@cortexkit/aft 0.42.0 → 0.43.0

package/dist/index.js

@@ -394,6 +394,15 @@ var init_bridge = __esm(() => {
     async send(command, params = {}, options) {
       return this.sendWithVersionMismatchRetry(command, params, options, true);
     }
+    async toolCall(sessionId, name, rawArgs = {}, options) {
+      const params = { name, arguments: rawArgs };
+      if (sessionId)
+        params.session_id = sessionId;
+      const { preview, ...sendOptions } = options ?? {};
+      if (preview === true)
+        params.preview = true;
+      return await this.send("tool_call", params, Object.keys(sendOptions).length > 0 ? sendOptions : undefined);
+    }
     async sendWithVersionMismatchRetry(command, params, options, canRetryAfterVersionSwap) {
       try {
         if (this._shuttingDown) {
@@ -1078,6 +1087,9 @@ function configHome() {
 function resolveCortexKitUserConfigPath() {
   return join2(configHome(), "cortexkit", "aft.jsonc");
 }
+function resolveCortexKitProjectConfigPath(projectDirectory) {
+  return join2(projectDirectory, ".cortexkit", "aft.jsonc");
+}
 var init_paths = () => {};
 
 // ../aft-bridge/dist/resolver.js
@@ -1377,124 +1389,2147 @@ class BridgePool {
     let projectOverrides = {};
     if (this.projectConfigLoader) {
       try {
-        projectOverrides = this.projectConfigLoader(key) ?? {};
-      } catch (err) {
-        const message = err instanceof Error ? err.message : String(err);
-        this.error(`projectConfigLoader failed; using global overrides only: ${message}`);
-      }
+        projectOverrides = this.projectConfigLoader(key) ?? {};
+      } catch (err) {
+        const message = err instanceof Error ? err.message : String(err);
+        this.error(`projectConfigLoader failed; using global overrides only: ${message}`);
+      }
+    }
+    const mergedOverrides = { ...this.configOverrides, ...projectOverrides };
+    const bridge = new BinaryBridge(this.binaryPath, key, this.bridgeOptions, mergedOverrides);
+    this.bridges.set(key, { bridge, lastUsed: Date.now() });
+    return bridge;
+  }
+  async toolCall(projectRoot, runtime, name, rawArgs = {}, options) {
+    return this.getBridge(projectRoot).toolCall(runtime.sessionID, name, rawArgs, options);
+  }
+  cleanup() {
+    const now = Date.now();
+    for (const [dir, entry] of this.bridges) {
+      if (entry.bridge.hasPendingRequests() || entry.bridge.hasOutstandingBackgroundTasks())
+        continue;
+      if (now - entry.lastUsed > this.idleTimeoutMs) {
+        entry.bridge.shutdown().catch((err) => this.error("cleanup shutdown failed:", err));
+        this.bridges.delete(dir);
+      }
+    }
+    for (const bridge of this.staleBridges) {
+      if (bridge.hasPendingRequests() || bridge.hasOutstandingBackgroundTasks())
+        continue;
+      bridge.shutdown().catch((err) => this.error("stale cleanup shutdown failed:", err));
+      this.staleBridges.delete(bridge);
+    }
+  }
+  evictLRU() {
+    let oldestDir = null;
+    let oldestTime = Infinity;
+    for (const [dir, entry] of this.bridges) {
+      if (entry.bridge.hasPendingRequests() || entry.bridge.hasOutstandingBackgroundTasks())
+        continue;
+      if (entry.lastUsed < oldestTime) {
+        oldestTime = entry.lastUsed;
+        oldestDir = dir;
+      }
+    }
+    if (oldestDir) {
+      const entry = this.bridges.get(oldestDir);
+      entry?.bridge.shutdown().catch((err) => this.error("eviction shutdown failed:", err));
+      this.bridges.delete(oldestDir);
+    }
+  }
+  async closeSession(_projectRoot, _session) {}
+  async shutdown() {
+    if (this.cleanupTimer) {
+      clearInterval(this.cleanupTimer);
+      this.cleanupTimer = null;
+    }
+    const shutdowns = [
+      ...Array.from(this.bridges.values(), (e) => e.bridge.shutdown()),
+      ...Array.from(this.staleBridges.values(), (bridge) => bridge.shutdown())
+    ];
+    this.bridges.clear();
+    this.staleBridges.clear();
+    await Promise.allSettled(shutdowns);
+  }
+  async replaceBinary(newPath) {
+    this.binaryPath = newPath;
+    for (const entry of this.bridges.values()) {
+      this.staleBridges.add(entry.bridge);
+    }
+    this.bridges.clear();
+    this.log(`Binary path updated to ${newPath}. Active bridges marked stale — next calls will use the new binary.`);
+    return newPath;
+  }
+  log(message, meta) {
+    const logger = this.logger ?? getActiveLogger();
+    if (logger) {
+      try {
+        logger.log(message, meta);
+      } catch (err) {
+        console.error(`[aft-bridge] ERROR: pool logger log threw: ${err instanceof Error ? err.message : String(err)}`);
+        console.error(`[aft-bridge] ${message}`);
+      }
+    } else
+      log(message, meta);
+  }
+  error(message, meta) {
+    const logger = this.logger ?? getActiveLogger();
+    if (logger) {
+      try {
+        logger.error(message, meta);
+      } catch (err) {
+        console.error(`[aft-bridge] ERROR: pool logger error threw: ${err instanceof Error ? err.message : String(err)}`);
+        console.error(`[aft-bridge] ERROR: ${message}`);
+      }
+    } else
+      error(message, meta);
+  }
+  setConfigureOverride(key, value) {
+    if (value === undefined) {
+      delete this.configOverrides[key];
+    } else {
+      this.configOverrides[key] = value;
+    }
+  }
+  get size() {
+    return this.bridges.size;
+  }
+  _testGetConfigOverrides() {
+    return { ...this.configOverrides };
+  }
+  _testGetBridgeOptions() {
+    return { ...this.bridgeOptions };
+  }
+}
+function normalizeKey(projectRoot) {
+  return canonicalizeProjectRoot(projectRoot);
+}
+var DEFAULT_IDLE_TIMEOUT_MS, DEFAULT_MAX_POOL_SIZE = 8, CLEANUP_INTERVAL_MS;
+var init_pool = __esm(() => {
+  init_active_logger();
+  init_bridge();
+  init_project_identity();
+  DEFAULT_IDLE_TIMEOUT_MS = 30 * 60 * 1000;
+  CLEANUP_INTERVAL_MS = 60 * 1000;
+});
+
+// ../../node_modules/.bun/@cortexkit+subc-client@0.2.0/node_modules/@cortexkit/subc-client/src/auth.ts
+import { createHmac, randomBytes, timingSafeEqual } from "node:crypto";
+function computeProof(key, domain, clientNonce, serverNonce, daemonId) {
+  const mac = createHmac("sha256", Buffer.from(key));
+  mac.update(Buffer.from(domain, "utf8"));
+  mac.update(Buffer.from(clientNonce));
+  mac.update(Buffer.from(serverNonce));
+  mac.update(Buffer.from(daemonId));
+  return new Uint8Array(mac.digest());
+}
+function constantTimeEq(a, b) {
+  if (a.length !== b.length)
+    return false;
+  return timingSafeEqual(Buffer.from(a), Buffer.from(b));
+}
+async function writeMessage(sock, value, deadlineMs) {
+  const json = Buffer.from(JSON.stringify(value), "utf8");
+  if (json.length > MAX_AUTH_MESSAGE_LEN) {
+    throw new AuthError(`auth message too large: ${json.length} > ${MAX_AUTH_MESSAGE_LEN}`);
+  }
+  const lenPrefix = new Uint8Array(4);
+  new DataView(lenPrefix.buffer).setUint32(0, json.length, true);
+  await sock.write(lenPrefix, deadlineMs);
+  await sock.write(json, deadlineMs);
+}
+async function readMessage(sock, deadlineMs) {
+  const lenBytes = await sock.readExact(4, deadlineMs);
+  const len = new DataView(lenBytes.buffer, lenBytes.byteOffset, 4).getUint32(0, true);
+  if (len > MAX_AUTH_MESSAGE_LEN) {
+    throw new AuthError(`auth message too large: ${len} > ${MAX_AUTH_MESSAGE_LEN}`);
+  }
+  const body = len === 0 ? new Uint8Array(0) : await sock.readExact(len, deadlineMs);
+  try {
+    return JSON.parse(Buffer.from(body).toString("utf8"));
+  } catch (err) {
+    throw new AuthError(`auth message JSON decode failed: ${String(err)}`);
+  }
+}
+async function authenticateClient(sock, conn, deadlineMs) {
+  const clientNonce = new Uint8Array(randomBytes(NONCE_LEN));
+  await writeMessage(sock, { client_nonce: Array.from(clientNonce), role: DEFAULT_CLIENT_ROLE }, deadlineMs);
+  const proof = await readMessage(sock, deadlineMs);
+  const serverNonce = Uint8Array.from(proof.server_nonce);
+  const daemonId = Uint8Array.from(proof.daemon_id);
+  const serverProof = Uint8Array.from(proof.server_proof);
+  const expected = computeProof(conn.key, SERVER_PROOF_DOMAIN, clientNonce, serverNonce, daemonId);
+  if (!constantTimeEq(expected, serverProof)) {
+    throw new AuthError("server proof mismatch — wrong key or impostor daemon");
+  }
+  if (!constantTimeEq(daemonId, conn.daemonId)) {
+    throw new AuthError("daemon id mismatch — connection file points at a different daemon");
+  }
+  const clientAuth = computeProof(conn.key, CLIENT_AUTH_DOMAIN, clientNonce, serverNonce, daemonId);
+  await writeMessage(sock, { client_auth: Array.from(clientAuth) }, deadlineMs);
+}
+var NONCE_LEN = 32, MAX_AUTH_MESSAGE_LEN = 4096, SERVER_PROOF_DOMAIN = "subc-server-v1", CLIENT_AUTH_DOMAIN = "subc-client-v1", DEFAULT_CLIENT_ROLE = "client", AuthError;
+var init_auth = __esm(() => {
+  AuthError = class AuthError extends Error {
+  };
+});
+
+// ../../node_modules/.bun/@cortexkit+subc-client@0.2.0/node_modules/@cortexkit/subc-client/src/connection-file.ts
+import { promises as fs } from "node:fs";
+function toBytes(value, field) {
+  if (!Array.isArray(value) || value.some((n) => typeof n !== "number")) {
+    throw new ConnectionFileError(`connection file field '${field}' must be a JSON array of bytes`);
+  }
+  return Uint8Array.from(value);
+}
+function validate(info) {
+  if (info.schema !== SCHEMA_VERSION) {
+    throw new ConnectionFileError(`unsupported connection file schema ${info.schema}; expected ${SCHEMA_VERSION}`);
+  }
+  if (info.endpoints.length === 0) {
+    throw new ConnectionFileError("connection file must include at least one endpoint");
+  }
+  if (info.key.length < MIN_KEY_LEN) {
+    throw new ConnectionFileError(`connection file key is too short: ${info.key.length} bytes, need at least ${MIN_KEY_LEN}`);
+  }
+  if (info.daemonId.length !== DAEMON_ID_LEN) {
+    throw new ConnectionFileError(`connection file daemon_id must be ${DAEMON_ID_LEN} bytes, got ${info.daemonId.length}`);
+  }
+}
+async function verifyOwnerOnly(path) {
+  if (process.platform === "win32")
+    return;
+  const stat = await fs.stat(path);
+  const mode = stat.mode & 511;
+  if ((mode & 63) !== 0) {
+    throw new ConnectionFileError(`connection file ${path} has insecure permissions 0o${mode.toString(8)}; expected owner-only 0600`);
+  }
+}
+async function readConnectionFile(path) {
+  await verifyOwnerOnly(path);
+  const raw = await fs.readFile(path, "utf8");
+  let parsed;
+  try {
+    parsed = JSON.parse(raw);
+  } catch (err) {
+    throw new ConnectionFileError(`connection file JSON read failed for ${path}: ${String(err)}`);
+  }
+  const endpointsRaw = parsed.endpoints;
+  if (!Array.isArray(endpointsRaw)) {
+    throw new ConnectionFileError("connection file 'endpoints' must be an array");
+  }
+  const endpoints = endpointsRaw.map((e) => {
+    const ep = e;
+    if (typeof ep.host !== "string" || typeof ep.port !== "number") {
+      throw new ConnectionFileError("connection file endpoint must be { host: string, port: number }");
+    }
+    return { host: ep.host, port: ep.port };
+  });
+  const info = {
+    schema: parsed.schema,
+    endpoints,
+    key: toBytes(parsed.key, "key"),
+    daemonId: toBytes(parsed.daemon_id, "daemon_id"),
+    pid: parsed.pid,
+    daemonVer: parsed.daemon_ver ?? ""
+  };
+  validate(info);
+  return info;
+}
+var SCHEMA_VERSION = 1, MIN_KEY_LEN = 32, DAEMON_ID_LEN = 16, ConnectionFileError;
+var init_connection_file = __esm(() => {
+  ConnectionFileError = class ConnectionFileError extends Error {
+  };
+});
+
+// ../../node_modules/.bun/@cortexkit+subc-client@0.2.0/node_modules/@cortexkit/subc-client/src/envelope.ts
+function isPureHeader(ty) {
+  return ty === 6 /* Cancel */ || ty === 7 /* Ping */ || ty === 8 /* Pong */ || ty === 11 /* Goodbye */;
+}
+function buildFlags(binary, priority, last) {
+  let b = 0;
+  if (binary)
+    b |= FLAG_BINARY;
+  b |= priority << FLAG_PRIORITY_SHIFT;
+  if (last)
+    b |= FLAG_LAST;
+  return b;
+}
+function encodeHeader(h) {
+  const buf = new Uint8Array(HEADER_LEN);
+  const view = new DataView(buf.buffer);
+  view.setUint32(0, h.len, true);
+  buf[4] = h.ver;
+  buf[5] = h.ty;
+  buf[6] = h.flags;
+  view.setUint16(7, h.channel, true);
+  view.setBigUint64(9, h.corr, true);
+  return buf;
+}
+function decodeHeader(bytes) {
+  if (bytes.length < FROZEN_PREFIX_LEN) {
+    throw new DecodeError(`header shorter than frozen prefix: have ${bytes.length} bytes`);
+  }
+  const ver = bytes[4];
+  if (ver !== PROTOCOL_VERSION) {
+    throw new DecodeError(`unsupported envelope version ${ver}`);
+  }
+  if (bytes.length < HEADER_LEN) {
+    throw new DecodeError(`header too short for version: have ${bytes.length} bytes, need ${HEADER_LEN}`);
+  }
+  const view = new DataView(bytes.buffer, bytes.byteOffset, bytes.byteLength);
+  const len = view.getUint32(0, true);
+  const tyByte = bytes[5];
+  if (tyByte > FRAME_TYPE_MAX) {
+    throw new DecodeError(`unknown frame type byte ${tyByte}`);
+  }
+  const ty = tyByte;
+  const flags = bytes[6];
+  if ((flags & FLAG_RESERVED_MASK) !== 0) {
+    throw new DecodeError(`reserved flag bits set in flags 0b${flags.toString(2)}`);
+  }
+  if ((flags & FLAG_PRIORITY_MASK) >> FLAG_PRIORITY_SHIFT === 3) {
+    throw new DecodeError(`reserved priority bits set in flags 0b${flags.toString(2)}`);
+  }
+  if (isPureHeader(ty) && len !== 0) {
+    throw new DecodeError(`pure-header frame ${FrameType[ty]} declared non-zero body length ${len}`);
+  }
+  const channel = view.getUint16(7, true);
+  const corr = view.getBigUint64(9, true);
+  return { len, ver, ty, flags, channel, corr };
+}
+function buildFrame(ty, flags, channel, corr, body) {
+  return buildFrameWithVersion(PROTOCOL_VERSION, ty, flags, channel, corr, body);
+}
+function buildFrameWithVersion(ver, ty, flags, channel, corr, body) {
+  if (body.length > MAX_FRAME_BODY_LEN) {
+    throw new DecodeError(`frame body ${body.length} exceeds max ${MAX_FRAME_BODY_LEN}`);
+  }
+  if (isPureHeader(ty) && body.length !== 0) {
+    throw new DecodeError(`pure-header frame ${FrameType[ty]} cannot carry a body`);
+  }
+  return {
+    header: { len: body.length, ver, ty, flags, channel, corr },
+    body
+  };
+}
+function encodeFrame(frame) {
+  const header = encodeHeader(frame.header);
+  const out = new Uint8Array(header.length + frame.body.length);
+  out.set(header, 0);
+  out.set(frame.body, header.length);
+  return out;
+}
+var PROTOCOL_VERSION = 1, HEADER_LEN = 17, FROZEN_PREFIX_LEN = 5, MAX_FRAME_BODY_LEN, FrameType, FRAME_TYPE_MAX = 11 /* Goodbye */, FLAG_BINARY = 1, FLAG_PRIORITY_MASK = 6, FLAG_PRIORITY_SHIFT = 1, FLAG_LAST = 8, FLAG_RESERVED_MASK = 240, DecodeError;
+var init_envelope = __esm(() => {
+  MAX_FRAME_BODY_LEN = 64 * 1024 * 1024;
+  ((FrameType2) => {
+    FrameType2[FrameType2["Request"] = 0] = "Request";
+    FrameType2[FrameType2["Response"] = 1] = "Response";
+    FrameType2[FrameType2["Push"] = 2] = "Push";
+    FrameType2[FrameType2["StreamData"] = 3] = "StreamData";
+    FrameType2[FrameType2["StreamEnd"] = 4] = "StreamEnd";
+    FrameType2[FrameType2["Error"] = 5] = "Error";
+    FrameType2[FrameType2["Cancel"] = 6] = "Cancel";
+    FrameType2[FrameType2["Ping"] = 7] = "Ping";
+    FrameType2[FrameType2["Pong"] = 8] = "Pong";
+    FrameType2[FrameType2["Hello"] = 9] = "Hello";
+    FrameType2[FrameType2["HelloAck"] = 10] = "HelloAck";
+    FrameType2[FrameType2["Goodbye"] = 11] = "Goodbye";
+  })(FrameType ||= {});
+  DecodeError = class DecodeError extends Error {
+  };
+});
+
+// ../../node_modules/.bun/@cortexkit+subc-client@0.2.0/node_modules/@cortexkit/subc-client/src/socket.ts
+import net from "node:net";
+
+class SubcSocket {
+  sock;
+  chunks = [];
+  buffered = 0;
+  waiter = null;
+  closedErr = null;
+  constructor(sock) {
+    this.sock = sock;
+    sock.on("data", (chunk) => {
+      this.chunks.push(chunk);
+      this.buffered += chunk.length;
+      this.tryServe();
+    });
+    const fail = (err) => {
+      if (!this.closedErr)
+        this.closedErr = err;
+      this.tryServe();
+    };
+    sock.on("error", (err) => fail(err instanceof Error ? err : new Error(String(err))));
+    sock.on("end", () => fail(new SocketClosedError("subc closed the connection")));
+    sock.on("close", () => fail(new SocketClosedError("subc connection closed")));
+  }
+  static connect(host, port, deadlineMs) {
+    return new Promise((resolve4, reject) => {
+      const sock = net.connect({ host, port });
+      sock.setNoDelay(true);
+      const timer = setTimeout(() => {
+        sock.destroy();
+        reject(new SocketTimeoutError(`timed out connecting to ${host}:${port}`));
+      }, Math.max(0, deadlineMs - Date.now()));
+      sock.once("connect", () => {
+        clearTimeout(timer);
+        resolve4(new SubcSocket(sock));
+      });
+      sock.once("error", (err) => {
+        clearTimeout(timer);
+        reject(err);
+      });
+    });
+  }
+  readExact(n, deadlineMs) {
+    if (this.waiter) {
+      return Promise.reject(new Error("concurrent readExact is not supported"));
+    }
+    if (n === 0)
+      return Promise.resolve(new Uint8Array(0));
+    return new Promise((resolve4, reject) => {
+      let timer = null;
+      if (Number.isFinite(deadlineMs)) {
+        const remaining = deadlineMs - Date.now();
+        if (remaining <= 0) {
+          reject(new SocketTimeoutError(`timed out waiting for ${n} bytes`));
+          return;
+        }
+        timer = setTimeout(() => {
+          this.waiter = null;
+          reject(new SocketTimeoutError(`timed out waiting for ${n} bytes`));
+        }, remaining);
+      }
+      this.waiter = { need: n, resolve: resolve4, reject, timer };
+      this.tryServe();
+    });
+  }
+  async write(bytes, deadlineMs) {
+    try {
+      await this.writeTracked(bytes, deadlineMs).completed;
+    } catch (err) {
+      if (err instanceof SocketWriteNotQueuedError || err instanceof SocketWriteQueuedError) {
+        throw err.cause ?? err;
+      }
+      throw err;
+    }
+  }
+  writeTracked(bytes, deadlineMs) {
+    if (this.closedErr) {
+      return {
+        queued: false,
+        completed: Promise.reject(new SocketWriteNotQueuedError("subc socket was closed before bytes could be queued", this.closedErr))
+      };
+    }
+    let queued = false;
+    let settled = false;
+    let timer = null;
+    const completed = new Promise((resolve4, reject) => {
+      const settle = (run) => {
+        if (settled)
+          return;
+        settled = true;
+        if (timer)
+          clearTimeout(timer);
+        run();
+      };
+      const remaining = deadlineMs - Date.now();
+      if (remaining <= 0) {
+        settle(() => reject(new SocketWriteNotQueuedError("timed out before bytes could be queued to subc", new SocketTimeoutError("timed out writing to subc"))));
+        return;
+      }
+      timer = setTimeout(() => {
+        const timeout = new SocketTimeoutError("timed out writing to subc");
+        settle(() => reject(queued ? new SocketWriteQueuedError("timed out after bytes were handed to the subc socket", timeout) : new SocketWriteNotQueuedError("timed out before bytes could be queued to subc", timeout)));
+      }, remaining);
+      try {
+        this.sock.write(Buffer.from(bytes), (err) => {
+          settle(() => {
+            if (err) {
+              reject(new SocketWriteQueuedError("subc socket reported a write error after bytes were handed to the socket", err instanceof Error ? err : new Error(String(err))));
+            } else {
+              resolve4();
+            }
+          });
+        });
+        queued = true;
+      } catch (err) {
+        settle(() => reject(new SocketWriteNotQueuedError("subc socket write threw before bytes could be queued", err instanceof Error ? err : new Error(String(err)))));
+      }
+    });
+    return { queued, completed };
+  }
+  close() {
+    this.sock.destroy();
+  }
+  tryServe() {
+    const w = this.waiter;
+    if (!w)
+      return;
+    if (this.buffered >= w.need) {
+      const out = this.take(w.need);
+      this.waiter = null;
+      if (w.timer)
+        clearTimeout(w.timer);
+      w.resolve(out);
+      return;
+    }
+    if (this.closedErr) {
+      this.waiter = null;
+      if (w.timer)
+        clearTimeout(w.timer);
+      w.reject(this.closedErr);
+    }
+  }
+  take(n) {
+    const out = Buffer.allocUnsafe(n);
+    let off = 0;
+    while (off < n) {
+      const head = this.chunks[0];
+      const want = n - off;
+      if (head.length <= want) {
+        head.copy(out, off);
+        off += head.length;
+        this.chunks.shift();
+      } else {
+        head.copy(out, off, 0, want);
+        this.chunks[0] = head.subarray(want);
+        off += want;
+      }
+    }
+    this.buffered -= n;
+    return out;
+  }
+}
+var SocketClosedError, SocketTimeoutError, SocketWriteNotQueuedError, SocketWriteQueuedError;
+var init_socket = __esm(() => {
+  SocketClosedError = class SocketClosedError extends Error {
+  };
+  SocketTimeoutError = class SocketTimeoutError extends Error {
+  };
+  SocketWriteNotQueuedError = class SocketWriteNotQueuedError extends Error {
+    cause;
+    constructor(message, cause) {
+      super(message);
+      this.cause = cause;
+    }
+  };
+  SocketWriteQueuedError = class SocketWriteQueuedError extends Error {
+    cause;
+    constructor(message, cause) {
+      super(message);
+      this.cause = cause;
+    }
+  };
+});
+
+// ../../node_modules/.bun/@cortexkit+subc-client@0.2.0/node_modules/@cortexkit/subc-client/src/client.ts
+import { promises as fs2 } from "node:fs";
+
+class SubcClient {
+  sock;
+  currentConn;
+  opts;
+  nextCorr = 1n;
+  pending = new Map;
+  routes = new Map;
+  closedErr = null;
+  closeStarted = false;
+  reconnecting = null;
+  generation = 1;
+  constructor(sock, currentConn, opts) {
+    this.sock = sock;
+    this.currentConn = currentConn;
+    this.opts = opts;
+    this.readLoop(sock, this.generation);
+  }
+  get conn() {
+    return this.currentConn;
+  }
+  static async connect(opts) {
+    const normalized = normalizeConnectOptions(opts);
+    const opened = await SubcClient.openConnection(normalized);
+    return new SubcClient(opened.sock, opened.conn, normalized);
+  }
+  async catalogList(moduleId) {
+    const body = this.encode(moduleId === undefined ? { op: "catalog.list" } : { op: "catalog.list", module_id: moduleId });
+    const reply = await this.controlRpc(body);
+    const parsed = this.parseJson(reply);
+    return parsed.modules ?? [];
+  }
+  async routeOpen(target, identity, opts = {}) {
+    const consumerIdentity = routeOpenConsumerIdentity(opts);
+    const body = this.encode({
+      op: "route.open",
+      target,
+      identity,
+      ...consumerIdentity ? { consumer_identity: consumerIdentity } : {}
+    });
+    const reply = await this.controlRpc(body);
+    const parsed = this.parseJson(reply);
+    if (typeof parsed.route_channel !== "number") {
+      throw new SubcError(`route.open returned no route_channel: ${JSON.stringify(parsed)}`);
+    }
+    return parsed.route_channel;
+  }
+  async request(routeChannel, body, opts = {}) {
+    const bytes = body instanceof Uint8Array ? body : this.encode(body);
+    const priority = opts.priority ?? 1 /* Interactive */;
+    const reply = await this.send(routeChannel, bytes, priority, opts.timeoutMs, opts.onProgress);
+    return this.parseJson(reply);
+  }
+  async call(moduleId, method, params, opts = {}) {
+    const body = params === undefined ? { method } : { method, params };
+    for (;; ) {
+      const routeChannel = await this.cachedRouteChannel(moduleId, opts);
+      try {
+        return await this.managedRequest(routeChannel, body, opts);
+      } catch (err) {
+        if (!(err instanceof SubcCallError))
+          throw this.terminalCallError("managed call failed", err);
+        if (err.kind === "not_sent") {
+          try {
+            await this.reconnectAfterDrop(err);
+          } catch (reconnectErr) {
+            throw this.notSentRecoveryError("managed call was not sent", reconnectErr);
+          }
+          continue;
+        }
+        if (err.kind === "outcome_unknown") {
+          this.scheduleReconnectAfterDrop(err);
+        }
+        throw err;
+      }
+    }
+  }
+  subscribe(routeChannel, body, onEvent, opts = {}) {
+    const bytes = body instanceof Uint8Array ? body : this.encode(body);
+    const priority = opts.priority ?? 1 /* Interactive */;
+    const corr = this.nextCorr++;
+    const key = `${routeChannel}:${corr}`;
+    const closed = new Promise((resolve4, reject) => {
+      if (this.closedErr) {
+        reject(this.closedErr);
+        return;
+      }
+      this.pending.set(key, {
+        channel: routeChannel,
+        resolve: () => resolve4(),
+        reject,
+        onProgress: onEvent,
+        timer: null,
+        subscription: true
+      });
+      const frame = buildFrame(0 /* Request */, buildFlags(false, priority, false), routeChannel, corr, bytes);
+      this.sock.write(encodeFrame(frame), Date.now() + DEFAULT_REQUEST_TIMEOUT_MS).catch((err) => {
+        const p = this.pending.get(key);
+        if (p)
+          this.rejectPending(key, p, err instanceof Error ? err : new SubcError(String(err)));
+      });
+    });
+    let cancelled = false;
+    const unsubscribe = () => {
+      if (cancelled)
+        return;
+      cancelled = true;
+      const cancel = buildFrame(6 /* Cancel */, buildFlags(false, priority, false), routeChannel, corr, EMPTY_BODY);
+      this.sock.write(encodeFrame(cancel), Date.now() + DEFAULT_REQUEST_TIMEOUT_MS).catch(() => {});
+    };
+    return { unsubscribe, closed };
+  }
+  async closeRoute(target, identity, opts = {}) {
+    const key = routeCacheKey(target, identity, routeOpenConsumerIdentity(opts));
+    const cached = this.routes.get(key);
+    if (!cached)
+      return;
+    cached.closed = true;
+    this.routes.delete(key);
+    const channel = cached.channel;
+    cached.channel = null;
+    if (channel !== null)
+      await this.closeRouteChannel(channel, opts);
+  }
+  async closeRouteChannel(channel, opts = {}) {
+    if (channel === 0)
+      return;
+    if (opts.drain) {
+      await this.drainUnaryOnChannel(channel);
+    }
+    this.failChannel(channel, new SubcError("route closed by closeRoute", "route_closed"));
+    this.sendRouteGoodbye(channel);
+  }
+  close() {
+    this.closeStarted = true;
+    this.fail(new SubcError("client closed"));
+    this.sock.close();
+  }
+  drainUnaryOnChannel(channel) {
+    const waiters = [];
+    for (const pending of this.pending.values()) {
+      if (pending.channel === channel && !pending.subscription) {
+        waiters.push(new Promise((resolve4) => {
+          const prev = pending.onSettle;
+          pending.onSettle = () => {
+            prev?.();
+            resolve4();
+          };
+        }));
+      }
+    }
+    return Promise.all(waiters).then(() => {
+      return;
+    });
+  }
+  sendRouteGoodbye(channel) {
+    if (this.closedErr)
+      return;
+    const goodbye = buildFrame(11 /* Goodbye */, buildFlags(false, 1 /* Interactive */, false), channel, 0n, EMPTY_BODY);
+    this.sock.write(encodeFrame(goodbye), Date.now() + DEFAULT_REQUEST_TIMEOUT_MS).catch(() => {});
+  }
+  static async openConnection(opts) {
+    const conn = await readConnectionFile(opts.connectionFile);
+    const deadline = Date.now() + (opts.handshakeTimeoutMs ?? DEFAULT_HANDSHAKE_TIMEOUT_MS);
+    const endpoint = conn.endpoints[0];
+    const sock = await SubcSocket.connect(endpoint.host, endpoint.port, deadline);
+    try {
+      await authenticateClient(sock, conn, deadline);
+    } catch (err) {
+      sock.close();
+      throw err;
+    }
+    return { sock, conn };
+  }
+  async controlRpc(body) {
+    return this.send(0, body, 1 /* Interactive */, undefined, undefined);
+  }
+  send(channel, body, priority, timeoutMs, onProgress) {
+    if (this.closedErr)
+      return Promise.reject(this.closedErr);
+    const corr = this.nextCorr++;
+    const key = `${channel}:${corr}`;
+    const frame = buildFrame(0 /* Request */, buildFlags(false, priority, false), channel, corr, body);
+    return new Promise((resolve4, reject) => {
+      const ms = timeoutMs ?? DEFAULT_REQUEST_TIMEOUT_MS;
+      const pending = {
+        channel,
+        resolve: resolve4,
+        reject,
+        onProgress,
+        timer: null
+      };
+      pending.timer = setTimeout(() => {
+        this.rejectPending(key, pending, new SubcError(`request on channel ${channel} timed out after ${ms}ms`));
+      }, ms);
+      this.pending.set(key, pending);
+      this.sock.write(encodeFrame(frame), Date.now() + ms).catch((err) => {
+        const p = this.pending.get(key);
+        if (p)
+          this.rejectPending(key, p, err instanceof Error ? err : new SubcError(String(err)));
+      });
+    });
+  }
+  async managedRequest(routeChannel, body, opts) {
+    const bytes = body instanceof Uint8Array ? body : this.encode(body);
+    const priority = opts.priority ?? 1 /* Interactive */;
+    try {
+      const reply = await this.sendManaged(routeChannel, bytes, priority, opts.timeoutMs, opts.onProgress);
+      return this.parseJson(reply);
+    } catch (err) {
+      if (err instanceof SubcCallError)
+        throw err;
+      throw this.terminalCallError("managed call failed", err);
+    }
+  }
+  sendManaged(channel, body, priority, timeoutMs, onProgress) {
+    if (this.closedErr) {
+      return Promise.reject(this.notSentCallError("request was not sent because the subc connection was already closed", this.closedErr));
+    }
+    const corr = this.nextCorr++;
+    const key = `${channel}:${corr}`;
+    const frame = buildFrame(0 /* Request */, buildFlags(false, priority, false), channel, corr, body);
+    let handedToSocket = false;
+    const classifyFailure = (err) => {
+      if (!handedToSocket) {
+        return this.notSentCallError("request bytes were not queued to the subc socket", err);
+      }
+      return this.outcomeUnknownCallError("connection dropped before the managed call returned a response", err);
+    };
+    return new Promise((resolve4, reject) => {
+      const ms = timeoutMs ?? DEFAULT_REQUEST_TIMEOUT_MS;
+      const pending = {
+        channel,
+        resolve: resolve4,
+        reject,
+        onProgress,
+        timer: null,
+        classifyFailure
+      };
+      pending.timer = setTimeout(() => {
+        this.rejectPending(key, pending, new SubcError(`request on channel ${channel} timed out after ${ms}ms`));
+      }, ms);
+      this.pending.set(key, pending);
+      const write = this.sock.writeTracked(encodeFrame(frame), Date.now() + ms);
+      handedToSocket = write.queued;
+      write.completed.catch((err) => {
+        const p = this.pending.get(key);
+        if (p)
+          this.rejectPending(key, p, err instanceof Error ? err : new SubcError(String(err)));
+      });
+    });
+  }
+  async cachedRouteChannel(moduleId, opts) {
+    const identity = opts.identity ?? this.opts.identity;
+    if (!identity) {
+      throw new SubcCallError("terminal", "managed call requires a BindIdentity in SubcClient.connect({ identity }) or call(..., { identity })", "missing_identity");
+    }
+    const target = { kind: opts.targetKind ?? this.opts.targetKind, module_id: moduleId };
+    const consumerIdentity = routeOpenConsumerIdentity(opts);
+    const key = routeCacheKey(target, identity, consumerIdentity);
+    let cached = this.routes.get(key);
+    if (!cached) {
+      cached = {
+        key,
+        moduleId,
+        target,
+        identity,
+        consumerIdentity,
+        channel: null,
+        generation: 0,
+        opening: null
+      };
+      this.routes.set(key, cached);
+    }
+    if (cached.channel !== null && cached.generation === this.generation && !this.closedErr) {
+      return cached.channel;
+    }
+    if (!cached.opening) {
+      cached.opening = this.openCachedRoute(cached).finally(() => {
+        cached.opening = null;
+      });
+    }
+    return cached.opening;
+  }
+  async openCachedRoute(cached) {
+    for (;; ) {
+      if (cached.closed)
+        throw this.routeClosedDuringOpen();
+      try {
+        await this.ensureConnectedForManaged();
+      } catch (err) {
+        throw this.notSentRecoveryError("route.open could not run because reconnect failed", err);
+      }
+      if (cached.channel !== null && cached.generation === this.generation && !this.closedErr) {
+        return cached.channel;
+      }
+      try {
+        const channel = await this.routeOpen(cached.target, cached.identity, {
+          consumerIdentity: cached.consumerIdentity ?? null
+        });
+        if (cached.closed) {
+          this.sendRouteGoodbye(channel);
+          throw this.routeClosedDuringOpen();
+        }
+        cached.channel = channel;
+        cached.generation = this.generation;
+        return channel;
+      } catch (err) {
+        if (err instanceof SubcCallError && err.code === "route_closed")
+          throw err;
+        if (!this.closeStarted && isConsumerReconnectTransient(err)) {
+          try {
+            await this.reconnectAfterDrop(err);
+          } catch (reconnectErr) {
+            throw this.notSentRecoveryError("route.open was not sent and reconnect failed", reconnectErr);
+          }
+          continue;
+        }
+        throw this.terminalCallError(`route.open failed for module ${cached.moduleId}`, err);
+      }
+    }
+  }
+  async ensureConnectedForManaged() {
+    if (this.closeStarted)
+      throw new SubcError("client closed");
+    if (this.reconnecting)
+      await this.reconnecting;
+    if (this.closedErr)
+      await this.reconnectAfterDrop(this.closedErr);
+  }
+  scheduleReconnectAfterDrop(err) {
+    if (this.closeStarted || this.reconnecting)
+      return;
+    this.reconnectAfterDrop(err).catch(() => {});
+  }
+  reconnectAfterDrop(trigger) {
+    if (this.closeStarted)
+      return Promise.reject(new SubcError("client closed"));
+    if (this.reconnecting)
+      return this.reconnecting;
+    const promise = this.reconnectWithRetry(trigger).finally(() => {
+      if (this.reconnecting === promise)
+        this.reconnecting = null;
+    });
+    this.reconnecting = promise;
+    return promise;
+  }
+  async reconnectWithRetry(_trigger) {
+    let attempt = 0;
+    let delay = this.opts.reconnectBackoff.baseMs;
+    for (;; ) {
+      if (this.closeStarted)
+        throw new SubcError("client closed");
+      attempt += 1;
+      try {
+        const opened = await SubcClient.openConnection(this.opts);
+        if (this.closeStarted) {
+          opened.sock.close();
+          throw new SubcError("client closed");
+        }
+        this.replaceConnection(opened);
+        await this.reopenCachedRoutes();
+        return;
+      } catch (err) {
+        if (!isConsumerReconnectTransient(err) || attempt >= this.opts.reconnectBackoff.maxAttempts) {
+          throw err;
+        }
+        await this.opts.sleep(delay);
+        delay = Math.min(delay * 2, this.opts.reconnectBackoff.capMs);
+      }
+    }
+  }
+  replaceConnection(opened) {
+    this.sock.close();
+    this.sock = opened.sock;
+    this.currentConn = opened.conn;
+    this.closedErr = null;
+    this.generation += 1;
+    this.readLoop(opened.sock, this.generation);
+  }
+  async reopenCachedRoutes() {
+    for (const cached of this.routes.values()) {
+      cached.channel = null;
+      cached.generation = 0;
+    }
+    for (const cached of this.routes.values()) {
+      if (cached.closed)
+        continue;
+      const channel = await this.routeOpen(cached.target, cached.identity);
+      if (cached.closed) {
+        this.sendRouteGoodbye(channel);
+        continue;
+      }
+      cached.channel = channel;
+      cached.generation = this.generation;
+    }
+  }
+  routeClosedDuringOpen() {
+    return new SubcCallError("not_sent", "route was closed before route.open completed", "route_closed");
+  }
+  async readLoop(sock, generation) {
+    try {
+      for (;; ) {
+        const headerBytes = await sock.readExact(HEADER_LEN, Number.POSITIVE_INFINITY);
+        const header = decodeHeader(headerBytes);
+        const body = header.len === 0 ? new Uint8Array(0) : await sock.readExact(header.len, Date.now() + BODY_READ_TIMEOUT_MS);
+        this.dispatch({ header, body });
+      }
+    } catch (err) {
+      if (this.sock === sock && this.generation === generation) {
+        this.fail(err instanceof Error ? err : new SubcError(String(err)));
+      }
+    }
+  }
+  dispatch(frame) {
+    const key = `${frame.header.channel}:${frame.header.corr}`;
+    const pending = this.pending.get(key);
+    if (pending) {
+      switch (frame.header.ty) {
+        case 2 /* Push */:
+        case 3 /* StreamData */:
+          pending.onProgress?.(frame.body);
+          return;
+        case 1 /* Response */:
+        case 4 /* StreamEnd */:
+          this.settle(key, pending, () => pending.resolve(frame));
+          return;
+        case 5 /* Error */:
+          this.settle(key, pending, () => pending.reject(this.errorFromFrame(frame)));
+          return;
+        default:
+          return;
+      }
+    }
+    if (frame.header.ty === 11 /* Goodbye */) {
+      this.failChannel(frame.header.channel, new SubcError("route closed by subc (GOODBYE)"));
+      return;
+    }
+  }
+  settle(key, pending, run) {
+    this.pending.delete(key);
+    if (pending.timer)
+      clearTimeout(pending.timer);
+    run();
+    pending.onSettle?.();
+  }
+  rejectPending(key, pending, err) {
+    this.settle(key, pending, () => pending.reject(pending.classifyFailure?.(err) ?? err));
+  }
+  errorFromFrame(frame) {
+    try {
+      const parsed = JSON.parse(Buffer.from(frame.body).toString("utf8"));
+      return new SubcError(parsed.message ?? "subc error", parsed.code);
+    } catch {
+      return new SubcError(Buffer.from(frame.body).toString("utf8") || "subc error");
+    }
+  }
+  failChannel(channel, err) {
+    for (const [key, pending] of this.pending) {
+      if (pending.channel === channel) {
+        this.rejectPending(key, pending, err);
+      }
+    }
+  }
+  fail(err) {
+    if (!this.closedErr)
+      this.closedErr = err;
+    for (const [key, pending] of this.pending) {
+      this.rejectPending(key, pending, err);
+    }
+  }
+  notSentCallError(message, cause) {
+    return new SubcCallError("not_sent", `${message}${causeMessage(cause)}`, errorCode(cause), cause);
+  }
+  outcomeUnknownCallError(message, cause) {
+    return new SubcCallError("outcome_unknown", `${message}${causeMessage(cause)}`, errorCode(cause), cause);
+  }
+  terminalCallError(message, cause) {
+    if (cause instanceof SubcCallError)
+      return cause;
+    return new SubcCallError("terminal", `${message}${causeMessage(cause)}`, errorCode(cause), cause);
+  }
+  notSentRecoveryError(message, cause) {
+    if (cause instanceof SubcCallError)
+      return cause;
+    if (isConsumerReconnectTransient(cause))
+      return this.notSentCallError(message, cause);
+    return this.terminalCallError(message, cause);
+  }
+  encode(value) {
+    return new Uint8Array(Buffer.from(JSON.stringify(value), "utf8"));
+  }
+  parseJson(frame) {
+    return JSON.parse(Buffer.from(frame.body).toString("utf8"));
+  }
+}
+function isConsumerReconnectTransient(err) {
+  if (err instanceof SocketClosedError || err instanceof SocketTimeoutError)
+    return true;
+  if (err instanceof SocketWriteNotQueuedError || err instanceof SocketWriteQueuedError)
+    return true;
+  if (err instanceof SubcCallError)
+    return err.kind === "not_sent" || err.kind === "outcome_unknown";
+  if (err instanceof SubcError || err instanceof ConnectionFileError || err instanceof AuthError)
+    return false;
+  const code = errorCode(err);
+  return code === "ECONNREFUSED" || code === "ECONNRESET" || code === "EPIPE" || code === "ETIMEDOUT" || code === "ENOENT";
+}
+async function connectionFileExists(path) {
+  try {
+    await fs2.access(path);
+    return true;
+  } catch {
+    return false;
+  }
+}
+function normalizeConnectOptions(opts) {
+  return {
+    connectionFile: opts.connectionFile,
+    handshakeTimeoutMs: opts.handshakeTimeoutMs,
+    identity: opts.identity,
+    targetKind: opts.targetKind ?? DEFAULT_MANAGED_TARGET_KIND,
+    reconnectBackoff: opts.reconnectBackoff ?? DEFAULT_RECONNECT_BACKOFF,
+    sleep: opts.sleep ?? ((ms) => new Promise((resolve4) => setTimeout(resolve4, ms)))
+  };
+}
+function routeCacheKey(target, identity, consumerIdentity) {
+  const consumerPart = consumerIdentity ? `${consumerIdentity.module_id}\x00${consumerIdentity.launch_nonce}` : "";
+  return `${target.kind}\x00${target.module_id}\x00${identity.project_root}\x00${identity.harness}\x00${identity.session}\x00${consumerPart}`;
+}
+function routeOpenConsumerIdentity(opts = {}) {
+  if (opts.consumerIdentity !== undefined)
+    return opts.consumerIdentity ?? undefined;
+  const moduleId = process.env[SUBC_MODULE_ID_ENV];
+  const launchNonce = process.env[SUBC_LAUNCH_NONCE_ENV];
+  if (!moduleId || !launchNonce)
+    return;
+  return { module_id: moduleId, launch_nonce: launchNonce };
+}
+function errorCode(err) {
+  if (typeof err === "object" && err !== null && "code" in err) {
+    const code = err.code;
+    if (typeof code === "string")
+      return code;
+  }
+  return;
+}
+function causeMessage(cause) {
+  if (cause === undefined)
+    return "";
+  return `: ${cause instanceof Error ? cause.message : String(cause)}`;
+}
+var DEFAULT_HANDSHAKE_TIMEOUT_MS = 1e4, DEFAULT_REQUEST_TIMEOUT_MS = 30000, BODY_READ_TIMEOUT_MS = 30000, EMPTY_BODY, DEFAULT_MANAGED_TARGET_KIND = "management_surface", SUBC_MODULE_ID_ENV = "SUBC_MODULE_ID", SUBC_LAUNCH_NONCE_ENV = "SUBC_LAUNCH_NONCE", DEFAULT_RECONNECT_BACKOFF, SubcCallError, SubcError;
+var init_client = __esm(() => {
+  init_auth();
+  init_connection_file();
+  init_envelope();
+  init_socket();
+  EMPTY_BODY = new Uint8Array(0);
+  DEFAULT_RECONNECT_BACKOFF = {
+    baseMs: 100,
+    capMs: 2000,
+    maxAttempts: 6
+  };
+  SubcCallError = class SubcCallError extends Error {
+    kind;
+    code;
+    cause;
+    constructor(kind, message, code, cause) {
+      super(message);
+      this.kind = kind;
+      this.code = code;
+      this.cause = cause;
+      this.name = "SubcCallError";
+    }
+  };
+  SubcError = class SubcError extends Error {
+    code;
+    constructor(message, code) {
+      super(message);
+      this.code = code;
+    }
+  };
+});
+
+// ../../node_modules/.bun/@cortexkit+subc-client@0.2.0/node_modules/@cortexkit/subc-client/src/provider.ts
+import { Buffer as Buffer2 } from "node:buffer";
+
+class SubcProvider {
+  sock;
+  currentConn;
+  opts;
+  closed;
+  resolveClosed = () => {
+    return;
+  };
+  closeStarted = false;
+  closedErr = null;
+  inflight = new Map;
+  reconnecting = null;
+  generation = 1;
+  connectionEpoch = 1;
+  stateQueue = [];
+  drainingStateQueue = false;
+  restoredDebounceToken = 0;
+  storage;
+  constructor(sock, currentConn, opts, storage) {
+    this.sock = sock;
+    this.currentConn = currentConn;
+    this.opts = opts;
+    this.storage = storage;
+    this.closed = new Promise((resolve4) => {
+      this.resolveClosed = resolve4;
+    });
+    this.readLoop(sock, this.generation);
+    this.enqueueConnectionState({ state: "connected", epoch: this.connectionEpoch });
+  }
+  get conn() {
+    return this.currentConn;
+  }
+  currentEpoch() {
+    return this.connectionEpoch;
+  }
+  static async connect(opts) {
+    if (opts.manifest.protocol_ver !== PROTOCOL_VERSION) {
+      throw new SubcProviderError(`manifest protocol_ver ${opts.manifest.protocol_ver} does not match client protocol ${PROTOCOL_VERSION}`, "invalid_manifest");
+    }
+    const normalized = normalizeProviderConnectOptions(opts);
+    const opened = await SubcProvider.openConnection(normalized);
+    return new SubcProvider(opened.sock, opened.conn, normalized, opened.ack.storage);
+  }
+  async close() {
+    if (!this.closeStarted) {
+      this.closeStarted = true;
+      this.cancelRestoredDebounce();
+      const sock = this.sock;
+      try {
+        await sendFrame(sock, buildFrame(11 /* Goodbye */, controlFlags(), 0, 0n, new Uint8Array(0)));
+      } catch {} finally {
+        sock.close();
+        this.finishClosed();
+      }
+    }
+    await this.closed;
+  }
+  static async openConnection(opts) {
+    const conn = await readConnectionFile(opts.connectionFile);
+    const deadline = Date.now() + (opts.handshakeTimeoutMs ?? DEFAULT_HANDSHAKE_TIMEOUT_MS2);
+    const endpoint = conn.endpoints[0];
+    const sock = await SubcSocket.connect(endpoint.host, endpoint.port, deadline);
+    try {
+      await authenticateClient(sock, conn, deadline);
+      await sendFrame(sock, buildHelloFrame(opts));
+      const ack = await expectHelloAck(sock, deadline);
+      return { sock, conn, ack };
+    } catch (err) {
+      sock.close();
+      throw err;
+    }
+  }
+  async readLoop(sock, generation) {
+    try {
+      for (;; ) {
+        const headerBytes = await sock.readExact(HEADER_LEN, Number.POSITIVE_INFINITY);
+        const header = decodeHeader(headerBytes);
+        const body = header.len === 0 ? new Uint8Array(0) : await sock.readExact(header.len, Date.now() + BODY_READ_TIMEOUT_MS2);
+        const keepGoing = await this.dispatch({ header, body }, sock, generation);
+        if (!keepGoing) {
+          if (this.sock === sock && this.generation === generation)
+            this.closeStarted = true;
+          break;
+        }
+      }
+    } catch (err) {
+      if (this.sock === sock && this.generation === generation && !this.closeStarted) {
+        this.handleUnexpectedDrop(sock, generation, err instanceof Error ? err : new SubcProviderError(String(err)));
+        return;
+      }
+    } finally {
+      if (this.sock === sock && this.generation === generation) {
+        sock.close();
+        if (this.closeStarted)
+          this.finishClosed();
+      }
+    }
+  }
+  async dispatch(frame, sock, generation) {
+    switch (frame.header.ty) {
+      case 7 /* Ping */:
+        if (frame.header.channel === 0) {
+          await this.sendOn(sock, generation, buildFrameWithVersion(frame.header.ver, 8 /* Pong */, frame.header.flags, 0, frame.header.corr, new Uint8Array(0)));
+        }
+        return true;
+      case 11 /* Goodbye */:
+        if (frame.header.channel === 0)
+          return false;
+        this.abortChannel(generation, frame.header.channel);
+        await this.opts.onRouteGone?.(frame.header.channel);
+        return true;
+      case 6 /* Cancel */:
+        this.inflight.get(routeKey(generation, frame.header.channel, frame.header.corr))?.abort();
+        return true;
+      case 0 /* Request */:
+        if (frame.header.channel === 0) {
+          await this.handleControlRequest(frame, sock, generation);
+        } else {
+          this.handleDataRequest(frame, sock, generation).catch((err) => {
+            if (!this.closeStarted && this.sock === sock && this.generation === generation) {
+              console.warn("SubcProvider handler failed after its request was dispatched", err);
+            }
+          });
+        }
+        return true;
+      default:
+        return true;
+    }
+  }
+  abortChannel(generation, channel) {
+    const prefix = `${generation}:${channel}:`;
+    for (const [key, controller] of this.inflight) {
+      if (key.startsWith(prefix))
+        controller.abort();
+    }
+  }
+  abortGeneration(generation) {
+    const prefix = `${generation}:`;
+    for (const [key, controller] of this.inflight) {
+      if (key.startsWith(prefix))
+        controller.abort();
+    }
+  }
+  abortAllInflight() {
+    for (const controller of this.inflight.values())
+      controller.abort();
+  }
+  async handleControlRequest(frame, sock, generation) {
+    const request = parseJson(frame.body);
+    if (request.op !== "route.bind") {
+      throw new SubcProviderError(`unsupported module control request ${request.op ?? "<missing op>"}`);
+    }
+    const bindRequest = {
+      route_channel: numberField(request.route_channel, "route_channel"),
+      target: request.target,
+      identity: request.identity,
+      principal: request.principal
+    };
+    const decision = await this.opts.onBind?.(bindRequest);
+    const rejection = bindRejection(decision);
+    if (rejection) {
+      await this.sendError(frame, rejection.code, rejection.message, controlFlags(), sock, generation);
+      return;
+    }
+    await this.sendOn(sock, generation, buildFrameWithVersion(frame.header.ver, 1 /* Response */, controlFlags(), 0, frame.header.corr, encodeJson({ op: "route.bind" })));
+  }
+  async handleDataRequest(frame, sock, generation) {
+    const { channel, corr, ver } = frame.header;
+    const key = routeKey(generation, channel, corr);
+    const controller = new AbortController;
+    this.inflight.set(key, controller);
+    const dataFlags = buildFlags(false, 1 /* Interactive */, false);
+    const ctx = {
+      signal: controller.signal,
+      currentEpoch: () => this.connectionEpoch,
+      emit: async (eventBody) => {
+        if (controller.signal.aborted)
+          return;
+        await this.sendOn(sock, generation, buildFrameWithVersion(ver, 3 /* StreamData */, dataFlags, channel, corr, eventBody));
+      }
+    };
+    try {
+      const body = await this.opts.handler(channel, frame.body, ctx);
+      if (body === undefined) {
+        await this.sendOn(sock, generation, buildFrameWithVersion(ver, 4 /* StreamEnd */, dataFlags, channel, corr, new Uint8Array(0)));
+      } else if (body instanceof Uint8Array) {
+        await this.sendOn(sock, generation, buildFrameWithVersion(ver, 1 /* Response */, dataFlags, channel, corr, body));
+      } else {
+        throw new SubcProviderError("provider handler must return a Uint8Array or void", "invalid_handler_response");
+      }
+    } catch (err) {
+      await this.sendError(frame, err instanceof SubcProviderError && err.code ? err.code : "handler_error", err instanceof Error ? err.message : String(err), dataFlags, sock, generation);
+    } finally {
+      if (this.inflight.get(key) === controller)
+        this.inflight.delete(key);
+    }
+  }
+  async sendError(frame, code, message, flags, sock, generation) {
+    await this.sendOn(sock, generation, buildFrameWithVersion(frame.header.ver, 5 /* Error */, flags, frame.header.channel, frame.header.corr, encodeJson({ code, message })));
+  }
+  async sendOn(sock, generation, frame) {
+    if (this.sock !== sock || this.generation !== generation || this.closeStarted || this.closedErr)
+      return;
+    await sendFrame(sock, frame);
+  }
+  handleUnexpectedDrop(sock, generation, cause) {
+    this.cancelRestoredDebounce();
+    this.abortGeneration(generation);
+    this.generation += 1;
+    sock.close();
+    this.enqueueConnectionState({ state: "down", cause });
+    this.scheduleReconnectAfterDrop(cause);
+  }
+  scheduleReconnectAfterDrop(trigger) {
+    if (this.closeStarted || this.reconnecting)
+      return;
+    const promise = this.reconnectWithRetry(trigger).catch((err) => {
+      if (!this.closeStarted)
+        this.failFatal(err instanceof Error ? err : new SubcProviderError(String(err)));
+    }).finally(() => {
+      if (this.reconnecting === promise)
+        this.reconnecting = null;
+    });
+    this.reconnecting = promise;
+  }
+  async reconnectWithRetry(_trigger) {
+    let attempt = 0;
+    let delay = this.opts.reconnectBackoff.baseMs;
+    for (;; ) {
+      if (this.closeStarted)
+        throw new SubcProviderError("provider closed");
+      attempt += 1;
+      this.enqueueConnectionState({ state: "reconnecting", attempt });
+      try {
+        const opened = await SubcProvider.openConnection(this.opts);
+        if (this.closeStarted) {
+          opened.sock.close();
+          throw new SubcProviderError("provider closed");
+        }
+        this.replaceConnection(opened);
+        return;
+      } catch (err) {
+        if (this.closeStarted)
+          throw err;
+        if (!isProviderReconnectTransient(err))
+          throw err;
+        await this.opts.sleep(delay);
+        delay = Math.min(delay * 2, this.opts.reconnectBackoff.capMs);
+      }
+    }
+  }
+  replaceConnection(opened) {
+    this.sock.close();
+    this.sock = opened.sock;
+    this.currentConn = opened.conn;
+    this.storage = opened.ack.storage;
+    this.closedErr = null;
+    this.connectionEpoch += 1;
+    const generation = this.generation;
+    this.readLoop(opened.sock, generation);
+    this.scheduleRestored(generation, this.connectionEpoch);
+  }
+  scheduleRestored(generation, epoch) {
+    if (!this.opts.onConnectionState)
+      return;
+    const token = ++this.restoredDebounceToken;
+    this.opts.sleep(this.opts.restoredDebounceMs).then(() => {
+      if (token === this.restoredDebounceToken && !this.closeStarted && this.sock && this.generation === generation && this.connectionEpoch === epoch) {
+        this.enqueueConnectionState({ state: "restored", epoch });
+      }
+    }).catch((err) => {
+      if (token === this.restoredDebounceToken && !this.closeStarted) {
+        console.warn("SubcProvider restored debounce timer failed", err);
+      }
+    });
+  }
+  cancelRestoredDebounce() {
+    this.restoredDebounceToken += 1;
+  }
+  enqueueConnectionState(event) {
+    if (!this.opts.onConnectionState)
+      return;
+    this.stateQueue.push(event);
+    if (!this.drainingStateQueue)
+      this.drainConnectionStateQueue();
+  }
+  async drainConnectionStateQueue() {
+    if (this.drainingStateQueue)
+      return;
+    this.drainingStateQueue = true;
+    try {
+      while (this.stateQueue.length > 0) {
+        const event = this.stateQueue[0];
+        try {
+          await this.opts.onConnectionState?.(event);
+          this.stateQueue.shift();
+        } catch (err) {
+          if (event.state === "restored") {
+            console.warn("SubcProvider restored callback failed; retrying delivery", err);
+            await pauseBeforeStateRetry();
+            continue;
+          }
+          console.warn("SubcProvider connection-state callback failed", err);
+          this.stateQueue.shift();
+        }
+      }
+    } finally {
+      this.drainingStateQueue = false;
+      if (this.stateQueue.length > 0)
+        this.drainConnectionStateQueue();
+    }
+  }
+  failFatal(err) {
+    if (!this.closedErr)
+      this.closedErr = err;
+    this.closeStarted = true;
+    this.cancelRestoredDebounce();
+    this.abortAllInflight();
+    this.sock.close();
+    this.finishClosed();
+  }
+  finishClosed() {
+    this.resolveClosed();
+  }
+}
+function routeKey(generation, channel, corr) {
+  return `${generation}:${channel}:${corr}`;
+}
+function launchNonce(opts) {
+  const nonce = opts.launchNonce ?? process.env[SUBC_LAUNCH_NONCE_ENV2];
+  return nonce && nonce.length > 0 ? nonce : undefined;
+}
+function normalizeProviderConnectOptions(opts) {
+  return {
+    connectionFile: opts.connectionFile,
+    manifest: opts.manifest,
+    handler: opts.handler,
+    handshakeTimeoutMs: opts.handshakeTimeoutMs,
+    controlOps: opts.controlOps,
+    onBind: opts.onBind,
+    onRouteGone: opts.onRouteGone,
+    reconnectBackoff: opts.reconnectBackoff ?? DEFAULT_RECONNECT_BACKOFF,
+    sleep: opts.sleep ?? ((ms) => new Promise((resolve4) => setTimeout(resolve4, ms))),
+    restoredDebounceMs: opts.restoredDebounceMs ?? DEFAULT_RESTORED_DEBOUNCE_MS,
+    onConnectionState: opts.onConnectionState,
+    launchNonce: opts.launchNonce
+  };
+}
+function buildHelloFrame(opts) {
+  const nonce = launchNonce(opts);
+  return buildFrame(9 /* Hello */, controlFlags(), 0, HELLO_CORR, encodeJson({
+    manifest: normalizeManifest(opts.manifest),
+    protocol_ver: PROTOCOL_VERSION,
+    control_ops: opts.controlOps === undefined ? null : opts.controlOps,
+    ...nonce ? { launch_nonce: nonce } : {}
+  }));
+}
+function isProviderReconnectTransient(err) {
+  if (err instanceof SubcProviderError)
+    return err.code === "duplicate_module_id";
+  if (err instanceof SocketClosedError || err instanceof SocketTimeoutError)
+    return true;
+  if (err instanceof SocketWriteNotQueuedError || err instanceof SocketWriteQueuedError)
+    return true;
+  if (err instanceof ConnectionFileError || err instanceof AuthError)
+    return false;
+  const code = errorCode2(err);
+  return code === "ECONNREFUSED" || code === "ECONNRESET" || code === "EPIPE" || code === "ETIMEDOUT" || code === "ENOENT";
+}
+function errorCode2(err) {
+  if (typeof err === "object" && err !== null && "code" in err) {
+    const code = err.code;
+    if (typeof code === "string")
+      return code;
+  }
+  return;
+}
+async function pauseBeforeStateRetry() {
+  await new Promise((resolve4) => setTimeout(resolve4, 0));
+}
+function controlFlags() {
+  return buildFlags(false, 0 /* Passive */, false);
+}
+async function sendFrame(sock, frame) {
+  await sock.write(encodeFrame(frame), Date.now() + WRITE_TIMEOUT_MS);
+}
+async function expectHelloAck(sock, deadline) {
+  const header = decodeHeader(await sock.readExact(HEADER_LEN, deadline));
+  const body = header.len === 0 ? new Uint8Array(0) : await sock.readExact(header.len, deadline);
+  const frame = { header, body };
+  switch (header.ty) {
+    case 10 /* HelloAck */:
+      return parseJson(body);
+    case 5 /* Error */: {
+      const error2 = parseJson(body);
+      throw new SubcProviderError(`subc rejected HELLO: ${error2.code ?? "unknown"} — ${error2.message ?? "subc error"}`, error2.code);
+    }
+    default:
+      throw new SubcProviderError(`unexpected frame ${FrameType[frame.header.ty]} awaiting HELLO_ACK`);
+  }
+}
+function encodeJson(value) {
+  return new Uint8Array(Buffer2.from(JSON.stringify(value), "utf8"));
+}
+function parseJson(bytes) {
+  return JSON.parse(Buffer2.from(bytes).toString("utf8"));
+}
+function numberField(value, field) {
+  if (typeof value !== "number" || !Number.isInteger(value)) {
+    throw new SubcProviderError(`route.bind ${field} must be an integer`);
+  }
+  return value;
+}
+function bindRejection(decision) {
+  if (decision === undefined || decision === true)
+    return null;
+  if (decision === false) {
+    return { code: "route_rejected", message: "route.bind rejected by provider" };
+  }
+  if (decision.accept)
+    return null;
+  return {
+    code: decision.code ?? "route_rejected",
+    message: decision.message ?? "route.bind rejected by provider"
+  };
+}
+function normalizeManifest(manifest) {
+  return {
+    module_id: manifest.module_id,
+    module_version: manifest.module_version,
+    protocol_ver: manifest.protocol_ver,
+    trust_tier: manifest.trust_tier,
+    provides: manifest.provides.map(normalizeProviderRole),
+    consumes: manifest.consumes.map(normalizeConsumerRole),
+    scheduled_tasks: manifest.scheduled_tasks.map(normalizeScheduledTask),
+    bindings: {
+      storage: {
+        kind: manifest.bindings.storage.kind,
+        scope: manifest.bindings.storage.scope,
+        owns_schema: manifest.bindings.storage.owns_schema
+      },
+      vault_grants: manifest.bindings.vault_grants.map((grant) => ({
+        secret: grant.secret,
+        reason: grant.reason
+      })),
+      identity: {
+        requires: [...manifest.bindings.identity.requires],
+        optional: [...manifest.bindings.identity.optional]
+      }
+    }
+  };
+}
+function normalizeProviderRole(role) {
+  switch (role.role) {
+    case "tool_provider":
+      return {
+        role: "tool_provider",
+        tools: role.tools.map((tool) => ({
+          name: tool.name,
+          execution_mode: tool.execution_mode,
+          schema: tool.schema
+        })),
+        identity_scope: [...role.identity_scope],
+        concurrency: role.concurrency,
+        emits_push: role.emits_push,
+        sub_supervises: role.sub_supervises
+      };
+    case "pipeline_stage":
+      return {
+        role: "pipeline_stage",
+        stage: role.stage,
+        applies_to: {
+          provider: role.applies_to.provider,
+          model: role.applies_to.model
+        },
+        interface: role.interface,
+        declares_frozen_floor: role.declares_frozen_floor,
+        needs_signals: [...role.needs_signals],
+        conformance_class: role.conformance_class
+      };
+    case "management_surface":
+      return {
+        role: "management_surface",
+        operations: role.operations.map((operation) => ({
+          name: operation.name,
+          kind: operation.kind
+        })),
+        config_schema: role.config_schema,
+        observability: role.observability.map((surface) => ({
+          name: surface.name,
+          kind: surface.kind
+        })),
+        identity_scope: [...role.identity_scope]
+      };
+    case "internal_service":
+      return {
+        role: "internal_service",
+        service_id: role.service_id,
+        transport: role.transport,
+        agent_facing: role.agent_facing,
+        operations: [...role.operations]
+      };
+  }
+}
+function normalizeConsumerRole(role) {
+  switch (role.role) {
+    case "tool_client":
+      return { role: "tool_client", of: [...role.of] };
+    case "llm_client":
+      return { role: "llm_client", via: role.via, auth: role.auth };
+    case "service_client":
+      return { role: "service_client", of: [...role.of] };
+  }
+}
+function normalizeScheduledTask(task) {
+  return {
+    task_id: task.task_id,
+    eligibility: {
+      cooldown: task.eligibility.cooldown,
+      window: task.eligibility.window
+    },
+    lease_scope: task.lease_scope,
+    renews_during_calls: task.renews_during_calls,
+    toolset: [...task.toolset],
+    model_policy: {
+      tier: task.model_policy.tier,
+      fallback_chain: [...task.model_policy.fallback_chain]
+    },
+    step_cap: task.step_cap,
+    circuit_breaker: {
+      identical_failures: task.circuit_breaker.identical_failures
+    }
+  };
+}
+var DEFAULT_HANDSHAKE_TIMEOUT_MS2 = 1e4, BODY_READ_TIMEOUT_MS2 = 30000, WRITE_TIMEOUT_MS = 30000, DEFAULT_RESTORED_DEBOUNCE_MS = 250, HELLO_CORR = 1n, SubcProviderError, SUBC_LAUNCH_NONCE_ENV2 = "SUBC_LAUNCH_NONCE";
+var init_provider = __esm(() => {
+  init_auth();
+  init_client();
+  init_connection_file();
+  init_envelope();
+  init_socket();
+  SubcProviderError = class SubcProviderError extends Error {
+    code;
+    constructor(message, code) {
+      super(message);
+      this.code = code;
+    }
+  };
+});
+
+// ../../node_modules/.bun/@cortexkit+subc-client@0.2.0/node_modules/@cortexkit/subc-client/src/index.ts
+var init_src = __esm(() => {
+  init_client();
+  init_connection_file();
+  init_envelope();
+  init_auth();
+  init_socket();
+  init_provider();
+});
+
+// ../aft-bridge/dist/subc-transport.js
+function identityKey(identity) {
+  return `${identity.project_root}\x00${identity.harness}\x00${identity.session}`;
+}
+
+class BgSubscription {
+  identity;
+  acquireClient;
+  dropClient;
+  onNudge;
+  sleep;
+  stopped = false;
+  current = null;
+  loop;
+  constructor(identity, acquireClient, dropClient, onNudge, sleep) {
+    this.identity = identity;
+    this.acquireClient = acquireClient;
+    this.dropClient = dropClient;
+    this.onNudge = onNudge;
+    this.sleep = sleep;
+    this.loop = this.run();
+  }
+  async stop() {
+    this.stopped = true;
+    const sub = this.current;
+    if (sub) {
+      try {
+        sub.unsubscribe();
+      } catch {}
     }
-    const mergedOverrides = { ...this.configOverrides, ...projectOverrides };
-    const bridge = new BinaryBridge(this.binaryPath, key, this.bridgeOptions, mergedOverrides);
-    this.bridges.set(key, { bridge, lastUsed: Date.now() });
-    return bridge;
+    await this.loop.catch(() => {
+      return;
+    });
   }
-  cleanup() {
-    const now = Date.now();
-    for (const [dir, entry] of this.bridges) {
-      if (entry.bridge.hasPendingRequests() || entry.bridge.hasOutstandingBackgroundTasks())
+  async run() {
+    let attempt = 0;
+    while (!this.stopped) {
+      let client;
+      try {
+        client = await this.acquireClient();
+      } catch {
+        await this.backoff(attempt++);
         continue;
-      if (now - entry.lastUsed > this.idleTimeoutMs) {
-        entry.bridge.shutdown().catch((err) => this.error("cleanup shutdown failed:", err));
-        this.bridges.delete(dir);
       }
-    }
-    for (const bridge of this.staleBridges) {
-      if (bridge.hasPendingRequests() || bridge.hasOutstandingBackgroundTasks())
-        continue;
-      bridge.shutdown().catch((err) => this.error("stale cleanup shutdown failed:", err));
-      this.staleBridges.delete(bridge);
-    }
-  }
-  evictLRU() {
-    let oldestDir = null;
-    let oldestTime = Infinity;
-    for (const [dir, entry] of this.bridges) {
-      if (entry.bridge.hasPendingRequests() || entry.bridge.hasOutstandingBackgroundTasks())
+      if (this.stopped)
+        return;
+      let channel;
+      try {
+        channel = await client.routeOpen({ kind: "tool_provider", module_id: AFT_MODULE_ID }, this.identity);
+      } catch (err) {
+        if (isConsumerReconnectTransient(err))
+          this.dropClient(client);
+        await this.backoff(attempt++);
         continue;
-      if (entry.lastUsed < oldestTime) {
-        oldestTime = entry.lastUsed;
-        oldestDir = dir;
       }
+      if (this.stopped) {
+        safeCloseRoute(client, channel);
+        return;
+      }
+      const subscribedAt = Date.now();
+      try {
+        const sub = client.subscribe(channel, { op: "bg_events" }, () => {
+          if (!this.stopped)
+            this.onNudge();
+        });
+        this.current = sub;
+        if (this.stopped)
+          sub.unsubscribe();
+        if (!this.stopped)
+          this.onNudge();
+        await sub.closed;
+        return;
+      } catch (err) {
+        if (this.stopped)
+          return;
+        if (isConsumerReconnectTransient(err))
+          this.dropClient(client);
+        if (Date.now() - subscribedAt >= BG_STABLE_MS)
+          attempt = 0;
+      } finally {
+        this.current = null;
+        safeCloseRoute(client, channel);
+      }
+      await this.backoff(attempt++);
     }
-    if (oldestDir) {
-      const entry = this.bridges.get(oldestDir);
-      entry?.bridge.shutdown().catch((err) => this.error("eviction shutdown failed:", err));
-      this.bridges.delete(oldestDir);
+  }
+  async backoff(attempt) {
+    const ms = Math.min(100 * 2 ** Math.min(attempt, 6), 2000);
+    await this.sleep(ms);
+  }
+}
+function isRecord(value) {
+  return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+function safeCloseRoute(client, channel) {
+  try {
+    client.closeRouteChannel(channel).catch(() => {
+      return;
+    });
+  } catch {}
+}
+function reliftReply(reply) {
+  if (!isRecord(reply) || !isRecord(reply.structuredContent)) {
+    throw new Error("subc tool reply is missing the structuredContent envelope (protocol violation)");
+  }
+  const flat = reply.structuredContent;
+  if (typeof flat.success !== "boolean" || typeof flat.text !== "string") {
+    throw new Error("subc tool reply structuredContent lacks a boolean `success` / string `text` (protocol violation)");
+  }
+  return flat;
+}
+
+class SubcTransport {
+  pool;
+  projectRoot;
+  lastStatusBar;
+  cachedStatus = null;
+  constructor(pool, projectRoot) {
+    this.pool = pool;
+    this.projectRoot = projectRoot;
+  }
+  getCwd() {
+    return this.projectRoot;
+  }
+  getStatusBar() {
+    return this.lastStatusBar;
+  }
+  getCachedStatus() {
+    return this.cachedStatus;
+  }
+  cacheStatusSnapshot(snapshot) {
+    this.cachedStatus = snapshot;
+  }
+  captureStatusBar(response) {
+    const parsed = parseStatusBarCounts(response.status_bar);
+    if (parsed)
+      this.lastStatusBar = parsed;
+  }
+  identityFor(session) {
+    return {
+      project_root: this.projectRoot,
+      harness: this.pool.harness,
+      session: session && session.length > 0 ? session : DEFAULT_SESSION_ID
+    };
+  }
+  async toolCall(sessionId, name, rawArgs = {}, options) {
+    const { preview, timeoutMs, onProgress } = this.splitOptions(options);
+    const body = { name, arguments: rawArgs };
+    if (preview === true)
+      body.preview = true;
+    const reply = await this.pool.routeRequest(this.identityFor(sessionId), body, timeoutMs, onProgress);
+    const result = reliftReply(reply);
+    this.captureStatusBar(result);
+    return result;
+  }
+  async send(command, params = {}, options) {
+    if (LOCALLY_SATISFIED_COMMANDS.has(command)) {
+      return { success: true, command, subc_local: true };
+    }
+    const { timeoutMs, onProgress } = this.splitOptions(options);
+    const session = typeof params.session_id === "string" ? params.session_id : undefined;
+    const reply = await this.pool.routeRequest(this.identityFor(session), { name: command, arguments: params }, timeoutMs, onProgress);
+    const response = reliftReply(reply);
+    this.captureStatusBar(response);
+    return response;
+  }
+  splitOptions(options) {
+    if (!options)
+      return {};
+    const preview = options.preview;
+    const timeoutMs = options.timeoutMs;
+    const onProgress = options.onProgress;
+    return { preview, timeoutMs, onProgress };
+  }
+}
+
+class SubcTransportPool {
+  harness;
+  connectionFile;
+  handshakeTimeoutMs;
+  connectFn;
+  onBgEventsNudge;
+  bgBackoffSleep;
+  client = null;
+  connecting = null;
+  sessions = new Map;
+  transportFailures = 0;
+  transports = new Map;
+  shuttingDown = false;
+  constructor(options) {
+    this.connectionFile = options.connectionFile;
+    this.harness = options.harness;
+    this.handshakeTimeoutMs = options.handshakeTimeoutMs;
+    this.connectFn = options.connect ?? ((opts) => SubcClient.connect(opts));
+    this.onBgEventsNudge = options.onBgEventsNudge;
+    this.bgBackoffSleep = options.bgBackoffSleep ?? ((ms) => new Promise((resolve4) => setTimeout(resolve4, ms)));
+  }
+  static async connectionAvailable(connectionFile) {
+    return connectionFileExists(connectionFile);
+  }
+  getBridge(projectRoot) {
+    const key = canonicalizeProjectRoot(projectRoot);
+    let transport = this.transports.get(key);
+    if (!transport) {
+      transport = new SubcTransport(this, key);
+      this.transports.set(key, transport);
     }
+    return transport;
   }
-  async shutdown() {
-    if (this.cleanupTimer) {
-      clearInterval(this.cleanupTimer);
-      this.cleanupTimer = null;
+  getActiveBridgeForRoot(projectRoot) {
+    const key = canonicalizeProjectRoot(projectRoot);
+    if (!this.client)
+      return null;
+    return this.transports.get(key) ?? null;
+  }
+  async toolCall(projectRoot, runtime, name, rawArgs = {}, options) {
+    return this.getBridge(projectRoot).toolCall(runtime.sessionID, name, rawArgs, options);
+  }
+  getOrCreateSession(key) {
+    let record = this.sessions.get(key);
+    if (!record || record.closed) {
+      record = { routeEntry: null, bgSub: null, closed: false, inflight: 0 };
+      this.sessions.set(key, record);
     }
-    const shutdowns = [
-      ...Array.from(this.bridges.values(), (e) => e.bridge.shutdown()),
-      ...Array.from(this.staleBridges.values(), (bridge) => bridge.shutdown())
-    ];
-    this.bridges.clear();
-    this.staleBridges.clear();
-    await Promise.allSettled(shutdowns);
+    return record;
   }
-  async replaceBinary(newPath) {
-    this.binaryPath = newPath;
-    for (const entry of this.bridges.values()) {
-      this.staleBridges.add(entry.bridge);
+  isCurrentSession(key, record) {
+    return this.sessions.get(key) === record && !record.closed;
+  }
+  deleteSessionIfEmpty(key, record) {
+    if (this.sessions.get(key) === record && !record.closed && record.inflight === 0 && record.routeEntry === null && record.bgSub === null) {
+      this.sessions.delete(key);
     }
-    this.bridges.clear();
-    this.log(`Binary path updated to ${newPath}. Active bridges marked stale — next calls will use the new binary.`);
-    return newPath;
   }
-  log(message, meta) {
-    const logger = this.logger ?? getActiveLogger();
-    if (logger) {
+  async routeRequest(identity, body, timeoutMs, onProgress) {
+    const key = identityKey(identity);
+    const record = this.getOrCreateSession(key);
+    record.inflight += 1;
+    try {
+      const client = await this.ensureClient();
+      if (!this.isCurrentSession(key, record)) {
+        throw new RouteTornDownError("subc session closed");
+      }
+      let channel;
+      let entry;
       try {
-        logger.log(message, meta);
+        ({ channel, entry } = await this.routeChannel(client, identity, record));
+        if (!this.isCurrentSession(key, record)) {
+          throw new RouteTornDownError("subc session closed");
+        }
       } catch (err) {
-        console.error(`[aft-bridge] ERROR: pool logger log threw: ${err instanceof Error ? err.message : String(err)}`);
-        console.error(`[aft-bridge] ${message}`);
+        if (err instanceof RouteTornDownError)
+          throw err;
+        if (isConsumerReconnectTransient(err) && this.isCurrentSession(key, record) && this.client === client) {
+          this.dropClient(client);
+        }
+        throw err;
       }
-    } else
-      log(message, meta);
-  }
-  error(message, meta) {
-    const logger = this.logger ?? getActiveLogger();
-    if (logger) {
       try {
-        logger.error(message, meta);
+        const reply = await client.request(channel, body, { timeoutMs, onProgress });
+        if (this.isCurrentSession(key, record) && this.client === client) {
+          this.transportFailures = 0;
+        }
+        this.ensureBgSubscription(identity, record);
+        return reply;
       } catch (err) {
-        console.error(`[aft-bridge] ERROR: pool logger error threw: ${err instanceof Error ? err.message : String(err)}`);
-        console.error(`[aft-bridge] ERROR: ${message}`);
+        if (record.routeEntry === entry) {
+          entry.closed = true;
+          record.routeEntry = null;
+        }
+        if (this.isCurrentSession(key, record) && this.client === client) {
+          if (isConsumerReconnectTransient(err)) {
+            this.transportFailures = 0;
+            this.dropClient(client);
+          } else if (++this.transportFailures >= MAX_CONSECUTIVE_TRANSPORT_FAILURES) {
+            this.transportFailures = 0;
+            this.dropClient(client);
+          }
+        }
+        throw err;
       }
-    } else
-      error(message, meta);
+    } finally {
+      record.inflight -= 1;
+      this.deleteSessionIfEmpty(key, record);
+    }
+  }
+  async ensureClient() {
+    if (this.shuttingDown) {
+      throw new SubcCallError("terminal", "subc transport is shutting down");
+    }
+    if (this.client)
+      return this.client;
+    if (this.connecting)
+      return this.connecting;
+    this.connecting = this.connectFn({
+      connectionFile: this.connectionFile,
+      handshakeTimeoutMs: this.handshakeTimeoutMs
+    }).then((client) => {
+      this.connecting = null;
+      if (this.shuttingDown) {
+        try {
+          client.close();
+        } catch {}
+        throw new SubcCallError("terminal", "subc transport is shutting down");
+      }
+      this.client = client;
+      this.transportFailures = 0;
+      return client;
+    }).catch((err) => {
+      this.connecting = null;
+      throw err;
+    });
+    return this.connecting;
+  }
+  async routeChannel(client, identity, record) {
+    const key = identityKey(identity);
+    const existing = record.routeEntry;
+    if (existing?.channel != null)
+      return { channel: existing.channel, entry: existing };
+    if (existing?.opening)
+      return { channel: await existing.opening, entry: existing };
+    const entry = { client, opening: null, channel: null, closed: false };
+    const opening = client.routeOpen({ kind: "tool_provider", module_id: AFT_MODULE_ID }, identity).then((channel) => {
+      if (!this.isCurrentSession(key, record) || record.routeEntry !== entry || entry.closed || this.client !== client) {
+        safeCloseRoute(client, channel);
+        if (record.routeEntry === entry)
+          record.routeEntry = null;
+        throw new RouteTornDownError("subc route opened after teardown");
+      }
+      entry.channel = channel;
+      entry.opening = null;
+      return channel;
+    }).catch((err) => {
+      const current = this.isCurrentSession(key, record);
+      if (record.routeEntry === entry) {
+        entry.closed = true;
+        record.routeEntry = null;
+      }
+      if (!current && !(err instanceof RouteTornDownError)) {
+        throw new RouteTornDownError("subc route opened after session closed");
+      }
+      throw err;
+    });
+    entry.opening = opening;
+    record.routeEntry = entry;
+    return { channel: await opening, entry };
   }
-  setConfigureOverride(key, value) {
-    if (value === undefined) {
-      delete this.configOverrides[key];
-    } else {
-      this.configOverrides[key] = value;
+  ensureBgSubscription(identity, record) {
+    if (this.shuttingDown || !this.onBgEventsNudge)
+      return;
+    const key = identityKey(identity);
+    if (!this.isCurrentSession(key, record))
+      return;
+    if (record.bgSub)
+      return;
+    const onNudge = () => this.onBgEventsNudge?.(identity.project_root, identity.session);
+    const sub = new BgSubscription(identity, () => this.ensureClient(), (client) => this.dropClient(client), onNudge, this.bgBackoffSleep);
+    record.bgSub = sub;
+  }
+  dropClient(client) {
+    if (this.client === client) {
+      this.client = null;
+      for (const [key, record] of this.sessions) {
+        const entry = record.routeEntry;
+        if (entry?.client === client) {
+          entry.closed = true;
+          record.routeEntry = null;
+          this.deleteSessionIfEmpty(key, record);
+        }
+      }
+      this.transportFailures = 0;
+      try {
+        client.close();
+      } catch {}
     }
   }
-  get size() {
-    return this.bridges.size;
+  setConfigureOverride(_key, _value) {}
+  async replaceBinary(path) {
+    return path;
   }
-  _testGetConfigOverrides() {
-    return { ...this.configOverrides };
+  async shutdown() {
+    this.shuttingDown = true;
+    const subs = [];
+    const entries = [];
+    for (const record of this.sessions.values()) {
+      record.closed = true;
+      const sub = record.bgSub;
+      record.bgSub = null;
+      if (sub)
+        subs.push(sub);
+      const entry = record.routeEntry;
+      record.routeEntry = null;
+      if (entry) {
+        entry.closed = true;
+        entries.push(entry);
+      }
+    }
+    this.sessions.clear();
+    const client = this.client;
+    this.client = null;
+    this.transports.clear();
+    await Promise.allSettled(subs.map((sub) => sub.stop()));
+    await Promise.allSettled(entries.map(async (entry) => {
+      if (entry.channel == null)
+        return;
+      try {
+        await entry.client.closeRouteChannel(entry.channel);
+      } catch {}
+    }));
+    if (client) {
+      try {
+        client.close();
+      } catch {}
+    }
   }
-  _testGetBridgeOptions() {
-    return { ...this.bridgeOptions };
+  async closeSession(projectRoot, session) {
+    const identity = {
+      project_root: canonicalizeProjectRoot(projectRoot),
+      harness: this.harness,
+      session: session && session.length > 0 ? session : DEFAULT_SESSION_ID
+    };
+    const key = identityKey(identity);
+    const record = this.sessions.get(key);
+    if (!record)
+      return;
+    record.closed = true;
+    this.sessions.delete(key);
+    const sub = record.bgSub;
+    record.bgSub = null;
+    const entry = record.routeEntry;
+    record.routeEntry = null;
+    if (entry)
+      entry.closed = true;
+    if (sub)
+      await sub.stop();
+    if (entry?.channel != null) {
+      try {
+        await entry.client.closeRouteChannel(entry.channel);
+      } catch {}
+    }
   }
 }
-function normalizeKey(projectRoot) {
-  return canonicalizeProjectRoot(projectRoot);
-}
-var DEFAULT_IDLE_TIMEOUT_MS, DEFAULT_MAX_POOL_SIZE = 8, CLEANUP_INTERVAL_MS;
-var init_pool = __esm(() => {
-  init_active_logger();
-  init_bridge();
+var AFT_MODULE_ID = "aft", MAX_CONSECUTIVE_TRANSPORT_FAILURES = 3, BG_STABLE_MS = 5000, DEFAULT_SESSION_ID = "__default__", LOCALLY_SATISFIED_COMMANDS, RouteTornDownError;
+var init_subc_transport = __esm(() => {
+  init_src();
   init_project_identity();
-  DEFAULT_IDLE_TIMEOUT_MS = 30 * 60 * 1000;
-  CLEANUP_INTERVAL_MS = 60 * 1000;
+  LOCALLY_SATISFIED_COMMANDS = new Set(["configure"]);
+  RouteTornDownError = class RouteTornDownError extends Error {
+  };
+});
+// ../aft-bridge/dist/transport-factory.js
+var init_transport_factory = __esm(() => {
+  init_pool();
+  init_subc_transport();
 });
 // ../aft-bridge/dist/index.js
 var init_dist = __esm(() => {
@@ -1513,6 +3548,8 @@ var init_dist = __esm(() => {
   init_pool();
   init_project_identity();
   init_resolver();
+  init_subc_transport();
+  init_transport_factory();
 });
 
 // src/lib/paths.ts
@@ -9803,6 +11840,63 @@ class OpenCodeAdapter {
       configPath
     };
   }
+  hasTuiPluginEntry() {
+    const paths = this.detectConfigPaths();
+    if (!paths.tuiConfig)
+      return false;
+    const { value } = readJsoncFile(paths.tuiConfig);
+    const plugins = Array.isArray(value?.plugin) ? value.plugin : [];
+    return plugins.some((entry) => typeof entry === "string" && matchesPluginEntry(entry));
+  }
+  async ensureTuiPluginEntry() {
+    const paths = this.detectConfigPaths();
+    const configPath = paths.tuiConfig;
+    if (!configPath) {
+      return {
+        ok: false,
+        action: "error",
+        message: "No TUI config path detected",
+        configPath: paths.configDir
+      };
+    }
+    if (paths.tuiConfigFormat === "none") {
+      writeJsoncFile(configPath, { plugin: [PLUGIN_ENTRY] }, "json");
+      return {
+        ok: true,
+        action: "added",
+        message: `Created ${configPath} and added ${PLUGIN_ENTRY} (TUI sidebar)`,
+        configPath
+      };
+    }
+    const { value, error: error2 } = readJsoncFile(configPath);
+    if (error2 || !value) {
+      return {
+        ok: false,
+        action: "error",
+        message: `Could not parse ${configPath}: ${error2 ?? "unknown error"}`,
+        configPath
+      };
+    }
+    const plugins = Array.isArray(value.plugin) ? value.plugin : [];
+    const already = plugins.some((entry) => typeof entry === "string" && matchesPluginEntry(entry));
+    if (already) {
+      return {
+        ok: true,
+        action: "already_present",
+        message: `${PLUGIN_NAME} is already registered in ${configPath}`,
+        configPath
+      };
+    }
+    plugins.push(PLUGIN_ENTRY);
+    value.plugin = plugins;
+    writeJsoncFile(configPath, value, paths.tuiConfigFormat);
+    return {
+      ok: true,
+      action: "added",
+      message: `Added ${PLUGIN_ENTRY} to ${configPath} (TUI sidebar)`,
+      configPath
+    };
+  }
   getPluginCacheInfo() {
     const path = join7(getOpenCodeCacheDir(), "packages", PLUGIN_ENTRY);
     let cached;
@@ -11954,6 +14048,14 @@ async function runSetup(argv) {
       default:
         log2.info(`${adapter.displayName}: ${result.message}`);
     }
+    if (adapter.ensureTuiPluginEntry) {
+      const tuiResult = await adapter.ensureTuiPluginEntry();
+      if (!tuiResult.ok) {
+        log2.warn(`${adapter.displayName}: ${tuiResult.message}`);
+      } else if (tuiResult.action === "added" || tuiResult.action === "updated") {
+        log2.success(`${adapter.displayName}: ${tuiResult.message}`);
+      }
+    }
     try {
       const { aftConfig, aftConfigFormat } = adapter.detectConfigPaths();
       const schemaResult = ensureAftSchemaUrl(aftConfig, aftConfigFormat);
@@ -13141,6 +15243,12 @@ async function diagnoseHarness(adapter) {
   const configPaths = adapter.detectConfigPaths();
   const aftConfigRead = readJsoncFile(configPaths.aftConfig);
   const aftFlags = sanitizeValue(aftConfigRead.value ?? {}) ?? {};
+  const projectConfigPath = resolveCortexKitProjectConfigPath(process.cwd());
+  const projectConfigRead = readJsoncFile(projectConfigPath);
+  const userEnabled = typeof aftFlags.enabled === "boolean" ? aftFlags.enabled : undefined;
+  const projectEnabled = typeof projectConfigRead.value?.enabled === "boolean" ? projectConfigRead.value.enabled : undefined;
+  const aftEnabled = projectEnabled ?? userEnabled ?? true;
+  const aftEnabledSource = projectEnabled !== undefined ? projectConfigPath : userEnabled !== undefined ? configPaths.aftConfig : undefined;
   const storage = adapter.getStorageDir();
   const logPath = adapter.getLogFile();
   const pluginCache = adapter.getPluginCacheInfo();
@@ -13155,7 +15263,7 @@ async function diagnoseHarness(adapter) {
     }
   })();
   const describeStorage = "describeStorageSubtrees" in adapter && typeof adapter.describeStorageSubtrees === "function" ? adapter.describeStorageSubtrees() : {};
-  const semanticEnabled = aftConfigRead.value?.semantic_search === true || aftConfigRead.value?.experimental_semantic_search === true;
+  const semanticEnabled = aftEnabled && (aftConfigRead.value?.semantic_search === true || aftConfigRead.value?.experimental_semantic_search === true);
   const systemOrtDir = findSystemOnnxRuntime();
   const cachedOrtDir = findCachedOnnxRuntime(storage);
   const systemVersion = systemOrtDir ? detectOrtVersion(systemOrtDir) : null;
@@ -13170,6 +15278,8 @@ async function diagnoseHarness(adapter) {
     aftConfig: {
       exists: existsSync14(configPaths.aftConfig),
       ...aftConfigRead.error ? { parseError: aftConfigRead.error } : {},
+      enabled: aftEnabled,
+      ...aftEnabledSource ? { enabledSource: aftEnabledSource } : {},
       flags: aftFlags
     },
     pluginCache,
@@ -13220,6 +15330,7 @@ function renderDiagnosticsMarkdown(report) {
     lines.push(`- Host version: ${h2.hostVersion ?? "unknown"}`);
     lines.push(`- Plugin registered: ${h2.pluginRegistered}`);
     lines.push(`- Plugin version: ${h2.pluginCache.cached ?? "not installed"}`);
+    lines.push(`- AFT enabled: ${h2.aftConfig.enabled}${h2.aftConfig.enabledSource ? ` (from ${h2.aftConfig.enabledSource})` : ""}`);
     lines.push(`- AFT config parse error: ${h2.aftConfig.parseError ?? "none"}`);
     lines.push("");
     lines.push("#### Config paths");
@@ -13300,7 +15411,8 @@ function pluginVersionSkewIssue(harness, cliVersion) {
 }
 function collectDiagnosticIssues(report) {
   const issues = [];
-  if (!report.binaryVersion) {
+  const hasEnabledRegisteredHarness = report.harnesses.some((h2) => h2.pluginRegistered && h2.aftConfig.enabled);
+  if (!report.binaryVersion && hasEnabledRegisteredHarness) {
     issues.push({
       code: "binary_missing",
       severity: "high",
@@ -13339,9 +15451,9 @@ function collectDiagnosticIssues(report) {
       });
     }
     const skewIssue = pluginVersionSkewIssue(h2, report.cliVersion);
-    if (skewIssue)
+    if (h2.aftConfig.enabled && skewIssue)
       issues.push(skewIssue);
-    if (h2.onnxRuntime.required) {
+    if (h2.aftConfig.enabled && h2.onnxRuntime.required) {
       if (!h2.onnxRuntime.cachedPath && !h2.onnxRuntime.systemPath) {
         issues.push({
           code: "onnx_missing",
@@ -13425,6 +15537,7 @@ function tailLogFile(path, lines) {
   }
 }
 var init_diagnostics = __esm(async () => {
+  init_dist();
   init_binary_cache();
   init_jsonc();
   init_lsp_cache();
@@ -13887,7 +16000,15 @@ async function runDoctor(options) {
   const report = await collectDiagnostics(adapters);
   log2.info(`AFT CLI v${report.cliVersion}, AFT binary ${report.binaryVersion ?? "unknown"}`);
   if (!report.binaryVersion) {
-    log2.warn("  no matching aft binary detected — run `aft doctor --fix` to download, or it will install automatically when an AFT-enabled session makes its first tool call");
+    const hasEnabledRegisteredHarness = report.harnesses.some((h2) => h2.pluginRegistered && h2.aftConfig.enabled);
+    const hasRegisteredHarness = report.harnesses.some((h2) => h2.pluginRegistered);
+    if (hasEnabledRegisteredHarness) {
+      log2.warn("  no matching aft binary detected — run `aft doctor --fix` to download, or it will install automatically when an AFT-enabled session makes its first tool call");
+    } else if (hasRegisteredHarness) {
+      log2.info("  no matching aft binary detected; all registered AFT harnesses are disabled by config");
+    } else {
+      log2.warn("  no matching aft binary detected — run `aft doctor --fix` to download");
+    }
     logUnmatchedBinaryCandidates(report.cliVersion);
   }
   log2.info(`Binary cache: ${report.binaryCache.versions.length} version(s), ${formatBytes(report.binaryCache.totalSize)} at ${report.binaryCache.path}`);
@@ -13906,6 +16027,9 @@ async function runDoctor(options) {
     log2.info(`  host: ${h2.hostVersion ?? "unknown version"}`);
     log2.info(`  plugin registered: ${h2.pluginRegistered ? "yes" : "no"}`);
     log2.info(`  plugin version: ${h2.pluginCache.cached ?? "not installed"}`);
+    if (!h2.aftConfig.enabled) {
+      log2.info(`  AFT disabled by config${h2.aftConfig.enabledSource ? ` (${h2.aftConfig.enabledSource})` : ""}; plugin will stay inert`);
+    }
     if (!h2.pluginRegistered) {
       log2.warn("  plugin registration can be fixed with `aft setup` or `aft doctor --fix`");
     }
@@ -14061,6 +16185,8 @@ function findPluginUpdateTargets(adapters, report) {
   for (const harness of report.harnesses) {
     if (harness.kind !== "opencode")
       continue;
+    if (!harness.aftConfig.enabled)
+      continue;
     if (!harness.hostInstalled || !harness.pluginRegistered)
       continue;
     const cache = harness.pluginCache;
@@ -14164,13 +16290,29 @@ function buildDoctorFixPlan(adapters, report) {
       });
     }
   }
+  for (const harness of report.harnesses) {
+    const adapter = adaptersByKind.get(harness.kind);
+    if (!adapter || !harness.hostInstalled)
+      continue;
+    if (!adapter.ensureTuiPluginEntry || !adapter.hasTuiPluginEntry)
+      continue;
+    if (adapter.hasTuiPluginEntry())
+      continue;
+    items.push({
+      kind: "plugin",
+      message: `Will add ${adapter.pluginEntryWithVersion} to ${harness.configPaths.tuiConfig} (TUI sidebar)`
+    });
+  }
   for (const target of findPluginUpdateTargets(adapters, report)) {
     items.push({
       kind: "plugin-update",
       message: `Will update ${target.adapter.displayName} plugin ${target.cached} → ${target.latest} via npm (the plugin's own auto-update could not run, often no npm on PATH)`
     });
   }
-  if (!report.binaryVersion) {
+  const hasEnabledHarness = report.harnesses.some((harness) => {
+    return harness.hostInstalled && harness.aftConfig.enabled;
+  });
+  if (!report.binaryVersion && hasEnabledHarness) {
     const skews = findPluginCliVersionSkews(report);
     items.push({
       kind: "binary",
@@ -14178,7 +16320,9 @@ function buildDoctorFixPlan(adapters, report) {
     });
   }
   for (const harness of report.harnesses) {
-    if (!harness.hostInstalled || !harness.pluginRegistered || harness.storageDir.exists)
+    if (!harness.hostInstalled || !harness.pluginRegistered || !harness.aftConfig.enabled)
+      continue;
+    if (harness.storageDir.exists)
       continue;
     items.push({
       kind: "storage",
@@ -14408,7 +16552,9 @@ async function fixPluginEntries(adapters) {
   }
 }
 async function maybeFixPlugin(adapter) {
-  if (!adapter.hasPluginEntry() && adapter.isInstalled()) {
+  if (!adapter.isInstalled())
+    return;
+  if (!adapter.hasPluginEntry()) {
     log2.info(`${adapter.displayName}: attempting to register plugin…`);
     const r2 = await adapter.ensurePluginEntry();
     if (r2.ok) {
@@ -14417,6 +16563,14 @@ async function maybeFixPlugin(adapter) {
       log2.error(`${adapter.displayName}: ${r2.message}`);
     }
   }
+  if (adapter.ensureTuiPluginEntry && adapter.hasTuiPluginEntry && !adapter.hasTuiPluginEntry()) {
+    const r2 = await adapter.ensureTuiPluginEntry();
+    if (r2.ok && (r2.action === "added" || r2.action === "updated")) {
+      log2.success(`${adapter.displayName}: ${r2.message}`);
+    } else if (!r2.ok) {
+      log2.error(`${adapter.displayName}: ${r2.message}`);
+    }
+  }
 }
 function describeAdapterInstallHint(kind) {
   if (kind === "opencode")