isRetryableRouteOpenCode(code) {
+  return code === "unknown_module" || code === "module_reloading" || code === "target_unavailable" || code === "module_timeout";
+}
 async function connectionFileExists(path2) {
   try {
     await fs2.access(path2);
@@ -12368,7 +12497,8 @@ function normalizeConnectOptions(opts) {
     identity: opts.identity,
     targetKind: opts.targetKind ?? DEFAULT_MANAGED_TARGET_KIND,
     reconnectBackoff: opts.reconnectBackoff ?? DEFAULT_RECONNECT_BACKOFF,
-    sleep: opts.sleep ?? ((ms) => new Promise((resolve7) => setTimeout(resolve7, ms)))
+    sleep: opts.sleep ?? ((ms) => new Promise((resolve7) => setTimeout(resolve7, ms))),
+    timeoutArbitrationGraceMs: opts.timeoutArbitrationGraceMs ?? TIMEOUT_ARBITRATION_GRACE_MS
   };
 }
 function routeCacheKey(target, identity, consumerIdentity) {
@@ -12397,7 +12527,7 @@ function causeMessage(cause) {
     return "";
   return `: ${cause instanceof Error ? cause.message : String(cause)}`;
 }
-// ../../node_modules/.bun/@cortexkit+subc-client@0.2.0/node_modules/@cortexkit/subc-client/src/provider.ts
+// ../../node_modules/.bun/@cortexkit+subc-client@0.3.0/node_modules/@cortexkit/subc-client/src/provider.ts
 import { Buffer as Buffer2 } from "node:buffer";
 var DEFAULT_HANDSHAKE_TIMEOUT_MS2 = 1e4;
 var BODY_READ_TIMEOUT_MS2 = 30000;
@@ -13426,7 +13556,7 @@ async function createAftTransportPool(opts) {
   return new BridgePool(opts.binaryPath, opts.poolOptions, opts.configOverrides);
 }
 // src/bg-notifications.ts
-import { createHash as createHash4, randomUUID as randomUUID2 } from "node:crypto";
+import { createHash as createHash5, randomUUID as randomUUID2 } from "node:crypto";
 
 // src/logger.ts
 import * as fs3 from "node:fs";
@@ -13590,7 +13720,7 @@ async function resolvePromptContext(client, sessionId) {
 
 // src/bg-notifications.ts
 function hashReminder(text) {
-  return createHash4("sha256").update(text).digest("hex").slice(0, 16);
+  return createHash5("sha256").update(text).digest("hex").slice(0, 16);
 }
 var CONSUMED_TASKIDS_CAP = 256;
 var DELIVERED_AWAITING_ACK_CAP = 4096;
@@ -14354,7 +14484,7 @@ function formatDuration(completion) {
 }
 
 // src/config.ts
-import { existsSync as existsSync7, readFileSync as readFileSync6, renameSync as renameSync5, unlinkSync as unlinkSync5, writeFileSync as writeFileSync4 } from "node:fs";
+import { existsSync as existsSync7, readFileSync as readFileSync7, renameSync as renameSync5, unlinkSync as unlinkSync5, writeFileSync as writeFileSync4 } from "node:fs";
 var import_comment_json = __toESM(require_src2(), 1);
 
 // ../../node_modules/.bun/zod@4.4.3/node_modules/zod/v4/classic/external.js
@@ -28728,6 +28858,7 @@ var InspectConfigSchema = exports_external.object({
   duplicates: exports_external.object({
     lower_bound: exports_external.number().int().positive().optional(),
     discard_cost: exports_external.number().int().min(0).optional(),
+    expected_mirrors: exports_external.array(exports_external.tuple([exports_external.string().trim().min(1), exports_external.string().trim().min(1)])).optional(),
     anonymize: exports_external.object({
       variables: exports_external.boolean().optional(),
       fields: exports_external.boolean().optional(),
@@ -28945,7 +29076,7 @@ function migrateAftConfigFile2(configPath, logger = { log: log2, warn: warn2 })
   let tmpPath = null;
   let oldKeys = [];
   try {
-    const content = readFileSync6(configPath, "utf-8");
+    const content = readFileSync7(configPath, "utf-8");
     const rawConfig = import_comment_json.parse(content);
     if (!rawConfig || typeof rawConfig !== "object" || Array.isArray(rawConfig)) {
       return { migrated: false, oldKeys: [] };
@@ -29022,7 +29153,7 @@ function loadConfigFromPath(configPath) {
     if (!existsSync7(configPath)) {
       return null;
     }
-    const content = readFileSync6(configPath, "utf-8");
+    const content = readFileSync7(configPath, "utf-8");
     const rawConfig = import_comment_json.parse(content);
     migrateRawConfig(rawConfig, configPath, { log: log2, warn: warn2 });
     const cleanConfig = stripJsoncSymbols(rawConfig);
@@ -29290,7 +29421,7 @@ function loadAftConfig(projectDirectory) {
 }
 
 // src/notifications.ts
-import { existsSync as existsSync8, readFileSync as readFileSync7 } from "node:fs";
+import { existsSync as existsSync8, readFileSync as readFileSync8 } from "node:fs";
 import { homedir as homedir9, platform } from "node:os";
 import { join as join11 } from "node:path";
 function isTuiMode() {
@@ -29333,7 +29464,7 @@ function readDesktopState() {
     return { serverUrl: null };
   }
   try {
-    const raw = readFileSync7(statePath, "utf-8");
+    const raw = readFileSync8(statePath, "utf-8");
     const state = JSON.parse(raw);
     let serverUrl = null;
     const serverStr = state.server;
@@ -29832,7 +29963,7 @@ import {
   existsSync as existsSync11,
   mkdirSync as mkdirSync6,
   openSync as openSync5,
-  readFileSync as readFileSync10,
+  readFileSync as readFileSync11,
   renameSync as renameSync6,
   rmSync as rmSync5,
   writeFileSync as writeFileSync7
@@ -29841,14 +29972,14 @@ import { dirname as dirname7 } from "node:path";
 
 // src/hooks/auto-update-checker/cache.ts
 import { spawn as spawn2 } from "node:child_process";
-import { cpSync, existsSync as existsSync10, mkdtempSync, readFileSync as readFileSync9, rmSync as rmSync4, writeFileSync as writeFileSync6 } from "node:fs";
+import { cpSync, existsSync as existsSync10, mkdtempSync, readFileSync as readFileSync10, rmSync as rmSync4, writeFileSync as writeFileSync6 } from "node:fs";
 import { tmpdir as tmpdir3 } from "node:os";
 import { basename as basename3, dirname as dirname6, join as join14 } from "node:path";
 var import_comment_json3 = __toESM(require_src2(), 1);
 
 // src/hooks/auto-update-checker/checker.ts
 var import_comment_json2 = __toESM(require_src2(), 1);
-import { existsSync as existsSync9, readFileSync as readFileSync8, statSync as statSync5, writeFileSync as writeFileSync5 } from "node:fs";
+import { existsSync as existsSync9, readFileSync as readFileSync9, statSync as statSync5, writeFileSync as writeFileSync5 } from "node:fs";
 import { homedir as homedir11 } from "node:os";
 import { dirname as dirname5, isAbsolute as isAbsolute6, join as join13, resolve as resolve7 } from "node:path";
 import { fileURLToPath } from "node:url";
@@ -29954,7 +30085,7 @@ function getLocalDevPath(directory) {
     try {
       if (!existsSync9(configPath))
         continue;
-      const rawConfig = parseJsonConfig(readFileSync8(configPath, "utf-8"));
+      const rawConfig = parseJsonConfig(readFileSync9(configPath, "utf-8"));
       const plugins = getPluginEntries(rawConfig);
       for (const entry of plugins) {
         if (entry === PACKAGE_NAME || entry.startsWith(`${PACKAGE_NAME}@`))
@@ -29964,7 +30095,7 @@ function getLocalDevPath(directory) {
           const pkgPath = findPackageJsonUp(localPath);
           if (!pkgPath)
             continue;
-          const pkg = PackageJsonSchema.safeParse(JSON.parse(readFileSync8(pkgPath, "utf-8")));
+          const pkg = PackageJsonSchema.safeParse(JSON.parse(readFileSync9(pkgPath, "utf-8")));
           if (pkg.success && pkg.data.name === PACKAGE_NAME)
             return localPath;
         }
@@ -29981,7 +30112,7 @@ function findPackageJsonUp(startPath) {
       const pkgPath = join13(dir, "package.json");
       if (existsSync9(pkgPath)) {
         try {
-          const pkg = PackageJsonSchema.safeParse(JSON.parse(readFileSync8(pkgPath, "utf-8")));
+          const pkg = PackageJsonSchema.safeParse(JSON.parse(readFileSync9(pkgPath, "utf-8")));
           if (pkg.success && pkg.data.name === PACKAGE_NAME)
             return pkgPath;
         } catch {}
@@ -30002,7 +30133,7 @@ function getLocalDevVersion(directory) {
     const pkgPath = findPackageJsonUp(localPath);
     if (!pkgPath)
       return null;
-    const pkg = PackageJsonSchema.safeParse(JSON.parse(readFileSync8(pkgPath, "utf-8")));
+    const pkg = PackageJsonSchema.safeParse(JSON.parse(readFileSync9(pkgPath, "utf-8")));
     return pkg.success ? pkg.data.version ?? null : null;
   } catch {
     return null;
@@ -30021,7 +30152,7 @@ function findPluginEntry(directory) {
     try {
       if (!existsSync9(configPath))
         continue;
-      const rawConfig = parseJsonConfig(readFileSync8(configPath, "utf-8"));
+      const rawConfig = parseJsonConfig(readFileSync9(configPath, "utf-8"));
       const plugins = getPluginEntries(rawConfig);
       for (const entry of plugins) {
         if (entry === PACKAGE_NAME) {
@@ -30054,7 +30185,7 @@ function getCachedVersion(spec) {
     try {
       if (!existsSync9(packageJsonPath))
         continue;
-      const pkg = PackageJsonSchema.safeParse(JSON.parse(readFileSync8(packageJsonPath, "utf-8")));
+      const pkg = PackageJsonSchema.safeParse(JSON.parse(readFileSync9(packageJsonPath, "utf-8")));
       if (pkg.success && pkg.data.version) {
         if (!spec)
           cachedPackageVersion = pkg.data.version;
@@ -30104,9 +30235,9 @@ function createAutoUpdateSnapshot(installDir, packageJsonPath, packageName) {
     cpSync(packageDir, stagedPackageDir, { recursive: true });
   return {
     packageJsonPath,
-    packageJson: existsSync10(packageJsonPath) ? readFileSync9(packageJsonPath, "utf-8") : null,
+    packageJson: existsSync10(packageJsonPath) ? readFileSync10(packageJsonPath, "utf-8") : null,
     lockfilePath,
-    lockfile: existsSync10(lockfilePath) ? readFileSync9(lockfilePath, "utf-8") : null,
+    lockfile: existsSync10(lockfilePath) ? readFileSync10(lockfilePath, "utf-8") : null,
     packageDir,
     stagedPackageDir,
     tempDir
@@ -30144,7 +30275,7 @@ function removeFromPackageLock(installDir, packageName) {
   if (!existsSync10(lockPath))
     return false;
   try {
-    const lock = import_comment_json3.parse(readFileSync9(lockPath, "utf-8"));
+    const lock = import_comment_json3.parse(readFileSync10(lockPath, "utf-8"));
     let modified = false;
     if (lock.packages) {
       const key = `node_modules/${packageName}`;
@@ -30170,7 +30301,7 @@ function ensureDependencyVersion(packageJsonPath, packageName, version2) {
   if (!existsSync10(packageJsonPath))
     return false;
   try {
-    const raw = import_comment_json3.parse(readFileSync9(packageJsonPath, "utf-8"));
+    const raw = import_comment_json3.parse(readFileSync10(packageJsonPath, "utf-8"));
     const pkgJson = PackageJsonSchema.safeParse(raw);
     if (!pkgJson.success)
       return false;
@@ -30424,7 +30555,7 @@ function hasRecentCheckTimestamp(file2, intervalMs) {
   if (!existsSync11(file2))
     return false;
   try {
-    const raw = JSON.parse(readFileSync10(file2, "utf-8"));
+    const raw = JSON.parse(readFileSync11(file2, "utf-8"));
     const last = typeof raw.lastCheckedMs === "number" ? raw.lastCheckedMs : 0;
     return Number.isFinite(last) && Date.now() - last < intervalMs;
   } catch {
@@ -30528,12 +30659,12 @@ function showToast(ctx, title, message, variant = "info", duration3 = 3000) {
 
 // src/lsp-auto-install.ts
 import { spawn as spawn3 } from "node:child_process";
-import { createHash as createHash5 } from "node:crypto";
+import { createHash as createHash6 } from "node:crypto";
 import {
   createReadStream,
   existsSync as existsSync13,
   mkdirSync as mkdirSync8,
-  readFileSync as readFileSync13,
+  readFileSync as readFileSync14,
   renameSync as renameSync7,
   rmSync as rmSync6,
   statSync as statSync7,
@@ -30546,7 +30677,7 @@ import {
   closeSync as closeSync6,
   mkdirSync as mkdirSync7,
   openSync as openSync6,
-  readFileSync as readFileSync11,
+  readFileSync as readFileSync12,
   statSync as statSync6,
   unlinkSync as unlinkSync6,
   writeFileSync as writeFileSync8
@@ -30610,7 +30741,7 @@ function readInstalledMetaIn(installDir) {
   try {
     if (!statSync6(path3).isFile())
       return null;
-    const raw = readFileSync11(path3, "utf8");
+    const raw = readFileSync12(path3, "utf8");
     const parsed = JSON.parse(raw);
     if (typeof parsed.version !== "string" || parsed.version.length === 0)
       return null;
@@ -30660,7 +30791,7 @@ ${new Date().toISOString()}
   let owningPid = null;
   let lockMtimeMs = 0;
   try {
-    const raw = readFileSync11(lock, "utf8");
+    const raw = readFileSync12(lock, "utf8");
     const firstLine = raw.split(/\r?\n/, 1)[0]?.trim() ?? "";
     const parsed = Number.parseInt(firstLine, 10);
     if (Number.isFinite(parsed) && parsed > 0)
@@ -30698,7 +30829,7 @@ function releaseInstallLock(lockKey) {
   try {
     let owningPid = null;
     try {
-      const raw = readFileSync11(lock, "utf8");
+      const raw = readFileSync12(lock, "utf8");
       const firstLine = raw.split(/\r?\n/, 1)[0]?.trim() ?? "";
       const parsed = Number.parseInt(firstLine, 10);
       if (Number.isFinite(parsed) && parsed > 0)
@@ -30739,7 +30870,7 @@ var VERSION_CHECK_FILE = ".aft-version-check";
 function readVersionCheck(npmPackage) {
   const file2 = join15(lspPackageDir(npmPackage), VERSION_CHECK_FILE);
   try {
-    const raw = readFileSync11(file2, "utf8");
+    const raw = readFileSync12(file2, "utf8");
     const parsed = JSON.parse(raw);
     if (typeof parsed.last_checked === "string") {
       return {
@@ -30916,7 +31047,7 @@ var NPM_LSP_TABLE = [
 ];
 
 // src/lsp-project-relevance.ts
-import { existsSync as existsSync12, readdirSync as readdirSync3, readFileSync as readFileSync12 } from "node:fs";
+import { existsSync as existsSync12, readdirSync as readdirSync3, readFileSync as readFileSync13 } from "node:fs";
 import { join as join16 } from "node:path";
 var MAX_WALK_DIRS = 200;
 var MAX_WALK_DEPTH = 4;
@@ -30958,7 +31089,7 @@ function hasPackageJsonDep(projectRoot, depNames) {
 }
 function readPackageJson(projectRoot) {
   try {
-    const raw = readFileSync12(join16(projectRoot, "package.json"), "utf8");
+    const raw = readFileSync13(join16(projectRoot, "package.json"), "utf8");
     const parsed = JSON.parse(raw);
     if (typeof parsed !== "object" || parsed === null)
       return null;
@@ -31280,7 +31411,7 @@ function hashInstalledBinary(spec) {
       reject(new Error(`installed binary not found at any of: ${candidates.join(", ")}`));
       return;
     }
-    const hash2 = createHash5("sha256");
+    const hash2 = createHash6("sha256");
     const stream = createReadStream(pathToHash);
     stream.on("error", reject);
     stream.on("data", (chunk) => hash2.update(chunk));
@@ -31303,7 +31434,7 @@ function installedBinaryPath(spec) {
   return null;
 }
 function sha256OfFileSync(path3) {
-  return createHash5("sha256").update(readFileSync13(path3)).digest("hex");
+  return createHash6("sha256").update(readFileSync14(path3)).digest("hex");
 }
 function quarantineCachedNpmInstall(spec, reason) {
   const packageDir = lspPackageDir(spec.npm);
@@ -31388,7 +31519,7 @@ function runAutoInstall(projectRoot, config2, fetchImpl = fetch) {
 
 // src/lsp-github-install.ts
 import { execFileSync as execFileSync2 } from "node:child_process";
-import { createHash as createHash6, randomBytes as randomBytes2 } from "node:crypto";
+import { createHash as createHash7, randomBytes as randomBytes2 } from "node:crypto";
 import {
   copyFileSync as copyFileSync4,
   createReadStream as createReadStream2,
@@ -31397,7 +31528,7 @@ import {
   lstatSync as lstatSync2,
   mkdirSync as mkdirSync9,
   readdirSync as readdirSync4,
-  readFileSync as readFileSync14,
+  readFileSync as readFileSync15,
   readlinkSync as readlinkSync2,
   realpathSync as realpathSync3,
   renameSync as renameSync8,
@@ -31531,7 +31662,7 @@ function readGithubInstalledMetaIn(installDir) {
     const path3 = join18(installDir, INSTALLED_META_FILE2);
     if (!statSync8(path3).isFile())
       return null;
-    const parsed = JSON.parse(readFileSync14(path3, "utf8"));
+    const parsed = JSON.parse(readFileSync15(path3, "utf8"));
     if (typeof parsed.version !== "string" || parsed.version.length === 0)
       return null;
     return {
@@ -31564,7 +31695,7 @@ var MAX_DOWNLOAD_BYTES3 = 256 * 1024 * 1024;
 var MAX_EXTRACT_BYTES2 = 1024 * 1024 * 1024;
 function sha256OfFile(path3) {
   return new Promise((resolve9, reject) => {
-    const hash2 = createHash6("sha256");
+    const hash2 = createHash7("sha256");
     const stream = createReadStream2(path3);
     stream.on("error", reject);
     stream.on("data", (chunk) => hash2.update(chunk));
@@ -31572,7 +31703,7 @@ function sha256OfFile(path3) {
   });
 }
 function sha256OfFileSync2(path3) {
-  return createHash6("sha256").update(readFileSync14(path3)).digest("hex");
+  return createHash7("sha256").update(readFileSync15(path3)).digest("hex");
 }
 async function fetchReleaseByTag(githubRepo, tag, fetchImpl, signal) {
   const candidates = [];
@@ -32351,7 +32482,7 @@ import {
   existsSync as existsSync15,
   mkdirSync as mkdirSync10,
   readdirSync as readdirSync5,
-  readFileSync as readFileSync15,
+  readFileSync as readFileSync16,
   renameSync as renameSync9,
   unlinkSync as unlinkSync8,
   writeFileSync as writeFileSync11
@@ -32531,7 +32662,7 @@ class AftRpcServer {
       if (filePath === this.portFilePath)
         continue;
       try {
-        const record2 = parseRpcPortRecord(readFileSync15(filePath, "utf-8"));
+        const record2 = parseRpcPortRecord(readFileSync16(filePath, "utf-8"));
         if (record2 === null) {
           unlinkSync8(filePath);
           continue;
@@ -33561,17 +33692,18 @@ var SUPPORTED_LANGS = [
   "rust",
   "go",
   "pascal",
-  "r"
+  "r",
+  "objc"
 ];
 function astTools(ctx) {
   const searchTool = {
-    description: `Search code patterns across filesystem using AST-aware matching. Supports 8 languages.
+    description: `Search code patterns across filesystem using AST-aware matching. Supports 9 languages.
 
 ` + `Use meta-variables: $VAR matches a single AST node, $$$ matches multiple nodes (variadic).
 ` + `IMPORTANT: Patterns must be complete AST nodes (valid code fragments).
 ` + `For functions, include params and body: 'export async function $NAME($$$) { $$$ }' not just 'export async function $NAME'.
 
-` + "Examples: pattern='console.log($MSG)' lang='typescript', pattern='async function $NAME($$$) { $$$ }' lang='javascript', pattern='def $FUNC($$$): $$$' lang='python', pattern='Writeln($MSG);' lang='pascal', pattern='$X <- $Y' lang='r'",
+` + "Examples: pattern='console.log($MSG)' lang='typescript', pattern='async function $NAME($$$) { $$$ }' lang='javascript', pattern='def $FUNC($$$): $$$' lang='python', pattern='Writeln($MSG);' lang='pascal', pattern='$X <- $Y' lang='r', pattern='[obj foo:$ARG]' lang='objc'",
     args: {
       pattern: z3.string().describe("AST pattern with meta-variables ($VAR, $$$). Must be complete AST node."),
       lang: z3.enum(SUPPORTED_LANGS).describe("Target language"),
@@ -33734,14 +33866,14 @@ function resolveForegroundWaitMs(configured) {
   }
   return configured;
 }
-function orchestratedTransportTimeoutMs(blockToCompletion, effectiveTimeout, foregroundWaitMs) {
-  const waitBudget = blockToCompletion ? effectiveTimeout ?? DEFAULT_HARD_TIMEOUT_MS : foregroundWaitMs;
+function orchestratedTransportTimeoutMs(blockToCompletion, wait, effectiveTimeout, foregroundWaitMs) {
+  const waitBudget = blockToCompletion || wait ? effectiveTimeout ?? DEFAULT_HARD_TIMEOUT_MS : foregroundWaitMs;
   return waitBudget + BASH_TRANSPORT_MARGIN_MS;
 }
 function bashToolDescription(aftSearchRegistered, compressionOn, backgroundOn) {
   const searchSteer = aftSearchRegistered ? "use aft_search (concepts, identifiers, regex, literals), read, aft_outline, or aft_zoom instead" : "use the grep tool, read, aft_outline, or aft_zoom instead";
   const compression = compressionOn ? " Output is compressed by default; pass compressed: false for raw output. Piped commands run verbatim and show the pipeline's output; for AFT's test/build summary, run the runner without | head, | tail, or | grep." : "";
-  const tasks = backgroundOn ? ' Commands run in the foreground and return inline; a long-running one auto-promotes to background and delivers a completion reminder when it finishes — so for the common "I am waiting on this result" case, just run it and wait, no flags needed. Use background: true yourself ONLY when you have other useful work to do while it runs; then bash_watch waits on the task (sync blocks until exit/pattern, async notifies) and bash_status peeks at it — never background a command and immediately bash_watch it (that wastes a turn for what foreground returns in one), and never loop bash_status to wait. pty: true runs interactive programs (REPLs, TUIs), implies background, and is driven with bash_status({ outputMode: "screen" }) plus bash_write.' : " Commands run in the foreground to completion; timeout is the hard kill cap (default 30 minutes).";
+  const tasks = backgroundOn ? ' Commands run in the foreground and return inline; wait: true blocks until a long command finishes instead of auto-promoting — use it when you need the result before doing anything else; keep it off otherwise so auto-promote can remind you while you work. Use background: true yourself ONLY when you have other useful work to do while it runs; then bash_watch waits on the task (sync blocks until exit/pattern, async notifies) and bash_status peeks at it — never background a command and immediately bash_watch it (that wastes a turn for what foreground returns in one), and never loop bash_status to wait. pty: true runs interactive programs (REPLs, TUIs), implies background, and is driven with bash_status({ outputMode: "screen" }) plus bash_write.' : " Commands run in the foreground to completion; timeout is the hard kill cap (default 30 minutes).";
   return `Execute shell commands.${compression}${tasks}
 
 DO NOT use bash for code search or code exploration. If you are about to run grep, rg, sed, awk, find, or cat through bash to locate or read code: STOP — ${searchSteer}.`;
@@ -33807,6 +33939,7 @@ function createBashTool(ctx, aftSearchRegisteredOverride) {
     timeout: optionalInt(1, Number.MAX_SAFE_INTEGER).describe(initialBashCfg.background ? "Hard kill cap in milliseconds (positive integer). When omitted, the task can run up to 30 minutes. Foreground bash returns inline if the command finishes within ~8s (configurable via bash.foreground_wait_window_ms); otherwise it's automatically promoted to background and a completion reminder is delivered when the task actually finishes." : "Hard kill cap in milliseconds (positive integer). When omitted, the foreground command can run up to 30 minutes and returns inline when it finishes."),
     workdir: z4.string().optional().describe("Working directory for command execution. Relative paths resolve through the bridge; defaults to the current tool context/project root when omitted."),
     description: z4.string().optional().describe("Short 5-10 word human-readable summary shown in OpenCode UI metadata instead of raw shell syntax."),
+    wait: z4.boolean().optional().describe("When true, run in the foreground without auto-promoting and wait until the command finishes or reaches its timeout. Use only when you know the result is required before doing anything else."),
     ...backgroundFlagArg,
     compressed: z4.boolean().optional().describe("When true or omitted, return compressed output with noisy terminal control sequences reduced. Set to false for raw output."),
     ...ptyArgs
@@ -33826,21 +33959,30 @@ function createBashTool(ctx, aftSearchRegisteredOverride) {
       const cwd = args2.workdir ?? context.directory;
       const isSubagent = await resolveIsSubagent(ctx.client, context.sessionID, context.directory);
       const backgroundDisabled = !bashCfg.background;
-      const requestedPty = !backgroundDisabled && coerceBoolean(args2.pty);
-      const requestedBackground = !backgroundDisabled && (coerceBoolean(args2.background) || requestedPty);
+      const requestedWait = coerceBoolean(args2.wait);
+      const rawRequestedPty = coerceBoolean(args2.pty);
+      const rawRequestedBackground = coerceBoolean(args2.background);
+      if (requestedWait && rawRequestedPty) {
+        throw new Error("wait:true cannot be used with pty:true because PTY sessions run in background.");
+      }
+      if (requestedWait && rawRequestedBackground) {
+        throw new Error("wait:true cannot be used with background:true.");
+      }
+      const requestedPty = !backgroundDisabled && rawRequestedPty;
+      const requestedBackground = !backgroundDisabled && (rawRequestedBackground || requestedPty);
       if (requestedPty && isSubagent) {
         throw new Error("PTY mode is not available in subagent sessions; subagents cannot drive interactive terminals.");
       }
       const allowSubagentBg = bashCfg.subagent_background;
       const subagentForcedForeground = isSubagent && !allowSubagentBg;
-      const blockToCompletion = subagentForcedForeground || backgroundDisabled;
+      const blockToCompletion = subagentForcedForeground || backgroundDisabled || requestedWait;
       const effectiveBackground = blockToCompletion ? false : requestedBackground;
       const rawTimeout = coerceOptionalInt(args2.timeout, "timeout", 1, Number.MAX_SAFE_INTEGER);
       const ptyRows = coerceOptionalInt(args2.ptyRows, "ptyRows", 1, 60);
       const ptyCols = coerceOptionalInt(args2.ptyCols, "ptyCols", 1, 140);
       const compressed = coerceBoolean(args2.compressed, true);
       const foregroundWaitMs = resolveForegroundWaitMs(bashCfg.foreground_wait_window_ms);
-      const effectiveTimeout = effectiveBackground || backgroundDisabled ? rawTimeout : resolveBashKillTimeout(rawTimeout, foregroundWaitMs);
+      const effectiveTimeout = requestedWait || effectiveBackground || backgroundDisabled ? rawTimeout : resolveBashKillTimeout(rawTimeout, foregroundWaitMs);
       if (subagentForcedForeground && requestedBackground) {
         sessionLog(context.sessionID, "[bash] subagent + background:true → converting to foreground (subagent would lose task_id)");
       }
@@ -33859,9 +34001,10 @@ function createBashTool(ctx, aftSearchRegisteredOverride) {
         pty_cols: ptyCols,
         permissions_requested: true,
         foreground_orchestrate: true,
-        block_to_completion: blockToCompletion
+        block_to_completion: blockToCompletion,
+        wait: requestedWait
       }, callBashBridge, {
-        transportTimeoutMs: orchestratedTransportTimeoutMs(blockToCompletion, effectiveTimeout, foregroundWaitMs),
+        transportTimeoutMs: orchestratedTransportTimeoutMs(blockToCompletion, requestedWait, effectiveTimeout, foregroundWaitMs),
         onProgress: ({ text }) => {
           accumulatedOutput = preview(accumulatedOutput + text);
           metadata?.({ output: accumulatedOutput, description });
@@ -35319,11 +35462,11 @@ function createInspectTier2IdleScheduler(options) {
 }
 function inspectTools(ctx) {
   const inspectTool = {
-    description: "Codebase health snapshot. One call returns summary stats for: TODOs, diagnostics, file/symbol metrics, dead code, unused exports, code duplicates. Pass `sections` for per-category drill-down details.\n\n" + "Categories run in tiers — Tier 1 (todos, metrics) return synchronously from cache. Tier 2 (dead_code, unused_exports, duplicates) waits for a fresh reuse scan up to a short deadline; if a category is still scanning the response reports `complete: false` with `pending_categories: [...]` rather than a fabricated clean count.\n\n" + `Use when: starting work on unfamiliar code, after multi-edit batches to check diagnostics, before a refactor, before review, or to verify cleanup completeness.
+    description: "Codebase health snapshot. One call returns summary stats for: TODOs, diagnostics, file/symbol metrics, dead code, unused exports, code duplicates, and TS/JS import cycles. Pass `sections` for per-category drill-down details.\n\n" + "Categories run in tiers — Tier 1 (todos, metrics) return synchronously from cache. Tier 2 (dead_code, unused_exports, duplicates, cycles) waits for a fresh reuse scan up to a short deadline; if a category is still scanning the response reports `complete: false` with `pending_categories: [...]` rather than a fabricated clean count. Rust module cycles are out of scope for `cycles`.\n\n" + `Use when: starting work on unfamiliar code, after multi-edit batches to check diagnostics, before a refactor, before review, or to verify cleanup completeness.
 
 ` + "Treat `dead_code` as a hint, not proof: reachability is call-based, so symbols reached only via method dispatch or referenced only in type position may be false positives — verify before deleting.",
     args: {
-      sections: arg(z10.union([z10.string(), z10.array(z10.string())]).optional().describe("Categories to include in detailed drill-down (e.g. 'todos' or ['todos', 'dead_code']). Use 'all' for every active category. Omit for summary-only mode.")),
+      sections: arg(z10.union([z10.string(), z10.array(z10.string())]).optional().describe("Categories to include in detailed drill-down (e.g. 'todos' or ['todos', 'dead_code', 'cycles']). Use 'all' for every active category. Omit for summary-only mode.")),
       scope: arg(z10.union([z10.string(), z10.array(z10.string())]).optional().describe("Restrict scan/results to paths under this scope (file or directory, absolute or relative to project root). Tier 1 scopes the scan; Tier 2 scans project-wide and applies scope as a result filter.")),
       topK: arg(z10.number().int().positive().max(100).optional().describe("Max drill-down items per category. Default 20, max 100."))
     },
@@ -36235,7 +36378,7 @@ function buildWorkflowHints(opts) {
   }
   if (hasBash && hasBgBash) {
     sections.push([
-      `**Long-running commands** (builds, installs, full test suites): run them in the FOREGROUND — \`${bashName}({ command })\` waits and returns the result in ONE step, and if it outlives the short wait window it auto-promotes to background and delivers a completion reminder when it finishes. Don't reach for \`background: true\` for the common "I'm waiting on this result" case — that costs an extra turn.`,
+      `**Long-running commands** (builds, installs, full test suites): run them in the FOREGROUND — use \`${bashName}({ command, wait: true })\` when you know it is long and need the result before anything else; otherwise omit \`wait\` so auto-promote can hand you a reminder while you work.`,
       "- `background: true` is ONLY for when you have OTHER useful work to do while it runs: start it, do the other work, and the completion reminder delivers the result (or spawn a subagent for the side work). Do NOT background a command and then immediately `bash_watch` it — that spends a whole extra turn waiting for something foreground returns in one.",
       "- `bash_watch` is for blocking on an ALREADY-backgrounded task once you've run out of parallel work (sync — the user can interrupt), or reacting to a specific early output line (async: background:true + pattern). Never loop `bash_status` to wait — it's a one-shot inspector."
     ].join(`
@@ -36292,12 +36435,13 @@ var PLUGIN_VERSION = (() => {
     return "0.0.0";
   }
 })();
-var ANNOUNCEMENT_VERSION = "0.43.0";
+var ANNOUNCEMENT_VERSION = "0.45.0";
 var ANNOUNCEMENT_FEATURES = [
-  "Fewer permission prompts: system temp paths (/tmp and friends) no longer trigger external-directory asks, and aft_search now has its own permission id so a grep deny rule can't block it.",
-  `New enabled config toggle: set "enabled": false in a project's .cortexkit/aft.jsonc (or your user config) to turn AFT off there entirely.`,
-  "Bash compression honesty fix: empty successful output stays empty instead of being replaced with synthesized text like 'kubectl: no resources found'.",
-  "TUI sidebar now updates over a push channel instead of polling (lower idle CPU), and AFT no longer re-adds itself to tui.json if you remove it (aft setup re-registers)."
+  "Code Health verified against 12 real repositories: dead code is only reported for languages we can actually analyze (Java/Kotlin now say 'not analyzed' instead of guessing), and generated code (gen/ trees, *_pb.ts, DO NOT EDIT banners) moves out of the headline counts into its own bucket.",
+  "Config files (playwright/eslint/tsup/vitest *.config.ts), Storybook stories, Mocha hooks, and SvelteKit hooks/$lib imports are no longer flagged as dead code.",
+  "Rust module aliases, inline-module calls, and cross-crate pub use re-exports now resolve; Go interface methods (sort.Interface, Bubble Tea) are no longer flagged dead.",
+  "Fixed npx @cortexkit/aft doctor --fix and setup failing to download the binary on fresh installs.",
+  "Bridges now detect an updated aft binary on disk and respawn onto it automatically."
 ];
 var ANNOUNCEMENT_FOOTER = "Join us on Discord: https://discord.gg/DSa65w8wuf";
 var plugin = async (input) => initializePluginForDirectory(input);