@cortexkit/aft 0.60.0 → 0.61.0

package/dist/index.js

@@ -109,6 +109,29 @@ var ACTIVE_LOGGER_SYMBOL;
 var init_active_logger = __esm(() => {
   ACTIVE_LOGGER_SYMBOL = Symbol.for("aft-bridge-active-logger");
 });
+
+// ../aft-bridge/dist/protocol.js
+function isTerminalBashStatus(status, compatibilityAliases = false) {
+  return typeof status === "string" && (TERMINAL_BASH_STATUSES.has(status) || compatibilityAliases && (status === "cancelled" || status === "timeout"));
+}
+var TERMINAL_BG_TASK_STATUSES, TERMINAL_BASH_STATUSES;
+var init_protocol = __esm(() => {
+  TERMINAL_BG_TASK_STATUSES = Object.freeze([
+    "completed",
+    "failed",
+    "killed",
+    "timed_out",
+    "fate_unknown"
+  ]);
+  TERMINAL_BASH_STATUSES = new Set(TERMINAL_BG_TASK_STATUSES);
+});
+
+// ../aft-bridge/dist/bash-format.js
+var init_bash_format = __esm(() => {
+  init_protocol();
+  init_protocol();
+});
+
 // ../aft-bridge/dist/path-display.js
 import { homedir } from "node:os";
 import { posix, win32 } from "node:path";
@@ -129,6 +152,7 @@ var init_path_display = () => {};
 
 // ../aft-bridge/dist/bash-hints.js
 var init_bash_hints = __esm(() => {
+  init_bash_format();
   init_path_display();
 });
 
@@ -615,9 +639,6 @@ var WORKER_SESSION_FIELD = "worker_session", HOST_TOOL_NAMES_FIELD = "host_tool_
 import { homedir as homedir4 } from "node:os";
 import { join as join3 } from "node:path";
 import { StringDecoder } from "node:string_decoder";
-function isTerminalBashStatus(status) {
-  return typeof status === "string" && TERMINAL_BASH_STATUSES.has(status);
-}
 function bashTaskIdFrom(response) {
   const snakeCase = response.task_id;
   if (typeof snakeCase === "string" && snakeCase.length > 0)
@@ -646,44 +667,37 @@ function shouldSurfaceStderrLine(line) {
   return !(normalized === `Error in cpuinfo: ${BENIGN_CPUINFO_PROC_CPUINFO_PARSE_FAILURE}` || normalized === BENIGN_CPUINFO_PROC_CPUINFO_PARSE_FAILURE);
 }
 function compareSemver(a, b) {
-  const [aMain, aPre] = a.split("-", 2);
-  const [bMain, bPre] = b.split("-", 2);
-  const aParts = aMain.split(".").map(Number);
-  const bParts = bMain.split(".").map(Number);
+  const parse = (version) => {
+    const match = /^(0|[1-9]\d*)\.(0|[1-9]\d*)\.(0|[1-9]\d*)(?:-([0-9A-Za-z-]+(?:\.[0-9A-Za-z-]+)*))?(?:\+[0-9A-Za-z-]+(?:\.[0-9A-Za-z-]+)*)?$/.exec(version);
+    const pre = match?.[4]?.split(".") ?? [];
+    if (!match || pre.some((id) => /^\d+$/.test(id) && id.length > 1 && id[0] === "0")) {
+      throw new Error(`Invalid semantic version: ${version}`);
+    }
+    return { core: match.slice(1, 4), pre };
+  };
+  const numeric = (a, b) => a.length !== b.length ? a.length - b.length : a === b ? 0 : a < b ? -1 : 1;
+  const left = parse(a);
+  const right = parse(b);
   for (let i = 0;i < 3; i++) {
-    if (aParts[i] !== bParts[i])
-      return (aParts[i] ?? 0) - (bParts[i] ?? 0);
+    const diff = numeric(left.core[i], right.core[i]);
+    if (diff !== 0)
+      return diff;
   }
-  if (!aPre && !bPre)
-    return 0;
-  if (!aPre)
-    return 1;
-  if (!bPre)
-    return -1;
-  const aIds = aPre.split(".");
-  const bIds = bPre.split(".");
-  for (let i = 0;i < Math.max(aIds.length, bIds.length); i++) {
-    const ai = aIds[i];
-    const bi = bIds[i];
+  if (left.pre.length === 0 || right.pre.length === 0) {
+    return left.pre.length === right.pre.length ? 0 : left.pre.length === 0 ? 1 : -1;
+  }
+  for (let i = 0;i < Math.max(left.pre.length, right.pre.length); i++) {
+    const ai = left.pre[i];
+    const bi = right.pre[i];
     if (ai === undefined)
       return -1;
     if (bi === undefined)
       return 1;
     const aNum = /^\d+$/.test(ai);
     const bNum = /^\d+$/.test(bi);
-    if (aNum && bNum) {
-      const diff = Number.parseInt(ai, 10) - Number.parseInt(bi, 10);
-      if (diff !== 0)
-        return diff;
-    } else if (aNum) {
-      return -1;
-    } else if (bNum) {
-      return 1;
-    } else {
-      const cmp = ai.localeCompare(bi);
-      if (cmp !== 0)
-        return cmp;
-    }
+    const diff = aNum && bNum ? numeric(ai, bi) : aNum !== bNum ? aNum ? -1 : 1 : ai === bi ? 0 : ai < bi ? -1 : 1;
+    if (diff !== 0)
+      return diff;
   }
   return 0;
 }
@@ -701,22 +715,27 @@ function coerceConfigureDroppedKeys(value) {
   }
   return dropped;
 }
-var DEFAULT_BRIDGE_TIMEOUT_MS = 30000, BRIDGE_HANG_TIMEOUT_THRESHOLD = 2, MAX_STDOUT_BUFFER, MALFORMED_STDOUT_LOG_CHARS = 512, HASHLINE_REGISTRATION_LOG_INTERVAL_MS = 60000, HASHLINE_REGISTRATION_LOG_STATE_LIMIT = 256, TERMINAL_BASH_STATUSES, binaryFingerprintReader, binaryFingerprintAsyncReader, BENIGN_CPUINFO_PROC_CPUINFO_PARSE_FAILURE = "failed to parse processor information from /proc/cpuinfo", BridgeReplacedDuringVersionCheck, BridgeTransportTimeoutError, BridgeTransportUnavailableError, BridgeTransportUnknownOutcomeError, BinaryBridge;
+function shellOutcomeFromLateReply(response) {
+  const taskId = bashTaskIdFrom(response);
+  if (taskId)
+    return { kind: "task_started", taskId };
+  if (response.success === false) {
+    return {
+      kind: "not_started",
+      ...typeof response.code === "string" ? { code: response.code } : {},
+      ...typeof response.message === "string" ? { message: response.message } : {}
+    };
+  }
+  return { kind: "unknown" };
+}
+var DEFAULT_BRIDGE_TIMEOUT_MS = 30000, BRIDGE_HANG_TIMEOUT_THRESHOLD = 2, MAX_STDOUT_BUFFER, MALFORMED_STDOUT_LOG_CHARS = 512, HASHLINE_REGISTRATION_LOG_INTERVAL_MS = 60000, HASHLINE_REGISTRATION_LOG_STATE_LIMIT = 256, binaryFingerprintReader, binaryFingerprintAsyncReader, BENIGN_CPUINFO_PROC_CPUINFO_PARSE_FAILURE = "failed to parse processor information from /proc/cpuinfo", BridgeReplacedDuringVersionCheck, BridgeTransportTimeoutError, SHELL_TASK_COMMANDS, DEFAULT_LATE_SHELL_REPLY_GRACE_MS = 1e4, BridgeTransportUnavailableError, BridgeTransportUnknownOutcomeError, BinaryBridge;
 var init_bridge = __esm(() => {
   init_active_logger();
   init_binary_identity();
   init_child_process();
   init_command_timeouts();
+  init_protocol();
   MAX_STDOUT_BUFFER = 64 * 1024 * 1024;
-  TERMINAL_BASH_STATUSES = new Set([
-    "completed",
-    "failed",
-    "killed",
-    "timed_out",
-    "fate_unknown",
-    "cancelled",
-    "timeout"
-  ]);
   binaryFingerprintReader = peekBinaryFingerprint;
   binaryFingerprintAsyncReader = binaryContentHash;
   BridgeReplacedDuringVersionCheck = class BridgeReplacedDuringVersionCheck extends Error {
@@ -731,13 +750,16 @@ var init_bridge = __esm(() => {
     command;
     timeoutMs;
     code = "transport_timeout";
-    constructor(command, timeoutMs, message) {
+    shellOutcome;
+    constructor(command, timeoutMs, message, shellOutcome) {
       super(message);
       this.command = command;
       this.timeoutMs = timeoutMs;
       this.name = "BridgeTransportTimeoutError";
+      this.shellOutcome = shellOutcome;
     }
   };
+  SHELL_TASK_COMMANDS = new Set(["bash", "powershell"]);
   BridgeTransportUnavailableError = class BridgeTransportUnavailableError extends Error {
     code = "bridge_transport_unavailable";
     constructor(message, options) {
@@ -778,6 +800,7 @@ var init_bridge = __esm(() => {
     _shuttingDown = false;
     timeoutMs;
     hangThreshold;
+    lateShellReplyGraceMs;
     maxRestarts;
     configured = false;
     _configurePromise = null;
@@ -794,6 +817,7 @@ var init_bridge = __esm(() => {
     cachedStatus = null;
     statusListeners = new Set;
     configureWarningClients = new Map;
+    restartTimer = null;
     restartResetTimer = null;
     lastChildActivityAt = 0;
     consecutiveRequestTimeouts = 0;
@@ -807,6 +831,7 @@ var init_bridge = __esm(() => {
       this.cwd = cwd;
       this.timeoutMs = options?.timeoutMs ?? DEFAULT_BRIDGE_TIMEOUT_MS;
       this.hangThreshold = options?.hangThreshold ?? BRIDGE_HANG_TIMEOUT_THRESHOLD;
+      this.lateShellReplyGraceMs = options?.lateShellReplyGraceMs ?? DEFAULT_LATE_SHELL_REPLY_GRACE_MS;
       this.maxRestarts = options?.maxRestarts ?? 3;
       this.errorPrefix = options?.errorPrefix ?? "[aft-bridge]";
       this.configOverrides = { ...configOverrides ?? {} };
@@ -1079,9 +1104,6 @@ var init_bridge = __esm(() => {
         }
         const requestSessionId = typeof params.session_id === "string" && params.session_id.length > 0 ? params.session_id : undefined;
         this.ensureSpawned(requestSessionId);
-        if (requestSessionId && options?.configureWarningClient !== undefined) {
-          this.configureWarningClients.set(requestSessionId, options.configureWarningClient);
-        }
         const passive = isPassiveCommand(command);
         const resolvedTimeoutMs = options?.transportTimeoutMs ?? options?.timeoutMs ?? this.timeoutMs;
         const effectiveTimeoutMs = passive ? Math.min(resolvedTimeoutMs, PASSIVE_COMMAND_TIMEOUT_MS) : resolvedTimeoutMs;
@@ -1092,6 +1114,9 @@ var init_bridge = __esm(() => {
         if (!this.configured) {
           if (command !== "configure" && command !== "version") {
             if (!this._configurePromise) {
+              if (this.onConfigureWarnings && requestSessionId && options?.configureWarningClient !== undefined) {
+                this.configureWarningClients.set(requestSessionId, options.configureWarningClient);
+              }
               const configuringChild = this.process;
               const requireConfiguringChild = () => {
                 if (this.process !== configuringChild) {
@@ -1118,6 +1143,10 @@ var init_bridge = __esm(() => {
                     throw new BridgeTransportUnavailableError(`${this.errorPrefix} Bridge died during version check. Check logs: ${this.getLogFilePathVia()}`);
                   }
                   this.configured = true;
+                } catch (error) {
+                  if (sessionIdForConfigure)
+                    this.configureWarningClients.delete(sessionIdForConfigure);
+                  throw error;
                 } finally {
                   this._configurePromise = null;
                 }
@@ -1157,6 +1186,9 @@ var init_bridge = __esm(() => {
             const entry = this.pending.get(id);
             if (!entry)
               return;
+            if (keepBridgeOnTimeout && this.holdForLateShellReply(id, entry, effectiveTimeoutMs, requestSessionId)) {
+              return;
+            }
             this.pending.delete(id);
             clearTimeout(entry.timer);
             entry.onSettled?.();
@@ -1251,52 +1283,48 @@ var init_bridge = __esm(() => {
       }
     }
     async deliverConfigureWarnings(configResult, params, options) {
+      const sessionId = typeof params.session_id === "string" ? params.session_id : undefined;
+      const client = options?.configureWarningClient ?? (sessionId ? this.configureWarningClients.get(sessionId) : undefined);
+      if (sessionId && configResult.warnings_pending !== true)
+        this.configureWarningClients.delete(sessionId);
       if (!this.onConfigureWarnings)
         return;
       const warnings = Array.isArray(configResult.warnings) ? configResult.warnings : [];
       const configDroppedKeys = coerceConfigureDroppedKeys(configResult.config_dropped_keys);
       if (warnings.length === 0 && configDroppedKeys.length === 0)
         return;
-      const sessionId = typeof params.session_id === "string" ? params.session_id : undefined;
       const context = {
         projectRoot: this.cwd,
         sessionId,
-        client: options?.configureWarningClient ?? (sessionId ? this.configureWarningClients.get(sessionId) : undefined),
+        client,
         warnings
       };
-      if (configDroppedKeys.length > 0) {
+      if (configDroppedKeys.length > 0)
         context.configDroppedKeys = configDroppedKeys;
-      }
-      try {
-        await this.onConfigureWarnings(context);
-      } catch (err) {
-        this.warnVia(`configure warning delivery failed: ${err instanceof Error ? err.message : String(err)}`);
-      } finally {
-        if (sessionId) {
-          this.configureWarningClients.delete(sessionId);
-        }
-      }
+      this.dispatchHostCallback("configure warning", () => this.onConfigureWarnings?.(context));
     }
     async handleConfigureWarningsFrame(frame) {
-      if (!this.onConfigureWarnings)
-        return;
-      const warnings = frame.warnings;
-      if (!Array.isArray(warnings) || warnings.length === 0)
+      const sessionId = typeof frame.session_id === "string" && frame.session_id.length > 0 ? frame.session_id : null;
+      const client = sessionId ? this.configureWarningClients.get(sessionId) : undefined;
+      if (sessionId)
+        this.configureWarningClients.delete(sessionId);
+      if (!this.onConfigureWarnings || !Array.isArray(frame.warnings) || frame.warnings.length === 0)
         return;
-      const projectRoot = typeof frame.project_root === "string" ? frame.project_root : this.cwd;
-      const rawSessionId = frame.session_id;
-      const sessionId = typeof rawSessionId === "string" && rawSessionId.length > 0 ? rawSessionId : null;
+      this.dispatchHostCallback("configure warning", () => this.onConfigureWarnings?.({
+        projectRoot: typeof frame.project_root === "string" ? frame.project_root : this.cwd,
+        sessionId,
+        client,
+        warnings: frame.warnings
+      }));
+    }
+    dispatchHostCallback(label, callback) {
+      const failed = (error) => {
+        this.warnVia(`${label} delivery failed: ${error instanceof Error ? error.message : String(error)}`);
+      };
       try {
-        await this.onConfigureWarnings({
-          projectRoot,
-          sessionId,
-          client: sessionId ? this.configureWarningClients.get(sessionId) : undefined,
-          warnings
-        });
-      } finally {
-        if (sessionId) {
-          this.configureWarningClients.delete(sessionId);
-        }
+        Promise.resolve(callback()).catch(failed);
+      } catch (error) {
+        failed(error);
       }
     }
     handleStatusChangedFrame(frame) {
@@ -1319,6 +1347,7 @@ var init_bridge = __esm(() => {
       this._shuttingDown = true;
       this.spawnedBinaryFingerprint = null;
       this.clearRestartResetTimer();
+      this.clearRestartTimer();
       this.configureWarningClients.clear();
       this.rejectAllPending(new BridgeTransportUnknownOutcomeError(`${this.errorPrefix} Bridge shutting down`));
       if (this.process) {
@@ -1402,6 +1431,7 @@ var init_bridge = __esm(() => {
       this.spawnProcess(triggeringSessionId);
     }
     spawnProcess(triggeringSessionId) {
+      this.clearRestartTimer();
       this._retiringDueToBinaryChange = false;
       if (triggeringSessionId) {
         this.sessionLogVia(triggeringSessionId, `Spawning binary: ${this.binaryPath} (cwd: ${this.cwd})`);
@@ -1452,6 +1482,11 @@ var init_bridge = __esm(() => {
         env: spawnEnv
       });
       const currentChild = child;
+      child.stdin?.on("error", (cause) => {
+        if (this.process !== currentChild)
+          return;
+        this.invalidateTransportProcess(new BridgeTransportUnknownOutcomeError(`${this.errorPrefix} Failed to write to stdin: ${cause.message}`, { cause }));
+      });
       const stdoutDecoder = new StringDecoder("utf8");
       child.stdout?.on("data", (chunk) => {
         if (this.process !== currentChild)
@@ -1567,10 +1602,12 @@ var init_bridge = __esm(() => {
   ${tail}`;
     }
     onStdoutData(data) {
-      if (this.stdoutPendingLength + data.length > MAX_STDOUT_BUFFER) {
+      const exceedsLimit = (fragment) => {
+        if (this.stdoutPendingLength + Buffer.byteLength(fragment, "utf8") <= MAX_STDOUT_BUFFER)
+          return false;
         this.handleCrash(new Error(`aft bridge stdout buffer exceeded ${MAX_STDOUT_BUFFER} bytes — killing bridge`));
-        return;
-      }
+        return true;
+      };
       this.stdoutScannedChars += data.length;
       const generation = this.processGeneration;
       let start = 0;
@@ -1578,6 +1615,8 @@ var init_bridge = __esm(() => {
 `);
       while (newlineIdx !== -1) {
         let line = data.slice(start, newlineIdx);
+        if (exceedsLimit(line))
+          return;
         if (this.stdoutPending.length > 0) {
           this.stdoutPending.push(line);
           line = this.stdoutPending.join("");
@@ -1596,8 +1635,10 @@ var init_bridge = __esm(() => {
       }
       if (start < data.length) {
         const rest = start === 0 ? data : data.slice(start);
+        if (exceedsLimit(rest))
+          return;
         this.stdoutPending.push(rest);
-        this.stdoutPendingLength += rest.length;
+        this.stdoutPendingLength += Buffer.byteLength(rest, "utf8");
       }
     }
     flushStdoutBuffer() {
@@ -1641,15 +1682,15 @@ var init_bridge = __esm(() => {
           if (taskId)
             this.outstandingBackgroundTaskIds.delete(taskId);
           this.syncEventLoopHold();
-          this.onBashCompletion?.(response, this);
+          this.dispatchHostCallback("bash completion", () => this.onBashCompletion?.(response, this));
           return;
         }
         if (response.type === "bash_long_running") {
-          this.onBashLongRunning?.(response, this);
+          this.dispatchHostCallback("bash long-running", () => this.onBashLongRunning?.(response, this));
           return;
         }
         if (response.type === "bash_pattern_match") {
-          this.onBashPatternMatch?.(response, this);
+          this.dispatchHostCallback("bash pattern-match", () => this.onBashPatternMatch?.(response, this));
           return;
         }
         if (response.type === "configure_warnings") {
@@ -1685,6 +1726,13 @@ var init_bridge = __esm(() => {
           this.scheduleRestartCountReset();
           this.accountForBashTaskResponse(entry.command, response);
           entry.resolve(response);
+        } else if (id && typeof response.type !== "string") {
+          const taskId = bashTaskIdFrom(response);
+          if (taskId) {
+            this.warnVia(`Dropped late reply for settled request id=${id} task_id=${taskId}`);
+          } else {
+            this.logVia(`Dropped late reply for settled request id=${id}`);
+          }
         } else if (typeof response.type === "string") {
           this.logVia(`Ignoring unknown stdout push frame type: ${response.type}`);
         }
@@ -1693,11 +1741,38 @@ var init_bridge = __esm(() => {
         this.warnVia(`Failed to parse stdout line: ${quoted}`);
       }
     }
+    holdForLateShellReply(id, entry, effectiveTimeoutMs, requestSessionId) {
+      const graceMs = this.lateShellReplyGraceMs;
+      if (!SHELL_TASK_COMMANDS.has(entry.command) || graceMs <= 0)
+        return false;
+      const timeoutMsg = `Request "${entry.command}" (id=${id}) timed out after ${effectiveTimeoutMs}ms; waiting up to ${graceMs}ms for a late reply naming its task`;
+      if (requestSessionId) {
+        this.sessionWarnVia(requestSessionId, timeoutMsg);
+      } else {
+        this.warnVia(timeoutMsg);
+      }
+      const message = `${this.errorPrefix} Request "${entry.command}" (id=${id}) timed out after ${effectiveTimeoutMs}ms`;
+      const rejectWith = entry.reject;
+      const settle = (outcome) => {
+        rejectWith(new BridgeTransportTimeoutError(entry.command, effectiveTimeoutMs, message, outcome));
+      };
+      entry.resolve = (response) => settle(shellOutcomeFromLateReply(response));
+      clearTimeout(entry.timer);
+      entry.timer = setTimeout(() => {
+        if (this.pending.get(id) !== entry)
+          return;
+        this.pending.delete(id);
+        entry.onSettled?.();
+        this.warnVia(`Request "${entry.command}" (id=${id}) got no reply within ${graceMs}ms after its deadline`);
+        settle({ kind: "unknown" });
+      }, graceMs);
+      return true;
+    }
     accountForBashTaskResponse(command, response) {
       const taskId = bashTaskIdFrom(response);
       if (!taskId)
         return;
-      if (isTerminalBashStatus(response.status)) {
+      if (isTerminalBashStatus(response.status, true)) {
         this.outstandingBackgroundTaskIds.delete(taskId);
         return;
       }
@@ -1732,6 +1807,7 @@ var init_bridge = __esm(() => {
       }
     }
     handleCrash(cause) {
+      this.clearRestartTimer();
       const proc = this.process;
       this.process = null;
       this.spawnedBinaryFingerprint = null;
@@ -1754,7 +1830,8 @@ var init_bridge = __esm(() => {
         const delay = 100 * 2 ** this._restartCount;
         this._restartCount++;
         this.logVia(`Auto-restart #${this._restartCount} in ${delay}ms`);
-        const restartTimer = setTimeout(() => {
+        this.restartTimer = setTimeout(() => {
+          this.restartTimer = null;
           if (!this._shuttingDown && !this.isAlive()) {
             try {
               this.spawnProcess();
@@ -1763,7 +1840,7 @@ var init_bridge = __esm(() => {
             }
           }
         }, delay);
-        restartTimer.unref?.();
+        this.restartTimer.unref?.();
         this.scheduleRestartCountReset();
       } else {
         this.errorVia(`Max restarts (${this.maxRestarts}) reached, giving up. Logs: ${this.getLogFilePathVia()}${tail}`);
@@ -1771,6 +1848,7 @@ var init_bridge = __esm(() => {
       }
     }
     rejectAllPending(error) {
+      this.configureWarningClients.clear();
       for (const [_id, entry] of this.pending) {
         clearTimeout(entry.timer);
         entry.onSettled?.();
@@ -1779,6 +1857,8 @@ var init_bridge = __esm(() => {
       this.pending.clear();
     }
     scheduleRestartCountReset() {
+      if (this._restartCount === 0)
+        return;
       this.clearRestartResetTimer();
       this.restartResetTimer = setTimeout(() => {
         this._restartCount = 0;
@@ -1786,6 +1866,11 @@ var init_bridge = __esm(() => {
       }, BinaryBridge.RESTART_RESET_MS);
       this.restartResetTimer.unref?.();
     }
+    clearRestartTimer() {
+      if (this.restartTimer)
+        clearTimeout(this.restartTimer);
+      this.restartTimer = null;
+    }
     clearRestartResetTimer() {
       if (this.restartResetTimer) {
         clearTimeout(this.restartResetTimer);
@@ -2061,7 +2146,8 @@ async function downloadBinary(version) {
   const handleSigint = () => {
     cleanUpInterruptedDownload();
     process.off("SIGINT", handleSigint);
-    process.kill(process.pid, "SIGINT");
+    if (process.listenerCount("SIGINT") === 0)
+      process.kill(process.pid, "SIGINT");
   };
   const handleExit = () => cleanUpInterruptedDownload();
   process.once("SIGINT", handleSigint);
@@ -2987,6 +3073,7 @@ var CALL_DEADLINE_EXPIRED, LOCALLY_SATISFIED_COMMANDS, dispatchProbes;
 var init_subc_transport = __esm(() => {
   init_dist();
   init_active_logger();
+  init_bash_format();
   init_error_contract();
   init_lifecycle_registry();
   init_project_identity();
@@ -3189,6 +3276,30 @@ function translateBlock(map, userBase, blockLabel, out) {
   translateGithubAliases(map, prefix, out);
   translateInspectLspPaths(map, prefix, out);
   translateExperimentalPaths(map, prefix, out);
+  if (isRecord(map.sandbox) && Object.hasOwn(map.sandbox, "enabled")) {
+    const sandbox = map.sandbox;
+    const enabled = sandbox.enabled;
+    delete sandbox.enabled;
+    recordRetired(out, prefix, "sandbox.enabled");
+    if (typeof enabled === "boolean") {
+      if (sandbox.profile === undefined)
+        sandbox.profile = {};
+      if (isRecord(sandbox.profile)) {
+        const modes = { worker: enabled ? "strict" : "relaxed", head: enabled ? "strict" : "off" };
+        for (const role of ["worker", "head"]) {
+          if (sandbox.profile[role] !== undefined && sandbox.profile[role] !== modes[role]) {
+            superseded(out, `${prefix}sandbox.enabled`, `sandbox.profile.${role} takes precedence over sandbox.enabled`);
+          }
+          sandbox.profile[role] ??= modes[role];
+        }
+      }
+    } else
+      out.warnings.push({
+        code: "invalid_legacy_config",
+        key: `${prefix}sandbox.enabled`,
+        message: "Ignoring non-boolean sandbox.enabled; use sandbox.profile"
+      });
+  }
   let explicitList;
   const rawList = map.disabled_tools;
   if (Array.isArray(rawList) && rawList.every((entry) => typeof entry === "string")) {
@@ -3418,6 +3529,7 @@ var init_feature_config = __esm(() => {
     aft_bash: "bash"
   };
   RETIRED_PATHS = [
+    ["sandbox.enabled", "sandbox.profile"],
     ["tool_surface", "disabled_tools"],
     ["hoist_builtin_tools", "disabled_tools"],
     ["enabled", "disabled_tools"],
@@ -3477,6 +3589,73 @@ var init_location_lifecycle = __esm(() => {
   RELEASE_LOCATION = Symbol.for("@cortexkit/aft-bridge/location-release/v1");
 });
 
+// ../aft-bridge/dist/lsp-github-probe.js
+var init_lsp_github_probe = __esm(() => {
+  init_active_logger();
+});
+
+// ../aft-bridge/dist/lsp-github-table.js
+var init_lsp_github_table = () => {};
+
+// ../aft-bridge/dist/tar-executable.js
+import { existsSync as existsSync3 } from "node:fs";
+import { join as join8 } from "node:path";
+function windowsTarExecutable(options = {}) {
+  const platform = options.platform ?? process.platform;
+  if (platform !== "win32")
+    return "tar";
+  const env = options.env ?? process.env;
+  const systemTar = join8(env.SystemRoot ?? "C:\\Windows", "System32", "tar.exe");
+  return (options.exists ?? existsSync3)(systemTar) ? systemTar : "tar";
+}
+function extractionCommand(args, privateStorage) {
+  const executable = windowsTarExecutable();
+  if (privateStorage && process.platform !== "win32") {
+    return {
+      executable,
+      file: "/bin/sh",
+      args: [
+        "-c",
+        'umask 077; exec "$@"',
+        "aft-extract",
+        executable,
+        "--no-same-permissions",
+        ...args.map((arg, index) => index === 0 && !arg.startsWith("-") ? `-${arg}` : arg)
+      ]
+    };
+  }
+  return { executable, file: executable, args };
+}
+function extractionError(executable, cause) {
+  const detail = cause instanceof Error ? cause.message : String(cause);
+  return new Error(`tar extraction failed using ${executable}: ${detail}`, { cause });
+}
+function execTarExtraction(args, timeout, privateStorage = false) {
+  const command = extractionCommand(args, privateStorage);
+  return new Promise((resolve, reject) => {
+    execFile(command.file, command.args, { timeout }, (error) => {
+      if (error)
+        reject(extractionError(command.executable, error));
+      else
+        resolve();
+    });
+  });
+}
+var init_tar_executable = __esm(() => {
+  init_child_process();
+});
+
+// ../aft-bridge/dist/lsp-github-install.js
+var init_lsp_github_install = __esm(() => {
+  init_binary_identity();
+  init_cache_paths();
+  init_child_process();
+  init_lsp_github_probe();
+  init_lsp_github_table();
+  init_path_display();
+  init_tar_executable();
+});
+
 // ../aft-bridge/dist/message-detach.js
 var BASH_WAIT_DETACH_MAGIC_KEYWORD = "&detach", STANDALONE_DETACH_KEYWORD_SOURCE, STANDALONE_DETACH_KEYWORD_PATTERN, STANDALONE_DETACH_KEYWORDS_PATTERN;
 var init_message_detach = __esm(() => {
@@ -3487,7 +3666,7 @@ var init_message_detach = __esm(() => {
 
 // ../aft-bridge/dist/paths.js
 import { homedir as homedir7 } from "node:os";
-import { dirname as dirname2, isAbsolute as isAbsolute4, join as join8, resolve as resolve5 } from "node:path";
+import { dirname as dirname2, isAbsolute as isAbsolute4, join as join9, resolve as resolve5 } from "node:path";
 function homeDir3() {
   if (process.platform === "win32")
     return process.env.USERPROFILE || process.env.HOME || homedir7();
@@ -3497,20 +3676,20 @@ function configHome() {
   const xdg = process.env.XDG_CONFIG_HOME;
   if (xdg && isAbsolute4(xdg))
     return xdg;
-  return join8(homeDir3(), ".config");
+  return join9(homeDir3(), ".config");
 }
 function resolveCortexKitUserConfigPath() {
-  return join8(configHome(), "cortexkit", "aft.jsonc");
+  return join9(configHome(), "cortexkit", "aft.jsonc");
 }
 function resolveCortexKitProjectConfigPath(projectDirectory) {
-  return join8(projectDirectory, ".cortexkit", "aft.jsonc");
+  return join9(projectDirectory, ".cortexkit", "aft.jsonc");
 }
 var init_paths = __esm(() => {
   init_private_storage();
 });
 
 // ../aft-bridge/dist/resolver.js
-import { closeSync as closeSync4, existsSync as existsSync3, promises as fsPromises, openSync as openSync4, readFileSync as readFileSync4, readSync as readSync3 } from "node:fs";
+import { closeSync as closeSync4, existsSync as existsSync4, promises as fsPromises, openSync as openSync4, readFileSync as readFileSync4, readSync as readSync3 } from "node:fs";
 function isNativeExecutable(binaryPath) {
   let fd = null;
   try {
@@ -3567,10 +3746,10 @@ var init_migration = __esm(() => {
 // ../aft-bridge/dist/migration-notices.js
 import { readFileSync as readFileSync5, renameSync as renameSync3, rmdirSync, statSync as statSync3, writeFileSync as writeFileSync2 } from "node:fs";
 import { homedir as homedir8 } from "node:os";
-import { dirname as dirname3, join as join9, resolve as resolve6 } from "node:path";
+import { dirname as dirname3, join as join10, resolve as resolve6 } from "node:path";
 function migrationNoticeStorePath(env = process.env) {
-  const stateHome = env.XDG_STATE_HOME && env.XDG_STATE_HOME.length > 0 ? env.XDG_STATE_HOME : join9(homedir8(), ".local", "state");
-  return join9(stateHome, "cortexkit", "aft", "migration-notices.json");
+  const stateHome = env.XDG_STATE_HOME && env.XDG_STATE_HOME.length > 0 ? env.XDG_STATE_HOME : join10(homedir8(), ".local", "state");
+  return join10(stateHome, "cortexkit", "aft", "migration-notices.json");
 }
 function readRecords(storePath) {
   try {
@@ -3631,7 +3810,7 @@ var init_migration_notices = __esm(() => {
 // ../aft-bridge/dist/npm-resolver.js
 import { readdirSync as readdirSync2, statSync as statSync4 } from "node:fs";
 import { homedir as homedir9 } from "node:os";
-import { dirname as dirname4, isAbsolute as isAbsolute5, join as join10 } from "node:path";
+import { dirname as dirname4, isAbsolute as isAbsolute5, join as join11 } from "node:path";
 function defaultDeps() {
   return {
     platform: process.platform,
@@ -3660,14 +3839,14 @@ function npmFromPath(deps) {
     const dir = entry.trim().replace(/^"|"$/g, "");
     if (!dir || !isAbsolute5(dir))
       continue;
-    if (isFile(join10(dir, name)))
+    if (isFile(join11(dir, name)))
       return dir;
   }
   return null;
 }
 function npmAdjacentToNode(deps) {
   const dir = dirname4(deps.execPath);
-  return isFile(join10(dir, npmBinaryName(deps.platform))) ? dir : null;
+  return isFile(join11(dir, npmBinaryName(deps.platform))) ? dir : null;
 }
 function highestVersionedNodeBin(installsDir, name) {
   let entries;
@@ -3676,8 +3855,8 @@ function highestVersionedNodeBin(installsDir, name) {
   } catch {
     return null;
   }
-  const candidates = entries.filter((v) => isFile(join10(installsDir, v, "bin", name))).sort((a, b) => compareVersionsDesc(a, b));
-  return candidates.length > 0 ? join10(installsDir, candidates[0], "bin") : null;
+  const candidates = entries.filter((v) => isFile(join11(installsDir, v, "bin", name))).sort((a, b) => compareVersionsDesc(a, b));
+  return candidates.length > 0 ? join11(installsDir, candidates[0], "bin") : null;
 }
 function compareVersionsDesc(a, b) {
   const pa = a.replace(/^v/, "").split(".").map((n) => Number.parseInt(n, 10));
@@ -3702,22 +3881,22 @@ function wellKnownNpmDirs(deps) {
     const programFiles = env.ProgramFiles || "C:\\Program Files";
     const appData = env.APPDATA;
     const localAppData = env.LOCALAPPDATA;
-    push(join10(programFiles, "nodejs"));
+    push(join11(programFiles, "nodejs"));
     if (appData)
-      push(join10(appData, "npm"));
+      push(join11(appData, "npm"));
     if (localAppData)
-      push(join10(localAppData, "Volta", "bin"));
+      push(join11(localAppData, "Volta", "bin"));
     if (env.NVM_SYMLINK)
       push(env.NVM_SYMLINK);
   } else {
     if (env.NVM_BIN)
       push(env.NVM_BIN);
-    push(highestVersionedNodeBin(join10(home, ".nvm", "versions", "node"), name));
-    push(highestVersionedNodeBin(join10(home, ".local", "share", "mise", "installs", "node"), name));
-    push(highestVersionedNodeBin(join10(home, ".asdf", "installs", "nodejs"), name));
-    push(join10(home, ".volta", "bin"));
-    push(join10(home, ".asdf", "shims"));
-    const systemDirs = deps.systemNpmDirs ?? (platform === "darwin" ? ["/opt/homebrew/bin", "/usr/local/bin"] : ["/usr/local/bin", "/usr/bin", join10(home, ".local", "bin")]);
+    push(highestVersionedNodeBin(join11(home, ".nvm", "versions", "node"), name));
+    push(highestVersionedNodeBin(join11(home, ".local", "share", "mise", "installs", "node"), name));
+    push(highestVersionedNodeBin(join11(home, ".asdf", "installs", "nodejs"), name));
+    push(join11(home, ".volta", "bin"));
+    push(join11(home, ".asdf", "shims"));
+    const systemDirs = deps.systemNpmDirs ?? (platform === "darwin" ? ["/opt/homebrew/bin", "/usr/local/bin"] : ["/usr/local/bin", "/usr/bin", join11(home, ".local", "bin")]);
     for (const dir of systemDirs)
       push(dir);
   }
@@ -3727,12 +3906,12 @@ function resolveNpm(deps = defaultDeps()) {
   const name = npmBinaryName(deps.platform);
   const onPath = npmFromPath(deps);
   if (onPath)
-    return { command: join10(onPath, name), binDir: onPath };
+    return { command: join11(onPath, name), binDir: onPath };
   const adjacent = npmAdjacentToNode(deps);
   if (adjacent)
-    return { command: join10(adjacent, name), binDir: adjacent };
+    return { command: join11(adjacent, name), binDir: adjacent };
   for (const dir of wellKnownNpmDirs(deps)) {
-    const candidate = join10(dir, name);
+    const candidate = join11(dir, name);
     if (isFile(candidate))
       return { command: candidate, binDir: dir };
   }
@@ -3893,7 +4072,7 @@ function terminateNpmProcessTree(child, invocation, env = process.env, gracePeri
     };
     child.once("exit", onChildExit);
     const systemRoot = env.SystemRoot ?? env.SYSTEMROOT;
-    const taskkill = systemRoot ? join10(systemRoot, "System32", "taskkill.exe") : "taskkill.exe";
+    const taskkill = systemRoot ? join11(systemRoot, "System32", "taskkill.exe") : "taskkill.exe";
     try {
       killer = spawn(taskkill, ["/pid", String(child.pid), "/t", "/f"], {
         stdio: "ignore",
@@ -3929,7 +4108,7 @@ var init_npm_resolver = __esm(() => {
 });
 
 // ../aft-bridge/dist/onnx-probe.js
-import { closeSync as closeSync5, existsSync as existsSync4, openSync as openSync5, readSync as readSync4, realpathSync as realpathSync2 } from "node:fs";
+import { closeSync as closeSync5, existsSync as existsSync5, openSync as openSync5, readSync as readSync4, realpathSync as realpathSync2 } from "node:fs";
 function readAt(fd, offset, length) {
   const buffer = Buffer.alloc(length);
   const read = readSync4(fd, buffer, 0, length, offset);
@@ -4032,7 +4211,7 @@ function probeOnnxRuntimeLoadable(libPath, arch = process.arch) {
     for (const dependency of dylibs) {
       if (isUncheckableDependency(dependency))
         continue;
-      if (!existsSync4(dependency)) {
+      if (!existsSync5(dependency)) {
         return { loadable: false, reason: `missing dependency ${dependency}` };
       }
     }
@@ -4049,41 +4228,6 @@ var init_onnx_probe = __esm(() => {
   UNCHECKED = { loadable: true, checked: false };
 });
 
-// ../aft-bridge/dist/tar-executable.js
-import { existsSync as existsSync5 } from "node:fs";
-import { join as join11 } from "node:path";
-function windowsTarExecutable(options = {}) {
-  const platform = options.platform ?? process.platform;
-  if (platform !== "win32")
-    return "tar";
-  const env = options.env ?? process.env;
-  const systemTar = join11(env.SystemRoot ?? "C:\\Windows", "System32", "tar.exe");
-  return (options.exists ?? existsSync5)(systemTar) ? systemTar : "tar";
-}
-function execTarExtractionSync(args, timeout, privateStorage = false) {
-  const executable = windowsTarExecutable();
-  try {
-    if (privateStorage && process.platform !== "win32") {
-      execFileSync("/bin/sh", [
-        "-c",
-        'umask 077; exec "$@"',
-        "aft-extract",
-        executable,
-        "--no-same-permissions",
-        ...args.map((arg, index) => index === 0 && !arg.startsWith("-") ? `-${arg}` : arg)
-      ], { stdio: "pipe", timeout });
-    } else {
-      execFileSync(executable, args, { stdio: "pipe", timeout });
-    }
-  } catch (cause) {
-    const detail = cause instanceof Error ? cause.message : String(cause);
-    throw new Error(`tar extraction failed using ${executable}: ${detail}`, { cause });
-  }
-}
-var init_tar_executable = __esm(() => {
-  init_child_process();
-});
-
 // ../aft-bridge/dist/onnx-runtime.js
 import { randomBytes } from "node:crypto";
 import { chmodSync as chmodSync2, closeSync as closeSync6, copyFileSync as copyFileSync3, createWriteStream as createWriteStream2, existsSync as existsSync6, lstatSync as lstatSync2, openSync as openSync6, readdirSync as readdirSync3, readFileSync as readFileSync6, readlinkSync, realpathSync as realpathSync3, renameSync as renameSync4, rmSync as rmSync2, statSync as statSync5, symlinkSync, unlinkSync as unlinkSync3, writeFileSync as writeFileSync3 } from "node:fs";
@@ -4541,7 +4685,7 @@ async function downloadOnnxRuntime(info, targetDir) {
     const archiveSha256 = await sha256File(archivePath);
     log(`ONNX Runtime archive sha256=${archiveSha256}`);
     if (info.archiveType === "tgz") {
-      execTarExtractionSync(["xzf", archivePath, "-C", extractionRoot], 120000, true);
+      await execTarExtraction(["xzf", archivePath, "-C", extractionRoot], 120000, true);
     } else {
       await extractZipArchive(archivePath, extractionRoot);
     }
@@ -4674,12 +4818,16 @@ function copyOnnxLibraries(info, extractedDir, targetDir, realFiles, symlinks, c
 }
 async function extractZipArchive(archivePath, destinationDir) {
   if (process.platform === "win32") {
-    execTarExtractionSync(["-xf", archivePath, "-C", destinationDir], 120000);
+    await execTarExtraction(["-xf", archivePath, "-C", destinationDir], 120000);
     return;
   }
-  execFileSync("unzip", ["-q", archivePath, "-d", destinationDir], {
-    stdio: "pipe",
-    timeout: 120000
+  await new Promise((resolve, reject) => {
+    execFile("unzip", ["-q", archivePath, "-d", destinationDir], { timeout: 120000 }, (error) => {
+      if (error)
+        reject(error);
+      else
+        resolve();
+    });
   });
 }
 function writeOnnxInstalledMeta(installDir, version, sha256, archiveSha256) {
@@ -4954,6 +5102,7 @@ var init_semantic_status = __esm(() => {
 // ../aft-bridge/dist/index.js
 var init_dist2 = __esm(() => {
   init_active_logger();
+  init_bash_format();
   init_bash_hints();
   init_bash_host_fallback();
   init_binary_identity();
@@ -4971,6 +5120,9 @@ var init_dist2 = __esm(() => {
   init_error_contract();
   init_lifecycle_registry();
   init_location_lifecycle();
+  init_lsp_github_install();
+  init_lsp_github_probe();
+  init_lsp_github_table();
   init_message_detach();
   init_migration();
   init_migration_notices();
@@ -13651,7 +13803,7 @@ function getSelfVersion() {
 var init_self_version = () => {};
 
 // ../../.github/opencode-version.txt
-var opencode_version_default = `1.18.30
+var opencode_version_default = `1.19.3
 `;
 var init_opencode_version = () => {};
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@cortexkit/aft",
-  "version": "0.60.0",
+  "version": "0.61.0",
   "type": "module",
   "description": "Unified CLI for Agent File Tools (AFT) — setup, one-shot index snapshots, doctor, and diagnostics across supported agent harnesses (OpenCode, Pi)",
   "license": "MIT",
@@ -25,7 +25,7 @@
   "dependencies": {
     "@clack/core": "^1.4.2",
     "@clack/prompts": "^1.6.0",
-    "@cortexkit/aft-bridge": "0.60.0",
+    "@cortexkit/aft-bridge": "0.61.0",
     "comment-json": "^4.6.2"
   },
   "devDependencies": {