@cortexkit/aft-pi 0.39.3 → 0.40.0

package/dist/index.js

@@ -11675,11 +11675,6 @@ function error(message, meta) {
   }
 }
 // ../aft-bridge/dist/bash-format.js
-function appendPipeStripNote(output, note) {
-  return note ? `${output}
-
-${note}` : output;
-}
 function formatSeconds(ms) {
   return `${Number((ms / 1000).toFixed(1))}s`;
 }
@@ -11757,12 +11752,16 @@ function maybeAppendGrepSearchHint(output, command, aftSearchRegistered, project
 ${hint}`;
 }
 function shouldSuppressGrepSearchHint(command, projectRoot) {
-  const root = projectRoot?.trim();
-  if (!root)
-    return false;
   const statements = splitTopLevelStatements(command);
   if (statements === null)
     return false;
+  if (allSearchPathOperandsAreDynamic(statements))
+    return true;
+  const root = projectRoot?.trim();
+  if (!root)
+    return false;
+  const resolvedRoot = path.resolve(root);
+  let effectiveCwd = resolvedRoot;
   let sawCodeSearchStatement = false;
   for (const statement of statements) {
     const firstStage = firstPipelineStage(statement);
@@ -11771,19 +11770,84 @@ function shouldSuppressGrepSearchHint(command, projectRoot) {
     const firstToken = readShellToken(firstStage, skipSpaces(firstStage, 0));
     if (firstToken === null)
       continue;
-    if (firstToken.token !== "grep" && firstToken.token !== "rg")
+    const head = firstToken.token;
+    if (head === "cd") {
+      effectiveCwd = nextCwdAfterCd(effectiveCwd, firstStage, firstToken.end);
+      continue;
+    }
+    if (head !== "grep" && head !== "rg")
       continue;
     sawCodeSearchStatement = true;
+    if (effectiveCwd === null)
+      continue;
+    if (!isDirInsideProject(resolvedRoot, effectiveCwd))
+      continue;
     const operands = collectPathOperands(firstStage, firstToken.end);
     if (operands.length === 0)
       return false;
     for (const operand of operands) {
-      if (isPathInsideProject(root, operand))
+      if (isDynamicPathOperand(operand))
+        continue;
+      if (isPathInsideProject(resolvedRoot, effectiveCwd, operand))
         return false;
     }
   }
   return sawCodeSearchStatement;
 }
+function allSearchPathOperandsAreDynamic(statements) {
+  let sawDynamicOnlySearch = false;
+  for (const statement of statements) {
+    const firstStage = firstPipelineStage(statement);
+    if (firstStage === null)
+      continue;
+    const firstToken = readShellToken(firstStage, skipSpaces(firstStage, 0));
+    if (firstToken === null)
+      continue;
+    const head = firstToken.token;
+    if (head !== "grep" && head !== "rg")
+      continue;
+    const operands = collectPathOperands(firstStage, firstToken.end);
+    if (operands.length === 0)
+      return false;
+    if (operands.some((operand) => !isDynamicPathOperand(operand)))
+      return false;
+    sawDynamicOnlySearch = true;
+  }
+  return sawDynamicOnlySearch;
+}
+function nextCwdAfterCd(currentCwd, firstStage, afterCd) {
+  let index = skipSpaces(firstStage, afterCd);
+  let target = null;
+  while (index < firstStage.length) {
+    const tokenResult = readShellToken(firstStage, index);
+    if (tokenResult === null)
+      break;
+    const { token, end } = tokenResult;
+    if (end <= index)
+      break;
+    index = skipSpaces(firstStage, end);
+    if (token === "-")
+      return null;
+    if (token.length > 1 && token.startsWith("-"))
+      continue;
+    target = token;
+    break;
+  }
+  if (target === null)
+    return path.resolve(os.homedir());
+  if (target.includes("$") || target.includes("`"))
+    return null;
+  const expanded = expandTilde(target);
+  if (path.isAbsolute(expanded))
+    return path.resolve(expanded);
+  if (currentCwd === null)
+    return null;
+  return path.resolve(currentCwd, expanded);
+}
+function isDirInsideProject(resolvedRoot, dir) {
+  const rel = path.relative(resolvedRoot, path.resolve(dir));
+  return rel === "" || !rel.startsWith("..") && !path.isAbsolute(rel);
+}
 function collectPathOperands(firstStage, startAfterCommand) {
   const operands = [];
   let index = skipSpaces(firstStage, startAfterCommand);
@@ -11805,6 +11869,9 @@ function collectPathOperands(firstStage, startAfterCommand) {
 function looksLikePathOperand(token) {
   return token.includes("/") || token.startsWith("~") || token.startsWith("./") || token.startsWith("../");
 }
+function isDynamicPathOperand(token) {
+  return token.startsWith("~") || token.includes("$") || token.includes("`");
+}
 function expandTilde(target) {
   if (!target.startsWith("~"))
     return target;
@@ -11817,10 +11884,9 @@ function resolvePathOperand(projectRoot, operand) {
   const expanded = expandTilde(operand);
   return path.isAbsolute(expanded) ? path.resolve(expanded) : path.resolve(projectRoot, expanded);
 }
-function isPathInsideProject(projectRoot, operand) {
-  const root = path.resolve(projectRoot);
-  const resolved = resolvePathOperand(root, operand);
-  const rel = path.relative(root, resolved);
+function isPathInsideProject(resolvedRoot, baseCwd, operand) {
+  const resolved = resolvePathOperand(baseCwd, operand);
+  const rel = path.relative(resolvedRoot, resolved);
   return rel === "" || !rel.startsWith("..") && !path.isAbsolute(rel);
 }
 function splitTopLevelStatements(command) {
@@ -12013,6 +12079,7 @@ var LONG_RUNNING_COMMAND_TIMEOUT_MS = {
   trace_to_symbol: 60000,
   trace_data: 60000,
   impact: 60000,
+  inspect: 60000,
   grep: 60000,
   glob: 60000,
   semantic_search: 60000
@@ -12071,7 +12138,6 @@ function formatStatusBar(counts) {
 // ../aft-bridge/dist/bridge.js
 var DEFAULT_BRIDGE_TIMEOUT_MS = 30000;
 var BRIDGE_HANG_TIMEOUT_THRESHOLD = 2;
-var SEMANTIC_TIMEOUT_SAFETY_MARGIN_MS = 5000;
 var MAX_STDOUT_BUFFER = 64 * 1024 * 1024;
 var STDOUT_BUFFER_COMPACT_THRESHOLD = 64 * 1024;
 var TERMINAL_BASH_STATUSES = new Set([
@@ -12144,28 +12210,19 @@ function compareSemver(a, b) {
   }
   return 0;
 }
-function clampSemanticTimeout(configOverrides, bridgeTimeoutMs) {
-  const semantic = configOverrides.semantic;
-  if (!semantic || typeof semantic !== "object" || Array.isArray(semantic)) {
-    return configOverrides;
-  }
-  const timeoutMs = semantic.timeout_ms;
-  if (typeof timeoutMs !== "number" || !Number.isFinite(timeoutMs)) {
-    return configOverrides;
-  }
-  const semanticTransportBudgetMs = Math.max(bridgeTimeoutMs, LONG_RUNNING_COMMAND_TIMEOUT_MS.semantic_search ?? 0);
-  const maxSemanticTimeoutMs = semanticTransportBudgetMs > SEMANTIC_TIMEOUT_SAFETY_MARGIN_MS ? semanticTransportBudgetMs - SEMANTIC_TIMEOUT_SAFETY_MARGIN_MS : Math.max(1, semanticTransportBudgetMs - 1);
-  if (timeoutMs <= maxSemanticTimeoutMs) {
-    return configOverrides;
-  }
-  warn(`semantic.timeout_ms=${timeoutMs} exceeds the semantic transport budget; clamping to ${maxSemanticTimeoutMs}ms (budget: ${semanticTransportBudgetMs}ms)`);
-  return {
-    ...configOverrides,
-    semantic: {
-      ...semantic,
-      timeout_ms: maxSemanticTimeoutMs
+function coerceConfigureDroppedKeys(value) {
+  if (!Array.isArray(value))
+    return [];
+  const dropped = [];
+  for (const item of value) {
+    if (!item || typeof item !== "object" || Array.isArray(item))
+      continue;
+    const record = item;
+    if (typeof record.key === "string" && typeof record.tier === "string" && typeof record.reason === "string") {
+      dropped.push({ key: record.key, tier: record.tier, reason: record.reason });
     }
-  };
+  }
+  return dropped;
 }
 
 class BridgeReplacedDuringVersionCheck extends Error {
@@ -12177,6 +12234,21 @@ class BridgeReplacedDuringVersionCheck extends Error {
   }
 }
 
+class BridgeTransportTimeoutError extends Error {
+  command;
+  timeoutMs;
+  code = "transport_timeout";
+  constructor(command, timeoutMs, message) {
+    super(message);
+    this.command = command;
+    this.timeoutMs = timeoutMs;
+    this.name = "BridgeTransportTimeoutError";
+  }
+}
+function isBridgeTransportTimeout(err) {
+  return err instanceof Error && err.code === "transport_timeout";
+}
+
 class BinaryBridge {
   static RESTART_RESET_MS = 5 * 60 * 1000;
   static STDERR_TAIL_MAX = 20;
@@ -12220,7 +12292,7 @@ class BinaryBridge {
     this.timeoutMs = options?.timeoutMs ?? DEFAULT_BRIDGE_TIMEOUT_MS;
     this.hangThreshold = options?.hangThreshold ?? BRIDGE_HANG_TIMEOUT_THRESHOLD;
     this.maxRestarts = options?.maxRestarts ?? 3;
-    this.configOverrides = clampSemanticTimeout(configOverrides ?? {}, this.timeoutMs);
+    this.configOverrides = configOverrides ?? {};
     this.minVersion = options?.minVersion;
     this.onVersionMismatch = options?.onVersionMismatch;
     this.onConfigureWarnings = options?.onConfigureWarnings;
@@ -12404,7 +12476,7 @@ class BinaryBridge {
             } else {
               this.warnVia(timeoutMsg2);
             }
-            entry.reject(new Error(`${this.errorPrefix} Request "${command}" (id=${id}) timed out after ${effectiveTimeoutMs}ms`));
+            entry.reject(new BridgeTransportTimeoutError(command, effectiveTimeoutMs, `${this.errorPrefix} Request "${command}" (id=${id}) timed out after ${effectiveTimeoutMs}ms`));
             return;
           }
           const childActiveSinceRequest = this.lastChildActivityAt > requestSentAt;
@@ -12457,18 +12529,24 @@ class BinaryBridge {
     }
   }
   async deliverConfigureWarnings(configResult, params, options) {
-    if (!this.onConfigureWarnings || !Array.isArray(configResult.warnings))
+    if (!this.onConfigureWarnings)
       return;
-    if (configResult.warnings.length === 0)
+    const warnings = Array.isArray(configResult.warnings) ? configResult.warnings : [];
+    const configDroppedKeys = coerceConfigureDroppedKeys(configResult.config_dropped_keys);
+    if (warnings.length === 0 && configDroppedKeys.length === 0)
       return;
     const sessionId = typeof params.session_id === "string" ? params.session_id : undefined;
+    const context = {
+      projectRoot: this.cwd,
+      sessionId,
+      client: options?.configureWarningClient ?? (sessionId ? this.configureWarningClients.get(sessionId) : undefined),
+      warnings
+    };
+    if (configDroppedKeys.length > 0) {
+      context.configDroppedKeys = configDroppedKeys;
+    }
     try {
-      await this.onConfigureWarnings({
-        projectRoot: this.cwd,
-        sessionId,
-        client: options?.configureWarningClient ?? (sessionId ? this.configureWarningClients.get(sessionId) : undefined),
-        warnings: configResult.warnings
-      });
+      await this.onConfigureWarnings(context);
     } catch (err) {
       this.warnVia(`configure warning delivery failed: ${err instanceof Error ? err.message : String(err)}`);
     } finally {
@@ -12974,13 +13052,17 @@ function joinNonEmpty(parts, separator = " · ") {
 function treeLine(depth, text) {
   return `${"  ".repeat(depth)}${depth === 0 ? "" : "↳ "}${text}`;
 }
+function nameMatchEdgeMarker(record, theme) {
+  return asString(record.resolved_by) === "name_match" ? ` ${theme.fg("warning", "~")}` : "";
+}
 function renderCallTreeNode(node, depth, lines, theme) {
   const name = asString(node.name) ?? "(unknown)";
   const file = shortenPath(asString(node.file) ?? "(unknown file)");
   const line = asNumber(node.line);
   const unresolved = node.resolved === false ? ` ${theme.fg("warning", "[unresolved]")}` : "";
+  const nameMatch = nameMatchEdgeMarker(node, theme);
   const location = line !== undefined ? `[${file}:${line}]` : `[${file}]`;
-  lines.push(treeLine(depth, `${name} ${location}${unresolved}`));
+  lines.push(treeLine(depth, `${name} ${location}${unresolved}${nameMatch}`));
   asRecords(node.children).forEach((child) => {
     renderCallTreeNode(child, depth + 1, lines, theme);
   });
@@ -12993,34 +13075,39 @@ function depthWarning(response, theme, depthField = "depth_limited", truncatedFi
   const detail = truncated > 0 ? `, ${truncated} truncated` : "";
   return theme.fg("warning", `(depth limited${detail})`);
 }
-function renderTracePath(path2, index, lines) {
+function renderTracePath(path2, index, lines, theme) {
   lines.push(`Path ${index + 1}`);
   asRecords(path2.hops).forEach((hop, hopIndex) => {
     const symbol = asString(hop.symbol) ?? "(unknown)";
     const file = shortenPath(asString(hop.file) ?? "(unknown file)");
     const line = asNumber(hop.line);
     const entry = hop.is_entry_point === true ? " [entry]" : "";
-    lines.push(treeLine(hopIndex + 1, `${symbol}${entry} ${line !== undefined ? `[${file}:${line}]` : `[${file}]`}`));
+    const nameMatch = nameMatchEdgeMarker(hop, theme);
+    lines.push(treeLine(hopIndex + 1, `${symbol}${entry} ${line !== undefined ? `[${file}:${line}]` : `[${file}]`}${nameMatch}`));
   });
 }
 function renderCallersGroupLines(group, theme) {
   const file = shortenPath(asString(group.file) ?? "(unknown file)");
   const lines = [theme.fg("accent", file)];
   const callers = asRecords(group.callers);
-  const bySymbol = new Map;
+  const bySymbolProvenance = new Map;
   for (const caller of callers) {
     const symbol = asString(caller.symbol) ?? "(unknown)";
+    const provenanceKey = asString(caller.resolved_by) === "name_match" ? `${symbol}\x00name_match` : `${symbol}\x00exact`;
     const line = asNumber(caller.line);
-    const bucket = bySymbol.get(symbol) ?? [];
+    const bucket = bySymbolProvenance.get(provenanceKey) ?? [];
     if (line !== undefined)
       bucket.push(line);
-    bySymbol.set(symbol, bucket);
+    bySymbolProvenance.set(provenanceKey, bucket);
   }
-  const symbols = [...bySymbol.keys()].sort((a, b) => a.localeCompare(b));
-  for (const symbol of symbols) {
-    const lineNums = (bySymbol.get(symbol) ?? []).sort((a, b) => a - b);
+  const keys = [...bySymbolProvenance.keys()].sort((a, b) => a.localeCompare(b));
+  for (const key of keys) {
+    const symbol = key.split("\x00")[0] ?? "(unknown)";
+    const isNameMatch = key.endsWith("\x00name_match");
+    const lineNums = (bySymbolProvenance.get(key) ?? []).sort((a, b) => a - b);
     const linePart = lineNums.length > 0 ? lineNums.map(String).join(", ") : "?";
-    lines.push(`  ↳ ${symbol}:${linePart}`);
+    const marker = isNameMatch ? ` ${theme.fg("warning", "~")}` : "";
+    lines.push(`  ↳ ${symbol}:${linePart}${marker}`);
   }
   return lines;
 }
@@ -13066,7 +13153,8 @@ function formatCallgraphSections(op, response, theme = PLAIN_CALLGRAPH_THEME) {
       const symbol = asString(hop.symbol) ?? "(unknown)";
       const file = shortenPath(asString(hop.file) ?? "(unknown file)");
       const line = asNumber(hop.line);
-      lines.push(treeLine(index + 1, `${symbol} ${line !== undefined ? `[${file}:${line}]` : `[${file}]`}`));
+      const nameMatch = nameMatchEdgeMarker(hop, theme);
+      lines.push(treeLine(index + 1, `${symbol} ${line !== undefined ? `[${file}:${line}]` : `[${file}]`}${nameMatch}`));
     });
     return lines;
   }
@@ -13086,7 +13174,7 @@ function formatCallgraphSections(op, response, theme = PLAIN_CALLGRAPH_THEME) {
       sections2.push(theme.fg("muted", "No entry paths found."));
     paths.forEach((path2, index) => {
       const lines = [];
-      renderTracePath(path2, index, lines);
+      renderTracePath(path2, index, lines, theme);
       sections2.push(lines.join(`
 `));
     });
@@ -13111,11 +13199,12 @@ function formatCallgraphSections(op, response, theme = PLAIN_CALLGRAPH_THEME) {
       const symbol = asString(caller.caller_symbol) ?? "(unknown)";
       const line = asNumber(caller.line) ?? 0;
       const entry = caller.is_entry_point === true ? ` ${theme.fg("warning", "[entry]")}` : "";
+      const nameMatch = nameMatchEdgeMarker(caller, theme);
       const expression = asString(caller.call_expression);
       const params = Array.isArray(caller.parameters) ? caller.parameters.map(String).join(", ") : "";
       sections2.push([
         `${theme.fg("accent", file)}:${line}`,
-        `  ↳ ${symbol}${entry}`,
+        `  ↳ ${symbol}${entry}${nameMatch}`,
         expression ? `  ${theme.fg("muted", expression)}` : undefined,
         params ? `  ${theme.fg("muted", `params: ${params}`)}` : undefined
       ].filter(Boolean).join(`
@@ -13138,7 +13227,8 @@ function formatCallgraphSections(op, response, theme = PLAIN_CALLGRAPH_THEME) {
     const variable = asString(hop.variable) ?? "(unknown)";
     const line = asNumber(hop.line) ?? 0;
     const approximate = hop.approximate === true ? ` ${theme.fg("warning", "[approx]")}` : "";
-    sections.push(treeLine(index, `${variable} ${theme.fg("muted", `${asString(hop.flow_type) ?? "flow"}`)} ${symbol} [${file}:${line}]${approximate}`));
+    const nameMatch = nameMatchEdgeMarker(hop, theme);
+    sections.push(treeLine(index, `${variable} ${theme.fg("muted", `${asString(hop.flow_type) ?? "flow"}`)} ${symbol} [${file}:${line}]${approximate}${nameMatch}`));
   });
   return sections;
 }
@@ -13163,6 +13253,48 @@ function coerceStringArray(value) {
   }
   return [];
 }
+function coerceTargetParam(value) {
+  if (Array.isArray(value)) {
+    return value.filter((entry) => typeof entry === "string" && entry.length > 0);
+  }
+  if (typeof value === "string") {
+    const trimmed = value.trim();
+    if (trimmed.startsWith("[") && trimmed.endsWith("]")) {
+      try {
+        const parsed = JSON.parse(trimmed);
+        if (Array.isArray(parsed)) {
+          return parsed.filter((entry) => typeof entry === "string" && entry.length > 0);
+        }
+      } catch {}
+    }
+    return value;
+  }
+  return value;
+}
+function coerceBoolean(value, defaultValue = false) {
+  if (defaultValue) {
+    if (value === undefined)
+      return true;
+    if (typeof value === "boolean")
+      return value;
+    if (typeof value === "number")
+      return value !== 0;
+    if (typeof value === "string") {
+      const normalized = value.trim().toLowerCase();
+      return normalized !== "false" && normalized !== "0";
+    }
+    return true;
+  }
+  if (typeof value === "boolean")
+    return value;
+  if (typeof value === "number")
+    return value === 1;
+  if (typeof value === "string") {
+    const normalized = value.trim().toLowerCase();
+    return normalized === "true" || normalized === "1";
+  }
+  return false;
+}
 function coerceOptionalInt(v, paramName, min, max) {
   if (v === undefined || v === null || v === "")
     return;
@@ -13188,10 +13320,43 @@ function isEmptyParam(value) {
     return Object.keys(value).length === 0;
   return false;
 }
+// ../aft-bridge/dist/config-tiers.js
+import { existsSync, readFileSync } from "node:fs";
+import { resolve as resolve2 } from "node:path";
+function readConfigTiers(opts) {
+  const tiers = [];
+  try {
+    if (existsSync(opts.userConfigPath)) {
+      const doc = readFileSync(opts.userConfigPath, "utf-8");
+      tiers.push({
+        tier: "user",
+        source: resolve2(opts.userConfigPath),
+        doc
+      });
+    }
+  } catch {}
+  try {
+    if (existsSync(opts.projectConfigPath)) {
+      const doc = readFileSync(opts.projectConfigPath, "utf-8");
+      tiers.push({
+        tier: "project",
+        source: resolve2(opts.projectConfigPath),
+        doc
+      });
+    }
+  } catch {}
+  return tiers;
+}
+function formatDroppedKeyWarnings(dropped) {
+  if (!dropped || !Array.isArray(dropped)) {
+    return [];
+  }
+  return dropped.map((item) => `Ignoring ${item.key} from ${item.tier} config (${item.reason})`);
+}
 // ../aft-bridge/dist/downloader.js
 import { spawnSync } from "node:child_process";
 import { createHash, randomUUID } from "node:crypto";
-import { chmodSync, closeSync, copyFileSync, createWriteStream, existsSync, mkdirSync, openSync, readFileSync, renameSync, rmSync, statSync, unlinkSync, writeSync } from "node:fs";
+import { chmodSync, closeSync, copyFileSync, createWriteStream, existsSync as existsSync2, mkdirSync, openSync, readFileSync as readFileSync2, renameSync, rmSync, statSync, unlinkSync, writeSync } from "node:fs";
 import { homedir as homedir4 } from "node:os";
 import { join as join3 } from "node:path";
 import { Readable } from "node:stream";
@@ -13263,7 +13428,7 @@ function getCachedBinaryPath(version) {
   if (!version)
     return null;
   const binaryPath = join3(getCacheDir(), version, getBinaryName());
-  return existsSync(binaryPath) ? binaryPath : null;
+  return existsSync2(binaryPath) ? binaryPath : null;
 }
 async function downloadBinary(version) {
   const archMap = PLATFORM_ARCH_MAP[process.platform] ?? {};
@@ -13282,7 +13447,7 @@ async function downloadBinary(version) {
   const versionedCacheDir = join3(getCacheDir(), tag);
   const binaryName = getBinaryName();
   const binaryPath = join3(versionedCacheDir, binaryName);
-  if (existsSync(binaryPath) && isExpectedCachedBinary(binaryPath, tag)) {
+  if (existsSync2(binaryPath) && isExpectedCachedBinary(binaryPath, tag)) {
     return binaryPath;
   }
   const downloadUrl = `https://github.com/${REPO}/releases/download/${tag}/${assetName}`;
@@ -13296,11 +13461,11 @@ async function downloadBinary(version) {
   let checksumTimeout = null;
   const tmpPath = `${binaryPath}.${process.pid}.${Date.now()}.${Math.random().toString(16).slice(2)}.tmp`;
   try {
-    if (!existsSync(versionedCacheDir)) {
+    if (!existsSync2(versionedCacheDir)) {
       mkdirSync(versionedCacheDir, { recursive: true });
     }
     releaseLock = await acquireDownloadLock(lockPath);
-    if (existsSync(binaryPath) && isExpectedCachedBinary(binaryPath, tag)) {
+    if (existsSync2(binaryPath) && isExpectedCachedBinary(binaryPath, tag)) {
       return binaryPath;
     }
     binaryController = new AbortController;
@@ -13365,7 +13530,7 @@ async function downloadBinary(version) {
       renameSync(tmpPath, binaryPath);
     }
     try {
-      if (existsSync(tmpPath))
+      if (existsSync2(tmpPath))
         unlinkSync(tmpPath);
     } catch {
       warn(`Could not clean up temporary download file ${tmpPath} — it can be removed manually.`);
@@ -13375,7 +13540,7 @@ async function downloadBinary(version) {
   } catch (err) {
     const msg = err instanceof Error ? err.message : String(err);
     error(`Failed to download AFT binary: ${msg}`);
-    if (existsSync(tmpPath)) {
+    if (existsSync2(tmpPath)) {
       try {
         unlinkSync(tmpPath);
       } catch {}
@@ -13419,7 +13584,7 @@ async function acquireDownloadLock(lockPath) {
           closeSync(fd);
         } catch {}
         try {
-          if (readFileSync(lockPath, "utf-8") === owner) {
+          if (readFileSync2(lockPath, "utf-8") === owner) {
             rmSync(lockPath, { force: true });
           }
         } catch {}
@@ -13440,7 +13605,7 @@ async function acquireDownloadLock(lockPath) {
       if (Date.now() - startedAt > DOWNLOAD_LOCK_TIMEOUT_MS) {
         throw new Error(`Timed out waiting for download lock: ${lockPath}`);
       }
-      await new Promise((resolve2) => setTimeout(resolve2, 100));
+      await new Promise((resolve3) => setTimeout(resolve3, 100));
     }
   }
 }
@@ -13495,7 +13660,7 @@ function formatEditSummary(data) {
   if (data.created === true) {
     let s2 = `Created file (${counts}).`;
     if (data.formatted)
-      s2 += " Auto-formatted.";
+      s2 += formatAutoFormattedSuffix(data);
     return s2;
   }
   let detail = counts;
@@ -13506,9 +13671,21 @@ function formatEditSummary(data) {
   }
   let s = `Edited (${detail}).`;
   if (data.formatted)
-    s += " Auto-formatted.";
+    s += formatAutoFormattedSuffix(data);
   return s;
 }
+function formatAutoFormattedSuffix(data) {
+  const reflowText = data.reformatted?.text;
+  if (typeof reflowText === "string" && reflowText.length > 0) {
+    return `
+Auto-formatted — the formatter reflowed your edit. On disk now:
+${reflowText}`;
+  }
+  if (data.reformatted?.extensive === true) {
+    return " Auto-formatted — extensive reflow; re-read the file before your next anchored edit.";
+  }
+  return " Auto-formatted.";
+}
 // ../aft-bridge/dist/format.js
 function compressionSavingsPercent(original, compressed) {
   if (original <= 0)
@@ -13532,20 +13709,71 @@ function stripJsoncSymbols(value) {
 }
 // ../aft-bridge/dist/migration.js
 import { spawnSync as spawnSync2 } from "node:child_process";
-import { existsSync as existsSync4, mkdirSync as mkdirSync4 } from "node:fs";
-import { homedir as homedir6, tmpdir } from "node:os";
-import { dirname as dirname2, join as join6 } from "node:path";
+import { closeSync as closeSync3, existsSync as existsSync5, mkdirSync as mkdirSync4, openSync as openSync3, readFileSync as readFileSync4, renameSync as renameSync4, rmSync as rmSync2, statSync as statSync2, unlinkSync as unlinkSync3, writeFileSync as writeFileSync2 } from "node:fs";
+import { homedir as homedir7, tmpdir } from "node:os";
+import { basename, dirname as dirname2, join as join6, resolve as resolve4 } from "node:path";
 
 // ../aft-bridge/dist/paths.js
-import { existsSync as existsSync2, mkdirSync as mkdirSync2, readFileSync as readFileSync2, renameSync as renameSync2, writeFileSync } from "node:fs";
-import { dirname, join as join4 } from "node:path";
+import { existsSync as existsSync3, mkdirSync as mkdirSync2, readFileSync as readFileSync3, renameSync as renameSync2, writeFileSync } from "node:fs";
+import { homedir as homedir5 } from "node:os";
+import { dirname, isAbsolute as isAbsolute2, join as join4, resolve as resolve3 } from "node:path";
+function homeDir() {
+  if (process.platform === "win32")
+    return process.env.USERPROFILE || process.env.HOME || homedir5();
+  return process.env.HOME || homedir5();
+}
+function configHome() {
+  const xdg = process.env.XDG_CONFIG_HOME;
+  if (xdg && isAbsolute2(xdg))
+    return xdg;
+  return join4(homeDir(), ".config");
+}
+function legacyOpenCodeConfigDir() {
+  const envDir = process.env.OPENCODE_CONFIG_DIR?.trim();
+  if (envDir)
+    return resolve3(envDir);
+  return join4(configHome(), "opencode");
+}
+function legacyPiAgentDir() {
+  return join4(homeDir(), ".pi", "agent");
+}
+function legacySources(basePath, label, harness) {
+  return [
+    { path: `${basePath}.jsonc`, label: `${label} aft.jsonc`, harness },
+    { path: `${basePath}.json`, label: `${label} aft.json`, harness }
+  ];
+}
+function resolveCortexKitUserConfigPath() {
+  return join4(configHome(), "cortexkit", "aft.jsonc");
+}
+function resolveCortexKitProjectConfigPath(projectDirectory) {
+  return join4(projectDirectory, ".cortexkit", "aft.jsonc");
+}
+function resolveCortexKitConfigPaths(projectDirectory) {
+  return {
+    userConfigPath: resolveCortexKitUserConfigPath(),
+    projectConfigPath: resolveCortexKitProjectConfigPath(projectDirectory)
+  };
+}
+function resolveLegacyAftConfigSources(projectDirectory) {
+  return {
+    user: [
+      ...legacySources(join4(legacyOpenCodeConfigDir(), "aft"), "OpenCode user", "opencode"),
+      ...legacySources(join4(legacyPiAgentDir(), "aft"), "Pi user", "pi")
+    ],
+    project: [
+      ...legacySources(join4(projectDirectory, ".opencode", "aft"), "OpenCode project", "opencode"),
+      ...legacySources(join4(projectDirectory, ".pi", "aft"), "Pi project", "pi")
+    ]
+  };
+}
 function resolveHarnessStoragePath(storageRoot, harness, ...segments) {
   return join4(storageRoot, harness, ...segments);
 }
 function repairRootScopedStorageFile(storageRoot, harness, fileName) {
   const harnessPath = resolveHarnessStoragePath(storageRoot, harness, fileName);
   const rootPath = join4(storageRoot, fileName);
-  if (existsSync2(harnessPath) || !existsSync2(rootPath))
+  if (existsSync3(harnessPath) || !existsSync3(rootPath))
     return harnessPath;
   try {
     mkdirSync2(dirname(harnessPath), { recursive: true });
@@ -13559,8 +13787,8 @@ function shouldShowAnnouncement(storageRoot, harness, currentVersion) {
   const versionFile = repairRootScopedStorageFile(storageRoot, harness, "last_announced_version");
   let lastVersion = "";
   try {
-    if (existsSync2(versionFile)) {
-      lastVersion = readFileSync2(versionFile, "utf-8").trim();
+    if (existsSync3(versionFile)) {
+      lastVersion = readFileSync3(versionFile, "utf-8").trim();
     }
   } catch {
     return false;
@@ -13588,9 +13816,9 @@ function markAnnouncementSeen(storageRoot, harness, currentVersion) {
 
 // ../aft-bridge/dist/resolver.js
 import { execSync } from "node:child_process";
-import { chmodSync as chmodSync2, closeSync as closeSync2, copyFileSync as copyFileSync2, existsSync as existsSync3, mkdirSync as mkdirSync3, openSync as openSync2, readSync, renameSync as renameSync3, unlinkSync as unlinkSync2 } from "node:fs";
+import { chmodSync as chmodSync2, closeSync as closeSync2, copyFileSync as copyFileSync2, existsSync as existsSync4, mkdirSync as mkdirSync3, openSync as openSync2, readSync, renameSync as renameSync3, unlinkSync as unlinkSync2 } from "node:fs";
 import { createRequire as createRequire2 } from "node:module";
-import { homedir as homedir5 } from "node:os";
+import { homedir as homedir6 } from "node:os";
 import { join as join5 } from "node:path";
 var ensureBinaryForResolver = ensureBinary;
 function copyToVersionedCache(npmBinaryPath, knownVersion) {
@@ -13603,7 +13831,7 @@ function copyToVersionedCache(npmBinaryPath, knownVersion) {
     const versionedDir = join5(cacheDir, tag);
     const ext = process.platform === "win32" ? ".exe" : "";
     const cachedPath = join5(versionedDir, `aft${ext}`);
-    if (existsSync3(cachedPath)) {
+    if (existsSync4(cachedPath)) {
       const cachedVersion = readBinaryVersion(cachedPath);
       if (cachedVersion === version)
         return cachedPath;
@@ -13615,7 +13843,7 @@ function copyToVersionedCache(npmBinaryPath, knownVersion) {
     if (process.platform !== "win32") {
       chmodSync2(tmpPath, 493);
     }
-    if (process.platform === "win32" && existsSync3(cachedPath)) {
+    if (process.platform === "win32" && existsSync4(cachedPath)) {
       try {
         unlinkSync2(cachedPath);
       } catch {}
@@ -13632,7 +13860,7 @@ function normalizeBareVersion(version) {
   return version.startsWith("v") ? version.slice(1) : version;
 }
 function homeDirFromEnv(env) {
-  return (process.platform === "win32" ? env.USERPROFILE || env.HOME : env.HOME) || homedir5();
+  return (process.platform === "win32" ? env.USERPROFILE || env.HOME : env.HOME) || homedir6();
 }
 function cacheDirFromEnv(env) {
   if (process.platform === "win32") {
@@ -13644,7 +13872,7 @@ function cacheDirFromEnv(env) {
 }
 function cachedBinaryPathFromEnv(version, env, ext) {
   const binaryPath = join5(cacheDirFromEnv(env), version, `aft${ext}`);
-  return existsSync3(binaryPath) ? binaryPath : null;
+  return existsSync4(binaryPath) ? binaryPath : null;
 }
 function isExpectedCachedBinary2(binaryPath, expectedVersion) {
   const expected = normalizeBareVersion(expectedVersion);
@@ -13733,7 +13961,7 @@ function findBinarySync(expectedVersion) {
     const packageBin = `@cortexkit/aft-${key}/bin/aft${ext}`;
     const req = createRequire2(import.meta.url);
     const resolved = req.resolve(packageBin);
-    if (existsSync3(resolved)) {
+    if (existsSync4(resolved)) {
       const npmVersion = readBinaryVersion(resolved);
       if (npmVersion === null) {
         warn(`npm platform package binary at ${resolved} did not report a version; skipping (continuing to PATH lookup)`);
@@ -13763,7 +13991,7 @@ function findBinarySync(expectedVersion) {
     }
   } catch {}
   const cargoPath = join5(homeDirFromEnv(env), ".cargo", "bin", `aft${ext}`);
-  if (existsSync3(cargoPath)) {
+  if (existsSync4(cargoPath)) {
     const usable = probeBinaryCandidate(cargoPath, "cargo", expectedVersion);
     if (usable)
       return usable;
@@ -13808,23 +14036,343 @@ function dataHome() {
   if (process.env.XDG_DATA_HOME)
     return process.env.XDG_DATA_HOME;
   if (process.platform === "win32") {
-    return process.env.LOCALAPPDATA || process.env.APPDATA || join6(homeDir(), "AppData", "Local");
+    return process.env.LOCALAPPDATA || process.env.APPDATA || join6(homeDir2(), "AppData", "Local");
   }
-  return join6(homeDir(), ".local", "share");
+  return join6(homeDir2(), ".local", "share");
 }
-function homeDir() {
+function homeDir2() {
   if (process.platform === "win32")
-    return process.env.USERPROFILE || process.env.HOME || homedir6();
-  return process.env.HOME || homedir6();
+    return process.env.USERPROFILE || process.env.HOME || homedir7();
+  return process.env.HOME || homedir7();
 }
 function resolveLegacyStorageRoot(harness) {
   if (harness === "pi")
-    return join6(homeDir(), ".pi", "agent", "aft");
+    return join6(homeDir2(), ".pi", "agent", "aft");
   return join6(dataHome(), "opencode", "storage", "plugin", "aft");
 }
 function resolveCortexKitStorageRoot() {
   return join6(dataHome(), "cortexkit", "aft");
 }
+function stripJsoncForParse(input) {
+  let out = "";
+  let inString = false;
+  let escaped = false;
+  for (let i = 0;i < input.length; i++) {
+    const ch = input[i];
+    const next = input[i + 1];
+    if (inString) {
+      out += ch;
+      if (escaped) {
+        escaped = false;
+      } else if (ch === "\\") {
+        escaped = true;
+      } else if (ch === '"') {
+        inString = false;
+      }
+      continue;
+    }
+    if (ch === '"') {
+      inString = true;
+      out += ch;
+      continue;
+    }
+    if (ch === "/" && next === "/") {
+      while (i < input.length && input[i] !== `
+`)
+        i++;
+      out += `
+`;
+      continue;
+    }
+    if (ch === "/" && next === "*") {
+      i += 2;
+      while (i < input.length && !(input[i] === "*" && input[i + 1] === "/"))
+        i++;
+      i++;
+      out += " ";
+      continue;
+    }
+    out += ch;
+  }
+  let withoutTrailingCommas = "";
+  inString = false;
+  escaped = false;
+  for (let i = 0;i < out.length; i++) {
+    const ch = out[i];
+    if (inString) {
+      withoutTrailingCommas += ch;
+      if (escaped) {
+        escaped = false;
+      } else if (ch === "\\") {
+        escaped = true;
+      } else if (ch === '"') {
+        inString = false;
+      }
+      continue;
+    }
+    if (ch === '"') {
+      inString = true;
+      withoutTrailingCommas += ch;
+      continue;
+    }
+    if (ch === ",") {
+      let j = i + 1;
+      while (j < out.length && /\s/.test(out[j]))
+        j++;
+      if (out[j] === "}" || out[j] === "]")
+        continue;
+    }
+    withoutTrailingCommas += ch;
+  }
+  return withoutTrailingCommas;
+}
+function sortJson(value) {
+  if (Array.isArray(value))
+    return value.map(sortJson);
+  if (value && typeof value === "object") {
+    const sorted = {};
+    for (const key of Object.keys(value).sort()) {
+      sorted[key] = sortJson(value[key]);
+    }
+    return sorted;
+  }
+  return value;
+}
+function normalizedJsoncSemantics(content) {
+  return JSON.stringify(sortJson(JSON.parse(stripJsoncForParse(content))));
+}
+function fileSemanticsMatch(a, b) {
+  try {
+    return normalizedJsoncSemantics(a) === normalizedJsoncSemantics(b);
+  } catch {
+    return a === b;
+  }
+}
+function sleepSync(ms) {
+  Atomics.wait(new Int32Array(new SharedArrayBuffer(4)), 0, 0, ms);
+}
+function acquireConfigMigrationLock(lockDir) {
+  const deadline = Date.now() + 30000;
+  while (true) {
+    try {
+      mkdirSync4(lockDir, { recursive: false });
+      return () => {
+        try {
+          rmSync2(lockDir, { recursive: true, force: true });
+        } catch {}
+      };
+    } catch (err) {
+      const code = err?.code;
+      if (code !== "EEXIST")
+        throw err;
+      try {
+        const ageMs = Date.now() - statSync2(lockDir).mtimeMs;
+        if (ageMs > 60000) {
+          rmSync2(lockDir, { recursive: true, force: true });
+          continue;
+        }
+      } catch {}
+      if (Date.now() >= deadline) {
+        throw new Error(`timed out waiting for config migration lock ${lockDir}`);
+      }
+      sleepSync(25);
+    }
+  }
+}
+function atomicCopyConfigFile(sourcePath, targetPath) {
+  mkdirSync4(dirname2(targetPath), { recursive: true });
+  const tmpPath = join6(dirname2(targetPath), `.${basename(targetPath)}.${process.pid}.${Date.now()}.${Math.random().toString(16).slice(2)}.tmp`);
+  let fd = null;
+  try {
+    fd = openSync3(tmpPath, "wx", 384);
+    writeFileSync2(fd, readFileSync4(sourcePath));
+    closeSync3(fd);
+    fd = null;
+    renameSync4(tmpPath, targetPath);
+  } catch (err) {
+    if (fd !== null) {
+      try {
+        closeSync3(fd);
+      } catch {}
+    }
+    try {
+      unlinkSync3(tmpPath);
+    } catch {}
+    throw err;
+  }
+}
+function atomicWriteConfigFile(targetPath, content) {
+  mkdirSync4(dirname2(targetPath), { recursive: true });
+  const tmpPath = join6(dirname2(targetPath), `.${basename(targetPath)}.${process.pid}.${Date.now()}.${Math.random().toString(16).slice(2)}.tmp`);
+  let fd = null;
+  try {
+    fd = openSync3(tmpPath, "wx", 384);
+    writeFileSync2(fd, content);
+    closeSync3(fd);
+    fd = null;
+    renameSync4(tmpPath, targetPath);
+  } catch (err) {
+    if (fd !== null) {
+      try {
+        closeSync3(fd);
+      } catch {}
+    }
+    try {
+      unlinkSync3(tmpPath);
+    } catch {}
+    throw err;
+  }
+}
+var MOVED_MARKER_SUFFIX = ".MOVED_READPLEASE";
+function nonClobberingSidecarPath(desiredPath) {
+  if (!existsSync5(desiredPath))
+    return desiredPath;
+  for (let index = 1;index < Number.MAX_SAFE_INTEGER; index++) {
+    const candidate = `${desiredPath}.${index}`;
+    if (!existsSync5(candidate))
+      return candidate;
+  }
+  throw new Error(`could not find available preservation sidecar path for ${desiredPath}`);
+}
+function movedMarkerContent(targetPath, originalName, originalContent) {
+  const header = [
+    "// AFT configuration moved.",
+    "//",
+    "// AFT now reads its configuration from one shared CortexKit location",
+    "// instead of a per-agent path. The settings that were in this file have",
+    "// been moved to:",
+    "//",
+    `//     ${targetPath}`,
+    "//",
+    "// Edit that file to change AFT settings. This location is no longer read",
+    "// by AFT.",
+    "//",
+    `// To undo, rename this file back to "${originalName}" (and remove the`,
+    "// CortexKit copy above if you want this location to take precedence).",
+    "//",
+    "// Your original settings are preserved below for reference.",
+    "",
+    ""
+  ].join(`
+`);
+  return `${header}${originalContent}`;
+}
+function markLegacySourcesMovedAside(sources, targetPath, logger) {
+  const warnings = [];
+  const info = logger?.info ?? logger?.log;
+  for (const source of sources) {
+    const desiredMarkerPath = `${source.path}${MOVED_MARKER_SUFFIX}`;
+    const markerPath = nonClobberingSidecarPath(desiredMarkerPath);
+    try {
+      const original = readFileSync4(source.path, "utf-8");
+      if (markerPath !== desiredMarkerPath) {
+        logger?.warn?.(`Preserving existing legacy AFT marker ${desiredMarkerPath}; writing new marker to ${markerPath}`);
+      }
+      atomicWriteConfigFile(markerPath, movedMarkerContent(targetPath, basename(source.path), original));
+      unlinkSync3(source.path);
+      info?.(`Moved legacy AFT config ${source.path} aside to ${markerPath}; AFT now reads ${targetPath}`);
+    } catch (err) {
+      const msg = err instanceof Error ? err.message : String(err);
+      warnings.push(`AFT could not move legacy config ${source.path} aside (${msg}); it is now stale and ignored. Delete it manually — AFT reads ${targetPath}.`);
+      logger?.warn?.(`Could not move legacy AFT config ${source.path} aside (${msg}); AFT reads ${targetPath}`);
+    }
+  }
+  return warnings;
+}
+var PRESERVED_OLD_SUFFIX = "_OLD";
+function preservedOldContent(losingHarness, winningHarness, targetPath, originalContent) {
+  const winnerLine = winningHarness ? `// configs differed, so ${winningHarness}'s config won (first harness to run the` : "// configs differed, so the config that was migrated first won and is the";
+  const header = [
+    `// AFT config from ${losingHarness} — preserved, NOT read.`,
+    "//",
+    "// AFT now reads one shared config for all harnesses. Your OpenCode and Pi",
+    winnerLine,
+    winningHarness ? "// migration) and is now the active config at:" : "// active config at:",
+    "//",
+    `//     ${targetPath}`,
+    "//",
+    `// This file holds ${losingHarness}'s previous settings. Merge anything you`,
+    "// want to keep into the active config above, then delete this file. AFT does",
+    "// not read this path.",
+    "",
+    ""
+  ].join(`
+`);
+  return `${header}${originalContent}`;
+}
+function preserveDifferingSourceAsOld(source, winningHarness, targetPath, logger) {
+  const losingHarness = source.harness ?? "pi";
+  const desiredOldPath = `${targetPath}.${losingHarness}${PRESERVED_OLD_SUFFIX}`;
+  const oldPath = nonClobberingSidecarPath(desiredOldPath);
+  try {
+    if (oldPath !== desiredOldPath) {
+      logger?.warn?.(`Preserving existing ${losingHarness} config sidecar ${desiredOldPath}; writing new preserved config to ${oldPath}`);
+    }
+    atomicWriteConfigFile(oldPath, preservedOldContent(losingHarness, winningHarness, targetPath, source.content));
+  } catch (err) {
+    const msg = err instanceof Error ? err.message : String(err);
+    logger?.warn?.(`Could not preserve ${losingHarness} config as ${oldPath} (${msg})`);
+  }
+  const usingDesc = winningHarness ? `${winningHarness}'s config` : "the existing shared config";
+  return `AFT found different OpenCode and Pi configs during config unification. ` + `Using ${usingDesc} at ${targetPath}; preserved ${losingHarness}'s previous ` + `config at ${oldPath} — merge any settings you want to keep, then delete it.`;
+}
+function visibleConfigMigrationWarning(scope, targetPath, paths, reason) {
+  const uniquePaths = [...new Set([targetPath, ...paths])];
+  return `AFT ${scope} config migration refused: ${reason}. ` + `Legacy and CortexKit config paths collapse to one file, but AFT will not overwrite or merge them automatically. ` + `Please consolidate manually into ${targetPath}. Paths: ${uniquePaths.join(" ; ")}`;
+}
+function migrateAftConfigFile(opts) {
+  const warnings = [];
+  const resolvedTarget = resolve4(opts.targetPath);
+  const existingSources = opts.legacySources.filter((source) => existsSync5(source.path) && resolve4(source.path) !== resolvedTarget);
+  const info = opts.logger?.info ?? opts.logger?.log;
+  if (existingSources.length === 0) {
+    return { migrated: false, conflict: false, targetPath: opts.targetPath, warnings };
+  }
+  mkdirSync4(dirname2(opts.targetPath), { recursive: true });
+  const release = acquireConfigMigrationLock(`${opts.targetPath}.lock`);
+  try {
+    const sources = existingSources.map((source) => ({
+      ...source,
+      content: readFileSync4(source.path, "utf-8")
+    }));
+    if (existsSync5(opts.targetPath)) {
+      const targetContent = readFileSync4(opts.targetPath, "utf-8");
+      for (const source of sources) {
+        if (fileSemanticsMatch(source.content, targetContent))
+          continue;
+        warnings.push(preserveDifferingSourceAsOld(source, undefined, opts.targetPath, opts.logger));
+      }
+      info?.(`AFT ${opts.scope} config already present at ${opts.targetPath}; reconciled ${sources.length} legacy source(s)`);
+      warnings.push(...markLegacySourcesMovedAside(sources, opts.targetPath, opts.logger));
+      return { migrated: false, conflict: false, targetPath: opts.targetPath, warnings };
+    }
+    const winner = (opts.operatingHarness ? sources.find((source) => source.harness === opts.operatingHarness) : undefined) ?? sources[0];
+    atomicCopyConfigFile(winner.path, opts.targetPath);
+    info?.(`Migrated AFT ${opts.scope} config from ${winner.path} to ${opts.targetPath}`);
+    for (const source of sources) {
+      if (source.path === winner.path)
+        continue;
+      if (fileSemanticsMatch(source.content, winner.content))
+        continue;
+      warnings.push(preserveDifferingSourceAsOld(source, winner.harness, opts.targetPath, opts.logger));
+    }
+    warnings.push(...markLegacySourcesMovedAside(sources, opts.targetPath, opts.logger));
+    return {
+      migrated: true,
+      conflict: false,
+      sourcePath: winner.path,
+      targetPath: opts.targetPath,
+      warnings
+    };
+  } catch (err) {
+    const message = visibleConfigMigrationWarning(opts.scope, opts.targetPath, existingSources.map((source) => source.path), `migration failed (${err instanceof Error ? err.message : String(err)})`);
+    warnings.push(message);
+    opts.logger?.warn?.(message);
+    return { migrated: false, conflict: true, targetPath: opts.targetPath, warnings };
+  } finally {
+    release();
+  }
+}
 function tail(value) {
   if (!value)
     return "";
@@ -13852,11 +14400,11 @@ async function ensureStorageMigrated(opts) {
   const newRoot = resolveCortexKitStorageRoot();
   const targetMarker = resolveHarnessStoragePath(newRoot, opts.harness, TARGET_MARKER);
   const info = opts.logger?.info ?? opts.logger?.log;
-  if (existsSync4(targetMarker)) {
+  if (existsSync5(targetMarker)) {
     info?.(`AFT storage already migrated for ${opts.harness}; using ${newRoot}`);
     return;
   }
-  if (!existsSync4(legacyRoot)) {
+  if (!existsSync5(legacyRoot)) {
     info?.(`AFT storage migration skipped for ${opts.harness}: no legacy data at ${legacyRoot}; ` + `using ${newRoot} for fresh install`);
     return;
   }
@@ -13904,14 +14452,14 @@ async function ensureStorageMigrated(opts) {
   throw new Error(`AFT storage migration failed (${detail}). ` + `Harness: ${opts.harness}. Legacy: ${legacyRoot}. Target: ${newRoot}. ` + `See log: ${logPath}. ` + `Plugin load aborted to prevent legacy/new state divergence.` + (stderrTail ? ` Stderr tail: ${stderrTail}` : "") + (stdoutTail ? ` Stdout tail: ${stdoutTail}` : ""));
 }
 // ../aft-bridge/dist/npm-resolver.js
-import { readdirSync, statSync as statSync2 } from "node:fs";
-import { homedir as homedir7 } from "node:os";
-import { delimiter, dirname as dirname3, isAbsolute as isAbsolute2, join as join7 } from "node:path";
+import { readdirSync, statSync as statSync3 } from "node:fs";
+import { homedir as homedir8 } from "node:os";
+import { delimiter, dirname as dirname3, isAbsolute as isAbsolute3, join as join7 } from "node:path";
 function defaultDeps() {
   return {
     platform: process.platform,
     env: process.env,
-    home: homedir7(),
+    home: homedir8(),
     execPath: process.execPath
   };
 }
@@ -13920,7 +14468,7 @@ function npmBinaryName(platform) {
 }
 function isFile(p) {
   try {
-    return statSync2(p).isFile();
+    return statSync3(p).isFile();
   } catch {
     return false;
   }
@@ -13930,7 +14478,7 @@ function npmFromPath(deps) {
   const raw = deps.env.PATH ?? deps.env.Path ?? "";
   for (const entry of raw.split(delimiter)) {
     const dir = entry.trim().replace(/^"|"$/g, "");
-    if (!dir || !isAbsolute2(dir))
+    if (!dir || !isAbsolute3(dir))
       continue;
     if (isFile(join7(dir, name)))
       return dir;
@@ -14020,8 +14568,8 @@ function npmSpawnEnv(resolved, baseEnv = process.env) {
 // ../aft-bridge/dist/onnx-runtime.js
 import { execFileSync } from "node:child_process";
 import { createHash as createHash2 } from "node:crypto";
-import { chmodSync as chmodSync3, closeSync as closeSync3, copyFileSync as copyFileSync3, createWriteStream as createWriteStream2, existsSync as existsSync5, lstatSync, mkdirSync as mkdirSync5, openSync as openSync3, readdirSync as readdirSync2, readFileSync as readFileSync3, readlinkSync, realpathSync, rmSync as rmSync2, statSync as statSync3, symlinkSync, unlinkSync as unlinkSync3, writeFileSync as writeFileSync2 } from "node:fs";
-import { basename, dirname as dirname4, isAbsolute as isAbsolute3, join as join8, relative as relative2, resolve as resolve2, win32 } from "node:path";
+import { chmodSync as chmodSync3, closeSync as closeSync4, copyFileSync as copyFileSync3, createWriteStream as createWriteStream2, existsSync as existsSync6, lstatSync, mkdirSync as mkdirSync5, openSync as openSync4, readdirSync as readdirSync2, readFileSync as readFileSync5, readlinkSync, realpathSync, rmSync as rmSync3, statSync as statSync4, symlinkSync, unlinkSync as unlinkSync4, writeFileSync as writeFileSync3 } from "node:fs";
+import { basename as basename2, dirname as dirname4, isAbsolute as isAbsolute4, join as join8, relative as relative2, resolve as resolve5, win32 } from "node:path";
 import { Readable as Readable2 } from "node:stream";
 import { pipeline as pipeline2 } from "node:stream/promises";
 var ORT_VERSION = "1.24.4";
@@ -14088,7 +14636,7 @@ async function ensureOnnxRuntime(storageDir) {
   const libName = info?.libName ?? "libonnxruntime.dylib";
   const resolvedOrtDir = resolveCachedOnnxRuntimeDir(ortVersionDir, libName);
   const libPath = join8(resolvedOrtDir, libName);
-  if (existsSync5(libPath)) {
+  if (existsSync6(libPath)) {
     const meta = readOnnxInstalledMeta(ortVersionDir);
     if (meta?.sha256) {
       try {
@@ -14150,7 +14698,7 @@ function cleanupAbandonedStagingDirs(onnxBaseDir) {
             abandoned = true;
           } else {
             try {
-              const ageMs = Date.now() - statSync3(stagingDir).mtimeMs;
+              const ageMs = Date.now() - statSync4(stagingDir).mtimeMs;
               abandoned = ageMs > STALE_LOCK_MS;
             } catch {
               abandoned = true;
@@ -14165,7 +14713,7 @@ function cleanupAbandonedStagingDirs(onnxBaseDir) {
       if (abandoned) {
         log(`[onnx] removing abandoned staging dir ${stagingDir}`);
         try {
-          rmSync2(stagingDir, { recursive: true, force: true });
+          rmSync3(stagingDir, { recursive: true, force: true });
         } catch (err) {
           warn(`[onnx] failed to remove ${stagingDir}: ${err}`);
         }
@@ -14175,9 +14723,9 @@ function cleanupAbandonedStagingDirs(onnxBaseDir) {
 }
 function cleanupIncompleteTargetIfUnowned(ortDir) {
   try {
-    if (existsSync5(ortDir) && !existsSync5(join8(ortDir, ONNX_INSTALLED_META_FILE))) {
+    if (existsSync6(ortDir) && !existsSync6(join8(ortDir, ONNX_INSTALLED_META_FILE))) {
       log(`[onnx] removing half-populated install dir ${ortDir} (no meta file)`);
-      rmSync2(ortDir, { recursive: true, force: true });
+      rmSync3(ortDir, { recursive: true, force: true });
     }
   } catch (err) {
     warn(`[onnx] failed to sweep ${ortDir}: ${err}`);
@@ -14187,7 +14735,7 @@ var REQUIRED_ORT_MAJOR = 1;
 var REQUIRED_ORT_MIN_MINOR = 20;
 var INVALID_ORT_VERSION = "<invalid>";
 function parseOnnxVersionFromPath(value) {
-  const name = basename(value);
+  const name = basename2(value);
   const semverish = name.match(/(?:^|[._-])(\d+\.\d+\.\d+(?:[-+][A-Za-z0-9.-]+)?)(?:\.(?:dylib|dll))?$/);
   if (semverish)
     return semverish[1].split(/[-+]/, 1)[0];
@@ -14204,7 +14752,7 @@ function parseOnnxVersionFromDirectoryPath(value) {
 }
 function isPathInsideRoot(root, candidate) {
   const rel = relative2(root, candidate);
-  return rel === "" || !rel.startsWith("../") && !rel.startsWith("..\\") && rel !== ".." && !isAbsolute3(rel) && !win32.isAbsolute(rel);
+  return rel === "" || !rel.startsWith("../") && !rel.startsWith("..\\") && rel !== ".." && !isAbsolute4(rel) && !win32.isAbsolute(rel);
 }
 function detectOnnxVersion(libDir, libName) {
   try {
@@ -14220,7 +14768,7 @@ function detectOnnxVersion(libDir, libName) {
         return version;
     }
     const base = join8(libDir, libName);
-    if (existsSync5(base)) {
+    if (existsSync6(base)) {
       try {
         const real = realpathSync(base);
         const version = parseOnnxVersionFromPath(real) ?? parseOnnxVersionFromDirectoryPath(real);
@@ -14255,7 +14803,7 @@ function pathEntriesForPlatform() {
   return pathEnvValue().split(delimiter2).map((entry) => entry.trim().replace(/^"|"$/g, "")).filter((entry) => {
     if (!entry || entry === "." || entry.includes("\x00"))
       return false;
-    return isAbsolute3(entry) || win32.isAbsolute(entry);
+    return isAbsolute4(entry) || win32.isAbsolute(entry);
   });
 }
 function directoryContainsLibrary(dir, libName) {
@@ -14271,10 +14819,10 @@ function directoryContainsLibrary(dir, libName) {
   }
 }
 function resolveCachedOnnxRuntimeDir(ortVersionDir, libName) {
-  if (existsSync5(join8(ortVersionDir, libName)))
+  if (existsSync6(join8(ortVersionDir, libName)))
     return ortVersionDir;
   const libSubdir = join8(ortVersionDir, "lib");
-  if (existsSync5(join8(libSubdir, libName)))
+  if (existsSync6(join8(libSubdir, libName)))
     return libSubdir;
   return ortVersionDir;
 }
@@ -14295,7 +14843,7 @@ function findSystemOnnxRuntime(libName) {
       if (!userProfile)
         return nugetPaths;
       const nugetPackageDir = join8(userProfile, ".nuget", "packages", "microsoft.ml.onnxruntime");
-      if (!existsSync5(nugetPackageDir))
+      if (!existsSync6(nugetPackageDir))
         return nugetPaths;
       try {
         for (const entry of readdirSync2(nugetPackageDir, { withFileTypes: true })) {
@@ -14315,7 +14863,7 @@ function findSystemOnnxRuntime(libName) {
   const normalizeCase = process.platform === "win32" || process.platform === "darwin";
   const seen = new Set;
   const uniquePaths = searchPaths.filter((p) => {
-    let key = resolve2(p).replace(/[/\\]+$/, "");
+    let key = resolve5(p).replace(/[/\\]+$/, "");
     if (normalizeCase)
       key = key.toLowerCase();
     if (seen.has(key))
@@ -14329,7 +14877,7 @@ function findSystemOnnxRuntime(libName) {
     if (process.platform === "win32") {
       if (!directoryContainsLibrary(dir, libName))
         continue;
-    } else if (!existsSync5(libPath)) {
+    } else if (!existsSync6(libPath)) {
       continue;
     }
     const version = detectOnnxVersion(dir, libName);
@@ -14378,7 +14926,7 @@ async function downloadFileWithCap(url, destPath) {
     await pipeline2(nodeStream, createWriteStream2(destPath), { signal: controller.signal });
   } catch (err) {
     try {
-      unlinkSync3(destPath);
+      unlinkSync4(destPath);
     } catch {}
     throw err;
   } finally {
@@ -14395,15 +14943,15 @@ function validateExtractedTree(stagingRoot) {
       const lst = lstatSync(fullPath);
       if (lst.isSymbolicLink()) {
         const linkTarget = readlinkSync(fullPath);
-        const resolvedTarget = resolve2(dirname4(fullPath), linkTarget);
+        const resolvedTarget = resolve5(dirname4(fullPath), linkTarget);
         const rel2 = relative2(realRoot, resolvedTarget);
-        if (rel2.startsWith("..") || isAbsolute3(rel2) || win32.isAbsolute(rel2)) {
+        if (rel2.startsWith("..") || isAbsolute4(rel2) || win32.isAbsolute(rel2)) {
           throw new Error(`extracted symlink ${fullPath} points outside staging root: ${linkTarget}`);
         }
         continue;
       }
       const rel = relative2(realRoot, fullPath);
-      if (rel.startsWith("..") || isAbsolute3(rel) || win32.isAbsolute(rel)) {
+      if (rel.startsWith("..") || isAbsolute4(rel) || win32.isAbsolute(rel)) {
         throw new Error(`extracted entry ${fullPath} escapes staging root`);
       }
       if (lst.isDirectory()) {
@@ -14439,11 +14987,11 @@ async function downloadOnnxRuntime(info, targetDir) {
       await extractZipArchive(archivePath, tmpDir);
     }
     try {
-      unlinkSync3(archivePath);
+      unlinkSync4(archivePath);
     } catch {}
     validateExtractedTree(tmpDir);
     const extractedDir = join8(tmpDir, info.assetName, "lib");
-    if (!existsSync5(extractedDir)) {
+    if (!existsSync6(extractedDir)) {
       throw new Error(`Expected directory not found: ${extractedDir}`);
     }
     mkdirSync5(targetDir, { recursive: true });
@@ -14474,16 +15022,16 @@ async function downloadOnnxRuntime(info, targetDir) {
       warn(`Could not hash newly-installed ONNX library at ${libPath}: ${err}`);
     }
     writeOnnxInstalledMeta(targetDir, ORT_VERSION, libHash, archiveSha256);
-    rmSync2(tmpDir, { recursive: true, force: true });
+    rmSync3(tmpDir, { recursive: true, force: true });
     log(`ONNX Runtime v${ORT_VERSION} installed to ${targetDir}`);
     return targetDir;
   } catch (err) {
     error(`Failed to download ONNX Runtime: ${err}`);
     try {
-      rmSync2(tmpDir, { recursive: true, force: true });
+      rmSync3(tmpDir, { recursive: true, force: true });
     } catch {}
     try {
-      rmSync2(targetDir, { recursive: true, force: true });
+      rmSync3(targetDir, { recursive: true, force: true });
     } catch {}
     return null;
   }
@@ -14500,7 +15048,7 @@ function copyOnnxLibraries(info, extractedDir, targetDir, realFiles, symlinks, c
       }
     } catch (copyErr) {
       if (requiredLibs.has(libFile)) {
-        rmSync2(targetDir, { recursive: true, force: true });
+        rmSync3(targetDir, { recursive: true, force: true });
         throw copyErr;
       }
       log(`ORT extract: failed to copy optional ${libFile}: ${copyErr}`);
@@ -14510,14 +15058,14 @@ function copyOnnxLibraries(info, extractedDir, targetDir, realFiles, symlinks, c
   for (const link of symlinks) {
     const dst = join8(targetDir, link.name);
     try {
-      unlinkSync3(dst);
+      unlinkSync4(dst);
     } catch {}
     const dstForContainment = join8(targetRoot, link.name);
-    const resolvedTarget = resolve2(dirname4(dstForContainment), link.target);
+    const resolvedTarget = resolve5(dirname4(dstForContainment), link.target);
     if (!isPathInsideRoot(targetRoot, resolvedTarget)) {
       const message = `ONNX Runtime symlink ${link.name} points outside install dir: ${link.target}`;
       if (requiredLibs.has(link.name)) {
-        rmSync2(targetDir, { recursive: true, force: true });
+        rmSync3(targetDir, { recursive: true, force: true });
         throw new Error(message);
       }
       log(`ORT extract: skipping optional symlink ${link.name}: ${message}`);
@@ -14527,15 +15075,15 @@ function copyOnnxLibraries(info, extractedDir, targetDir, realFiles, symlinks, c
       symlinkSync(link.target, dst);
     } catch (symlinkErr) {
       if (requiredLibs.has(link.name)) {
-        rmSync2(targetDir, { recursive: true, force: true });
+        rmSync3(targetDir, { recursive: true, force: true });
         throw symlinkErr;
       }
       log(`ORT extract: failed to symlink optional ${link.name}: ${symlinkErr}`);
     }
   }
   const requiredPath = join8(targetDir, info.libName);
-  if (!existsSync5(requiredPath)) {
-    rmSync2(targetDir, { recursive: true, force: true });
+  if (!existsSync6(requiredPath)) {
+    rmSync3(targetDir, { recursive: true, force: true });
     throw new Error(`Required ONNX Runtime library missing after install: ${requiredPath}`);
   }
 }
@@ -14560,7 +15108,7 @@ function writeOnnxInstalledMeta(installDir, version, sha256, archiveSha256) {
       ...sha256 ? { sha256 } : {},
       archiveSha256
     };
-    writeFileSync2(join8(installDir, ONNX_INSTALLED_META_FILE), JSON.stringify(meta), "utf8");
+    writeFileSync3(join8(installDir, ONNX_INSTALLED_META_FILE), JSON.stringify(meta), "utf8");
   } catch (err) {
     log(`[onnx] failed to write installed-meta in ${installDir}: ${err}`);
   }
@@ -14568,9 +15116,9 @@ function writeOnnxInstalledMeta(installDir, version, sha256, archiveSha256) {
 function readOnnxInstalledMeta(installDir) {
   const path2 = join8(installDir, ONNX_INSTALLED_META_FILE);
   try {
-    if (!statSync3(path2).isFile())
+    if (!statSync4(path2).isFile())
       return null;
-    const raw = readFileSync3(path2, "utf8");
+    const raw = readFileSync5(path2, "utf8");
     const parsed = JSON.parse(raw);
     if (typeof parsed.version !== "string" || parsed.version.length === 0)
       return null;
@@ -14586,19 +15134,19 @@ function readOnnxInstalledMeta(installDir) {
 }
 function sha256File(path2) {
   const hash = createHash2("sha256");
-  hash.update(readFileSync3(path2));
+  hash.update(readFileSync5(path2));
   return hash.digest("hex");
 }
 function acquireLock(lockPath) {
   const tryClaim = () => {
     try {
-      const fd = openSync3(lockPath, "wx");
+      const fd = openSync4(lockPath, "wx");
       try {
-        writeFileSync2(fd, `${process.pid}
+        writeFileSync3(fd, `${process.pid}
 ${new Date().toISOString()}
 `);
       } finally {
-        closeSync3(fd);
+        closeSync4(fd);
       }
       return true;
     } catch (err) {
@@ -14614,12 +15162,12 @@ ${new Date().toISOString()}
   let owningPid = null;
   let lockMtimeMs = 0;
   try {
-    const raw = readFileSync3(lockPath, "utf8");
+    const raw = readFileSync5(lockPath, "utf8");
     const firstLine = raw.split(/\r?\n/, 1)[0]?.trim() ?? "";
     const parsed = Number.parseInt(firstLine, 10);
     if (Number.isFinite(parsed) && parsed > 0)
       owningPid = parsed;
-    lockMtimeMs = statSync3(lockPath).mtimeMs;
+    lockMtimeMs = statSync4(lockPath).mtimeMs;
   } catch {
     return tryClaim();
   }
@@ -14629,637 +15177,123 @@ ${new Date().toISOString()}
   if (ownerAlive && ageWithinFresh) {
     return false;
   }
-  log(`[onnx] reclaiming install lock (owner_pid=${owningPid ?? "unknown"}, alive=${ownerAlive}, age_ms=${age})`);
-  try {
-    unlinkSync3(lockPath);
-  } catch {}
-  return tryClaim();
-}
-function releaseLock(lockPath) {
-  try {
-    let owningPid = null;
-    try {
-      const raw = readFileSync3(lockPath, "utf8");
-      const firstLine = raw.split(/\r?\n/, 1)[0]?.trim() ?? "";
-      const parsed = Number.parseInt(firstLine, 10);
-      if (Number.isFinite(parsed) && parsed > 0)
-        owningPid = parsed;
-    } catch (readErr) {
-      const code = readErr.code;
-      if (code === "ENOENT")
-        return;
-      warn(`[onnx] could not read lock ${lockPath} during release: ${readErr}`);
-      return;
-    }
-    if (owningPid !== process.pid) {
-      log(`[onnx] not releasing lock ${lockPath}: owned by pid ${owningPid ?? "unknown"} (we are ${process.pid})`);
-      return;
-    }
-    try {
-      unlinkSync3(lockPath);
-    } catch (unlinkErr) {
-      const code = unlinkErr.code;
-      if (code !== "ENOENT") {
-        warn(`[onnx] failed to release lock ${lockPath}: ${unlinkErr}`);
-      }
-    }
-  } catch (err) {
-    warn(`[onnx] unexpected error releasing lock ${lockPath}: ${err}`);
-  }
-}
-function tasklistPidFromCsvLine(line) {
-  const quoted = line.match(/"([^"]*)"/g);
-  if (quoted && quoted.length >= 2)
-    return quoted[1].slice(1, -1);
-  const cells = line.split(",").map((cell) => cell.trim().replace(/^"|"$/g, ""));
-  return cells[1] ?? null;
-}
-function isWindowsProcessAlive(pid) {
-  if (!Number.isInteger(pid) || pid <= 0)
-    return false;
-  try {
-    const output = execFileSync("tasklist.exe", ["/FI", `PID eq ${pid}`, "/FO", "CSV", "/NH"], {
-      encoding: "utf8",
-      timeout: 2000,
-      windowsHide: true
-    });
-    const expected = String(pid);
-    return output.split(/\r?\n/).some((line) => tasklistPidFromCsvLine(line) === expected);
-  } catch {
-    return false;
-  }
-}
-function isProcessAlive(pid) {
-  if (process.platform === "win32")
-    return isWindowsProcessAlive(pid);
-  try {
-    process.kill(pid, 0);
-    return true;
-  } catch (err) {
-    const code = err.code;
-    if (code === "ESRCH")
-      return false;
-    return true;
-  }
-}
-// ../aft-bridge/dist/pipe-strip.js
-var NOISE_FILTERS = new Set([
-  "grep",
-  "rg",
-  "head",
-  "tail",
-  "cat",
-  "less",
-  "more",
-  "sed",
-  "awk",
-  "cut",
-  "sort",
-  "uniq",
-  "tr",
-  "column",
-  "fold"
-]);
-var GREP_GUARD_FLAGS = new Set([
-  "c",
-  "count",
-  "q",
-  "quiet",
-  "o",
-  "only-matching",
-  "l",
-  "files-with-matches"
-]);
-function maybeStripCompressorPipe(command, compressionEnabled) {
-  if (!compressionEnabled)
-    return { command, stripped: false };
-  const chain = splitTopLevelCommandChain(command);
-  if (chain === null)
-    return { command, stripped: false };
-  let stripped = false;
-  const droppedFilterChains = [];
-  const rebuilt = chain.map(({ segment, separator }) => {
-    const result = stripSinglePipelineSegment(segment);
-    if (result.stripped) {
-      stripped = true;
-      droppedFilterChains.push(result.filters);
-    }
-    return `${result.segment}${separator}`;
-  }).join("");
-  if (!stripped)
-    return { command, stripped: false };
-  return {
-    command: rebuilt,
-    stripped: true,
-    note: formatStripNote(droppedFilterChains)
-  };
-}
-function stripSinglePipelineSegment(segment) {
-  const leading = /^\s*/.exec(segment)?.[0] ?? "";
-  const trailing = /\s*$/.exec(segment)?.[0] ?? "";
-  const coreStart = leading.length;
-  const coreEnd = segment.length - trailing.length;
-  if (coreEnd <= coreStart)
-    return { segment, stripped: false };
-  const core = segment.slice(coreStart, coreEnd);
-  if (containsUnsplittableConstruct(core))
-    return { segment, stripped: false };
-  if (hasUnquotedBackground(core))
-    return { segment, stripped: false };
-  const stages = splitTopLevelPipeline(core);
-  if (stages.length < 2)
-    return { segment, stripped: false };
-  const firstStage = stages[0]?.trim() ?? "";
-  if (!isCompressorHandledRunner(firstStage))
-    return { segment, stripped: false };
-  const filterStages = stages.slice(1).map((stage) => stage.trim());
-  for (const stage of filterStages) {
-    if (!filterStageIsSafeToDrop(stage))
-      return { segment, stripped: false };
-  }
-  return {
-    segment: `${leading}${firstStage}${trailing}`,
-    stripped: true,
-    filters: filterStages.join(" | ")
-  };
-}
-function formatStripNote(droppedFilterChains) {
-  const filters = droppedFilterChains.map((filter) => `\`| ${filter}\``).join(", ");
-  return `[AFT dropped ${filters} (compressed:false to keep)]`;
-}
-function splitTopLevelCommandChain(command) {
-  const segments = [];
-  let start = 0;
-  let quote = null;
-  let escaped = false;
-  let inBacktick = false;
-  let parenDepth = 0;
-  for (let index = 0;index < command.length; index++) {
-    const char = command[index];
-    const next = command[index + 1];
-    if (escaped) {
-      escaped = false;
-      continue;
-    }
-    if (inBacktick) {
-      if (char === "\\")
-        escaped = true;
-      else if (char === "`")
-        inBacktick = false;
-      continue;
-    }
-    if (char === "\\" && quote !== "'") {
-      escaped = true;
-      continue;
-    }
-    if (quote) {
-      if (char === quote)
-        quote = null;
-      continue;
-    }
-    if (char === "'" || char === '"') {
-      quote = char;
-      continue;
-    }
-    if (char === "`") {
-      inBacktick = true;
-      continue;
-    }
-    if (char === "(") {
-      parenDepth++;
-      continue;
-    }
-    if (char === ")") {
-      if (parenDepth === 0)
-        return null;
-      parenDepth--;
-      continue;
-    }
-    if (parenDepth > 0)
-      continue;
-    if (char === `
-` || char === "\r")
-      return null;
-    if (char === "#" && (index === 0 || command[index - 1] === " " || command[index - 1] === "\t"))
-      return null;
-    if (char === "&" && next === "&") {
-      segments.push({ segment: command.slice(start, index), separator: "&&" });
-      start = index + 2;
-      index++;
-      continue;
-    }
-    if (char === "|" && next === "|") {
-      segments.push({ segment: command.slice(start, index), separator: "||" });
-      start = index + 2;
-      index++;
-      continue;
-    }
-    if (char === ";") {
-      segments.push({ segment: command.slice(start, index), separator: ";" });
-      start = index + 1;
-    }
-  }
-  if (escaped || quote || inBacktick || parenDepth !== 0)
-    return null;
-  segments.push({ segment: command.slice(start), separator: "" });
-  return segments;
-}
-function splitTopLevelPipeline(command) {
-  const stages = [];
-  let start = 0;
-  let quote = null;
-  let escaped = false;
-  for (let index = 0;index < command.length; index++) {
-    const char = command[index];
-    const next = command[index + 1];
-    const previous = command[index - 1];
-    if (escaped) {
-      escaped = false;
-      continue;
-    }
-    if (char === "\\" && quote !== "'") {
-      escaped = true;
-      continue;
-    }
-    if (quote) {
-      if (char === quote)
-        quote = null;
-      continue;
-    }
-    if (char === "'" || char === '"') {
-      quote = char;
-      continue;
-    }
-    if (char === "|" && previous !== "|" && next !== "|") {
-      stages.push(command.slice(start, index));
-      start = index + 1;
-    }
-  }
-  stages.push(command.slice(start));
-  return stages;
-}
-function isCompressorHandledRunner(stage) {
-  const tokens = tokenizeStage(stage);
-  if (tokens.length === 0)
-    return false;
-  if (tokens.some((token) => token === "&&" || token === "||" || token.includes(";"))) {
-    return false;
-  }
-  let tokenOffset = 0;
-  while (tokenOffset < tokens.length && isEnvAssignment(tokens[tokenOffset])) {
-    tokenOffset++;
-  }
-  const first = runnerName(tokens[tokenOffset]);
-  const runnerArgs = tokens.slice(tokenOffset + 1);
-  const second = runnerArgs[0];
-  const third = runnerArgs[1];
-  const rest = runnerArgs;
-  if (!first)
-    return false;
-  if (first === "bun") {
-    let args = rest;
-    if (args[0] === "--cwd")
-      args = args.slice(2);
-    else if (args[0]?.startsWith("--cwd="))
-      args = args.slice(1);
-    const sub = args[0];
-    const subNext = args[1];
-    return sub === "test" || sub === "run" && isJsVerificationScript(subNext);
-  }
-  if (first === "npm" || first === "pnpm") {
-    return second === "test" || second === "run" && isJsVerificationScript(third);
-  }
-  if (first === "yarn") {
-    return isJsVerificationScript(second) || second === "run" && isJsVerificationScript(third);
-  }
-  if (first === "deno")
-    return ["test", "lint", "check", "bench"].includes(second ?? "");
-  if (first === "npx") {
-    return ["tsc", "eslint", "vitest", "jest", "playwright", "biome"].includes(second ?? "");
-  }
-  if (first === "playwright")
-    return second === "test";
-  if (first === "cargo") {
-    return ["test", "build", "check", "clippy", "nextest"].includes(second ?? "");
-  }
-  if (first === "go")
-    return ["test", "build", "vet"].includes(second ?? "");
-  if (first === "gradle" || first === "gradlew") {
-    return hasBuildTask(rest, ["test", "check", "build", "assemble", "clean"]);
-  }
-  if (first === "mvn" || first === "mvnw") {
-    return hasBuildTask(rest, ["test", "verify", "package", "install", "clean"]);
-  }
-  if (first === "dotnet")
-    return ["test", "build"].includes(second ?? "");
-  if (first === "rspec")
-    return true;
-  if (first === "rake") {
-    const positionals = rest.filter((a) => !a.startsWith("-"));
-    if (positionals.length === 0)
-      return false;
-    if (positionals.some((a) => a.includes("/") || a.includes(".") || a.includes("=")))
-      return false;
-    return positionals.some((a) => a === "test" || a === "spec");
-  }
-  if (first === "phpunit" || first === "pest")
-    return true;
-  if (first === "xcodebuild")
-    return xcodebuildHasBuildAction(rest);
-  if (first === "swift")
-    return second === "test" || second === "build";
-  if (first === "make" || first === "gmake") {
-    return hasBuildTask(rest, ["test", "check", "lint", "clean"]);
-  }
-  return [
-    "vitest",
-    "jest",
-    "pytest",
-    "tsc",
-    "eslint",
-    "biome",
-    "ruff",
-    "mypy",
-    "tox",
-    "nox"
-  ].includes(first);
-}
-function isEnvAssignment(token) {
-  if (!token)
-    return false;
-  return /^[a-zA-Z_][a-zA-Z0-9_]*=/.test(token);
-}
-function runnerName(token) {
-  if (!token)
-    return "";
-  const slash = token.lastIndexOf("/");
-  return slash === -1 ? token : token.slice(slash + 1);
-}
-function hasBuildTask(args, tasks) {
-  const isAllowedTask = (arg) => tasks.some((task) => arg === task || arg.endsWith(`:${task}`));
-  const isFlagOrProperty = (arg) => arg.startsWith("-") || arg.includes("=");
-  let sawAllowed = false;
-  for (const arg of args) {
-    if (isFlagOrProperty(arg))
-      continue;
-    if (!isAllowedTask(arg))
-      return false;
-    sawAllowed = true;
-  }
-  return sawAllowed;
-}
-function isJsVerificationScript(token) {
-  if (!token)
-    return false;
-  return token.startsWith("test") || token === "typecheck" || token.startsWith("typecheck:");
-}
-var XCODEBUILD_VALUE_FLAGS = new Set([
-  "-scheme",
-  "-target",
-  "-project",
-  "-workspace",
-  "-configuration",
-  "-sdk",
-  "-destination",
-  "-arch",
-  "-derivedDataPath",
-  "-resultBundlePath",
-  "-xcconfig",
-  "-toolchain"
-]);
-var XCODEBUILD_BUILD_ACTIONS = new Set([
-  "build",
-  "test",
-  "build-for-testing",
-  "test-without-building",
-  "analyze"
-]);
-function xcodebuildHasBuildAction(args) {
-  for (let i = 0;i < args.length; i++) {
-    const arg = args[i];
-    if (arg.startsWith("-")) {
-      if (XCODEBUILD_VALUE_FLAGS.has(arg))
-        i++;
-      continue;
-    }
-    if (XCODEBUILD_BUILD_ACTIONS.has(arg))
-      return true;
-  }
-  return false;
+  log(`[onnx] reclaiming install lock (owner_pid=${owningPid ?? "unknown"}, alive=${ownerAlive}, age_ms=${age})`);
+  try {
+    unlinkSync4(lockPath);
+  } catch {}
+  return tryClaim();
 }
-function containsUnsplittableConstruct(command) {
-  let quote = null;
-  let escaped = false;
-  for (let i = 0;i < command.length; i++) {
-    const char = command[i];
-    if (escaped) {
-      escaped = false;
-      continue;
-    }
-    if (char === "\\" && quote !== "'") {
-      escaped = true;
-      continue;
-    }
-    if (quote === "'") {
-      if (char === "'")
-        quote = null;
-      continue;
+function releaseLock(lockPath) {
+  try {
+    let owningPid = null;
+    try {
+      const raw = readFileSync5(lockPath, "utf8");
+      const firstLine = raw.split(/\r?\n/, 1)[0]?.trim() ?? "";
+      const parsed = Number.parseInt(firstLine, 10);
+      if (Number.isFinite(parsed) && parsed > 0)
+        owningPid = parsed;
+    } catch (readErr) {
+      const code = readErr.code;
+      if (code === "ENOENT")
+        return;
+      warn(`[onnx] could not read lock ${lockPath} during release: ${readErr}`);
+      return;
     }
-    if (quote === '"') {
-      if (char === '"')
-        quote = null;
-      else if (char === "`")
-        return true;
-      else if (char === "$" && command[i + 1] === "(")
-        return true;
-      continue;
+    if (owningPid !== process.pid) {
+      log(`[onnx] not releasing lock ${lockPath}: owned by pid ${owningPid ?? "unknown"} (we are ${process.pid})`);
+      return;
     }
-    if (char === "'" || char === '"') {
-      quote = char;
-      continue;
+    try {
+      unlinkSync4(lockPath);
+    } catch (unlinkErr) {
+      const code = unlinkErr.code;
+      if (code !== "ENOENT") {
+        warn(`[onnx] failed to release lock ${lockPath}: ${unlinkErr}`);
+      }
     }
-    if (char === "`")
-      return true;
-    if (char === "(" || char === ")")
-      return true;
+  } catch (err) {
+    warn(`[onnx] unexpected error releasing lock ${lockPath}: ${err}`);
   }
-  return false;
 }
-var READS_FILE_OPERAND = new Set(["cat", "tac", "nl", "less", "more"]);
-function filterStageIsSafeToDrop(stage) {
-  const head = tokenizeStage(stage)[0];
-  if (!head)
-    return false;
-  if (head === "wc")
-    return false;
-  if (!NOISE_FILTERS.has(head))
-    return false;
-  if (/[<>]/.test(stage))
+function tasklistPidFromCsvLine(line) {
+  const quoted = line.match(/"([^"]*)"/g);
+  if (quoted && quoted.length >= 2)
+    return quoted[1].slice(1, -1);
+  const cells = line.split(",").map((cell) => cell.trim().replace(/^"|"$/g, ""));
+  return cells[1] ?? null;
+}
+function isWindowsProcessAlive(pid) {
+  if (!Number.isInteger(pid) || pid <= 0)
     return false;
-  if (hasUnquotedBackground(stage))
+  try {
+    const output = execFileSync("tasklist.exe", ["/FI", `PID eq ${pid}`, "/FO", "CSV", "/NH"], {
+      encoding: "utf8",
+      timeout: 2000,
+      windowsHide: true
+    });
+    const expected = String(pid);
+    return output.split(/\r?\n/).some((line) => tasklistPidFromCsvLine(line) === expected);
+  } catch {
     return false;
-  const args = tokenizeStage(stage).slice(1);
-  const hasFlag = (...names) => args.some((a) => names.some((n) => a === n || a.startsWith(`${n}=`)));
-  if (head === "grep" || head === "rg") {
-    if (hasIntentChangingGrepFlag(args))
-      return false;
-    if (countBareOperands(args) > 1)
-      return false;
-    return true;
-  }
-  if (head === "head" || head === "tail") {
-    if (bareOperands(args).some((op) => !/^\d+$/.test(op)))
-      return false;
-    return true;
   }
-  if (READS_FILE_OPERAND.has(head)) {
-    if (countBareOperands(args) > 0)
-      return false;
-    return true;
-  }
-  if (head === "sed") {
-    if (hasFlag("-i", "--in-place"))
-      return false;
-    if (countBareOperands(args) > 1)
-      return false;
+}
+function isProcessAlive(pid) {
+  if (process.platform === "win32")
+    return isWindowsProcessAlive(pid);
+  try {
+    process.kill(pid, 0);
     return true;
-  }
-  if (head === "awk") {
-    if (countBareOperands(args) > 1)
+  } catch (err) {
+    const code = err.code;
+    if (code === "ESRCH")
       return false;
     return true;
   }
-  if (head === "sort" && hasFlag("-o", "--output"))
-    return false;
-  if (bareOperands(args).some((op) => op.includes("/") || op.includes(".")))
-    return false;
-  return true;
-}
-function bareOperands(args) {
-  const out = [];
-  let afterDoubleDash = false;
-  for (const arg of args) {
-    if (!afterDoubleDash && arg === "--") {
-      afterDoubleDash = true;
-      continue;
-    }
-    if (!afterDoubleDash && arg.startsWith("-") && arg !== "-")
-      continue;
-    out.push(arg);
-  }
-  return out;
-}
-function countBareOperands(args) {
-  return bareOperands(args).length;
 }
-function hasUnquotedBackground(stage) {
-  let quote = null;
-  let escaped = false;
-  for (let i = 0;i < stage.length; i++) {
-    const char = stage[i];
-    if (escaped) {
-      escaped = false;
-      continue;
-    }
-    if (char === "\\" && quote !== "'") {
-      escaped = true;
-      continue;
-    }
-    if (quote) {
-      if (char === quote)
-        quote = null;
-      continue;
-    }
-    if (char === "'" || char === '"') {
-      quote = char;
-      continue;
-    }
-    if (char === "&") {
-      const prev = stage[i - 1];
-      const next = stage[i + 1];
-      if (prev === "&" || next === "&" || prev === ">" || next === ">")
-        continue;
-      return true;
-    }
+// ../aft-bridge/dist/pool.js
+import { homedir as homedir9 } from "node:os";
+
+// ../aft-bridge/dist/project-identity.js
+import { realpathSync as realpathSync2 } from "node:fs";
+import { resolve as resolve6 } from "node:path";
+function canonicalizeProjectRoot(dir) {
+  const trimmed = dir.replace(/[/\\]+$/, "");
+  let canonical;
+  try {
+    canonical = realpathSync2(trimmed);
+  } catch {
+    canonical = resolve6(trimmed);
   }
-  return false;
+  return normalizeWindowsRoot(canonical);
 }
-function hasIntentChangingGrepFlag(args) {
-  for (const arg of args) {
-    if (arg === "--")
-      return false;
-    if (!arg.startsWith("-") || arg === "-")
-      continue;
-    if (arg.startsWith("--")) {
-      const flag = arg.slice(2).split("=", 1)[0];
-      if (GREP_GUARD_FLAGS.has(flag))
-        return true;
-      continue;
-    }
-    for (const flag of arg.slice(1)) {
-      if (GREP_GUARD_FLAGS.has(flag))
-        return true;
-    }
+function normalizeWindowsRoot(p) {
+  if (process.platform !== "win32")
+    return p;
+  let s = p;
+  if (s.startsWith("\\\\?\\UNC\\")) {
+    s = `\\\\${s.slice("\\\\?\\UNC\\".length)}`;
+  } else if (s.startsWith("\\\\?\\")) {
+    s = s.slice("\\\\?\\".length);
   }
-  return false;
-}
-function tokenizeStage(stage) {
-  const tokens = [];
-  let current = "";
-  let quote = null;
-  let escaped = false;
-  for (let index = 0;index < stage.length; index++) {
-    const char = stage[index];
-    if (escaped) {
-      current += char;
-      escaped = false;
-      continue;
-    }
-    if (char === "\\" && quote !== "'") {
-      escaped = true;
-      continue;
-    }
-    if (quote) {
-      if (char === quote) {
-        quote = null;
-      } else {
-        current += char;
-      }
-      continue;
-    }
-    if (char === "'" || char === '"') {
-      quote = char;
-      continue;
-    }
-    if (/\s/.test(char)) {
-      if (current.length > 0) {
-        tokens.push(current);
-        current = "";
-      }
-      continue;
+  if (s.length >= 2 && s[1] === ":") {
+    const drive = s.charCodeAt(0);
+    if (drive >= 97 && drive <= 122) {
+      s = s[0].toUpperCase() + s.slice(1);
     }
-    current += char;
   }
-  if (current.length > 0)
-    tokens.push(current);
-  return tokens;
+  return s;
 }
+
 // ../aft-bridge/dist/pool.js
-import { realpathSync as realpathSync2 } from "node:fs";
-import { homedir as homedir8 } from "node:os";
 var DEFAULT_IDLE_TIMEOUT_MS = 30 * 60 * 1000;
 var DEFAULT_MAX_POOL_SIZE = 8;
 var CLEANUP_INTERVAL_MS = 60 * 1000;
 function canonicalHomeDir() {
   try {
-    const home = homedir8();
+    const home = homedir9();
     if (!home)
       return null;
-    try {
-      return realpathSync2(home);
-    } catch {
-      return home.replace(/[/\\]+$/, "");
-    }
+    return canonicalizeProjectRoot(home);
   } catch {
     return null;
   }
@@ -15438,12 +15472,7 @@ class BridgePool {
   }
 }
 function normalizeKey(projectRoot) {
-  const stripped = projectRoot.replace(/[/\\]+$/, "");
-  try {
-    return realpathSync2(stripped);
-  } catch {
-    return stripped;
-  }
+  return canonicalizeProjectRoot(projectRoot);
 }
 // ../aft-bridge/dist/tool-format.js
 function asPlainObject(value) {
@@ -16275,7 +16304,7 @@ import {
 // package.json
 var package_default = {
   name: "@cortexkit/aft-pi",
-  version: "0.39.3",
+  version: "0.40.0",
   type: "module",
   description: "Pi coding agent extension for Agent File Tools (AFT) — tree-sitter and LSP-powered code analysis",
   main: "dist/index.js",
@@ -16298,7 +16327,7 @@ var package_default = {
     "test:unit": "bun test src/__tests__ --path-ignore-patterns 'src/__tests__/e2e/**'"
   },
   dependencies: {
-    "@cortexkit/aft-bridge": "0.39.3",
+    "@cortexkit/aft-bridge": "0.40.0",
     "@xterm/headless": "^5.5.0",
     "comment-json": "^5.0.0",
     diff: "^8.0.4",
@@ -16306,12 +16335,12 @@ var package_default = {
     zod: "^4.1.8"
   },
   optionalDependencies: {
-    "@cortexkit/aft-darwin-arm64": "0.39.3",
-    "@cortexkit/aft-darwin-x64": "0.39.3",
-    "@cortexkit/aft-linux-arm64": "0.39.3",
-    "@cortexkit/aft-linux-x64": "0.39.3",
-    "@cortexkit/aft-win32-arm64": "0.39.3",
-    "@cortexkit/aft-win32-x64": "0.39.3"
+    "@cortexkit/aft-darwin-arm64": "0.40.0",
+    "@cortexkit/aft-darwin-x64": "0.40.0",
+    "@cortexkit/aft-linux-arm64": "0.40.0",
+    "@cortexkit/aft-linux-x64": "0.40.0",
+    "@cortexkit/aft-win32-arm64": "0.40.0",
+    "@cortexkit/aft-win32-x64": "0.40.0"
   },
   devDependencies: {
     "@earendil-works/pi-coding-agent": "*",
@@ -16885,9 +16914,7 @@ function registerStatusCommand(pi, ctx) {
 }
 
 // src/config.ts
-import { existsSync as existsSync6, readFileSync as readFileSync4, renameSync as renameSync4, unlinkSync as unlinkSync4, writeFileSync as writeFileSync3 } from "node:fs";
-import { homedir as homedir9 } from "node:os";
-import { join as join10 } from "node:path";
+import { existsSync as existsSync7, readFileSync as readFileSync6, renameSync as renameSync5, unlinkSync as unlinkSync5, writeFileSync as writeFileSync4 } from "node:fs";
 var import_comment_json = __toESM(require_src2(), 1);
 
 // ../../node_modules/.bun/zod@4.3.6/node_modules/zod/v4/classic/external.js
@@ -30423,7 +30450,7 @@ function date4(params) {
 // ../../node_modules/.bun/zod@4.3.6/node_modules/zod/v4/classic/external.js
 config(en_default());
 // src/config.ts
-var FOREGROUND_WAIT_WINDOW_DEFAULT_MS = 8000;
+var FOREGROUND_WAIT_WINDOW_DEFAULT_MS = 15000;
 var FOREGROUND_WAIT_WINDOW_MIN_MS = 5000;
 function resolveBashConfig(config2) {
   const top = config2.bash;
@@ -30594,105 +30621,6 @@ var AftConfigSchema = exports_external.object({
   max_callgraph_files: exports_external.number().int().positive().optional(),
   bridge: BridgeConfigSchema.optional()
 }).strict();
-function normalizeLspExtension(extension) {
-  return extension.trim().replace(/^\.+/, "");
-}
-function resolveLspConfigForConfigure(config2) {
-  const overrides = {};
-  const disabled = new Set(config2.lsp?.disabled ?? []);
-  let experimentalTy = config2.experimental?.lsp_ty;
-  switch (config2.lsp?.python ?? "auto") {
-    case "ty":
-      experimentalTy = true;
-      disabled.add("python");
-      break;
-    case "pyright":
-      experimentalTy = false;
-      disabled.add("ty");
-      break;
-    case "auto":
-      break;
-  }
-  if (experimentalTy !== undefined) {
-    overrides.experimental_lsp_ty = experimentalTy;
-  }
-  const servers = Object.entries(config2.lsp?.servers ?? {}).map(([id, server]) => {
-    const entry = {
-      id,
-      args: server.args,
-      root_markers: server.root_markers,
-      disabled: server.disabled
-    };
-    if (server.extensions && server.extensions.length > 0) {
-      entry.extensions = server.extensions.map(normalizeLspExtension);
-    }
-    if (server.binary) {
-      entry.binary = server.binary;
-    }
-    if (server.env && Object.keys(server.env).length > 0) {
-      entry.env = server.env;
-    }
-    if (server.initialization_options !== undefined) {
-      entry.initialization_options = server.initialization_options;
-    }
-    return entry;
-  });
-  if (servers.length > 0) {
-    overrides.lsp_servers = servers;
-  }
-  if (disabled.size > 0) {
-    overrides.disabled_lsp = [...disabled];
-  }
-  return overrides;
-}
-function resolveProjectOverridesForConfigure(config2) {
-  const overrides = {};
-  if (config2.format_on_edit !== undefined)
-    overrides.format_on_edit = config2.format_on_edit;
-  if (config2.formatter_timeout_secs !== undefined)
-    overrides.formatter_timeout_secs = config2.formatter_timeout_secs;
-  if (config2.validate_on_edit !== undefined)
-    overrides.validate_on_edit = config2.validate_on_edit;
-  if (config2.formatter !== undefined)
-    overrides.formatter = config2.formatter;
-  if (config2.checker !== undefined)
-    overrides.checker = config2.checker;
-  overrides.restrict_to_project_root = config2.restrict_to_project_root ?? false;
-  if (config2.search_index !== undefined)
-    overrides.search_index = config2.search_index;
-  if (config2.semantic_search !== undefined)
-    overrides.semantic_search = config2.semantic_search;
-  if (config2.callgraph_store !== undefined)
-    overrides.callgraph_store = config2.callgraph_store;
-  if (config2.callgraph_chunk_size !== undefined)
-    overrides.callgraph_chunk_size = config2.callgraph_chunk_size;
-  Object.assign(overrides, resolveExperimentalConfigForConfigure(config2));
-  Object.assign(overrides, resolveLspConfigForConfigure(config2));
-  if (config2.semantic !== undefined)
-    overrides.semantic = config2.semantic;
-  if (config2.inspect !== undefined)
-    overrides.inspect = config2.inspect;
-  if (config2.max_callgraph_files !== undefined)
-    overrides.max_callgraph_files = config2.max_callgraph_files;
-  return overrides;
-}
-function resolveExperimentalConfigForConfigure(config2) {
-  const overrides = {};
-  const bash = resolveBashConfig(config2);
-  overrides.experimental_bash_rewrite = bash.rewrite;
-  overrides.experimental_bash_compress = bash.compress;
-  overrides.experimental_bash_background = bash.background;
-  if (bash.long_running_reminder_enabled !== undefined) {
-    overrides.bash_long_running_reminder_enabled = bash.long_running_reminder_enabled;
-  }
-  if (bash.long_running_reminder_interval_ms !== undefined) {
-    overrides.bash_long_running_reminder_interval_ms = bash.long_running_reminder_interval_ms;
-  }
-  if (config2.experimental?.lsp_ty !== undefined) {
-    overrides.experimental_lsp_ty = config2.experimental.lsp_ty;
-  }
-  return overrides;
-}
 var CONFIG_MIGRATIONS = [
   { oldKey: "experimental_search_index", newPath: ["search_index"] },
   { oldKey: "experimental_semantic_search", newPath: ["semantic_search"] },
@@ -30802,14 +30730,14 @@ function migrateExperimentalBashBlock(rawConfig, configPath, logger) {
   }
   return movedKeys;
 }
-function migrateAftConfigFile(configPath, logger = { log: log2, warn: warn2 }) {
-  if (!existsSync6(configPath)) {
+function migrateAftConfigFile2(configPath, logger = { log: log2, warn: warn2 }) {
+  if (!existsSync7(configPath)) {
     return { migrated: false, oldKeys: [] };
   }
   let tmpPath = null;
   let oldKeys = [];
   try {
-    const content = readFileSync4(configPath, "utf-8");
+    const content = readFileSync6(configPath, "utf-8");
     const rawConfig = import_comment_json.parse(content);
     if (!rawConfig || typeof rawConfig !== "object" || Array.isArray(rawConfig)) {
       return { migrated: false, oldKeys: [] };
@@ -30825,14 +30753,14 @@ function migrateAftConfigFile(configPath, logger = { log: log2, warn: warn2 }) {
 `)}
 ${serialized}` : serialized;
     tmpPath = `${configPath}.tmp.${process.pid}`;
-    writeFileSync3(tmpPath, nextContent, "utf-8");
-    renameSync4(tmpPath, configPath);
+    writeFileSync4(tmpPath, nextContent, "utf-8");
+    renameSync5(tmpPath, configPath);
     logger.log(`Migrated config at ${configPath}: removed ${oldKeys.join(", ")}`);
     return { migrated: true, oldKeys };
   } catch (err) {
     if (tmpPath) {
       try {
-        unlinkSync4(tmpPath);
+        unlinkSync5(tmpPath);
       } catch {}
     }
     if (isWritableMigrationError(err)) {
@@ -30843,15 +30771,6 @@ ${serialized}` : serialized;
     return { migrated: false, oldKeys: [] };
   }
 }
-function detectConfigFile(basePath) {
-  const jsoncPath = `${basePath}.jsonc`;
-  const jsonPath = `${basePath}.json`;
-  if (existsSync6(jsoncPath))
-    return { format: "jsonc", path: jsoncPath };
-  if (existsSync6(jsonPath))
-    return { format: "json", path: jsonPath };
-  return { format: "none", path: jsonPath };
-}
 var configLoadErrors = [];
 function getConfigLoadErrors() {
   return configLoadErrors;
@@ -30865,9 +30784,9 @@ function recordConfigParseFailure(configPath, errorMessage) {
 }
 function loadConfigFromPath(configPath) {
   try {
-    if (!existsSync6(configPath))
+    if (!existsSync7(configPath))
       return null;
-    const content = readFileSync4(configPath, "utf-8");
+    const content = readFileSync6(configPath, "utf-8");
     const rawConfig = import_comment_json.parse(content);
     if (!rawConfig || typeof rawConfig !== "object" || Array.isArray(rawConfig)) {
       recordConfigParseFailure(configPath, "root must be an object");
@@ -31084,21 +31003,43 @@ function resolveBridgePoolTransportOptions(config2) {
     hangThreshold: config2.bridge?.hang_threshold ?? DEFAULT_BRIDGE_HANG_THRESHOLD
   };
 }
-function getGlobalPiDir() {
-  return join10(homedir9(), ".pi", "agent");
+function migrateAftConfigLocations(projectDirectory, logger = { log: log2, warn: warn2 }) {
+  const paths = resolveCortexKitConfigPaths(projectDirectory);
+  const legacy = resolveLegacyAftConfigSources(projectDirectory);
+  return [
+    migrateAftConfigFile({
+      scope: "user",
+      targetPath: paths.userConfigPath,
+      legacySources: legacy.user,
+      operatingHarness: "pi",
+      logger
+    }),
+    migrateAftConfigFile({
+      scope: "project",
+      targetPath: paths.projectConfigPath,
+      legacySources: legacy.project,
+      operatingHarness: "pi",
+      logger
+    })
+  ];
+}
+function resolveAftConfigPaths(projectDirectory) {
+  const paths = resolveCortexKitConfigPaths(projectDirectory);
+  migrateAftConfigFile2(paths.userConfigPath);
+  migrateAftConfigFile2(paths.projectConfigPath);
+  return paths;
+}
+function buildConfigTierConfigureParams(projectDirectory, processState = {}) {
+  const paths = resolveAftConfigPaths(projectDirectory);
+  return {
+    ...processState,
+    cortexkit_user_config_path: paths.userConfigPath,
+    config: readConfigTiers(paths)
+  };
 }
 function loadAftConfig(projectDirectory) {
   configLoadErrors = [];
-  const userBasePath = join10(getGlobalPiDir(), "aft");
-  migrateAftConfigFile(`${userBasePath}.jsonc`);
-  migrateAftConfigFile(`${userBasePath}.json`);
-  const userDetected = detectConfigFile(userBasePath);
-  const userConfigPath = userDetected.format !== "none" ? userDetected.path : `${userBasePath}.json`;
-  const projectBasePath = join10(projectDirectory, ".pi", "aft");
-  migrateAftConfigFile(`${projectBasePath}.jsonc`);
-  migrateAftConfigFile(`${projectBasePath}.json`);
-  const projectDetected = detectConfigFile(projectBasePath);
-  const projectConfigPath = projectDetected.format !== "none" ? projectDetected.path : `${projectBasePath}.json`;
+  const { userConfigPath, projectConfigPath } = resolveAftConfigPaths(projectDirectory);
   let config2 = loadConfigFromPath(userConfigPath) ?? {};
   const projectConfig = loadConfigFromPath(projectConfigPath);
   if (projectConfig) {
@@ -31123,56 +31064,56 @@ import { spawn as spawn2 } from "node:child_process";
 import { createHash as createHash3 } from "node:crypto";
 import {
   createReadStream,
-  existsSync as existsSync8,
+  existsSync as existsSync9,
   mkdirSync as mkdirSync7,
-  readFileSync as readFileSync7,
-  renameSync as renameSync5,
-  rmSync as rmSync3,
-  statSync as statSync5,
-  writeFileSync as writeFileSync5
+  readFileSync as readFileSync9,
+  renameSync as renameSync6,
+  rmSync as rmSync4,
+  statSync as statSync6,
+  writeFileSync as writeFileSync6
 } from "node:fs";
-import { join as join13 } from "node:path";
+import { join as join12 } from "node:path";
 
 // src/lsp-cache.ts
 import {
-  closeSync as closeSync4,
+  closeSync as closeSync5,
   mkdirSync as mkdirSync6,
-  openSync as openSync4,
-  readFileSync as readFileSync5,
-  statSync as statSync4,
-  unlinkSync as unlinkSync5,
-  writeFileSync as writeFileSync4
+  openSync as openSync5,
+  readFileSync as readFileSync7,
+  statSync as statSync5,
+  unlinkSync as unlinkSync6,
+  writeFileSync as writeFileSync5
 } from "node:fs";
 import { homedir as homedir10 } from "node:os";
-import { join as join11 } from "node:path";
+import { join as join10 } from "node:path";
 function aftCacheBase() {
   const override = process.env.AFT_CACHE_DIR;
   if (override && override.length > 0)
     return override;
   if (process.platform === "win32") {
     const localAppData = process.env.LOCALAPPDATA || process.env.APPDATA;
-    const base2 = localAppData || join11(homedir10(), "AppData", "Local");
-    return join11(base2, "aft");
+    const base2 = localAppData || join10(homedir10(), "AppData", "Local");
+    return join10(base2, "aft");
   }
-  const base = process.env.XDG_CACHE_HOME || join11(homedir10(), ".cache");
-  return join11(base, "aft");
+  const base = process.env.XDG_CACHE_HOME || join10(homedir10(), ".cache");
+  return join10(base, "aft");
 }
 function lspCacheRoot() {
-  return join11(aftCacheBase(), "lsp-packages");
+  return join10(aftCacheBase(), "lsp-packages");
 }
 function lspPackageDir(npmPackage) {
-  return join11(lspCacheRoot(), encodeURIComponent(npmPackage));
+  return join10(lspCacheRoot(), encodeURIComponent(npmPackage));
 }
 function lspBinaryPath(npmPackage, binary) {
-  return join11(lspPackageDir(npmPackage), "node_modules", ".bin", binary);
+  return join10(lspPackageDir(npmPackage), "node_modules", ".bin", binary);
 }
 function lspBinDir(npmPackage) {
-  return join11(lspPackageDir(npmPackage), "node_modules", ".bin");
+  return join10(lspPackageDir(npmPackage), "node_modules", ".bin");
 }
 function isInstalled(npmPackage, binary) {
   for (const candidate of lspBinaryCandidates(binary)) {
     try {
-      if (statSync4(join11(lspBinDir(npmPackage), candidate)).isFile())
+      if (statSync5(join10(lspBinDir(npmPackage), candidate)).isFile())
         return true;
     } catch {}
   }
@@ -31192,17 +31133,17 @@ function writeInstalledMetaIn(installDir, version2, sha256) {
       installedAt: new Date().toISOString(),
       ...sha256 ? { sha256 } : {}
     };
-    writeFileSync4(join11(installDir, INSTALLED_META_FILE), JSON.stringify(meta3), "utf8");
+    writeFileSync5(join10(installDir, INSTALLED_META_FILE), JSON.stringify(meta3), "utf8");
   } catch (err) {
     log2(`[lsp-cache] failed to write installed-meta in ${installDir}: ${err}`);
   }
 }
 function readInstalledMetaIn(installDir) {
-  const path3 = join11(installDir, INSTALLED_META_FILE);
+  const path3 = join10(installDir, INSTALLED_META_FILE);
   try {
-    if (!statSync4(path3).isFile())
+    if (!statSync5(path3).isFile())
       return null;
-    const raw = readFileSync5(path3, "utf8");
+    const raw = readFileSync7(path3, "utf8");
     const parsed = JSON.parse(raw);
     if (typeof parsed.version !== "string" || parsed.version.length === 0)
       return null;
@@ -31222,7 +31163,7 @@ function readInstalledMeta(packageKey) {
   return readInstalledMetaIn(lspPackageDir(packageKey));
 }
 function lockPath(npmPackage) {
-  return join11(lspPackageDir(npmPackage), ".aft-installing");
+  return join10(lspPackageDir(npmPackage), ".aft-installing");
 }
 var STALE_LOCK_MS2 = 30 * 60 * 1000;
 function acquireInstallLock(lockKey) {
@@ -31230,13 +31171,13 @@ function acquireInstallLock(lockKey) {
   const lock = lockPath(lockKey);
   const tryClaim = () => {
     try {
-      const fd = openSync4(lock, "wx");
+      const fd = openSync5(lock, "wx");
       try {
-        writeFileSync4(fd, `${process.pid}
+        writeFileSync5(fd, `${process.pid}
 ${new Date().toISOString()}
 `);
       } finally {
-        closeSync4(fd);
+        closeSync5(fd);
       }
       return true;
     } catch (err) {
@@ -31252,12 +31193,12 @@ ${new Date().toISOString()}
   let owningPid = null;
   let lockMtimeMs = 0;
   try {
-    const raw = readFileSync5(lock, "utf8");
+    const raw = readFileSync7(lock, "utf8");
     const firstLine = raw.split(/\r?\n/, 1)[0]?.trim() ?? "";
     const parsed = Number.parseInt(firstLine, 10);
     if (Number.isFinite(parsed) && parsed > 0)
       owningPid = parsed;
-    lockMtimeMs = statSync4(lock).mtimeMs;
+    lockMtimeMs = statSync5(lock).mtimeMs;
   } catch {
     return tryClaim();
   }
@@ -31270,7 +31211,7 @@ ${new Date().toISOString()}
   }
   log2(`[lsp] reclaiming install lock for ${lockKey} (owner_pid=${owningPid ?? "unknown"}, alive=${ownerAlive}, age_ms=${age})`);
   try {
-    unlinkSync5(lock);
+    unlinkSync6(lock);
   } catch {}
   return tryClaim();
 }
@@ -31290,7 +31231,7 @@ function releaseInstallLock(lockKey) {
   try {
     let owningPid = null;
     try {
-      const raw = readFileSync5(lock, "utf8");
+      const raw = readFileSync7(lock, "utf8");
       const firstLine = raw.split(/\r?\n/, 1)[0]?.trim() ?? "";
       const parsed = Number.parseInt(firstLine, 10);
       if (Number.isFinite(parsed) && parsed > 0)
@@ -31307,7 +31248,7 @@ function releaseInstallLock(lockKey) {
       return;
     }
     try {
-      unlinkSync5(lock);
+      unlinkSync6(lock);
     } catch (unlinkErr) {
       const code = unlinkErr.code;
       if (code !== "ENOENT") {
@@ -31329,9 +31270,9 @@ async function withInstallLock(lockKey, task) {
 }
 var VERSION_CHECK_FILE = ".aft-version-check";
 function readVersionCheck(npmPackage) {
-  const file2 = join11(lspPackageDir(npmPackage), VERSION_CHECK_FILE);
+  const file2 = join10(lspPackageDir(npmPackage), VERSION_CHECK_FILE);
   try {
-    const raw = readFileSync5(file2, "utf8");
+    const raw = readFileSync7(file2, "utf8");
     const parsed = JSON.parse(raw);
     if (typeof parsed.last_checked === "string") {
       return {
@@ -31346,12 +31287,12 @@ function readVersionCheck(npmPackage) {
 }
 function writeVersionCheck(npmPackage, latest) {
   mkdirSync6(lspPackageDir(npmPackage), { recursive: true });
-  const file2 = join11(lspPackageDir(npmPackage), VERSION_CHECK_FILE);
+  const file2 = join10(lspPackageDir(npmPackage), VERSION_CHECK_FILE);
   const record2 = {
     last_checked: new Date().toISOString(),
     latest_eligible: latest
   };
-  writeFileSync4(file2, JSON.stringify(record2, null, 2));
+  writeFileSync5(file2, JSON.stringify(record2, null, 2));
 }
 function shouldRecheckVersion(record2, weeklyCheckIntervalMs = 7 * 24 * 60 * 60 * 1000) {
   if (!record2)
@@ -31508,8 +31449,8 @@ var NPM_LSP_TABLE = [
 ];
 
 // src/lsp-project-relevance.ts
-import { existsSync as existsSync7, readdirSync as readdirSync3, readFileSync as readFileSync6 } from "node:fs";
-import { join as join12 } from "node:path";
+import { existsSync as existsSync8, readdirSync as readdirSync3, readFileSync as readFileSync8 } from "node:fs";
+import { join as join11 } from "node:path";
 var MAX_WALK_DIRS = 200;
 var MAX_WALK_DEPTH = 4;
 var NOISE_DIRS = new Set([
@@ -31526,7 +31467,7 @@ function hasRootMarker(projectRoot, rootMarkers) {
   if (!rootMarkers)
     return false;
   for (const marker of rootMarkers) {
-    if (existsSync7(join12(projectRoot, marker)))
+    if (existsSync8(join11(projectRoot, marker)))
       return true;
   }
   return false;
@@ -31550,7 +31491,7 @@ function hasPackageJsonDep(projectRoot, depNames) {
 }
 function readPackageJson(projectRoot) {
   try {
-    const raw = readFileSync6(join12(projectRoot, "package.json"), "utf8");
+    const raw = readFileSync8(join11(projectRoot, "package.json"), "utf8");
     const parsed = JSON.parse(raw);
     if (typeof parsed !== "object" || parsed === null)
       return null;
@@ -31580,7 +31521,7 @@ function relevantExtensionsInProject(projectRoot, extToServer) {
     for (const entry of entries) {
       if (entry.isDirectory()) {
         if (current.depth < MAX_WALK_DEPTH && !NOISE_DIRS.has(entry.name.toLowerCase())) {
-          queue.push({ dir: join12(current.dir, entry.name), depth: current.depth + 1 });
+          queue.push({ dir: join11(current.dir, entry.name), depth: current.depth + 1 });
         }
         continue;
       }
@@ -31707,9 +31648,9 @@ async function resolveTargetVersion(spec, config2, fetchImpl = fetch) {
 }
 function ensureInstallAnchor(cwd) {
   try {
-    const stub = join13(cwd, "package.json");
-    if (!existsSync8(stub)) {
-      writeFileSync5(stub, `${JSON.stringify({ name: "aft-lsp-cache", version: "0.0.0", private: true })}
+    const stub = join12(cwd, "package.json");
+    if (!existsSync9(stub)) {
+      writeFileSync6(stub, `${JSON.stringify({ name: "aft-lsp-cache", version: "0.0.0", private: true })}
 `);
     }
   } catch (err) {
@@ -31717,18 +31658,18 @@ function ensureInstallAnchor(cwd) {
   }
 }
 function runInstall(spec, version2, cwd, signal) {
-  return new Promise((resolve3) => {
+  return new Promise((resolve7) => {
     const target = `${spec.npm}@${version2}`;
     log2(`[lsp] installing ${target} to ${cwd}`);
     if (signal?.aborted) {
       warn2(`[lsp] install ${target} aborted before spawn`);
-      resolve3(false);
+      resolve7(false);
       return;
     }
     const npm = resolveNpm();
     if (!npm) {
       warn2(`[lsp] npm not found on PATH or known locations; cannot install ${target}`);
-      resolve3(false);
+      resolve7(false);
       return;
     }
     ensureInstallAnchor(cwd);
@@ -31751,7 +31692,7 @@ function runInstall(spec, version2, cwd, signal) {
         return;
       settled = true;
       cleanup();
-      resolve3(ok);
+      resolve7(ok);
     };
     const onAbort = () => {
       warn2(`[lsp] install ${target} aborted during shutdown`);
@@ -31852,7 +31793,7 @@ function cachedPackageDir(npmPackage) {
   return lspBinDir(npmPackage).replace(/[\\/]node_modules[\\/]\.bin[\\/]?$/, "");
 }
 function hashInstalledBinary(spec) {
-  return new Promise((resolve3, reject) => {
+  return new Promise((resolve7, reject) => {
     const candidates = process.platform === "win32" ? [
       lspBinaryPath(spec.npm, spec.binary),
       lspBinaryPath(spec.npm, `${spec.binary}.cmd`),
@@ -31862,7 +31803,7 @@ function hashInstalledBinary(spec) {
     let pathToHash = null;
     for (const p of candidates) {
       try {
-        if (statSync5(p).isFile()) {
+        if (statSync6(p).isFile()) {
           pathToHash = p;
           break;
         }
@@ -31876,7 +31817,7 @@ function hashInstalledBinary(spec) {
     const stream = createReadStream(pathToHash);
     stream.on("error", reject);
     stream.on("data", (chunk) => hash2.update(chunk));
-    stream.on("end", () => resolve3(hash2.digest("hex")));
+    stream.on("end", () => resolve7(hash2.digest("hex")));
   });
 }
 function installedBinaryPath(spec) {
@@ -31888,23 +31829,23 @@ function installedBinaryPath(spec) {
   ] : [lspBinaryPath(spec.npm, spec.binary)];
   for (const candidate of candidates) {
     try {
-      if (statSync5(candidate).isFile())
+      if (statSync6(candidate).isFile())
         return candidate;
     } catch {}
   }
   return null;
 }
 function sha256OfFileSync(path3) {
-  return createHash3("sha256").update(readFileSync7(path3)).digest("hex");
+  return createHash3("sha256").update(readFileSync9(path3)).digest("hex");
 }
 function quarantineCachedNpmInstall(spec, reason) {
   const packageDir = lspPackageDir(spec.npm);
-  const dest = join13(packageDir, "..", ".quarantine", encodeURIComponent(spec.npm), `${Date.now()}`);
+  const dest = join12(packageDir, "..", ".quarantine", encodeURIComponent(spec.npm), `${Date.now()}`);
   warn2(`[lsp] tofu_mismatch ${spec.npm}: ${reason}; quarantining ${packageDir} -> ${dest}`);
   try {
-    mkdirSync7(join13(dest, ".."), { recursive: true });
-    rmSync3(dest, { recursive: true, force: true });
-    renameSync5(packageDir, dest);
+    mkdirSync7(join12(dest, ".."), { recursive: true });
+    rmSync4(dest, { recursive: true, force: true });
+    renameSync6(packageDir, dest);
   } catch (err) {
     warn2(`[lsp] tofu_mismatch ${spec.npm}: failed to quarantine cache entry: ${err}`);
   }
@@ -31984,20 +31925,20 @@ import {
   copyFileSync as copyFileSync4,
   createReadStream as createReadStream2,
   createWriteStream as createWriteStream3,
-  existsSync as existsSync9,
+  existsSync as existsSync10,
   lstatSync as lstatSync2,
   mkdirSync as mkdirSync8,
   readdirSync as readdirSync4,
-  readFileSync as readFileSync8,
+  readFileSync as readFileSync10,
   readlinkSync as readlinkSync2,
   realpathSync as realpathSync3,
-  renameSync as renameSync6,
-  rmSync as rmSync4,
-  statSync as statSync6,
-  unlinkSync as unlinkSync6,
-  writeFileSync as writeFileSync6
+  renameSync as renameSync7,
+  rmSync as rmSync5,
+  statSync as statSync7,
+  unlinkSync as unlinkSync7,
+  writeFileSync as writeFileSync7
 } from "node:fs";
-import { dirname as dirname5, join as join14, relative as relative3, resolve as resolve3 } from "node:path";
+import { dirname as dirname5, join as join13, relative as relative3, resolve as resolve7 } from "node:path";
 import { Readable as Readable3 } from "node:stream";
 import { pipeline as pipeline3 } from "node:stream/promises";
 
@@ -32087,26 +32028,26 @@ function detectHostPlatform() {
 
 // src/lsp-github-install.ts
 function ghCacheRoot() {
-  return join14(aftCacheBase(), "lsp-binaries");
+  return join13(aftCacheBase(), "lsp-binaries");
 }
 function ghPackageDir(spec) {
-  return join14(ghCacheRoot(), spec.id);
+  return join13(ghCacheRoot(), spec.id);
 }
 function ghBinDir(spec) {
-  return join14(ghPackageDir(spec), "bin");
+  return join13(ghPackageDir(spec), "bin");
 }
 function ghExtractDir(spec) {
-  return join14(ghPackageDir(spec), "extracted");
+  return join13(ghPackageDir(spec), "extracted");
 }
 var INSTALLED_META_FILE2 = ".aft-installed";
 function ghBinaryPath(spec, platform) {
   const ext = platform === "win32" ? ".exe" : "";
-  return join14(ghBinDir(spec), `${spec.binary}${ext}`);
+  return join13(ghBinDir(spec), `${spec.binary}${ext}`);
 }
 function isGithubInstalled(spec, platform) {
   for (const candidate of ghBinaryCandidates(spec, platform)) {
     try {
-      if (statSync6(join14(ghBinDir(spec), candidate)).isFile())
+      if (statSync7(join13(ghBinDir(spec), candidate)).isFile())
         return true;
     } catch {}
   }
@@ -32119,10 +32060,10 @@ function ghBinaryCandidates(spec, platform) {
 }
 function readGithubInstalledMetaIn(installDir) {
   try {
-    const path3 = join14(installDir, INSTALLED_META_FILE2);
-    if (!statSync6(path3).isFile())
+    const path3 = join13(installDir, INSTALLED_META_FILE2);
+    if (!statSync7(path3).isFile())
       return null;
-    const parsed = JSON.parse(readFileSync8(path3, "utf8"));
+    const parsed = JSON.parse(readFileSync10(path3, "utf8"));
     if (typeof parsed.version !== "string" || parsed.version.length === 0)
       return null;
     return {
@@ -32146,7 +32087,7 @@ function writeGithubInstalledMetaIn(installDir, version2, binarySha256, archiveS
       binarySha256,
       ...archiveSha256 ? { archiveSha256 } : {}
     };
-    writeFileSync6(join14(installDir, INSTALLED_META_FILE2), JSON.stringify(meta3), "utf8");
+    writeFileSync7(join13(installDir, INSTALLED_META_FILE2), JSON.stringify(meta3), "utf8");
   } catch (err) {
     warn2(`[lsp] failed to write github installed metadata in ${installDir}: ${err}`);
   }
@@ -32154,16 +32095,16 @@ function writeGithubInstalledMetaIn(installDir, version2, binarySha256, archiveS
 var MAX_DOWNLOAD_BYTES3 = 256 * 1024 * 1024;
 var MAX_EXTRACT_BYTES2 = 1024 * 1024 * 1024;
 function sha256OfFile(path3) {
-  return new Promise((resolve4, reject) => {
+  return new Promise((resolve8, reject) => {
     const hash2 = createHash4("sha256");
     const stream = createReadStream2(path3);
     stream.on("error", reject);
     stream.on("data", (chunk) => hash2.update(chunk));
-    stream.on("end", () => resolve4(hash2.digest("hex")));
+    stream.on("end", () => resolve8(hash2.digest("hex")));
   });
 }
 function sha256OfFileSync2(path3) {
-  return createHash4("sha256").update(readFileSync8(path3)).digest("hex");
+  return createHash4("sha256").update(readFileSync10(path3)).digest("hex");
 }
 async function fetchReleaseByTag(githubRepo, tag, fetchImpl, signal) {
   const candidates = [];
@@ -32356,7 +32297,7 @@ async function downloadFile(url2, destPath, fetchImpl, assetSize, signal) {
     await pipeline3(nodeStream, createWriteStream3(destPath), { signal: timeout.signal });
   } catch (err) {
     try {
-      unlinkSync6(destPath);
+      unlinkSync7(destPath);
     } catch {}
     throw err;
   } finally {
@@ -32395,7 +32336,7 @@ function validateExtraction(stagingRoot) {
       throw new Error(`failed to read staging dir ${dir}: ${err}`);
     }
     for (const entry of entries) {
-      const full = join14(dir, entry);
+      const full = join13(dir, entry);
       let lst;
       try {
         lst = lstatSync2(full);
@@ -32416,7 +32357,7 @@ function validateExtraction(stagingRoot) {
         throw new Error(`failed to realpath ${full}: ${err}`);
       }
       const rel = relative3(realStagingRoot, realFull);
-      if (rel.startsWith("..") || resolve3(realStagingRoot, rel) !== realFull) {
+      if (rel.startsWith("..") || resolve7(realStagingRoot, rel) !== realFull) {
         throw new Error(`archive entry escapes staging root: ${full} → ${realFull} (zip-slip defense)`);
       }
       if (lst.isDirectory()) {
@@ -32463,7 +32404,7 @@ function extractArchiveSafely(archivePath, destDir, archiveType) {
   const suffix = randomBytes(8).toString("hex");
   const stagingDir = `${destDir}.staging-${suffix}`;
   try {
-    rmSync4(stagingDir, { recursive: true, force: true });
+    rmSync5(stagingDir, { recursive: true, force: true });
   } catch {}
   mkdirSync8(stagingDir, { recursive: true });
   try {
@@ -32471,24 +32412,24 @@ function extractArchiveSafely(archivePath, destDir, archiveType) {
     runPlatformExtractor(archivePath, stagingDir, archiveType);
     validateExtraction(stagingDir);
     try {
-      rmSync4(destDir, { recursive: true, force: true });
+      rmSync5(destDir, { recursive: true, force: true });
     } catch {}
-    renameSync6(stagingDir, destDir);
+    renameSync7(stagingDir, destDir);
   } catch (err) {
     try {
-      rmSync4(stagingDir, { recursive: true, force: true });
+      rmSync5(stagingDir, { recursive: true, force: true });
     } catch {}
     throw err;
   }
 }
 function quarantineCachedGithubInstall(spec, reason) {
   const packageDir = ghPackageDir(spec);
-  const dest = join14(ghCacheRoot(), ".quarantine", encodeURIComponent(spec.id), `${Date.now()}`);
+  const dest = join13(ghCacheRoot(), ".quarantine", encodeURIComponent(spec.id), `${Date.now()}`);
   warn2(`[lsp] tofu_mismatch ${spec.id}: ${reason}; quarantining ${packageDir} -> ${dest}`);
   try {
     mkdirSync8(dirname5(dest), { recursive: true });
-    rmSync4(dest, { recursive: true, force: true });
-    renameSync6(packageDir, dest);
+    rmSync5(dest, { recursive: true, force: true });
+    renameSync7(packageDir, dest);
   } catch (err) {
     warn2(`[lsp] tofu_mismatch ${spec.id}: failed to quarantine cache entry: ${err}`);
   }
@@ -32496,9 +32437,9 @@ function quarantineCachedGithubInstall(spec, reason) {
 function validateCachedGithubInstall(spec, platform) {
   const packageDir = ghPackageDir(spec);
   const meta3 = readGithubInstalledMetaIn(packageDir);
-  const binaryPath = ghBinaryCandidates(spec, platform).map((candidate) => join14(ghBinDir(spec), candidate)).find((candidate) => {
+  const binaryPath = ghBinaryCandidates(spec, platform).map((candidate) => join13(ghBinDir(spec), candidate)).find((candidate) => {
     try {
-      return statSync6(candidate).isFile();
+      return statSync7(candidate).isFile();
     } catch {
       return false;
     }
@@ -32574,7 +32515,7 @@ async function downloadAndInstall(spec, tag, assets, platform, arch, fetchImpl,
   }
   const pkgDir = ghPackageDir(spec);
   const extractDir = ghExtractDir(spec);
-  const archivePath = join14(pkgDir, expected.name);
+  const archivePath = join13(pkgDir, expected.name);
   log2(`[lsp] downloading ${spec.id} ${tag} → ${matchingAsset.url}`);
   try {
     await downloadFile(matchingAsset.url, archivePath, fetchImpl, matchingAsset.size, signal);
@@ -32588,7 +32529,7 @@ async function downloadAndInstall(spec, tag, assets, platform, arch, fetchImpl,
   } catch (err) {
     error2(`[lsp] hash ${spec.id} failed: ${err}`);
     try {
-      unlinkSync6(archivePath);
+      unlinkSync7(archivePath);
     } catch {}
     return null;
   }
@@ -32599,7 +32540,7 @@ async function downloadAndInstall(spec, tag, assets, platform, arch, fetchImpl,
     if (previousArchiveSha256 !== archiveSha256) {
       error2(`[lsp] ${spec.id} ${tag}: TOFU sha256 mismatch — refusing install. ` + `Previously installed archive sha256=${previousArchiveSha256}, downloaded sha256=${archiveSha256}. ` + `This means the published release for tag ${tag} changed. Investigate before proceeding.`);
       try {
-        unlinkSync6(archivePath);
+        unlinkSync7(archivePath);
       } catch {}
       return null;
     }
@@ -32611,11 +32552,11 @@ async function downloadAndInstall(spec, tag, assets, platform, arch, fetchImpl,
     return null;
   } finally {
     try {
-      unlinkSync6(archivePath);
+      unlinkSync7(archivePath);
     } catch {}
   }
-  const innerBinaryPath = join14(extractDir, spec.binaryPathInArchive(platform, arch, version2));
-  if (!existsSync9(innerBinaryPath)) {
+  const innerBinaryPath = join13(extractDir, spec.binaryPathInArchive(platform, arch, version2));
+  if (!existsSync10(innerBinaryPath)) {
     error2(`[lsp] ${spec.id}: extracted binary not found at ${innerBinaryPath}`);
     return null;
   }
@@ -32699,7 +32640,7 @@ function runGithubAutoInstall(relevantServers, config2, fetchImpl = fetch) {
   if (!host) {
     for (const spec of GITHUB_LSP_TABLE) {
       try {
-        if (existsSync9(ghBinDir(spec))) {
+        if (existsSync10(ghBinDir(spec))) {
           cachedBinDirs.push(ghBinDir(spec));
         }
       } catch {}
@@ -32869,9 +32810,13 @@ function warningTitle(warning) {
       return "LSP binary is missing";
     case "config_parse_failed":
       return "Config failed to parse";
+    case "config_key_dropped":
+      return "Config key ignored";
   }
 }
 function formatConfigureWarning(warning) {
+  if (warning.kind === "config_key_dropped")
+    return `${WARNING_MARKER} ${warning.hint}`;
   const details = [];
   if (warning.language)
     details.push(`language: ${warning.language}`);
@@ -33014,7 +32959,7 @@ function renderScreen(state, rows = state.rows, cols = state.cols) {
 `);
 }
 function writeTerminal(terminal, data) {
-  return new Promise((resolve4) => terminal.write(data, resolve4));
+  return new Promise((resolve8) => terminal.write(data, resolve8));
 }
 
 // src/shutdown-hooks.ts
@@ -33071,8 +33016,8 @@ function installProcessHandlers() {
       }
       signalShutdownStarted = true;
       process.exitCode = SIGNAL_EXIT_CODES[sig];
-      const timeout = new Promise((resolve4) => {
-        setTimeout(resolve4, SIGNAL_CLEANUP_TIMEOUT_MS);
+      const timeout = new Promise((resolve8) => {
+        setTimeout(resolve8, SIGNAL_CLEANUP_TIMEOUT_MS);
       });
       Promise.race([runCleanups(sig), timeout]).finally(() => {
         process.exit(SIGNAL_EXIT_CODES[sig]);
@@ -33115,7 +33060,7 @@ import { Type as Type3 } from "typebox";
 // src/tools/hoisted.ts
 import { stat } from "node:fs/promises";
 import { homedir as homedir11 } from "node:os";
-import { isAbsolute as isAbsolute4, relative as relative4, resolve as resolve4, sep } from "node:path";
+import { isAbsolute as isAbsolute5, relative as relative4, resolve as resolve8, sep } from "node:path";
 import {
   renderDiff
 } from "@earendil-works/pi-coding-agent";
@@ -33230,7 +33175,7 @@ function diagnosticsOnEditDefault(ctx) {
 }
 function containsPath(parent, child) {
   const rel = relative4(parent, child);
-  return rel === "" || !rel.startsWith("..") && !isAbsolute4(rel);
+  return rel === "" || !rel.startsWith("..") && !isAbsolute5(rel);
 }
 function expandTilde2(path3) {
   if (!path3 || !path3.startsWith("~"))
@@ -33238,13 +33183,13 @@ function expandTilde2(path3) {
   if (path3 === "~")
     return homedir11();
   if (path3.startsWith(`~${sep}`) || path3.startsWith("~/")) {
-    return resolve4(homedir11(), path3.slice(2));
+    return resolve8(homedir11(), path3.slice(2));
   }
   return path3;
 }
 function absoluteSearchPath(cwd, target) {
   const expanded = expandTilde2(target);
-  return isAbsolute4(expanded) ? expanded : resolve4(cwd, expanded);
+  return isAbsolute5(expanded) ? expanded : resolve8(cwd, expanded);
 }
 async function searchPathExists(cwd, target) {
   try {
@@ -33296,46 +33241,16 @@ function appendSkippedSearchPaths(text, missing) {
 
 ${note}` : note;
 }
-function externalDirectoryPromptTimeoutMs() {
-  const raw = process.env.AFT_PI_EXTERNAL_PROMPT_TIMEOUT_MS;
-  if (raw === undefined)
-    return 30000;
-  const parsed = Number.parseInt(raw, 10);
-  return Number.isFinite(parsed) && parsed > 0 ? parsed : 30000;
-}
-async function assertExternalDirectoryPermission(extCtx, target, action = "modify", options = {}) {
+async function assertExternalDirectoryPermission(extCtx, target, options = {}) {
   if (!target)
     return;
   const expanded = expandTilde2(target);
-  const absoluteTarget = isAbsolute4(expanded) ? expanded : resolve4(extCtx.cwd, expanded);
+  const absoluteTarget = isAbsolute5(expanded) ? expanded : resolve8(extCtx.cwd, expanded);
   if (containsPath(extCtx.cwd, absoluteTarget))
     return;
   if (options.restrictToProjectRoot === false)
     return;
-  const confirmFn = extCtx.ui?.confirm;
-  if (extCtx.hasUI === false || !confirmFn) {
-    throw new Error(`Permission denied: cannot prompt for ${action} outside the project (${absoluteTarget}).`);
-  }
-  const timeoutMs = externalDirectoryPromptTimeoutMs();
-  let timer;
-  const timeoutPromise = new Promise((resolve5) => {
-    timer = setTimeout(() => resolve5("timeout"), timeoutMs);
-  });
-  try {
-    const result = await Promise.race([
-      confirmFn("Allow external directory access?", `AFT wants to ${action} outside the project: ${absoluteTarget}`),
-      timeoutPromise
-    ]);
-    if (result === true)
-      return;
-    if (result === "timeout") {
-      throw new Error(`Permission denied: external directory prompt timed out after ${timeoutMs}ms.`);
-    }
-    throw new Error("Permission denied: external directory access was cancelled.");
-  } finally {
-    if (timer !== undefined)
-      clearTimeout(timer);
-  }
+  throw new Error(`Blocked: '${absoluteTarget}' is outside the project root and restrict_to_project_root is ` + "enabled (AFT full isolation). Not overridable per-call; set restrict_to_project_root: false " + "in aft.jsonc to allow external paths.");
 }
 var ReadParams = Type2.Object({
   path: Type2.String({
@@ -33384,7 +33299,7 @@ function registerHoistedTools(pi, ctx, surface) {
         const offset = coerceOptionalInt(params.offset, "offset", 1, Number.MAX_SAFE_INTEGER);
         const limit = coerceOptionalInt(params.limit, "limit", 1, Number.MAX_SAFE_INTEGER);
         const filePath = await resolvePathArg(extCtx.cwd, params.path);
-        await assertExternalDirectoryPermission(extCtx, filePath, "read", {
+        await assertExternalDirectoryPermission(extCtx, filePath, {
           restrictToProjectRoot: surface.restrictToProjectRoot
         });
         const req = {
@@ -33422,7 +33337,7 @@ function registerHoistedTools(pi, ctx, surface) {
       parameters: WriteParams,
       async execute(_toolCallId, params, _signal, _onUpdate, extCtx) {
         const filePath = await resolvePathArg(extCtx.cwd, params.filePath);
-        await assertExternalDirectoryPermission(extCtx, filePath, "modify", {
+        await assertExternalDirectoryPermission(extCtx, filePath, {
           restrictToProjectRoot: surface.restrictToProjectRoot
         });
         const bridge = bridgeFor(ctx, extCtx.cwd);
@@ -33456,7 +33371,7 @@ function registerHoistedTools(pi, ctx, surface) {
       parameters: EditParams,
       async execute(_toolCallId, params, _signal, _onUpdate, extCtx) {
         const filePath = await resolvePathArg(extCtx.cwd, params.filePath);
-        await assertExternalDirectoryPermission(extCtx, filePath, "modify", {
+        await assertExternalDirectoryPermission(extCtx, filePath, {
           restrictToProjectRoot: surface.restrictToProjectRoot
         });
         const bridge = bridgeFor(ctx, extCtx.cwd);
@@ -33478,7 +33393,7 @@ function registerHoistedTools(pi, ctx, surface) {
           diagnostics: diagnosticsOnEditDefault(ctx),
           include_diff_content: true
         };
-        if (params.replaceAll === true)
+        if (coerceBoolean(params.replaceAll))
           req.replace_all = true;
         const occurrence = coerceOptionalInt(params.occurrence, "occurrence", 0, Number.MAX_SAFE_INTEGER);
         if (occurrence !== undefined)
@@ -33509,7 +33424,7 @@ function registerHoistedTools(pi, ctx, surface) {
         if (params.path) {
           pathSplit = await splitSearchPathArg(extCtx.cwd, params.path);
           for (const target of pathSplit.paths) {
-            await assertExternalDirectoryPermission(extCtx, absoluteSearchPath(extCtx.cwd, target), "search", {
+            await assertExternalDirectoryPermission(extCtx, absoluteSearchPath(extCtx.cwd, target), {
               restrictToProjectRoot: surface.restrictToProjectRoot
             });
           }
@@ -33930,7 +33845,7 @@ async function resolveAstPaths(extCtx, paths) {
     return;
   return Promise.all(paths.filter((path3) => typeof path3 === "string").map((path3) => resolvePathArg(extCtx.cwd, path3)));
 }
-async function assertAstPathsPermission(extCtx, paths, action, restrictToProjectRoot) {
+async function assertAstPathsPermission(extCtx, paths, restrictToProjectRoot) {
   if (paths === undefined || paths.length === 0)
     return;
   const checked = new Set;
@@ -33938,7 +33853,7 @@ async function assertAstPathsPermission(extCtx, paths, action, restrictToProject
     if (checked.has(path3))
       continue;
     checked.add(path3);
-    await assertExternalDirectoryPermission(extCtx, path3, action, { restrictToProjectRoot });
+    await assertExternalDirectoryPermission(extCtx, path3, { restrictToProjectRoot });
   }
 }
 function buildAstSearchSections(payload, theme) {
@@ -34057,7 +33972,7 @@ function registerAstTools(pi, ctx, surface) {
       parameters: SearchParams,
       async execute(_toolCallId, params, _signal, _onUpdate, extCtx) {
         const paths = await resolveAstPaths(extCtx, params.paths);
-        await assertAstPathsPermission(extCtx, paths, "search", ctx.config.restrict_to_project_root ?? false);
+        await assertAstPathsPermission(extCtx, paths, ctx.config.restrict_to_project_root ?? false);
         const bridge = bridgeFor(ctx, extCtx.cwd);
         const req = {
           pattern: params.pattern,
@@ -34088,7 +34003,7 @@ function registerAstTools(pi, ctx, surface) {
       parameters: ReplaceParams,
       async execute(_toolCallId, params, _signal, _onUpdate, extCtx) {
         const paths = await resolveAstPaths(extCtx, params.paths);
-        await assertAstPathsPermission(extCtx, paths, params.dryRun === true ? "search" : "modify", ctx.config.restrict_to_project_root ?? false);
+        await assertAstPathsPermission(extCtx, paths, ctx.config.restrict_to_project_root ?? false);
         const bridge = bridgeFor(ctx, extCtx.cwd);
         const req = {
           pattern: params.pattern,
@@ -34099,7 +34014,7 @@ function registerAstTools(pi, ctx, surface) {
           req.paths = paths;
         if (!isEmptyParam(params.globs))
           req.globs = params.globs;
-        req.dry_run = params.dryRun === true;
+        req.dry_run = coerceBoolean(params.dryRun);
         const response = await callBridge(bridge, "ast_replace", req, extCtx);
         return textResult(response.text ?? JSON.stringify(response));
       },
@@ -34215,6 +34130,9 @@ var BashWriteParams = Type4.Object({
     description: "Either a string of verbatim bytes (e.g. 'print(1)\\n') OR an array mixing strings " + "and { key: '<name>' } objects for atomic text+key sequences. " + "Example: [ 'iHello', { key: 'esc' }, ':wq', { key: 'enter' } ]. " + "Allowed key names: enter, return, tab, space, backspace, esc, escape, up, down, " + "left, right, home, end, page-up, page-down, delete, insert, f1..f12, ctrl-a..ctrl-z."
   })
 });
+function unavailableSnapshot() {
+  return { status: "unknown" };
+}
 async function callBashBridge(bridge, command, params = {}, extCtx, options) {
   return await callBridge(bridge, command, params, extCtx, {
     transportTimeoutMs: BASH_TRANSPORT_TIMEOUT_MS,
@@ -34247,8 +34165,8 @@ function registerBashTool(pi, ctx, aftSearchRegistered = false) {
   const spawnHook = getBashSpawnHook(pi);
   const searchSteer = aftSearchRegistered ? "use `aft_search` (concepts, identifiers, regex, literals), `read`, `aft_outline`, or `aft_zoom` instead" : "use the `grep` tool, `read`, `aft_outline`, or `aft_zoom` instead";
   const bashCfg = resolveBashConfig(ctx.config);
-  const compressionSentence = bashCfg.compress ? " Output is compressed by default; pass `compressed: false` for raw output." : "";
-  const tasksSentence = bashCfg.background ? ' Pass `background: true` to run in the background and get a task_id for `bash_status`/`bash_watch`/`bash_kill`. Pass `pty: true` for interactive programs (REPLs, TUIs) and drive them with `bash_status({ output_mode: "screen" })` plus `bash_write`. Use `bash_watch` to wait for exit or output patterns (sync blocks, async notifies). Do not loop `bash_status` to wait.' : " Commands run in the foreground to completion; `timeout` is the hard kill cap (default 30 minutes).";
+  const compressionSentence = bashCfg.compress ? " Output is compressed by default; pass `compressed: false` for raw output. Piped commands run verbatim and show the pipeline's output; for AFT's test/build summary, run the runner without `| head`, `| tail`, or `| grep`." : "";
+  const tasksSentence = bashCfg.background ? ' Commands run in the foreground and return inline; a long-running one auto-promotes to background and delivers a completion reminder when it finishes — so for the common "I am waiting on this result" case, just run it and wait, no flags needed. Use `background: true` yourself ONLY when you have other useful work to do while it runs; then `bash_watch` waits on the task (sync blocks until exit/pattern, async notifies) and `bash_status` peeks at it — never background a command and immediately `bash_watch` it (that wastes a turn for what foreground returns in one), and never loop `bash_status` to wait. `pty: true` runs interactive programs (REPLs, TUIs), implies background, and is driven with `bash_status({ output_mode: "screen" })` plus `bash_write`.' : " Commands run in the foreground to completion; `timeout` is the hard kill cap (default 30 minutes).";
   pi.registerTool({
     name: "bash",
     label: "bash",
@@ -34258,7 +34176,8 @@ DO NOT use bash for code search or code exploration. If you are about to run gre
     promptSnippet: bashCfg.background ? "Run shell commands (timeout in milliseconds; supports workdir, background tasks, compressed output, PTY mode)" : "Run shell commands (timeout in milliseconds; supports workdir and compressed output)",
     promptGuidelines: [
       `DO NOT use bash for code search or exploration — ${searchSteer}.`,
-      "Set compressed: false when you need ANSI color codes in the output."
+      "Set compressed: false when you need ANSI color codes in the output.",
+      "Piped commands run verbatim and show the pipeline's output; run test/build tools without pipes when you need AFT's summary."
     ],
     parameters: bashParamsForConfig(bashCfg.background),
     async execute(_toolCallId, params, _signal, onUpdate, extCtx) {
@@ -34269,8 +34188,9 @@ DO NOT use bash for code search or code exploration. If you are about to run gre
       const timeout = coerceOptionalInt(params.timeout, "timeout", 1, Number.MAX_SAFE_INTEGER);
       const ptyRows = backgroundDisabled ? undefined : coerceOptionalInt(params.ptyRows, "ptyRows", 1, 60);
       const ptyCols = backgroundDisabled ? undefined : coerceOptionalInt(params.ptyCols, "ptyCols", 1, 140);
-      const requestedPty = !backgroundDisabled && params.pty === true;
-      const effectiveBackground = !backgroundDisabled && (params.background === true || requestedPty);
+      const compressed = coerceBoolean(params.compressed, true);
+      const requestedPty = !backgroundDisabled && coerceBoolean(params.pty);
+      const effectiveBackground = !backgroundDisabled && (coerceBoolean(params.background) || requestedPty);
       const effectiveTimeout = effectiveBackground || backgroundDisabled ? timeout : resolveBashKillTimeout(timeout, foregroundWaitMs);
       let spawnContext = {
         command: params.command,
@@ -34283,9 +34203,7 @@ DO NOT use bash for code search or code exploration. If you are about to run gre
           throw new Error(`BashSpawnHook failed: ${hookErr instanceof Error ? hookErr.message : String(hookErr)}`);
         }
       }
-      const compressionEnabled = bashCfg2.compress && params.compressed !== false;
-      const pipeStrip = maybeStripCompressorPipe(spawnContext.command, compressionEnabled);
-      const bridgeCommand = pipeStrip.command;
+      const bridgeCommand = spawnContext.command;
       let streamed = "";
       const response = await callBashBridge(bridge, "bash", {
         command: bridgeCommand,
@@ -34295,7 +34213,7 @@ DO NOT use bash for code search or code exploration. If you are about to run gre
         description: params.description,
         background: effectiveBackground,
         notify_on_completion: effectiveBackground,
-        compressed: params.compressed,
+        compressed,
         pty: requestedPty,
         pty_rows: ptyRows,
         pty_cols: ptyCols
@@ -34318,7 +34236,7 @@ DO NOT use bash for code search or code exploration. If you are about to run gre
       if (response.status === "running" && taskId) {
         if (effectiveBackground) {
           trackBgTask(resolveSessionId(extCtx), taskId);
-          return bashResult(appendPipeStripNote(formatBackgroundLaunch(taskId, requestedPty), pipeStrip.note), { task_id: taskId });
+          return bashResult(formatBackgroundLaunch(taskId, requestedPty), { task_id: taskId });
         }
         const waitTimeoutMs = backgroundDisabled ? effectiveTimeout ?? DEFAULT_HARD_TIMEOUT_MS : effectiveTimeout !== undefined ? Math.min(effectiveTimeout, foregroundWaitMs) : foregroundWaitMs;
         const startedAt = Date.now();
@@ -34328,7 +34246,7 @@ DO NOT use bash for code search or code exploration. If you are about to run gre
             throw new Error(status.message ?? "bash_status failed");
           }
           if (isTerminalStatus(status.status)) {
-            return bashResult(appendPipeStripNote(withBashHints(formatForegroundResult(status), bridgeCommand, aftSearchRegistered, extCtx.cwd), pipeStrip.note), {
+            return bashResult(withBashHints(formatForegroundResult(status), bridgeCommand, aftSearchRegistered, extCtx.cwd), {
               exit_code: status.exit_code,
               duration_ms: status.duration_ms,
               truncated: status.output_truncated,
@@ -34346,7 +34264,9 @@ DO NOT use bash for code search or code exploration. If you are about to run gre
               throw new Error(promoted.message ?? "bash_promote failed");
             }
             trackBgTask(resolveSessionId(extCtx), taskId);
-            return bashResult(appendPipeStripNote(formatPromotionMessage(taskId, effectiveTimeout, foregroundWaitMs), pipeStrip.note), { task_id: taskId });
+            return bashResult(formatPromotionMessage(taskId, effectiveTimeout, foregroundWaitMs), {
+              task_id: taskId
+            });
           }
           await sleep(FOREGROUND_POLL_INTERVAL_MS);
         }
@@ -34359,7 +34279,7 @@ DO NOT use bash for code search or code exploration. If you are about to run gre
         task_id: taskId
       };
       const output = response.output ?? "";
-      return bashResult(appendPipeStripNote(withBashHints(output, bridgeCommand, aftSearchRegistered, extCtx.cwd), pipeStrip.note), details);
+      return bashResult(withBashHints(output, bridgeCommand, aftSearchRegistered, extCtx.cwd), details);
     },
     renderCall(args, theme, context) {
       return renderBashCall(args?.command, args?.description, theme, context);
@@ -34413,13 +34333,13 @@ function createBashWatchTool(ctx) {
     async execute(_toolCallId, params, _signal, _onUpdate, extCtx) {
       const bridge = bridgeFor(ctx, extCtx.cwd);
       const waitFor = parseWaitPattern(params.pattern);
-      if (params.background === true) {
+      if (coerceBoolean(params.background)) {
         if (!waitFor) {
           throw new Error("invalid_request: Use auto-reminder; bash_watch without pattern in async mode is redundant");
         }
         const notifyParams = {
           task_id: params.task_id,
-          once: params.once !== false
+          once: coerceBoolean(params.once, true)
         };
         if (waitFor.kind === "regex")
           notifyParams.regex = waitFor.source;
@@ -34445,7 +34365,7 @@ A notification will fire when the pattern matches or the task exits.`, watchDeta
       }
       const data = await waitForBashStatus(ctx, bridge, extCtx, params.task_id, undefined, waitFor, true, Math.min(coerceOptionalInt(params.timeout_ms, "timeout_ms", 1, MAX_BASH_STATUS_WAIT_TIMEOUT_MS) ?? DEFAULT_BASH_STATUS_WAIT_TIMEOUT_MS, MAX_BASH_STATUS_WAIT_TIMEOUT_MS));
       if (data.waited?.reason === "user_message") {
-        const convertedText = await convertToAsyncWatchOnAbort(bridge, extCtx, params.task_id, waitFor, params.once !== false);
+        const convertedText = await convertToAsyncWatchOnAbort(bridge, extCtx, params.task_id, waitFor, coerceBoolean(params.once, true));
         return textResult(convertedText, { waited: data.waited });
       }
       const text = await formatBashStatus(extCtx, params.task_id, data, undefined);
@@ -34561,9 +34481,31 @@ async function waitForBashStatus(ctx, bridge, extCtx, taskId, outputMode, waitFo
   if (waitForExit)
     markTaskWaiting(sessionId, taskId);
   let sawTerminal = false;
+  let lastData;
   try {
     while (true) {
-      const data = await bashStatusSnapshot(bridge, extCtx, taskId, outputMode, bridgeOptions);
+      let data;
+      try {
+        data = await bashStatusSnapshot(bridge, extCtx, taskId, outputMode, bridgeOptions);
+      } catch (err) {
+        if (!isBridgeTransportTimeout(err))
+          throw err;
+        if (isSyncWatchAborted(sessionId)) {
+          return withWaited(lastData ?? unavailableSnapshot(), {
+            reason: "user_message",
+            elapsed_ms: Date.now() - startedAt
+          });
+        }
+        if (Date.now() >= deadline) {
+          return withWaited(lastData ?? unavailableSnapshot(), {
+            reason: "unavailable",
+            elapsed_ms: Date.now() - startedAt
+          });
+        }
+        await sleep(Math.min(BASH_WAIT_POLL_INTERVAL_MS, Math.max(0, deadline - Date.now())));
+        continue;
+      }
+      lastData = data;
       const terminal = isTerminalStatus(data.status);
       if (waitFor) {
         const scan = await readNewTaskOutput(extCtx, taskId, data, spillCursor);
@@ -34755,6 +34697,9 @@ function formatWaitSummary(waited, details) {
   if (waited.reason === "timeout") {
     return `Waited ${waited.elapsed_ms}ms; timeout reached without match.`;
   }
+  if (waited.reason === "unavailable") {
+    return `Waited ${waited.elapsed_ms}ms; the bridge stayed busy and status couldn't be read. The task may still be running — check with bash_status({ taskId }).`;
+  }
   const exit = typeof details.exit_code === "number" ? `, exit ${details.exit_code}` : "";
   return `Waited ${waited.elapsed_ms}ms; task exited (${details.status}${exit}).`;
 }
@@ -34924,7 +34869,7 @@ function registerConflictsTool(pi, ctx) {
       const reqParams = {};
       const path3 = params?.path;
       if (typeof path3 === "string" && path3.trim() !== "") {
-        await assertExternalDirectoryPermission(extCtx, path3, "inspect", {
+        await assertExternalDirectoryPermission(extCtx, path3, {
           restrictToProjectRoot: ctx.config.restrict_to_project_root ?? false
         });
         reqParams.path = await resolvePathArg(extCtx.cwd, path3);
@@ -35015,14 +34960,14 @@ function registerFsTools(pi, ctx, surface) {
           if (checked.has(file2))
             continue;
           checked.add(file2);
-          await assertExternalDirectoryPermission(extCtx, file2, "modify", {
+          await assertExternalDirectoryPermission(extCtx, file2, {
             restrictToProjectRoot: ctx.config.restrict_to_project_root ?? false
           });
         }
         const bridge = bridgeFor(ctx, extCtx.cwd);
         const response = await callBridge(bridge, "delete_file", {
           files,
-          recursive: params.recursive === true
+          recursive: coerceBoolean(params.recursive)
         }, extCtx);
         const deletedEntries = response.deleted ?? [];
         const skipped = response.skipped_files ?? [];
@@ -35059,7 +35004,7 @@ function registerFsTools(pi, ctx, surface) {
         const destination = await resolvePathArg(extCtx.cwd, params.destination);
         const checked = new Set([filePath, destination]);
         for (const file2 of checked) {
-          await assertExternalDirectoryPermission(extCtx, file2, "modify", {
+          await assertExternalDirectoryPermission(extCtx, file2, {
             restrictToProjectRoot: ctx.config.restrict_to_project_root ?? false
           });
         }
@@ -35163,7 +35108,7 @@ function registerImportTools(pi, ctx) {
         throw new Error(`op='${params.op}' requires 'module'`);
       }
       const filePath = await resolvePathArg(extCtx.cwd, params.filePath);
-      await assertExternalDirectoryPermission(extCtx, filePath, "modify", {
+      await assertExternalDirectoryPermission(extCtx, filePath, {
         restrictToProjectRoot: ctx.config.restrict_to_project_root ?? false
       });
       const bridge = bridgeFor(ctx, extCtx.cwd);
@@ -35239,7 +35184,7 @@ async function resolveAndGateScope(extCtx, ctx, scope) {
     if (checked.has(target))
       continue;
     checked.add(target);
-    await assertExternalDirectoryPermission(extCtx, target, "read", {
+    await assertExternalDirectoryPermission(extCtx, target, {
       restrictToProjectRoot: ctx.config.restrict_to_project_root ?? false
     });
   }
@@ -35463,7 +35408,7 @@ function registerInspectTool(pi, ctx) {
   pi.registerTool({
     name: "aft_inspect",
     label: "inspect",
-    description: "Codebase health snapshot. One call returns summary stats for: TODOs, diagnostics, file/symbol metrics, dead code, unused exports, code duplicates. Pass `sections` for per-category drill-down details.\n\n" + "Categories run in tiers — Tier 1 (todos, metrics) return synchronously from cache. Tier 2 (dead_code, unused_exports, duplicates) run asynchronously on demand: when a call sees cold `pending_categories: [...]` or stale `stale_categories: [...]`, Pi quietly starts a background Tier 2 warmup (deduped while in-flight and rate-limited per category to at most once every 4 minutes, matching OpenCode's default idle window). The current call may still return pending results while the cache warms; a later call can use cached data.\n\n" + `Use when: starting work on unfamiliar code, after multi-edit batches to check diagnostics, before a refactor, before review, or to verify cleanup completeness.
+    description: "Codebase health snapshot. One call returns summary stats for: TODOs, diagnostics, file/symbol metrics, dead code, unused exports, code duplicates. Pass `sections` for per-category drill-down details.\n\n" + "Categories run in tiers — Tier 1 (todos, metrics) return synchronously from cache. Tier 2 (dead_code, unused_exports, duplicates) waits for a fresh reuse scan up to a short deadline; if a category is still scanning the response reports `complete: false` with `pending_categories: [...]` rather than a fabricated clean count. Pi may still trigger a deduped background warmup for categories that remain pending.\n\n" + `Use when: starting work on unfamiliar code, after multi-edit batches to check diagnostics, before a refactor, before review, or to verify cleanup completeness.
 
 ` + "Treat `dead_code` as a hint, not proof: reachability is call-based, so symbols reached only via method dispatch or referenced only in type position may be false positives — verify before deleting.",
     parameters: InspectParams,
@@ -35472,11 +35417,16 @@ function registerInspectTool(pi, ctx) {
       const sections = normalizeStringOrArray(params.sections);
       const scope = await resolveAndGateScope(extCtx, ctx, normalizeStringOrArray(params.scope));
       const topK = validateOptionalTopK(params.topK);
-      const response = await callBridge(bridge, "inspect", { sections, scope, topK }, extCtx);
+      const response = await callBridge(bridge, "inspect", { sections, scope, topK }, extCtx, {
+        keepBridgeOnTimeout: true
+      });
       runPendingTier2Categories(bridge, tier2RefreshCategories(response), extCtx);
       const body = response.text;
       if (typeof body === "string") {
-        const diagnostics = diagnosticsSummaryPart(asRecord3(response.summary));
+        const diagnosticsSummary = diagnosticsSummaryPart(asRecord3(response.summary));
+        const diagnosticsDetail = diagnosticsDetailSection(asRecord3(response.details));
+        const diagnostics = [diagnosticsSummary, diagnosticsDetail].filter(Boolean).join(`
+`);
         const text = diagnostics ? body ? `${body}
 
 ${diagnostics}` : diagnostics : body;
@@ -35540,7 +35490,7 @@ function registerNavigateTool(pi, ctx) {
   pi.registerTool({
     name: "aft_callgraph",
     label: "callgraph",
-    description: "Answer code-relationship questions from a real call graph — instead of grep + read chains. Reach for this whenever the question is about how symbols connect. All ops require both `filePath` and `symbol`. Use `callers` for call sites (before renaming/signature changes), `impact` for blast radius (what breaks if a symbol changes), `call_tree` for what a function calls, `trace_to` for how execution reaches a symbol from entry points, `trace_to_symbol` for the shortest path from one symbol to another (requires `toSymbol`; if ambiguous, the error returns candidate files — retry with `toFile`), `trace_data` to follow a value across assignments/params.",
+    description: "Answer code-relationship questions from a real call graph — instead of grep + read chains. Reach for this whenever the question is about how symbols connect. All ops require both `filePath` and `symbol`. Use `callers` for call sites (before renaming/signature changes), `impact` for blast radius (what breaks if a symbol changes), `call_tree` for what a function calls, `trace_to` for how execution reaches a symbol from entry points, `trace_to_symbol` for the shortest path from one symbol to another (requires `toSymbol`; if ambiguous, the error returns candidate files — retry with `toFile`), `trace_data` to follow a value across assignments/params. Markers: ~ = edge resolved by name only (may point at the wrong same-named symbol); [unresolved] = callee not resolved to a definition, so the location shown is the call site. Unmarked edges are resolved exactly.",
     parameters: navigateParamsSchema(),
     async execute(_toolCallId, params, _signal, _onUpdate, extCtx) {
       if (isEmptyParam(params.filePath)) {
@@ -35562,7 +35512,7 @@ function registerNavigateTool(pi, ctx) {
         if (checked.has(target))
           continue;
         checked.add(target);
-        await assertExternalDirectoryPermission(extCtx, target, "read", {
+        await assertExternalDirectoryPermission(extCtx, target, {
           restrictToProjectRoot: ctx.config.restrict_to_project_root ?? false
         });
       }
@@ -35642,7 +35592,7 @@ async function assertReadPathPermissions(extCtx, ctx, paths) {
     if (!target || checked.has(target))
       continue;
     checked.add(target);
-    await assertExternalDirectoryPermission(extCtx, target, "read", {
+    await assertExternalDirectoryPermission(extCtx, target, {
       restrictToProjectRoot: ctx.config.restrict_to_project_root ?? false
     });
   }
@@ -35769,8 +35719,8 @@ Pass a single \`target\`:
       parameters: OutlineParams,
       async execute(_toolCallId, params, _signal, _onUpdate, extCtx) {
         const bridge = bridgeFor(ctx, extCtx.cwd);
-        const target = params.target;
-        const filesMode = params.files === true;
+        const target = coerceTargetParam(params.target);
+        const filesMode = coerceBoolean(params.files);
         const isArray = Array.isArray(target) && target.length > 0;
         if (filesMode) {
           if (Array.isArray(target)) {
@@ -35868,7 +35818,7 @@ Pass a single \`target\`:
         const hasUrl = !isEmptyParam(params.url);
         const hasTargets = hasTargetsProvided(params.targets);
         const hasSymbols = !isEmptyParam(params.symbols);
-        const wantCallgraph = params.callgraph === true;
+        const wantCallgraph = coerceBoolean(params.callgraph);
         if (hasTargets) {
           if (hasFilePath || hasUrl || hasSymbols) {
             throw new Error("'targets' is mutually exclusive with 'filePath', 'url', and 'symbols'");
@@ -36137,7 +36087,7 @@ function registerRefactorTool(pi, ctx) {
         if (checked.has(target))
           continue;
         checked.add(target);
-        await assertExternalDirectoryPermission(extCtx, target, "modify", {
+        await assertExternalDirectoryPermission(extCtx, target, {
           restrictToProjectRoot: ctx.config.restrict_to_project_root ?? false
         });
       }
@@ -36290,7 +36240,7 @@ function registerSafetyTool(pi, ctx) {
           previewReq.file = filePath;
         const preview = await callBridge(bridge, "undo_preview", previewReq, extCtx);
         for (const file2 of new Set(responsePaths(preview))) {
-          await assertExternalDirectoryPermission(extCtx, file2, "modify", {
+          await assertExternalDirectoryPermission(extCtx, file2, {
             restrictToProjectRoot
           });
         }
@@ -36303,7 +36253,7 @@ function registerSafetyTool(pi, ctx) {
             if (checked.has(file2))
               continue;
             checked.add(file2);
-            await assertExternalDirectoryPermission(extCtx, file2, "modify", {
+            await assertExternalDirectoryPermission(extCtx, file2, {
               restrictToProjectRoot
             });
           }
@@ -36312,7 +36262,7 @@ function registerSafetyTool(pi, ctx) {
       if (params.op === "restore" && params.name) {
         const preview = await callBridge(bridge, "checkpoint_paths", { name: params.name }, extCtx);
         for (const file2 of new Set(responsePaths(preview))) {
-          await assertExternalDirectoryPermission(extCtx, file2, "modify", {
+          await assertExternalDirectoryPermission(extCtx, file2, {
             restrictToProjectRoot
           });
         }
@@ -36390,6 +36340,10 @@ var SearchParams2 = Type13.Object({
     Type13.Literal("auto")
   ], {
     description: "Optional routing hint. Defaults to 'auto'."
+  })),
+  includeTests: Type13.Optional(Type13.Boolean({
+    default: false,
+    description: "Include test files (*.test.*, *_test.rs, __tests__/, …) plus test-support, fixture, mock, snapshot, and corpus files. Defaults to false."
   }))
 });
 function buildSemanticSections(args, payload, theme) {
@@ -36495,6 +36449,8 @@ function registerSemanticTool(pi, ctx) {
         req.top_k = params.topK;
       if (params.hint !== undefined)
         req.hint = params.hint;
+      if (params.includeTests !== undefined)
+        req.include_tests = params.includeTests;
       const response = await callBridge(bridge, "semantic_search", req, extCtx);
       let agentText = response.text ?? "No results.";
       const extra = extraAgentHonestyNote(response);
@@ -36528,7 +36484,7 @@ function buildWorkflowHints(opts) {
   const hasBgBash = opts.bashBackgroundEnabled && hasBash && !opts.absentTools.has("bash_status");
   if (hasBash && opts.bashCompressionEnabled) {
     sections.push([
-      "**Test/build output**: bash output is auto-compressed — failures and the summary are always kept. DO NOT pipe test/build commands through filters to summarize; that hides failures:",
+      "**Test/build output**: bash output is auto-compressed for non-piped commands. Piped commands run verbatim and show the pipeline's output. For AFT's test/build summary, run the runner without filters:",
       "- `bun test | grep fail` → run `bun test`",
       "- `cargo test 2>&1 | tail -20` → run `cargo test`",
       "- `npm run build | head -50` → run `npm run build`"
@@ -36567,11 +36523,9 @@ function buildWorkflowHints(opts) {
   }
   if (hasBgBash) {
     sections.push([
-      `**Long-running commands** (builds, installs, full test suites): \`${bashName}({ background: true })\` returns a \`task_id\` immediately.`,
-      "1. Nothing else useful to do (a build/test/validation whose result is the next thing you need) → sync `bash_watch` to block until it exits (pass a longer timeout_ms for long commands; the user can interrupt).",
-      "2. Useful parallel work available → end your turn; the completion reminder delivers the result. (Or spawn a subagent for the side work.)",
-      "3. Want to react to a specific early output line → async `bash_watch` (background:true + pattern).",
-      "Never loop `bash_status` to wait — it's a one-shot inspector, not a wait primitive."
+      `**Long-running commands** (builds, installs, full test suites): run them in the FOREGROUND — \`${bashName}({ command })\` waits and returns the result in ONE step, and if it outlives the short wait window it auto-promotes to background and delivers a completion reminder when it finishes. Don't reach for \`background: true\` for the common "I'm waiting on this result" case — that costs an extra turn.`,
+      "- `background: true` is ONLY for when you have OTHER useful work to do while it runs: start it, do the other work, and the completion reminder delivers the result (or spawn a subagent for the side work). Do NOT background a command and then immediately `bash_watch` it — that spends a whole extra turn waiting for something foreground returns in one.",
+      "- `bash_watch` is for blocking on an ALREADY-backgrounded task once you've run out of parallel work (sync — the user can interrupt), or reacting to a specific early output line (async: background:true + pattern). Never loop `bash_status` to wait — it's a one-shot inspector."
     ].join(`
 `));
     sections.push(`**PTY / interactive commands**: PTY mode is for interactive REPLs and terminal apps (python, node, bash itself, vim). Start with \`${bashName}({ command: "python", pty: true, background: true })\`, read the screen with \`bash_status({ task_id, output_mode: "screen" })\`, and send input with \`bash_write({ task_id, input: "..." })\`.`);
@@ -36673,11 +36627,12 @@ var PLUGIN_VERSION = (() => {
     return "0.0.0";
   }
 })();
-var ANNOUNCEMENT_VERSION = "0.39.0";
+var ANNOUNCEMENT_VERSION = "0.40.0";
 var ANNOUNCEMENT_FEATURES = [
-  "Accurate Rust dead code: constructors and associated functions reached through receiver-type inference are no longer mis-reported as dead.",
-  "Code Health scans reparse only the file you changed instead of the whole project on every edit — a single-file edit dropped from ~3s of scan work to ~130ms on this repo, byte-identical results.",
-  "R language support in outline, zoom, and the AST tools."
+  "Groundwork for Subconscious, the CortexKit daemon: configuration now lives in one place under ~/.config/cortexkit/ and <project>/.cortexkit/ (auto-migrated). The daemon integration is dormant — nothing changes in how you run AFT today.",
+  "Bash output never hides a failure: piped commands run exactly as written with their real exit status, cancelled tasks report as failed, and a failing run is never compressed to a clean-looking summary.",
+  "The top aft_search result is now the complete, ready-to-edit symbol (no re-read needed); test files are hidden from results by default.",
+  "format_on_edit is now off by default, and bash commands default to the foreground."
 ];
 var ANNOUNCEMENT_FOOTER = "Join us on Discord: https://discord.gg/DSa65w8wuf";
 var ALL_ONLY_TOOLS = new Set(["aft_callgraph", "aft_delete", "aft_move", "aft_refactor"]);
@@ -36686,11 +36641,25 @@ function isConfigureWarning(value) {
   if (!value || typeof value !== "object" || Array.isArray(value))
     return false;
   const warning = value;
-  return (warning.kind === "formatter_not_installed" || warning.kind === "checker_not_installed" || warning.kind === "lsp_binary_missing" || warning.kind === "config_parse_failed") && typeof warning.hint === "string";
+  return (warning.kind === "formatter_not_installed" || warning.kind === "checker_not_installed" || warning.kind === "lsp_binary_missing" || warning.kind === "config_parse_failed" || warning.kind === "config_key_dropped") && typeof warning.hint === "string";
 }
 function coerceConfigureWarnings(warnings) {
   return warnings.filter(isConfigureWarning);
 }
+function isDroppedConfigKey(value) {
+  if (!value || typeof value !== "object" || Array.isArray(value))
+    return false;
+  const dropped = value;
+  return typeof dropped.key === "string" && typeof dropped.tier === "string" && typeof dropped.reason === "string";
+}
+function coerceDroppedKeyWarnings(droppedKeys) {
+  if (!Array.isArray(droppedKeys))
+    return [];
+  return formatDroppedKeyWarnings(droppedKeys.filter(isDroppedConfigKey)).map((hint) => ({
+    kind: "config_key_dropped",
+    hint
+  }));
+}
 function drainPendingEagerWarnings(projectRoot) {
   const pending = pendingEagerWarnings.get(projectRoot) ?? [];
   pendingEagerWarnings.delete(projectRoot);
@@ -36717,7 +36686,10 @@ function bridgeDirectoryFromCallback(bridge, fallback) {
   return typeof cwd === "string" && cwd.length > 0 ? cwd : fallback;
 }
 async function handleConfigureWarningsForSession(context) {
-  const validWarnings = coerceConfigureWarnings(context.warnings);
+  const validWarnings = [
+    ...coerceConfigureWarnings(context.warnings),
+    ...coerceDroppedKeyWarnings(context.configDroppedKeys)
+  ];
   if (!context.sessionId) {
     if (validWarnings.length === 0)
       return;
@@ -36815,6 +36787,25 @@ async function src_default(pi) {
     return;
   }
   await ensureStorageMigrated({ harness: "pi", binaryPath, logger: bridgeLogger });
+  const deliverConfigMigrationWarnings = (messages) => {
+    for (const message of messages) {
+      const notify = pi.ui?.notify;
+      if (typeof notify === "function") {
+        try {
+          notify(message, "warning");
+          continue;
+        } catch (err) {
+          warn2(`[config] failed to deliver migration notification: ${err}`);
+        }
+      }
+      try {
+        process.stderr.write(`
+[AFT] ${message}
+`);
+      } catch {}
+    }
+  };
+  deliverConfigMigrationWarnings(migrateAftConfigLocations(process.cwd(), bridgeLogger).flatMap((result) => result.warnings));
   const config2 = loadAftConfig(process.cwd());
   enqueueConfigParseWarnings(process.cwd(), getConfigLoadErrors());
   const storageDir = resolveCortexKitStorageRoot();
@@ -36825,10 +36816,9 @@ async function src_default(pi) {
       return null;
     });
   }
-  const configOverrides = resolveProjectOverridesForConfigure(config2);
-  if (config2.url_fetch_allow_private !== undefined)
-    configOverrides.url_fetch_allow_private = config2.url_fetch_allow_private;
-  configOverrides.storage_dir = storageDir;
+  const configOverrides = buildConfigTierConfigureParams(process.cwd(), {
+    storage_dir: storageDir
+  });
   try {
     const lspAutoInstall = config2.lsp?.auto_install ?? true;
     const lspGraceDays = config2.lsp?.grace_days ?? 7;
@@ -36896,7 +36886,7 @@ ${lines}
     errorPrefix: "[aft-pi]",
     minVersion: PLUGIN_VERSION,
     onVersionMismatch: createVersionMismatchHandler(() => pool),
-    onConfigureWarnings: ({ projectRoot, sessionId, client, warnings }) => {
+    onConfigureWarnings: ({ projectRoot, sessionId, client, warnings, configDroppedKeys }) => {
       const bridge = pool.getActiveBridgeForRoot(projectRoot);
       if (!bridge)
         return;
@@ -36908,6 +36898,7 @@ ${lines}
           client,
           bridge,
           warnings: [...pendingWarnings, ...warnings],
+          configDroppedKeys,
           storageDir,
           pluginVersion: PLUGIN_VERSION
         });
@@ -36967,7 +36958,7 @@ ${lines}
       if (onnxRuntimePromise) {
         await Promise.race([
           onnxRuntimePromise,
-          new Promise((resolve5) => setTimeout(() => resolve5(null), 60000))
+          new Promise((resolve9) => setTimeout(() => resolve9(null), 60000))
         ]);
       }
       const bridge = pool.getBridge(cwd);