@cortexkit/aft 0.62.0 → 0.63.4

package/dist/index.js

@@ -110,12 +110,125 @@ var init_active_logger = __esm(() => {
   ACTIVE_LOGGER_SYMBOL = Symbol.for("aft-bridge-active-logger");
 });
 
+// ../aft-bridge/dist/bash-env.js
+var BLOCKED_BASH_ENV_NAMES, PROJECT_ONLY_BLOCKED_BASH_ENV_NAMES, PROJECT_ONLY_NETWORK_BLOCKED_BASH_ENV_NAMES, BLOCKED, PROJECT_ONLY;
+var init_bash_env = __esm(() => {
+  BLOCKED_BASH_ENV_NAMES = [
+    "LD_PRELOAD",
+    "LD_LIBRARY_PATH",
+    "LD_AUDIT",
+    "DYLD_INSERT_LIBRARIES",
+    "DYLD_LIBRARY_PATH",
+    "DYLD_FALLBACK_LIBRARY_PATH",
+    "BASH_ENV",
+    "ENV",
+    "IFS",
+    "PATH",
+    "SHELLOPTS",
+    "BASHOPTS",
+    "PROMPT_COMMAND",
+    "PS4",
+    "PYTHONSTARTUP",
+    "PYTHONPATH",
+    "PYTHONHOME",
+    "PERL5OPT",
+    "PERL5LIB",
+    "PERLLIB",
+    "PERL5DB",
+    "RUBYOPT",
+    "RUBYLIB",
+    "NODE_OPTIONS",
+    "GCONV_PATH",
+    "LOCPATH",
+    "NLSPATH",
+    "HOSTALIASES",
+    "RESOLV_HOST_CONF",
+    "HOME",
+    "SHELL",
+    "TMPDIR",
+    "TMP",
+    "TEMP",
+    "XDG_CONFIG_HOME",
+    "XDG_DATA_HOME",
+    "XDG_CACHE_HOME",
+    "XDG_STATE_HOME",
+    "XDG_RUNTIME_DIR",
+    "CARGO_HOME",
+    "RUSTUP_HOME",
+    "USERPROFILE",
+    "APPDATA",
+    "LOCALAPPDATA",
+    "COMSPEC",
+    "PATHEXT",
+    "SYSTEMROOT",
+    "PSMODULEPATH",
+    "NODE_PATH",
+    "JAVA_TOOL_OPTIONS",
+    "_JAVA_OPTIONS",
+    "JDK_JAVA_OPTIONS",
+    "PYTHONUSERBASE",
+    "GIT_DIR",
+    "GIT_WORK_TREE",
+    "GIT_COMMON_DIR",
+    "GIT_INDEX_FILE",
+    "GIT_OBJECT_DIRECTORY",
+    "GIT_ALTERNATE_OBJECT_DIRECTORIES",
+    "GIT_CEILING_DIRECTORIES",
+    "GIT_EXEC_PATH",
+    "GIT_TEMPLATE_DIR",
+    "GIT_SSH",
+    "GIT_SSH_COMMAND",
+    "GIT_ASKPASS",
+    "SSH_ASKPASS",
+    "GIT_EXTERNAL_DIFF",
+    "GIT_PROXY_COMMAND",
+    "RUSTC_WRAPPER",
+    "CARGO_BUILD_RUSTC_WRAPPER",
+    "RUSTC_WORKSPACE_WRAPPER",
+    "RUST_TEST_THREADS",
+    "NEXTEST_TEST_THREADS",
+    "DBUS_SESSION_BUS_ADDRESS"
+  ];
+  PROJECT_ONLY_BLOCKED_BASH_ENV_NAMES = [
+    "SSH_AUTH_SOCK",
+    "GOOGLE_APPLICATION_CREDENTIALS",
+    "KUBECONFIG",
+    "DOCKER_HOST",
+    "DOCKER_CONFIG"
+  ];
+  PROJECT_ONLY_NETWORK_BLOCKED_BASH_ENV_NAMES = [
+    "HTTP_PROXY",
+    "HTTPS_PROXY",
+    "ALL_PROXY",
+    "NO_PROXY",
+    "SSL_CERT_FILE",
+    "SSL_CERT_DIR",
+    "NODE_EXTRA_CA_CERTS",
+    "REQUESTS_CA_BUNDLE",
+    "CURL_CA_BUNDLE",
+    "GIT_SSL_NO_VERIFY",
+    "NODE_TLS_REJECT_UNAUTHORIZED"
+  ];
+  BLOCKED = new Set(BLOCKED_BASH_ENV_NAMES);
+  PROJECT_ONLY = new Set([
+    ...PROJECT_ONLY_BLOCKED_BASH_ENV_NAMES,
+    ...PROJECT_ONLY_NETWORK_BLOCKED_BASH_ENV_NAMES
+  ]);
+});
+
 // ../aft-bridge/dist/protocol.js
 function isTerminalBashStatus(status, compatibilityAliases = false) {
   return typeof status === "string" && (TERMINAL_BASH_STATUSES.has(status) || compatibilityAliases && (status === "cancelled" || status === "timeout"));
 }
-var TERMINAL_BG_TASK_STATUSES, TERMINAL_BASH_STATUSES;
+var LIVE_DESCENDANTS_UNAVAILABLE_REASONS, TERMINAL_BG_TASK_STATUSES, TERMINAL_BASH_STATUSES;
 var init_protocol = __esm(() => {
+  LIVE_DESCENDANTS_UNAVAILABLE_REASONS = Object.freeze([
+    "unsupported_platform",
+    "no_process_group",
+    "listing_failed",
+    "listing_incomplete",
+    "not_checked"
+  ]);
   TERMINAL_BG_TASK_STATUSES = Object.freeze([
     "completed",
     "failed",
@@ -392,7 +505,16 @@ var init_bash_host_fallback = __esm(() => {
   BASH_HOST_FALLBACK_MAX_OUTPUT_BYTES = 100 * 1024;
   BASH_HOST_FALLBACK_MAX_TIMEOUT_MS = 10 * 60 * 1000;
 });
+// ../aft-bridge/dist/bash-permissions.js
+var init_bash_permissions = __esm(() => {
+  init_active_logger();
+});
 
+// ../aft-bridge/dist/bash-watch-lines.js
+var DEFAULT_MASKING_LINE_CAP_BYTES;
+var init_bash_watch_lines = __esm(() => {
+  DEFAULT_MASKING_LINE_CAP_BYTES = 8 * 1024;
+});
 // ../aft-bridge/dist/binary-identity.js
 import { createHash } from "node:crypto";
 import { closeSync, createReadStream, openSync, readFileSync, readSync, renameSync, statSync, unlinkSync, writeFileSync } from "node:fs";
@@ -627,9 +749,22 @@ var init_binary_identity = __esm(() => {
 function isPassiveCommand(command) {
   return PASSIVE_COMMANDS.has(command);
 }
-var PASSIVE_COMMANDS, PASSIVE_COMMAND_TIMEOUT_MS = 5000;
+function isReadOnlyRetryCommand(tool) {
+  return READ_ONLY_RETRY_COMMANDS.has(tool);
+}
+var PASSIVE_COMMANDS, PASSIVE_COMMAND_TIMEOUT_MS = 5000, READ_ONLY_RETRY_COMMANDS;
 var init_command_timeouts = __esm(() => {
   PASSIVE_COMMANDS = new Set(["status"]);
+  READ_ONLY_RETRY_COMMANDS = new Set([
+    "read",
+    "outline",
+    "zoom",
+    "grep",
+    "glob",
+    "search",
+    "callgraph",
+    "inspect"
+  ]);
 });
 
 // ../aft-bridge/dist/transport.js
@@ -639,6 +774,12 @@ var WORKER_SESSION_FIELD = "worker_session", HOST_TOOL_NAMES_FIELD = "host_tool_
 import { homedir as homedir4 } from "node:os";
 import { join as join3 } from "node:path";
 import { StringDecoder } from "node:string_decoder";
+function hangWindowMs(budgetsMs, minWindowMs = DEFAULT_MIN_HANG_WINDOW_MS) {
+  let longest = 0;
+  for (const budget of budgetsMs)
+    longest = Math.max(longest, budget);
+  return Math.max(minWindowMs, 2 * longest);
+}
 function bashTaskIdFrom(response) {
   const snakeCase = response.task_id;
   if (typeof snakeCase === "string" && snakeCase.length > 0)
@@ -728,7 +869,7 @@ function shellOutcomeFromLateReply(response) {
   }
   return { kind: "unknown" };
 }
-var DEFAULT_BRIDGE_TIMEOUT_MS = 30000, BRIDGE_HANG_TIMEOUT_THRESHOLD = 2, MAX_STDOUT_BUFFER, MALFORMED_STDOUT_LOG_CHARS = 512, HASHLINE_REGISTRATION_LOG_INTERVAL_MS = 60000, HASHLINE_REGISTRATION_LOG_STATE_LIMIT = 256, binaryFingerprintReader, binaryFingerprintAsyncReader, BENIGN_CPUINFO_PROC_CPUINFO_PARSE_FAILURE = "failed to parse processor information from /proc/cpuinfo", BridgeReplacedDuringVersionCheck, BridgeTransportTimeoutError, SHELL_TASK_COMMANDS, DEFAULT_LATE_SHELL_REPLY_GRACE_MS = 1e4, BridgeTransportUnavailableError, BridgeTransportUnknownOutcomeError, BinaryBridge;
+var DEFAULT_BRIDGE_TIMEOUT_MS = 30000, DEFAULT_MIN_HANG_WINDOW_MS = 60000, DEFAULT_HANG_PROBE_TIMEOUT_MS = 5000, MAX_STDOUT_BUFFER, MALFORMED_STDOUT_LOG_CHARS = 512, HASHLINE_REGISTRATION_LOG_INTERVAL_MS = 60000, HASHLINE_REGISTRATION_LOG_STATE_LIMIT = 256, binaryFingerprintReader, binaryFingerprintAsyncReader, BENIGN_CPUINFO_PROC_CPUINFO_PARSE_FAILURE = "failed to parse processor information from /proc/cpuinfo", SYSTEM_CLOCK, BridgeReplacedDuringVersionCheck, BridgeTransportTimeoutError, SHELL_TASK_COMMANDS, DEFAULT_LATE_SHELL_REPLY_GRACE_MS = 1e4, BridgeTransportUnavailableError, BridgeTransportUnknownOutcomeError, BridgeRestartedError, BinaryBridge;
 var init_bridge = __esm(() => {
   init_active_logger();
   init_binary_identity();
@@ -738,6 +879,11 @@ var init_bridge = __esm(() => {
   MAX_STDOUT_BUFFER = 64 * 1024 * 1024;
   binaryFingerprintReader = peekBinaryFingerprint;
   binaryFingerprintAsyncReader = binaryContentHash;
+  SYSTEM_CLOCK = {
+    now: () => Date.now(),
+    setTimeout: (callback, ms) => setTimeout(callback, ms),
+    clearTimeout: (timer) => clearTimeout(timer)
+  };
   BridgeReplacedDuringVersionCheck = class BridgeReplacedDuringVersionCheck extends Error {
     newBinaryPath;
     constructor(newBinaryPath) {
@@ -773,6 +919,18 @@ var init_bridge = __esm(() => {
       this.name = "BridgeTransportUnknownOutcomeError";
     }
   };
+  BridgeRestartedError = class BridgeRestartedError extends BridgeTransportUnknownOutcomeError {
+    tool;
+    outcomeUnknown;
+    retryable = true;
+    restartReason = "hang_watchdog";
+    constructor(tool, outcomeUnknown, message) {
+      super(message);
+      this.tool = tool;
+      this.outcomeUnknown = outcomeUnknown;
+      this.name = "BridgeRestartedError";
+    }
+  };
   BinaryBridge = class BinaryBridge {
     static RESTART_RESET_MS = 5 * 60 * 1000;
     static STDERR_TAIL_MAX = 20;
@@ -799,7 +957,9 @@ var init_bridge = __esm(() => {
     _restartCount = 0;
     _shuttingDown = false;
     timeoutMs;
-    hangThreshold;
+    hangWindowMinMs;
+    hangProbeTimeoutMs;
+    clock;
     lateShellReplyGraceMs;
     maxRestarts;
     configured = false;
@@ -819,8 +979,11 @@ var init_bridge = __esm(() => {
     configureWarningClients = new Map;
     restartTimer = null;
     restartResetTimer = null;
-    lastChildActivityAt = 0;
-    consecutiveRequestTimeouts = 0;
+    awaitingReply = new Map;
+    lastChildActivity = Number.NEGATIVE_INFINITY;
+    hangProbe = null;
+    hangWatchdogTimer = null;
+    hangSuppressionLogged = false;
     timeoutRestartAwaitingRecovery = false;
     errorPrefix;
     logger;
@@ -830,7 +993,9 @@ var init_bridge = __esm(() => {
       this.binaryPath = binaryPath;
       this.cwd = cwd;
       this.timeoutMs = options?.timeoutMs ?? DEFAULT_BRIDGE_TIMEOUT_MS;
-      this.hangThreshold = options?.hangThreshold ?? BRIDGE_HANG_TIMEOUT_THRESHOLD;
+      this.hangWindowMinMs = options?.hangWindowMinMs ?? DEFAULT_MIN_HANG_WINDOW_MS;
+      this.hangProbeTimeoutMs = options?.hangProbeTimeoutMs ?? DEFAULT_HANG_PROBE_TIMEOUT_MS;
+      this.clock = options?.clock ?? SYSTEM_CLOCK;
       this.lateShellReplyGraceMs = options?.lateShellReplyGraceMs ?? DEFAULT_LATE_SHELL_REPLY_GRACE_MS;
       this.maxRestarts = options?.maxRestarts ?? 3;
       this.errorPrefix = options?.errorPrefix ?? "[aft-bridge]";
@@ -871,6 +1036,19 @@ var init_bridge = __esm(() => {
         log(message, meta);
       }
     }
+    debugVia(message, meta) {
+      const logger = this.logger ?? getActiveLogger();
+      if (!logger?.debug) {
+        this.logVia(message, meta);
+        return;
+      }
+      try {
+        logger.debug(message, meta);
+      } catch (err) {
+        console.error(`[aft-bridge] ERROR: logger debug threw: ${err instanceof Error ? err.message : String(err)}`);
+        console.error(`[aft-bridge] ${message}`);
+      }
+    }
     warnVia(message, meta) {
       const logger = this.logger ?? getActiveLogger();
       if (logger) {
@@ -1091,7 +1269,7 @@ var init_bridge = __esm(() => {
         params[HOST_TOOL_NAMES_FIELD] = hostToolNames;
       return await this.send("tool_call", params, Object.keys(sendOptions).length > 0 ? sendOptions : undefined);
     }
-    async sendWithVersionMismatchRetry(command, params, options, canRetryAfterVersionSwap) {
+    async sendWithVersionMismatchRetry(command, params, options, canRetryAfterVersionSwap, retriedAfterHangRestart = false) {
       try {
         if (this._retiringDueToBinaryChange) {
           throw new BridgeTransportUnavailableError(`${this.errorPrefix} Bridge is retiring after the on-disk binary changed; retry to respawn on the updated binary`);
@@ -1176,13 +1354,15 @@ var init_bridge = __esm(() => {
         } else {
           request = { id, command, ...params };
         }
+        delete request.handles_progress;
+        if (options?.onProgress)
+          request.handles_progress = true;
         const line = `${JSON.stringify(request)}
 `;
         const keepBridgeOnTimeout = passive || command === "bash_drain_completions" || options?.keepBridgeOnTimeout === true;
-        let requestSentAt = Date.now();
         const child = this.process;
         const response = await new Promise((resolve, reject) => {
-          const timer = setTimeout(() => {
+          const timer = this.clock.setTimeout(() => {
             const entry = this.pending.get(id);
             if (!entry)
               return;
@@ -1190,45 +1370,25 @@ var init_bridge = __esm(() => {
               return;
             }
             this.pending.delete(id);
-            clearTimeout(entry.timer);
+            this.clock.clearTimeout(entry.timer);
             entry.onSettled?.();
-            if (keepBridgeOnTimeout) {
-              const timeoutMsg = `Request "${command}" (id=${id}) timed out after ${effectiveTimeoutMs}ms`;
-              if (requestSessionId) {
-                this.sessionWarnVia(requestSessionId, timeoutMsg);
-              } else {
-                this.warnVia(timeoutMsg);
-              }
-              entry.reject(new BridgeTransportTimeoutError(command, effectiveTimeoutMs, `${this.errorPrefix} Request "${command}" (id=${id}) timed out after ${effectiveTimeoutMs}ms`));
-              return;
-            }
-            const childActiveSinceRequest = this.lastChildActivityAt > requestSentAt;
-            const consecutiveTimeouts = this.consecutiveRequestTimeouts + 1;
-            this.consecutiveRequestTimeouts = consecutiveTimeouts;
-            const restartSuppressed = this.timeoutRestartAwaitingRecovery;
-            const keepWarm = restartSuppressed || childActiveSinceRequest || consecutiveTimeouts < this.hangThreshold;
-            const restartSuffix = keepWarm ? " — bridge kept warm" : " — restarting bridge";
-            const timeoutMsg = `Request "${command}" (id=${id}) timed out after ${effectiveTimeoutMs}ms${restartSuffix}`;
+            const timeoutMsg = `Request "${command}" (id=${id}) timed out after ${effectiveTimeoutMs}ms — bridge kept warm`;
             if (requestSessionId) {
               this.sessionWarnVia(requestSessionId, timeoutMsg);
             } else {
               this.warnVia(timeoutMsg);
             }
-            if (keepWarm) {
-              entry.reject(new Error(restartSuppressed ? `${this.errorPrefix} request "${command}" timed out after ${effectiveTimeoutMs}ms; automatic timeout restart already attempted; bridge kept warm to finish startup. Retry later or restart the host explicitly if it remains unresponsive. A timed-out mutation may still complete; inspect before repeating it.` : `${this.errorPrefix} request "${command}" timed out after ${effectiveTimeoutMs}ms (bridge busy/under load); bridge kept warm — retry`));
+            if (keepBridgeOnTimeout) {
+              entry.reject(new BridgeTransportTimeoutError(command, effectiveTimeoutMs, `${this.errorPrefix} Request "${command}" (id=${id}) timed out after ${effectiveTimeoutMs}ms`));
               return;
             }
-            entry.reject(new Error(`${this.errorPrefix} Request "${command}" (id=${id}) timed out after ${effectiveTimeoutMs}ms`));
-            this.handleTimeout({
-              requestId: id,
-              tool: entry.tool,
-              generation: entry.generation
-            }, requestSessionId);
+            entry.reject(new Error(`${this.errorPrefix} request "${command}" timed out after ${effectiveTimeoutMs}ms (bridge busy/under load); bridge kept warm — retry. A timed-out mutation may still complete; inspect before repeating it.`));
           }, effectiveTimeoutMs);
           const entry = {
             resolve,
             reject,
             timer,
+            budgetMs: effectiveTimeoutMs,
             onProgress: options?.onProgress,
             command,
             tool,
@@ -1237,21 +1397,21 @@ var init_bridge = __esm(() => {
           this.pending.set(id, entry);
           if (!child?.stdin?.writable) {
             this.pending.delete(id);
-            clearTimeout(timer);
+            this.clock.clearTimeout(timer);
             const error = new BridgeTransportUnavailableError(`${this.errorPrefix} stdin not writable for command "${command}"`);
             reject(error);
             if (this.process === child)
               this.invalidateTransportProcess(error);
             return;
           }
-          requestSentAt = Date.now();
+          this.recordAwaitingReply(id, effectiveTimeoutMs, tool, requestSessionId);
           const handleWriteFailure = (cause) => {
             const writeError = cause instanceof Error ? cause : new Error(String(cause));
             const error = new BridgeTransportUnknownOutcomeError(`${this.errorPrefix} Failed to write to stdin: ${writeError.message}`, { cause: writeError });
             const entry = this.pending.get(id);
             if (entry) {
               this.pending.delete(id);
-              clearTimeout(entry.timer);
+              this.clock.clearTimeout(entry.timer);
               entry.onSettled?.();
               entry.reject(error);
             }
@@ -1277,7 +1437,12 @@ var init_bridge = __esm(() => {
       } catch (err) {
         if (err instanceof BridgeReplacedDuringVersionCheck && canRetryAfterVersionSwap && command !== "configure" && command !== "version") {
           this.logVia(`Retrying request "${command}" once after coordinated binary replacement: ${err.newBinaryPath}`);
-          return this.sendWithVersionMismatchRetry(command, params, options, false);
+          return this.sendWithVersionMismatchRetry(command, params, options, false, retriedAfterHangRestart);
+        }
+        const tool = command === "tool_call" && typeof params.name === "string" ? params.name : command;
+        if (err instanceof BridgeRestartedError && !retriedAfterHangRestart && isReadOnlyRetryCommand(tool) && !this._shuttingDown && options?.abortSignal?.aborted !== true) {
+          this.logVia(`Retrying read-only request "${tool}" once after the hang watchdog restart`);
+          return this.sendWithVersionMismatchRetry(command, params, options, canRetryAfterVersionSwap, true);
         }
         throw err;
       }
@@ -1346,6 +1511,7 @@ var init_bridge = __esm(() => {
     async shutdown() {
       this._shuttingDown = true;
       this.spawnedBinaryFingerprint = null;
+      this.resetHangWatchdog();
       this.clearRestartResetTimer();
       this.clearRestartTimer();
       this.configureWarningClients.clear();
@@ -1544,8 +1710,7 @@ var init_bridge = __esm(() => {
       this.stdoutPending = [];
       this.stdoutPendingLength = 0;
       this.stderrBuffer = "";
-      this.lastChildActivityAt = 0;
-      this.consecutiveRequestTimeouts = 0;
+      this.resetHangWatchdog();
       this.stderrTail = [];
       this.processLoopReferenced = true;
       this.syncEventLoopHold();
@@ -1589,7 +1754,16 @@ var init_bridge = __esm(() => {
       if (!line || !shouldSurfaceStderrLine(line))
         return;
       const tagged = tagStderrLine(line);
-      this.logVia(tagged);
+      const level = /^\d{4}-\d{2}-\d{2}T\d{2}:\d{2}:\d{2}\.\d{3}Z \[aft(?:-lsp)?\] (INFO|WARN|ERROR|DEBUG) /.exec(line)?.[1];
+      const meta = level ? { engineRecord: true } : undefined;
+      if (level === "WARN")
+        this.warnVia(tagged, meta);
+      else if (level === "ERROR")
+        this.errorVia(tagged, meta);
+      else if (level === "DEBUG")
+        this.debugVia(tagged, meta);
+      else
+        this.logVia(tagged, meta);
       this.pushStderrLine(tagged);
     }
     formatStderrTail() {
@@ -1652,7 +1826,7 @@ var init_bridge = __esm(() => {
     processStdoutLine(line) {
       try {
         const response = JSON.parse(line);
-        this.lastChildActivityAt = Date.now();
+        this.lastChildActivity = this.clock.now();
         if (response.type === "progress") {
           const requestId = response.request_id;
           const entry = requestId ? this.pending.get(requestId) : undefined;
@@ -1666,7 +1840,7 @@ var init_bridge = __esm(() => {
           const entry = requestId ? this.pending.get(requestId) : undefined;
           if (requestId && entry) {
             this.pending.delete(requestId);
-            clearTimeout(entry.timer);
+            this.clock.clearTimeout(entry.timer);
             entry.onSettled?.();
             entry.resolve({
               success: false,
@@ -1675,6 +1849,8 @@ var init_bridge = __esm(() => {
               asks: response.asks
             });
           }
+          if (requestId)
+            this.settleHangEvidence(requestId);
           return;
         }
         if (response.type === "bash_completed") {
@@ -1704,14 +1880,18 @@ var init_bridge = __esm(() => {
           return;
         }
         const id = response.id;
+        if (id && this.hangProbe?.id === id) {
+          this.onHangProbeAnswered();
+          return;
+        }
         if (id && this.pending.has(id)) {
           const entry = this.pending.get(id);
           if (!entry)
             return;
           this.pending.delete(id);
-          clearTimeout(entry.timer);
+          this.settleHangEvidence(id);
+          this.clock.clearTimeout(entry.timer);
           entry.onSettled?.();
-          this.consecutiveRequestTimeouts = 0;
           if (response.success !== false && ![
             "configure",
             "version",
@@ -1727,6 +1907,7 @@ var init_bridge = __esm(() => {
           this.accountForBashTaskResponse(entry.command, response);
           entry.resolve(response);
         } else if (id && typeof response.type !== "string") {
+          this.settleHangEvidence(id);
           const taskId = bashTaskIdFrom(response);
           if (taskId) {
             this.warnVia(`Dropped late reply for settled request id=${id} task_id=${taskId}`);
@@ -1757,8 +1938,8 @@ var init_bridge = __esm(() => {
         rejectWith(new BridgeTransportTimeoutError(entry.command, effectiveTimeoutMs, message, outcome));
       };
       entry.resolve = (response) => settle(shellOutcomeFromLateReply(response));
-      clearTimeout(entry.timer);
-      entry.timer = setTimeout(() => {
+      this.clock.clearTimeout(entry.timer);
+      entry.timer = this.clock.setTimeout(() => {
         if (this.pending.get(id) !== entry)
           return;
         this.pending.delete(id);
@@ -1780,17 +1961,150 @@ var init_bridge = __esm(() => {
         this.outstandingBackgroundTaskIds.add(taskId);
       }
     }
-    handleTimeout(trigger, triggeringSessionId) {
-      this.consecutiveRequestTimeouts = 0;
+    recordAwaitingReply(id, budgetMs, tool, sessionId) {
+      this.awaitingReply.set(id, { sentAt: this.clock.now(), budgetMs, tool, sessionId });
+      this.armHangWatchdog();
+    }
+    settleHangEvidence(id) {
+      if (!this.awaitingReply.delete(id))
+        return;
+      this.clearHangWatchdogTimer();
+      this.armHangWatchdog();
+    }
+    hangDeadline() {
+      if (this.awaitingReply.size === 0)
+        return null;
+      let oldestId = "";
+      let oldestSentAt = Number.POSITIVE_INFINITY;
+      const budgets = [];
+      for (const [id, entry] of this.awaitingReply) {
+        budgets.push(entry.budgetMs);
+        if (entry.sentAt < oldestSentAt) {
+          oldestSentAt = entry.sentAt;
+          oldestId = id;
+        }
+      }
+      for (const entry of this.pending.values())
+        budgets.push(entry.budgetMs);
+      const windowMs = hangWindowMs(budgets, this.hangWindowMinMs);
+      const silentSince = Math.max(oldestSentAt, this.lastChildActivity);
+      return { deadline: silentSince + windowMs, windowMs, silentSince, oldestId };
+    }
+    armHangWatchdog() {
+      if (this.hangWatchdogTimer || this.hangProbe)
+        return;
+      const hang = this.hangDeadline();
+      if (!hang)
+        return;
+      const timer = this.clock.setTimeout(() => {
+        this.hangWatchdogTimer = null;
+        this.checkForHang();
+      }, Math.max(0, hang.deadline - this.clock.now()));
+      timer.unref?.();
+      this.hangWatchdogTimer = timer;
+    }
+    clearHangWatchdogTimer() {
+      if (this.hangWatchdogTimer)
+        this.clock.clearTimeout(this.hangWatchdogTimer);
+      this.hangWatchdogTimer = null;
+    }
+    clearHangProbe() {
+      if (this.hangProbe)
+        this.clock.clearTimeout(this.hangProbe.timer);
+      this.hangProbe = null;
+    }
+    resetHangWatchdog() {
+      this.clearHangWatchdogTimer();
+      this.clearHangProbe();
+      this.awaitingReply.clear();
+      this.lastChildActivity = Number.NEGATIVE_INFINITY;
+      this.hangSuppressionLogged = false;
+    }
+    checkForHang() {
+      if (!this.isAlive() || this.hangProbe)
+        return;
+      const hang = this.hangDeadline();
+      if (!hang)
+        return;
+      const now = this.clock.now();
+      if (now < hang.deadline) {
+        this.armHangWatchdog();
+        return;
+      }
+      if (this.timeoutRestartAwaitingRecovery) {
+        if (!this.hangSuppressionLogged) {
+          this.hangSuppressionLogged = true;
+          this.warnVia(`Hang watchdog: child silent past its window, but it was already restarted once and no tool has succeeded since; not restarting again; ${this.hangAttribution(hang)}`);
+        }
+        return;
+      }
+      this.sendHangProbe(hang);
+    }
+    hangAttribution(hang) {
+      return `silent_ms=${this.clock.now() - hang.silentSince} ` + `hang_window_ms=${hang.windowMs} ` + `oldest_unanswered_request_id=${hang.oldestId} ` + `oldest_unanswered_tool=${JSON.stringify(this.awaitingReply.get(hang.oldestId)?.tool)} ` + `bridge_generation=${this.processGeneration}`;
+    }
+    sendHangProbe(hang) {
+      const id = `hang-probe-${this.nextId++}`;
+      const timer = this.clock.setTimeout(() => this.onHangProbeTimeout(id), this.hangProbeTimeoutMs);
+      timer.unref?.();
+      this.hangProbe = { id, sentAt: this.clock.now(), timer };
+      this.logVia(`Hang watchdog: child silent past its window; sending liveness probe id=${id} probe_timeout_ms=${this.hangProbeTimeoutMs}; ${this.hangAttribution(hang)}`);
+      try {
+        this.process?.stdin?.write(`${JSON.stringify({ id, command: "ping" })}
+`, () => {});
+      } catch {}
+    }
+    onHangProbeAnswered() {
+      const probeId = this.hangProbe?.id;
+      this.clearHangProbe();
+      let dropped = 0;
+      for (const id of Array.from(this.awaitingReply.keys())) {
+        if (this.pending.has(id))
+          continue;
+        this.awaitingReply.delete(id);
+        dropped += 1;
+      }
+      this.logVia(`Hang watchdog: liveness probe id=${probeId} answered; child kept; dropped ${dropped} unanswered request(s) whose callers already settled, ${this.awaitingReply.size} still waiting`);
+      this.clearHangWatchdogTimer();
+      this.armHangWatchdog();
+    }
+    onHangProbeTimeout(probeId) {
+      const probe = this.hangProbe;
+      if (!probe || probe.id !== probeId)
+        return;
+      this.hangProbe = null;
+      if (!this.isAlive())
+        return;
+      const hang = this.hangDeadline();
+      if (!hang)
+        return;
+      if (this.lastChildActivity >= probe.sentAt) {
+        this.armHangWatchdog();
+        return;
+      }
+      const attribution = `${this.hangAttribution(hang)} probe_id=${probeId} probe_timeout_ms=${this.hangProbeTimeoutMs}`;
+      this.killHungChild(attribution, this.awaitingReply.get(hang.oldestId)?.sessionId);
+    }
+    killHungChild(attribution, sessionId) {
       this.timeoutRestartAwaitingRecovery = true;
       this.spawnedBinaryFingerprint = null;
-      const abortedSiblings = Array.from(this.pending, ([requestId, entry]) => ({
+      const aborted = Array.from(this.pending, ([requestId, entry]) => ({
         request_id: requestId,
-        tool: entry.tool
+        tool: entry.tool,
+        retry: isReadOnlyRetryCommand(entry.tool)
       }));
-      const attribution = `triggering_request_id=${trigger.requestId} ` + `triggering_tool=${JSON.stringify(trigger.tool)} ` + `bridge_generation=${trigger.generation} ` + `aborted_siblings=${JSON.stringify(abortedSiblings)}`;
-      this.rejectAllPending(new BridgeTransportUnknownOutcomeError(`${this.errorPrefix} bridge killed during sibling timeout — request aborted; ${attribution}`));
+      const fullAttribution = `${attribution} aborted_requests=${JSON.stringify(aborted)}`;
+      this.configureWarningClients.clear();
+      const pending = Array.from(this.pending.values());
+      this.pending.clear();
+      for (const entry of pending) {
+        this.clock.clearTimeout(entry.timer);
+        entry.onSettled?.();
+        const readOnly = isReadOnlyRetryCommand(entry.tool);
+        entry.reject(new BridgeRestartedError(entry.tool, !readOnly, readOnly ? `${this.errorPrefix} bridge restarted: the child wrote nothing for longer than its hang window and did not answer a liveness probe; "${entry.tool}" is read-only and safe to retry; ${fullAttribution}` : `${this.errorPrefix} bridge restarted: the child wrote nothing for longer than its hang window and did not answer a liveness probe; the outcome of "${entry.tool}" is unknown — a mutation may already have been applied, inspect before repeating it; ${fullAttribution}`));
+      }
       this.outstandingBackgroundTaskIds.clear();
+      this.resetHangWatchdog();
       if (this.process) {
         this.process.kill("SIGKILL");
         this.process = null;
@@ -1799,9 +2113,9 @@ var init_bridge = __esm(() => {
       this.configured = false;
       const tail = this.formatStderrTail();
       this.stderrTail = [];
-      const killedMsg = tail ? `Bridge killed after timeout; ${attribution}.${tail}` : `Bridge killed after timeout; ${attribution} (see ${this.getLogFilePathVia()})`;
-      if (triggeringSessionId) {
-        this.sessionErrorVia(triggeringSessionId, killedMsg);
+      const killedMsg = tail ? `Bridge killed after timeout of the hang watchdog; ${fullAttribution}.${tail}` : `Bridge killed after timeout of the hang watchdog; ${fullAttribution} (see ${this.getLogFilePathVia()})`;
+      if (sessionId) {
+        this.sessionErrorVia(sessionId, killedMsg);
       } else {
         this.errorVia(killedMsg);
       }
@@ -1850,7 +2164,7 @@ var init_bridge = __esm(() => {
     rejectAllPending(error) {
       this.configureWarningClients.clear();
       for (const [_id, entry] of this.pending) {
-        clearTimeout(entry.timer);
+        this.clock.clearTimeout(entry.timer);
         entry.onSettled?.();
         entry.reject(error);
       }
@@ -3217,6 +3531,14 @@ function translateInspectLspPaths(map, prefix, out) {
       recordRetired(out, prefix, `inspect.${leaf}`);
   }
 }
+function dropNoEffectPaths(map, prefix, out) {
+  for (const path of REMOVED_NO_EFFECT_PATHS) {
+    const [container, leaf] = path.split(".");
+    if (container && leaf && takeNested(map, container, leaf).found) {
+      recordRetired(out, prefix, path);
+    }
+  }
+}
 function translateExperimentalPaths(map, prefix, out) {
   for (const [oldKey, leaf] of [
     ["experimental_lsp_ty", "lsp_ty"],
@@ -3278,6 +3600,7 @@ function translateBlock(map, userBase, blockLabel, out) {
   const prefix = blockLabel === "base" ? "" : `${blockLabel}.`;
   translateGithubAliases(map, prefix, out);
   translateInspectLspPaths(map, prefix, out);
+  dropNoEffectPaths(map, prefix, out);
   translateExperimentalPaths(map, prefix, out);
   if (isRecord(map.sandbox) && Object.hasOwn(map.sandbox, "enabled")) {
     const sandbox = map.sandbox;
@@ -3485,7 +3808,7 @@ function mergeIndexes(base, override, restricted) {
   }
   return merged;
 }
-var CANONICAL_TOOLS, HOST_TOOL_NAMES, DEFAULT_DISABLED_TOOLS, LEGACY_TOOL_ALIASES, RETIRED_PATHS, INDEX_INPUTS, LSP_IDLE_MINUTES_DEFAULT = 60, LSP_IDLE_MINUTES_MIN = 5, LSP_IDLE_MINUTES_MAX = 1440, RETIRED_ENABLED_FALSE_INDEXES_NOTE = "enabled: false no longer turns AFT off: it is translated to disabling every tool, but the trigram, semantic and callgraph indexes still build. To keep AFT from indexing this repository, also set indexes.trigram, indexes.semantic and indexes.callgraph to false.", SEMANTIC_COST_NOTICE_DIGEST;
+var CANONICAL_TOOLS, HOST_TOOL_NAMES, DEFAULT_DISABLED_TOOLS, LEGACY_TOOL_ALIASES, RETIRED_PATHS, INDEX_INPUTS, LSP_IDLE_MINUTES_DEFAULT = 60, LSP_IDLE_MINUTES_MIN = 5, LSP_IDLE_MINUTES_MAX = 1440, REMOVED_NO_EFFECT_PATHS, RETIRED_ENABLED_FALSE_INDEXES_NOTE = "enabled: false no longer turns AFT off: it is translated to disabling every tool, but the trigram, semantic and callgraph indexes still build. To keep AFT from indexing this repository, also set indexes.trigram, indexes.semantic and indexes.callgraph to false.", SEMANTIC_COST_NOTICE_DIGEST, SECURITY_CONFIG_SECTIONS;
 var init_feature_config = __esm(() => {
   CANONICAL_TOOLS = [
     "aft_callgraph",
@@ -3553,7 +3876,26 @@ var init_feature_config = __esm(() => {
     ["semantic", "semantic_search", "experimental_semantic_search"],
     ["callgraph", "callgraph_store", undefined]
   ];
+  REMOVED_NO_EFFECT_PATHS = ["bridge.hang_threshold"];
   SEMANTIC_COST_NOTICE_DIGEST = noticeDigest({ notice: "semantic_default_cost_v1" });
+  SECURITY_CONFIG_SECTIONS = new Set([
+    "restrict_to_project_root",
+    "url_fetch_allow_private",
+    "sandbox",
+    "indexes",
+    "index",
+    "remote_exec",
+    "disabled_tools",
+    "bash",
+    "lsp",
+    "semantic",
+    "search",
+    "subc",
+    "opencode",
+    "github",
+    "gh_shim",
+    "auto_update"
+  ]);
 });
 // ../aft-bridge/dist/pool.js
 var DEFAULT_IDLE_TIMEOUT_MS, CLEANUP_INTERVAL_MS;
@@ -3593,8 +3935,17 @@ var init_location_lifecycle = __esm(() => {
 });
 
 // ../aft-bridge/dist/lsp-github-probe.js
+var ALLOWED_GITHUB_HOSTS;
 var init_lsp_github_probe = __esm(() => {
   init_active_logger();
+  ALLOWED_GITHUB_HOSTS = new Set([
+    "github.com",
+    "api.github.com",
+    "objects.githubusercontent.com",
+    "release-assets.githubusercontent.com",
+    "raw.githubusercontent.com",
+    "codeload.github.com"
+  ]);
 });
 
 // ../aft-bridge/dist/lsp-github-table.js
@@ -3659,166 +4010,15 @@ var init_lsp_github_install = __esm(() => {
   init_tar_executable();
 });
 
-// ../aft-bridge/dist/message-detach.js
-var BASH_WAIT_DETACH_MAGIC_KEYWORD = "&detach", STANDALONE_DETACH_KEYWORD_SOURCE, STANDALONE_DETACH_KEYWORD_PATTERN, STANDALONE_DETACH_KEYWORDS_PATTERN;
-var init_message_detach = __esm(() => {
-  STANDALONE_DETACH_KEYWORD_SOURCE = `(^|[^\\p{L}\\p{N}_])${BASH_WAIT_DETACH_MAGIC_KEYWORD}(?![\\p{L}\\p{N}_])`;
-  STANDALONE_DETACH_KEYWORD_PATTERN = new RegExp(STANDALONE_DETACH_KEYWORD_SOURCE, "u");
-  STANDALONE_DETACH_KEYWORDS_PATTERN = new RegExp(STANDALONE_DETACH_KEYWORD_SOURCE, "gu");
-});
-
-// ../aft-bridge/dist/paths.js
-import { homedir as homedir7 } from "node:os";
-import { dirname as dirname2, isAbsolute as isAbsolute4, join as join9, resolve as resolve5 } from "node:path";
-function homeDir3() {
-  if (process.platform === "win32")
-    return process.env.USERPROFILE || process.env.HOME || homedir7();
-  return process.env.HOME || homedir7();
-}
-function configHome() {
-  const xdg = process.env.XDG_CONFIG_HOME;
-  if (xdg && isAbsolute4(xdg))
-    return xdg;
-  return join9(homeDir3(), ".config");
-}
-function resolveCortexKitUserConfigPath() {
-  return join9(configHome(), "cortexkit", "aft.jsonc");
-}
-function resolveCortexKitProjectConfigPath(projectDirectory) {
-  return join9(projectDirectory, ".cortexkit", "aft.jsonc");
-}
-var init_paths = __esm(() => {
-  init_private_storage();
-});
-
-// ../aft-bridge/dist/resolver.js
-import { closeSync as closeSync4, existsSync as existsSync4, promises as fsPromises, openSync as openSync4, readFileSync as readFileSync4, readSync as readSync3 } from "node:fs";
-function isNativeExecutable(binaryPath) {
-  let fd = null;
-  try {
-    fd = openSync4(binaryPath, "r");
-    const buf = Buffer.alloc(4);
-    const read = readSync3(fd, buf, 0, 4, 0);
-    if (read < 2)
-      return false;
-    const b0 = buf[0];
-    const b1 = buf[1];
-    if (b0 === 35 && b1 === 33)
-      return false;
-    const m32 = buf.readUInt32BE(0);
-    const machO = new Set([4277009102, 4277009103, 3472551422, 3489328638, 3405691582]);
-    if (read >= 4 && machO.has(m32))
-      return true;
-    if (read >= 4 && m32 === 2135247942)
-      return true;
-    if (b0 === 77 && b1 === 90)
-      return true;
-    return false;
-  } catch {
-    return false;
-  } finally {
-    if (fd !== null) {
-      try {
-        closeSync4(fd);
-      } catch {}
-    }
-  }
-}
-var cacheCopiesInFlight;
-var init_resolver = __esm(() => {
-  init_active_logger();
-  init_binary_identity();
-  init_cache_paths();
-  init_downloader();
-  init_platform();
-  init_version_probe();
-  cacheCopiesInFlight = new Map;
-});
-
-// ../aft-bridge/dist/migration.js
-var DEFAULT_TIMEOUT_MS;
-var init_migration = __esm(() => {
-  init_child_process();
-  init_paths();
-  init_resolver();
-  init_storage_paths();
-  init_storage_paths();
-  DEFAULT_TIMEOUT_MS = 30 * 60 * 1000;
-});
-
-// ../aft-bridge/dist/migration-notices.js
-import { readFileSync as readFileSync5, renameSync as renameSync3, rmdirSync, statSync as statSync3, writeFileSync as writeFileSync2 } from "node:fs";
-import { homedir as homedir8 } from "node:os";
-import { dirname as dirname3, join as join10, resolve as resolve6 } from "node:path";
-function migrationNoticeStorePath(env = process.env) {
-  const stateHome = env.XDG_STATE_HOME && env.XDG_STATE_HOME.length > 0 ? env.XDG_STATE_HOME : join10(homedir8(), ".local", "state");
-  return join10(stateHome, "cortexkit", "aft", "migration-notices.json");
-}
-function readRecords(storePath) {
-  try {
-    const parsed = JSON.parse(readFileSync5(storePath, "utf8"));
-    return parsed && typeof parsed === "object" && !Array.isArray(parsed) ? parsed : {};
-  } catch {
-    return {};
-  }
-}
-function withStoreLock(storePath, action) {
-  const lockPath = `${storePath}.lock`;
-  openPrivateStorageDir(dirname3(storePath));
-  const deadline = Date.now() + 2000;
-  for (;; ) {
-    try {
-      privateMkdirSync(lockPath, false);
-      break;
-    } catch (error) {
-      if (error.code !== "EEXIST")
-        throw error;
-      try {
-        if (Date.now() - statSync3(lockPath).mtimeMs > LOCK_STALE_MS)
-          rmdirSync(lockPath);
-      } catch {}
-      if (Date.now() > deadline)
-        throw error;
-      Atomics.wait(new Int32Array(new SharedArrayBuffer(4)), 0, 0, 10);
-    }
-  }
-  try {
-    return action();
-  } finally {
-    try {
-      rmdirSync(lockPath);
-    } catch {}
-  }
-}
-function clearMigrationNotices(configPath, storePath = migrationNoticeStorePath()) {
-  const prefix = `${resolve6(configPath)}|`;
-  withStoreLock(storePath, () => {
-    const records = readRecords(storePath);
-    for (const key of Object.keys(records))
-      if (key.startsWith(prefix))
-        delete records[key];
-    writeFileSync2(storePath, `${JSON.stringify(records, null, 2)}
-`, {
-      encoding: "utf8",
-      mode: PRIVATE_FILE_MODE
-    });
-  });
-}
-var LOCK_STALE_MS = 1e4;
-var init_migration_notices = __esm(() => {
-  init_feature_config();
-  init_private_storage();
-});
-
 // ../aft-bridge/dist/npm-resolver.js
-import { readdirSync as readdirSync2, statSync as statSync4 } from "node:fs";
-import { homedir as homedir9 } from "node:os";
-import { dirname as dirname4, isAbsolute as isAbsolute5, join as join11 } from "node:path";
+import { readdirSync as readdirSync2, statSync as statSync3 } from "node:fs";
+import { homedir as homedir7 } from "node:os";
+import { dirname as dirname2, isAbsolute as isAbsolute4, join as join9 } from "node:path";
 function defaultDeps() {
   return {
     platform: process.platform,
     env: process.env,
-    home: homedir9(),
+    home: homedir7(),
     execPath: process.execPath
   };
 }
@@ -3827,7 +4027,7 @@ function npmBinaryName(platform) {
 }
 function isFile(p) {
   try {
-    return statSync4(p).isFile();
+    return statSync3(p).isFile();
   } catch {
     return false;
   }
@@ -3840,16 +4040,16 @@ function npmFromPath(deps) {
   const separator = deps.platform === "win32" ? ";" : ":";
   for (const entry of raw.split(separator)) {
     const dir = entry.trim().replace(/^"|"$/g, "");
-    if (!dir || !isAbsolute5(dir))
+    if (!dir || !isAbsolute4(dir))
       continue;
-    if (isFile(join11(dir, name)))
+    if (isFile(join9(dir, name)))
       return dir;
   }
   return null;
 }
 function npmAdjacentToNode(deps) {
-  const dir = dirname4(deps.execPath);
-  return isFile(join11(dir, npmBinaryName(deps.platform))) ? dir : null;
+  const dir = dirname2(deps.execPath);
+  return isFile(join9(dir, npmBinaryName(deps.platform))) ? dir : null;
 }
 function highestVersionedNodeBin(installsDir, name) {
   let entries;
@@ -3858,8 +4058,8 @@ function highestVersionedNodeBin(installsDir, name) {
   } catch {
     return null;
   }
-  const candidates = entries.filter((v) => isFile(join11(installsDir, v, "bin", name))).sort((a, b) => compareVersionsDesc(a, b));
-  return candidates.length > 0 ? join11(installsDir, candidates[0], "bin") : null;
+  const candidates = entries.filter((v) => isFile(join9(installsDir, v, "bin", name))).sort((a, b) => compareVersionsDesc(a, b));
+  return candidates.length > 0 ? join9(installsDir, candidates[0], "bin") : null;
 }
 function compareVersionsDesc(a, b) {
   const pa = a.replace(/^v/, "").split(".").map((n) => Number.parseInt(n, 10));
@@ -3884,22 +4084,22 @@ function wellKnownNpmDirs(deps) {
     const programFiles = env.ProgramFiles || "C:\\Program Files";
     const appData = env.APPDATA;
     const localAppData = env.LOCALAPPDATA;
-    push(join11(programFiles, "nodejs"));
+    push(join9(programFiles, "nodejs"));
     if (appData)
-      push(join11(appData, "npm"));
+      push(join9(appData, "npm"));
     if (localAppData)
-      push(join11(localAppData, "Volta", "bin"));
+      push(join9(localAppData, "Volta", "bin"));
     if (env.NVM_SYMLINK)
       push(env.NVM_SYMLINK);
   } else {
     if (env.NVM_BIN)
       push(env.NVM_BIN);
-    push(highestVersionedNodeBin(join11(home, ".nvm", "versions", "node"), name));
-    push(highestVersionedNodeBin(join11(home, ".local", "share", "mise", "installs", "node"), name));
-    push(highestVersionedNodeBin(join11(home, ".asdf", "installs", "nodejs"), name));
-    push(join11(home, ".volta", "bin"));
-    push(join11(home, ".asdf", "shims"));
-    const systemDirs = deps.systemNpmDirs ?? (platform === "darwin" ? ["/opt/homebrew/bin", "/usr/local/bin"] : ["/usr/local/bin", "/usr/bin", join11(home, ".local", "bin")]);
+    push(highestVersionedNodeBin(join9(home, ".nvm", "versions", "node"), name));
+    push(highestVersionedNodeBin(join9(home, ".local", "share", "mise", "installs", "node"), name));
+    push(highestVersionedNodeBin(join9(home, ".asdf", "installs", "nodejs"), name));
+    push(join9(home, ".volta", "bin"));
+    push(join9(home, ".asdf", "shims"));
+    const systemDirs = deps.systemNpmDirs ?? (platform === "darwin" ? ["/opt/homebrew/bin", "/usr/local/bin"] : ["/usr/local/bin", "/usr/bin", join9(home, ".local", "bin")]);
     for (const dir of systemDirs)
       push(dir);
   }
@@ -3909,12 +4109,12 @@ function resolveNpm(deps = defaultDeps()) {
   const name = npmBinaryName(deps.platform);
   const onPath = npmFromPath(deps);
   if (onPath)
-    return { command: join11(onPath, name), binDir: onPath };
+    return { command: join9(onPath, name), binDir: onPath };
   const adjacent = npmAdjacentToNode(deps);
   if (adjacent)
-    return { command: join11(adjacent, name), binDir: adjacent };
+    return { command: join9(adjacent, name), binDir: adjacent };
   for (const dir of wellKnownNpmDirs(deps)) {
-    const candidate = join11(dir, name);
+    const candidate = join9(dir, name);
     if (isFile(candidate))
       return { command: candidate, binDir: dir };
   }
@@ -4075,7 +4275,7 @@ function terminateNpmProcessTree(child, invocation, env = process.env, gracePeri
     };
     child.once("exit", onChildExit);
     const systemRoot = env.SystemRoot ?? env.SYSTEMROOT;
-    const taskkill = systemRoot ? join11(systemRoot, "System32", "taskkill.exe") : "taskkill.exe";
+    const taskkill = systemRoot ? join9(systemRoot, "System32", "taskkill.exe") : "taskkill.exe";
     try {
       killer = spawn(taskkill, ["/pid", String(child.pid), "/t", "/f"], {
         stdio: "ignore",
@@ -4110,6 +4310,166 @@ var init_npm_resolver = __esm(() => {
   };
 });
 
+// ../aft-bridge/dist/lsp-npm-policy.js
+var npmCutoffSupport, NPM_PROBE_RETRY_MS;
+var init_lsp_npm_policy = __esm(() => {
+  init_child_process();
+  init_npm_resolver();
+  npmCutoffSupport = new Map;
+  NPM_PROBE_RETRY_MS = 5 * 60000;
+});
+
+// ../aft-bridge/dist/message-detach.js
+var BASH_WAIT_DETACH_MAGIC_KEYWORD = "&detach", STANDALONE_DETACH_KEYWORD_SOURCE, STANDALONE_DETACH_KEYWORD_PATTERN, STANDALONE_DETACH_KEYWORDS_PATTERN;
+var init_message_detach = __esm(() => {
+  STANDALONE_DETACH_KEYWORD_SOURCE = `(^|[^\\p{L}\\p{N}_])${BASH_WAIT_DETACH_MAGIC_KEYWORD}(?![\\p{L}\\p{N}_])`;
+  STANDALONE_DETACH_KEYWORD_PATTERN = new RegExp(STANDALONE_DETACH_KEYWORD_SOURCE, "u");
+  STANDALONE_DETACH_KEYWORDS_PATTERN = new RegExp(STANDALONE_DETACH_KEYWORD_SOURCE, "gu");
+});
+
+// ../aft-bridge/dist/paths.js
+import { homedir as homedir8 } from "node:os";
+import { dirname as dirname3, isAbsolute as isAbsolute5, join as join10, resolve as resolve5 } from "node:path";
+function homeDir3() {
+  if (process.platform === "win32")
+    return process.env.USERPROFILE || process.env.HOME || homedir8();
+  return process.env.HOME || homedir8();
+}
+function configHome() {
+  const xdg = process.env.XDG_CONFIG_HOME;
+  if (xdg && isAbsolute5(xdg))
+    return xdg;
+  return join10(homeDir3(), ".config");
+}
+function resolveCortexKitUserConfigPath() {
+  return join10(configHome(), "cortexkit", "aft.jsonc");
+}
+function resolveCortexKitProjectConfigPath(projectDirectory) {
+  return join10(projectDirectory, ".cortexkit", "aft.jsonc");
+}
+var init_paths = __esm(() => {
+  init_private_storage();
+});
+
+// ../aft-bridge/dist/resolver.js
+import { closeSync as closeSync4, existsSync as existsSync4, promises as fsPromises, openSync as openSync4, readFileSync as readFileSync4, readSync as readSync3 } from "node:fs";
+function isNativeExecutable(binaryPath) {
+  let fd = null;
+  try {
+    fd = openSync4(binaryPath, "r");
+    const buf = Buffer.alloc(4);
+    const read = readSync3(fd, buf, 0, 4, 0);
+    if (read < 2)
+      return false;
+    const b0 = buf[0];
+    const b1 = buf[1];
+    if (b0 === 35 && b1 === 33)
+      return false;
+    const m32 = buf.readUInt32BE(0);
+    const machO = new Set([4277009102, 4277009103, 3472551422, 3489328638, 3405691582]);
+    if (read >= 4 && machO.has(m32))
+      return true;
+    if (read >= 4 && m32 === 2135247942)
+      return true;
+    if (b0 === 77 && b1 === 90)
+      return true;
+    return false;
+  } catch {
+    return false;
+  } finally {
+    if (fd !== null) {
+      try {
+        closeSync4(fd);
+      } catch {}
+    }
+  }
+}
+var cacheCopiesInFlight;
+var init_resolver = __esm(() => {
+  init_active_logger();
+  init_binary_identity();
+  init_cache_paths();
+  init_downloader();
+  init_platform();
+  init_version_probe();
+  cacheCopiesInFlight = new Map;
+});
+
+// ../aft-bridge/dist/migration.js
+var DEFAULT_TIMEOUT_MS;
+var init_migration = __esm(() => {
+  init_child_process();
+  init_paths();
+  init_resolver();
+  init_storage_paths();
+  init_storage_paths();
+  DEFAULT_TIMEOUT_MS = 30 * 60 * 1000;
+});
+
+// ../aft-bridge/dist/migration-notices.js
+import { readFileSync as readFileSync5, renameSync as renameSync3, rmdirSync, statSync as statSync4, writeFileSync as writeFileSync2 } from "node:fs";
+import { homedir as homedir9 } from "node:os";
+import { dirname as dirname4, join as join11, resolve as resolve6 } from "node:path";
+function migrationNoticeStorePath(env = process.env) {
+  const stateHome = env.XDG_STATE_HOME && env.XDG_STATE_HOME.length > 0 ? env.XDG_STATE_HOME : join11(homedir9(), ".local", "state");
+  return join11(stateHome, "cortexkit", "aft", "migration-notices.json");
+}
+function readRecords(storePath) {
+  try {
+    const parsed = JSON.parse(readFileSync5(storePath, "utf8"));
+    return parsed && typeof parsed === "object" && !Array.isArray(parsed) ? parsed : {};
+  } catch {
+    return {};
+  }
+}
+function withStoreLock(storePath, action) {
+  const lockPath = `${storePath}.lock`;
+  openPrivateStorageDir(dirname4(storePath));
+  const deadline = Date.now() + 2000;
+  for (;; ) {
+    try {
+      privateMkdirSync(lockPath, false);
+      break;
+    } catch (error) {
+      if (error.code !== "EEXIST")
+        throw error;
+      try {
+        if (Date.now() - statSync4(lockPath).mtimeMs > LOCK_STALE_MS)
+          rmdirSync(lockPath);
+      } catch {}
+      if (Date.now() > deadline)
+        throw error;
+      Atomics.wait(new Int32Array(new SharedArrayBuffer(4)), 0, 0, 10);
+    }
+  }
+  try {
+    return action();
+  } finally {
+    try {
+      rmdirSync(lockPath);
+    } catch {}
+  }
+}
+function clearMigrationNotices(configPath, storePath = migrationNoticeStorePath()) {
+  const prefix = `${resolve6(configPath)}|`;
+  withStoreLock(storePath, () => {
+    const records = readRecords(storePath);
+    for (const key of Object.keys(records))
+      if (key.startsWith(prefix))
+        delete records[key];
+    writeFileSync2(storePath, `${JSON.stringify(records, null, 2)}
+`, {
+      encoding: "utf8",
+      mode: PRIVATE_FILE_MODE
+    });
+  });
+}
+var LOCK_STALE_MS = 1e4;
+var init_migration_notices = __esm(() => {
+  init_feature_config();
+  init_private_storage();
+});
+
 // ../aft-bridge/dist/onnx-probe.js
 import { closeSync as closeSync5, existsSync as existsSync5, openSync as openSync5, readSync as readSync4, realpathSync as realpathSync2 } from "node:fs";
 function readAt(fd, offset, length) {
@@ -5104,9 +5464,12 @@ var init_semantic_status = __esm(() => {
 // ../aft-bridge/dist/index.js
 var init_dist2 = __esm(() => {
   init_active_logger();
+  init_bash_env();
   init_bash_format();
   init_bash_hints();
   init_bash_host_fallback();
+  init_bash_permissions();
+  init_bash_watch_lines();
   init_binary_identity();
   init_bridge();
   init_cache_paths();
@@ -5125,6 +5488,7 @@ var init_dist2 = __esm(() => {
   init_lsp_github_install();
   init_lsp_github_probe();
   init_lsp_github_table();
+  init_lsp_npm_policy();
   init_message_detach();
   init_migration();
   init_migration_notices();
@@ -5138,6 +5502,7 @@ var init_dist2 = __esm(() => {
   init_platform();
   init_pool();
   init_project_identity();
+  init_protocol();
   init_resolver();
   init_revivable_transport();
   init_semantic_status();
@@ -5275,12 +5640,7 @@ function firstExisting(candidates) {
   return null;
 }
 function platformKey2(platform = process.platform, arch = process.arch) {
-  const table = {
-    darwin: { arm64: "darwin-arm64", x64: "darwin-x64" },
-    linux: { arm64: "linux-arm64", x64: "linux-x64" },
-    win32: { x64: "win32-x64" }
-  };
-  return table[platform]?.[arch] ?? null;
+  return PLATFORM_ARCH_MAP[platform]?.[arch] ?? null;
 }
 function newestCachedBinary(cacheDir, binaryName) {
   let entries;
@@ -5411,13 +5771,13 @@ var init_binary_probe = __esm(async () => {
 });
 
 // src/lib/fs-util.ts
-import { existsSync as existsSync8, readdirSync as readdirSync5, statSync as statSync7 } from "node:fs";
+import { existsSync as existsSync8, lstatSync as lstatSync3, readdirSync as readdirSync5 } from "node:fs";
 import { join as join14 } from "node:path";
 function dirSize(path) {
   if (!existsSync8(path)) {
     return 0;
   }
-  const stat = statSync7(path);
+  const stat = lstatSync3(path);
   if (stat.isFile()) {
     return stat.size;
   }
@@ -5431,10 +5791,10 @@ function dirSize(path) {
   return total;
 }
 function formatBytes(bytes) {
-  if (bytes === 0)
+  if (!Number.isFinite(bytes) || bytes < 1)
     return "0 B";
   const units = ["B", "KB", "MB", "GB", "TB"];
-  const i = Math.floor(Math.log(bytes) / Math.log(1024));
+  const i = Math.min(units.length - 1, Math.floor(Math.log(bytes) / Math.log(1024)));
   return `${(bytes / 1024 ** i).toFixed(1)} ${units[i]}`;
 }
 function compareVersionLabels(a, b) {
@@ -5505,12 +5865,12 @@ function getOmpPackageDir() {
 var init_omp_paths = () => {};
 
 // src/lib/omp-helpers.ts
-import { accessSync as accessSync2, constants as constants3, existsSync as existsSync10, readFileSync as readFileSync7, statSync as statSync8 } from "node:fs";
+import { accessSync as accessSync2, constants as constants3, existsSync as existsSync10, readFileSync as readFileSync7, statSync as statSync7 } from "node:fs";
 import { homedir as homedir12 } from "node:os";
 import { delimiter as delimiter2, extname, join as join16, resolve as resolve10 } from "node:path";
 function isExecutableFile(path, platform = process.platform) {
   try {
-    if (!existsSync10(path) || !statSync8(path).isFile())
+    if (!existsSync10(path) || !statSync7(path).isFile())
       return false;
     accessSync2(path, platform === "win32" ? constants3.F_OK : constants3.X_OK);
     return true;
@@ -5836,7 +6196,7 @@ var init_omp = __esm(() => {
 });
 
 // src/lib/fs-errors.ts
-import { existsSync as existsSync12, statSync as statSync9 } from "node:fs";
+import { existsSync as existsSync12, statSync as statSync8 } from "node:fs";
 import { homedir as homedir13 } from "node:os";
 import { dirname as dirname6, resolve as resolve11, sep as sep2 } from "node:path";
 function errorCode(error) {
@@ -5921,7 +6281,7 @@ var init_fs_errors = __esm(() => {
   defaultFacts = {
     ownerUid(path) {
       try {
-        return statSync9(path).uid;
+        return statSync8(path).uid;
       } catch {
         return null;
       }
@@ -13709,7 +14069,19 @@ var require_src2 = __commonJS(function(exports, module) {
 });
 
 // src/lib/jsonc.ts
-import { existsSync as existsSync13, mkdirSync as mkdirSync4, readFileSync as readFileSync9, writeFileSync as writeFileSync4 } from "node:fs";
+import { randomUUID as randomUUID2 } from "node:crypto";
+import {
+  chmodSync as chmodSync3,
+  existsSync as existsSync13,
+  lstatSync as lstatSync4,
+  mkdirSync as mkdirSync4,
+  readFileSync as readFileSync9,
+  realpathSync as realpathSync4,
+  renameSync as renameSync5,
+  rmSync as rmSync3,
+  statSync as statSync9,
+  writeFileSync as writeFileSync4
+} from "node:fs";
 import { dirname as dirname7 } from "node:path";
 function detectJsoncFile(configDir, baseName) {
   const jsoncPath = `${configDir}/${baseName}.jsonc`;
@@ -13737,11 +14109,28 @@ function readJsoncFile(path) {
     };
   }
 }
-function writeJsoncFile(path, value, format = "json") {
+function writeJsoncFile(path, value, _format = "json") {
   mkdirSync4(dirname7(path), { recursive: true });
-  const serialized = format === "jsonc" ? import_comment_json.stringify(value, null, 2) : JSON.stringify(value, null, 2);
-  writeFileSync4(path, `${serialized}
-`);
+  const link = lstatSync4(path, { throwIfNoEntry: false });
+  if (link?.isSymbolicLink() && !existsSync13(path)) {
+    throw new Error(`Cannot write ${path}: config symlink target is missing or unreadable`);
+  }
+  const target = existsSync13(path) ? realpathSync4(path) : path;
+  const mode = existsSync13(target) ? statSync9(target).mode & 511 : undefined;
+  const temporary = `${target}.tmp-${randomUUID2()}`;
+  try {
+    writeFileSync4(temporary, `${import_comment_json.stringify(value, null, 2)}
+`, { flag: "wx", mode });
+    if (mode !== undefined)
+      chmodSync3(temporary, mode);
+    renameSync5(temporary, target);
+  } catch (error) {
+    if (error && typeof error === "object" && "path" in error)
+      error.path = path;
+    throw error;
+  } finally {
+    rmSync3(temporary, { force: true });
+  }
 }
 function ensureAftSchemaUrl(path, format) {
   const existed = existsSync13(path);
@@ -14020,8 +14409,8 @@ import {
   readdirSync as readdirSync6,
   readFileSync as readFileSync10,
   readSync as readSync5,
-  realpathSync as realpathSync4,
-  rmSync as rmSync3,
+  realpathSync as realpathSync5,
+  rmSync as rmSync4,
   statSync as statSync10
 } from "node:fs";
 import { homedir as homedir14, tmpdir as tmpdir3 } from "node:os";
@@ -14040,7 +14429,7 @@ function packageMetadataAt(path, expectedName) {
 function packageMetadataNearExecutable(executable, expectedName) {
   let current;
   try {
-    current = dirname8(realpathSync4(executable));
+    current = dirname8(realpathSync5(executable));
   } catch {
     current = dirname8(executable);
   }
@@ -14205,7 +14594,7 @@ function probeOpenCodeV1Version(executable, options = {}) {
   }
   const after = snapshotOperatorState(operatorHome);
   const createdIsolatedState = probeCreatedIsolatedState(data, state);
-  rmSync3(root, { recursive: true, force: true });
+  rmSync4(root, { recursive: true, force: true });
   if (after !== before && env.AFT_LOAD_MATRIX_ALLOW_LIVE_OPERATOR === "0") {
     throw new Error("OpenCode host probe changed the operator database or log directory");
   }
@@ -14243,7 +14632,7 @@ function isV2Version(version) {
 }
 function resolvedPath(executable) {
   try {
-    return realpathSync4(executable);
+    return realpathSync5(executable);
   } catch {
     return executable;
   }
@@ -14324,7 +14713,7 @@ var init_host_generation = __esm(() => {
 });
 
 // src/adapters/opencode.ts
-import { existsSync as existsSync15, readFileSync as readFileSync11, rmSync as rmSync4, statSync as statSync11 } from "node:fs";
+import { existsSync as existsSync15, readFileSync as readFileSync11, rmSync as rmSync5, statSync as statSync11 } from "node:fs";
 import { homedir as homedir15 } from "node:os";
 import { dirname as dirname9, join as join19, parse as parse3, resolve as resolve12 } from "node:path";
 import { fileURLToPath } from "node:url";
@@ -14346,7 +14735,7 @@ function clearLegacyOpenCodePluginCache(primaryPath) {
   if (!legacyPath || !existsSync15(legacyPath))
     return { clearedPath: null };
   try {
-    rmSync4(legacyPath, { recursive: true, force: true });
+    rmSync5(legacyPath, { recursive: true, force: true });
     return { clearedPath: legacyPath };
   } catch (error) {
     return { clearedPath: null, error: error instanceof Error ? error.message : String(error) };
@@ -14666,18 +15055,20 @@ class OpenCodeAdapter {
     const configuredEntry = openCodePluginReadKeys(this.configGeneration()).flatMap((key) => Array.isArray(value?.[key]) ? value[key] : []).map(pluginEntryPackage).find(isAftNpmEntry);
     const path = join19(getOpenCodeCacheDir(), "packages", configuredEntry ?? PLUGIN_ENTRY);
     let cached;
+    let readError;
     try {
       const installedPkgPath = join19(path, "node_modules", "@cortexkit", "aft-opencode", "package.json");
-      if (existsSync15(installedPkgPath)) {
-        const pkg = JSON.parse(readFileSync11(installedPkgPath, "utf-8"));
-        cached = typeof pkg.version === "string" ? pkg.version : undefined;
+      const pkg = JSON.parse(readFileSync11(installedPkgPath, "utf-8"));
+      cached = typeof pkg.version === "string" ? pkg.version : undefined;
+    } catch (error) {
+      if (error.code !== "ENOENT") {
+        readError = error instanceof Error ? error.message : String(error);
       }
-    } catch {
-      cached = undefined;
     }
     return {
       path,
       cached,
+      readError,
       latest: getSelfVersion(),
       exists: existsSync15(path),
       configuredEntry
@@ -14719,7 +15110,7 @@ class OpenCodeAdapter {
       };
     }
     try {
-      rmSync4(info.path, { recursive: true, force: true });
+      rmSync5(info.path, { recursive: true, force: true });
       return {
         action: "cleared",
         path: info.path,
@@ -14770,7 +15161,8 @@ var init_opencode = __esm(() => {
 // src/adapters/pi.ts
 import { existsSync as existsSync16, readFileSync as readFileSync12 } from "node:fs";
 import { homedir as homedir16 } from "node:os";
-import { join as join20, resolve as resolve13 } from "node:path";
+import { isAbsolute as isAbsolute7, join as join20, resolve as resolve13 } from "node:path";
+import { fileURLToPath as fileURLToPath2 } from "node:url";
 function getPiAgentDir() {
   const configuredDir = process.env.PI_CODING_AGENT_DIR?.trim();
   if (configuredDir)
@@ -14832,12 +15224,11 @@ function piEntryMatchesAft(entry) {
   let resolved = null;
   if (entry.startsWith("file:")) {
     try {
-      const stripped = entry.slice("file:".length);
-      resolved = stripped.startsWith("//") ? stripped.slice(2) : stripped;
+      resolved = fileURLToPath2(entry);
     } catch {
       return false;
     }
-  } else if (entry.startsWith("/")) {
+  } else if (isAbsolute7(entry)) {
     resolved = entry;
   } else if (entry.length > 0) {
     resolved = join20(getPiAgentDir(), entry);
@@ -14887,7 +15278,7 @@ class PiAdapter {
       const stderr = (result.stderr ?? "").trim();
       const text = stdout || stderr;
       const semverLine = text.split(/\r?\n/).find((l) => /^\d+\.\d+\.\d+/.test(l.trim()));
-      return semverLine?.trim() ?? text ?? null;
+      return semverLine?.trim() ?? (text || null);
     } catch {
       return null;
     }
@@ -14942,29 +15333,37 @@ class PiAdapter {
       };
     }
   }
+  getConfiguredPluginEntry() {
+    return readPiExtensionIndex().installed.find(piEntryMatchesAft);
+  }
   getPluginCacheInfo() {
     const candidates = [
       join20(getPiAgentDir(), "npm", "node_modules", "@cortexkit", "aft-pi", "package.json"),
       join20(getPiAgentDir(), "node_modules", "@cortexkit", "aft-pi", "package.json"),
       join20(getPiAgentDir(), "extensions", "node_modules", "@cortexkit", "aft-pi", "package.json")
     ];
+    let readError;
     for (const candidate of candidates) {
-      if (!existsSync16(candidate))
-        continue;
       try {
         const pkg = JSON.parse(readFileSync12(candidate, "utf-8"));
         const cached = typeof pkg.version === "string" ? pkg.version : undefined;
         return {
           path: candidate,
           cached,
+          readError,
           latest: undefined,
           exists: true
         };
-      } catch {}
+      } catch (error) {
+        if (error.code !== "ENOENT") {
+          readError ??= error instanceof Error ? error.message : String(error);
+        }
+      }
     }
     return {
       path: join20(getPiAgentDir(), "npm", "node_modules", "@cortexkit", "aft-pi", "package.json"),
-      exists: false
+      exists: readError !== undefined,
+      readError
     };
   }
   getStorageDir() {
@@ -16256,7 +16655,7 @@ var init_dist6 = __esm(() => {
 function handleCancel(value, message = "Cancelled.") {
   if (isCancel(value)) {
     log2.warn(message);
-    process.exit(0);
+    process.exit(130);
   }
 }
 async function confirm2(message, defaultYes = true) {
@@ -16639,7 +17038,7 @@ function runConfigFix(run = runNative) {
   try {
     const report = JSON.parse(result.stdout);
     if (Array.isArray(report.files))
-      return { ok: true, files: report.files };
+      return { ok: true, files: report.files, cacheCleanup: report.cache_cleanup };
   } catch {}
   return {
     ok: false,
@@ -17043,7 +17442,7 @@ var init_feature_wizard = __esm(async () => {
   clackIO = {
     selectRows: (message, options, initial, rules) => promptFeatureList(message, options, initial, () => {
       log2.warn("Cancelled.");
-      process.exit(0);
+      process.exit(130);
     }, {}, rules),
     info: (message) => log2.info(message),
     warn: (message) => log2.warn(message),
@@ -17237,68 +17636,76 @@ var init_setup = __esm(async () => {
   ]);
 });
 
-// src/commands/index.ts
-function runIndex(argv) {
-  const binary = findAftBinary();
+// src/lib/native-forward.ts
+import { constants as constants4 } from "node:os";
+function forwardToNative(command, argv) {
+  const version = getSelfVersion();
+  const preferred = /^v?\d+\.\d+\.\d+(?:-[0-9A-Za-z.-]+)?$/.test(version) ? version : undefined;
+  const binary = findAftBinary(preferred);
   if (!binary) {
-    console.error(missingAftBinaryMessage(`${CLI} index`));
+    console.error(missingAftBinaryMessage(`${CLI} ${command}`, preferred));
     return 1;
   }
-  const result = spawnSync(binary, ["index", ...argv], {
-    stdio: "inherit",
-    env: process.env
-  });
+  const result = spawnSync(binary, [command, ...argv], { stdio: "inherit", env: process.env });
   if (result.error) {
-    console.error(`aft index failed to start ${binary}: ${result.error.message}`);
+    console.error(`aft ${command} failed to start ${binary}: ${result.error.message}`);
     return 1;
   }
-  return result.status ?? 1;
+  if (result.status !== null)
+    return result.status;
+  const signal = result.signal ? constants4.signals[result.signal] : undefined;
+  return signal === undefined ? 1 : 128 + signal;
 }
-var init_commands = __esm(async () => {
+var init_native_forward = __esm(async () => {
   init_dist2();
+  init_self_version();
   await init_binary_probe();
 });
 
+// src/commands/index.ts
+function runIndex(argv) {
+  return forwardToNative("index", argv);
+}
+var init_commands = __esm(async () => {
+  await init_native_forward();
+});
+
 // src/commands/backups.ts
 function runBackups(argv) {
-  const binary = findAftBinary();
-  if (!binary) {
-    console.error(missingAftBinaryMessage(`${CLI} backups`));
-    return 1;
-  }
-  const result = spawnSync(binary, ["backups", ...argv], {
-    stdio: "inherit",
-    env: process.env
-  });
-  if (result.error) {
-    console.error(`aft backups failed to start ${binary}: ${result.error.message}`);
-    return 1;
-  }
-  return result.status ?? 1;
+  return forwardToNative("backups", argv);
 }
 var init_backups = __esm(async () => {
-  init_dist2();
-  await init_binary_probe();
+  await init_native_forward();
 });
 
 // src/commands/cache.ts
 function runCache(argv) {
+  return forwardToNative("cache", argv);
+}
+var init_cache = __esm(async () => {
+  await init_native_forward();
+});
+
+// src/commands/clean-old-caches.ts
+function runOldCacheCleanup(argv) {
   const binary = findAftBinary();
   if (!binary) {
-    console.error(missingAftBinaryMessage(`${CLI} cache`));
+    console.error(missingAftBinaryMessage(`${CLI} doctor --clean-old-caches`));
     return 1;
   }
-  const result = spawnSync(binary, ["cache", ...argv], {
+  if (argv.some((arg) => !["--clean-old-caches", "--yes", "--help", "-h"].includes(arg))) {
+    console.error("usage: aft doctor --clean-old-caches [--yes]");
+    return 2;
+  }
+  const result = spawnSync(binary, ["clean-old-caches", ...argv.filter((arg) => arg !== "--clean-old-caches")], {
     stdio: "inherit",
     env: process.env
   });
-  if (result.error) {
-    console.error(`aft cache failed to start ${binary}: ${result.error.message}`);
-    return 1;
-  }
+  if (result.error)
+    console.error(`Old cache cleanup failed to start: ${result.error.message}`);
   return result.status ?? 1;
 }
-var init_cache = __esm(async () => {
+var init_clean_old_caches = __esm(async () => {
   init_dist2();
   await init_binary_probe();
 });
@@ -17413,7 +17820,7 @@ var init_features = __esm(() => {
 // src/doctor/opencode.ts
 import { existsSync as existsSync18, readFileSync as readFileSync13 } from "node:fs";
 import { dirname as dirname11, join as join23 } from "node:path";
-import { fileURLToPath as fileURLToPath2 } from "node:url";
+import { fileURLToPath as fileURLToPath3 } from "node:url";
 function isLoadPath(value) {
   return OPENCODE_LOAD_PATHS.includes(value);
 }
@@ -17460,7 +17867,7 @@ function localPluginRoot(entry) {
     return null;
   if (entry.startsWith("file://")) {
     try {
-      return fileURLToPath2(entry);
+      return fileURLToPath3(entry);
     } catch {
       return null;
     }
@@ -17636,7 +18043,7 @@ async function sendAftRequest(binaryPath, request) {
     throw new Error("aft exited before responding");
   return response;
 }
-async function sendAftRequests(binaryPath, requests) {
+async function sendAftRequests(binaryPath, requests, timeoutMs = 120000) {
   return new Promise((resolve, reject) => {
     const child = spawn(binaryPath, [], {
       stdio: ["pipe", "pipe", "pipe"]
@@ -17646,10 +18053,16 @@ async function sendAftRequests(binaryPath, requests) {
     let noiseLineCount = 0;
     let stderr = "";
     let settled = false;
+    let timedOut = false;
+    const deadline = setTimeout(() => {
+      timedOut = true;
+      child.kill("SIGKILL");
+    }, timeoutMs);
     const finish = (fn) => {
       if (settled)
         return;
       settled = true;
+      clearTimeout(deadline);
       child.kill();
       fn();
     };
@@ -17688,7 +18101,7 @@ async function sendAftRequests(binaryPath, requests) {
     });
     child.stdout.setEncoding("utf-8");
     child.stdout.on("data", (chunk) => {
-      if (settled)
+      if (settled || timedOut)
         return;
       stdoutLines.push(chunk);
     });
@@ -17702,6 +18115,13 @@ async function sendAftRequests(binaryPath, requests) {
     child.on("close", (code) => {
       if (settled)
         return;
+      if (timedOut) {
+        const received = new Set(responses.map((response) => response.id));
+        const pending = requests.filter((request) => !received.has(request.id)).map((request) => request.command);
+        finish(() => reject(new Error(`aft request deadline exceeded; pending: ${pending.join(", ")}.
+${stderr.trim()}`, { cause: { exitCode: code, signal: child.signalCode } })));
+        return;
+      }
       finish(() => reject(buildBridgeError({ binaryPath, code, stderr, noiseLines, noiseLineCount, responses })));
     });
     child.stdin.on("error", () => {});
@@ -17781,14 +18201,14 @@ var init_binary_cache = __esm(() => {
 });
 
 // src/lib/sanitize.ts
-import { realpathSync as realpathSync5 } from "node:fs";
+import { realpathSync as realpathSync6 } from "node:fs";
 import { homedir as homedir17, userInfo } from "node:os";
 function escapeRegex(value) {
   return value.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
 }
 function safeRealpath(p) {
   try {
-    return realpathSync5(p);
+    return realpathSync6(p);
   } catch {
     return null;
   }
@@ -18317,7 +18737,7 @@ var init_legacy_storage = __esm(() => {
 });
 
 // src/lib/lsp-cache.ts
-import { existsSync as existsSync24, readdirSync as readdirSync10, rmSync as rmSync5, statSync as statSync15 } from "node:fs";
+import { existsSync as existsSync24, readdirSync as readdirSync10, rmSync as rmSync6, statSync as statSync15 } from "node:fs";
 import { join as join27 } from "node:path";
 function inspectDir(path) {
   if (!existsSync24(path)) {
@@ -18337,8 +18757,12 @@ function inspectDir(path) {
       if (!statSync15(full).isDirectory())
         continue;
       const size = dirSize(full);
+      let decodedName = name;
+      try {
+        decodedName = decodeURIComponent(name);
+      } catch {}
       entries.push({
-        name: decodeURIComponent(name),
+        name: decodedName,
         path: full,
         size
       });
@@ -18372,7 +18796,7 @@ function clearLspCaches() {
   const report = getLspCacheReport();
   for (const entry of [...report.npm.entries, ...report.github.entries]) {
     try {
-      rmSync5(entry.path, { recursive: true, force: true });
+      rmSync6(entry.path, { recursive: true, force: true });
       result.cleared.push({ name: entry.name, path: entry.path, size: entry.size });
       result.totalBytes += entry.size;
     } catch (err) {
@@ -18390,8 +18814,8 @@ var init_lsp_cache = __esm(() => {
 });
 
 // src/lib/onnx.ts
-import { existsSync as existsSync25, readdirSync as readdirSync11, readlinkSync as readlinkSync2, realpathSync as realpathSync6 } from "node:fs";
-import { basename as basename2, isAbsolute as isAbsolute7, join as join28, resolve as resolve14, win32 as win323 } from "node:path";
+import { existsSync as existsSync25, readdirSync as readdirSync11, readlinkSync as readlinkSync2, realpathSync as realpathSync7 } from "node:fs";
+import { basename as basename2, isAbsolute as isAbsolute8, join as join28, resolve as resolve14, win32 as win323 } from "node:path";
 function getOnnxLibraryName() {
   if (process.platform === "darwin")
     return "libonnxruntime.dylib";
@@ -18427,7 +18851,7 @@ function pathEntriesForPlatform2() {
   return pathEnvValue2().split(delimiter).map((entry) => entry.trim().replace(/^"|"$/g, "")).filter((entry) => {
     if (!entry || entry === "." || entry.includes("\x00"))
       return false;
-    return isAbsolute7(entry) || win323.isAbsolute(entry);
+    return isAbsolute8(entry) || win323.isAbsolute(entry);
   });
 }
 function isWindowsSystem32Directory2(dir) {
@@ -18566,7 +18990,7 @@ function detectOrtVersion(libDir) {
     return null;
   const libName = getOnnxLibraryName();
   try {
-    const resolved = parseOrtVersionFromPath(realpathSync6(join28(libDir, libName)));
+    const resolved = parseOrtVersionFromPath(realpathSync7(join28(libDir, libName)));
     if (resolved && resolved !== INVALID_ORT_VERSION2)
       return resolved;
   } catch {}
@@ -18585,7 +19009,7 @@ function detectOrtVersion(libDir) {
     const base = join28(libDir, libName);
     if (existsSync25(base)) {
       try {
-        const real = realpathSync6(base);
+        const real = realpathSync7(base);
         const version = parseOrtVersionFromPath(real) ?? parseOrtVersionFromDirectoryPath(real);
         if (version)
           return version;
@@ -18617,6 +19041,8 @@ var init_onnx = __esm(() => {
 
 // src/lib/plugin-load.ts
 import { existsSync as existsSync26, readFileSync as readFileSync15 } from "node:fs";
+import { homedir as homedir18 } from "node:os";
+import { isAbsolute as isAbsolute9, join as join29, normalize } from "node:path";
 function isRecord3(value) {
   return typeof value === "object" && value !== null && !Array.isArray(value);
 }
@@ -18639,7 +19065,7 @@ function failsEveryToolCall(toolCallError, scope = "") {
 }
 function withHarness(block, harness) {
   const override = isRecord3(block.harnesses) ? block.harnesses[harness] : undefined;
-  return isRecord3(override) ? { ...block, ...override } : block;
+  return isRecord3(override) ? { ...block, ...override, storage: block.storage } : block;
 }
 function indexesOf(block) {
   return block && isRecord3(block.indexes) ? block.indexes : undefined;
@@ -18696,7 +19122,12 @@ function evaluatePluginLoad(input) {
   const semanticIndex = indexes?.semantic ?? true;
   const userSemantic = loaded.user && isRecord3(loaded.user.semantic) ? loaded.user.semantic : null;
   const semanticBackend = typeof userSemantic?.backend === "string" && userSemantic.backend.length > 0 ? userSemantic.backend : "fastembed";
+  const storage = loaded.user && isRecord3(loaded.user.storage) ? loaded.user.storage : null;
+  const requested = typeof storage?.cache_dir === "string" ? storage.cache_dir : "";
+  const home = input.home ?? homedir18();
+  const expanded = requested === "~" ? home : requested.startsWith("~/") || requested.startsWith("~\\") ? join29(home, requested.slice(2)) : requested;
   return {
+    ...isAbsolute9(expanded) ? { cacheDir: normalize(expanded) } : {},
     blockers,
     semanticIndex,
     semanticBackend,
@@ -18713,12 +19144,13 @@ var init_plugin_load = __esm(() => {
 import {
   accessSync as accessSync3,
   closeSync as closeSync9,
-  constants as constants4,
+  constants as constants5,
   existsSync as existsSync27,
   openSync as openSync9,
   readSync as readSync7,
   statSync as statSync16
 } from "node:fs";
+import { join as join30 } from "node:path";
 async function collectDiagnostics(adapters) {
   const cliVersion = getSelfVersion();
   const binaryVersion = probeBinaryVersion(cliVersion);
@@ -18756,7 +19188,7 @@ async function diagnoseHarness(adapter) {
     if (!existsSync27(storage))
       return false;
     try {
-      accessSync3(storage, constants4.R_OK | constants4.W_OK);
+      accessSync3(storage, constants5.R_OK | constants5.W_OK);
       return true;
     } catch {
       return false;
@@ -18800,6 +19232,7 @@ async function diagnoseHarness(adapter) {
       exists: existsSync27(storage),
       accessible: storageAccessible,
       sizesByKey: describeStorage,
+      ...pluginLoad.cacheDir ? { cacheRoot: join30(pluginLoad.cacheDir, "aft") } : {},
       ...legacyDuplication.totalPartitions > 0 ? { legacyDuplication } : {}
     },
     onnxRuntime: {
@@ -19251,14 +19684,14 @@ var init_issue_body = __esm(() => {
 
 // src/lib/onnx-fix.ts
 import { randomBytes as randomBytes2 } from "node:crypto";
-import { existsSync as existsSync28, mkdirSync as mkdirSync7, renameSync as renameSync5, rmSync as rmSync6 } from "node:fs";
-import { isAbsolute as isAbsolute8, join as join29, relative as relative4 } from "node:path";
+import { existsSync as existsSync28, mkdirSync as mkdirSync7, renameSync as renameSync6, rmSync as rmSync7 } from "node:fs";
+import { isAbsolute as isAbsolute10, join as join31, relative as relative4 } from "node:path";
 function findOnnxFixCandidates(report) {
   const candidates = [];
   for (const harness of report.harnesses) {
     if (!harness.onnxRuntime.required)
       continue;
-    const storageOnnxDir = join29(harness.storageDir.path, "onnxruntime");
+    const storageOnnxDir = join31(harness.storageDir.path, "onnxruntime");
     const systemTooOld = harness.onnxRuntime.systemPath !== null && harness.onnxRuntime.systemCompatible === false;
     const cachedTooOld = harness.onnxRuntime.cachedPath !== null && harness.onnxRuntime.cachedCompatible === false;
     const hasCompatibleCached = harness.onnxRuntime.cachedCompatible === true;
@@ -19297,7 +19730,7 @@ function findOnnxFixCandidates(report) {
 async function installManagedReplacement(candidate, ensureFn, rmFn) {
   const suffix = `${process.pid}.${Date.now().toString(36)}.${randomBytes2(6).toString("hex")}`;
   const stagingStorageDir = `${candidate.harness.storageDir.path}.onnx-fix.tmp.${suffix}`;
-  const stagedOnnxDir = join29(stagingStorageDir, "onnxruntime");
+  const stagedOnnxDir = join31(stagingStorageDir, "onnxruntime");
   const backupDir = `${candidate.storageOnnxDir}.backup.${suffix}`;
   try {
     const stagedInstalledPath = await ensureFn(stagingStorageDir);
@@ -19305,19 +19738,19 @@ async function installManagedReplacement(candidate, ensureFn, rmFn) {
       throw new Error("managed ONNX Runtime download was unavailable");
     }
     const installedRelativePath = relative4(stagedOnnxDir, stagedInstalledPath);
-    if (isAbsolute8(installedRelativePath) || installedRelativePath === ".." || installedRelativePath.startsWith("../") || installedRelativePath.startsWith("..\\")) {
+    if (isAbsolute10(installedRelativePath) || installedRelativePath === ".." || installedRelativePath.startsWith("../") || installedRelativePath.startsWith("..\\")) {
       throw new Error(`managed ONNX Runtime was installed outside staging: ${stagedInstalledPath}`);
     }
     mkdirSync7(candidate.harness.storageDir.path, { recursive: true });
     const hadPrevious = existsSync28(candidate.storageOnnxDir);
     if (hadPrevious)
-      renameSync5(candidate.storageOnnxDir, backupDir);
+      renameSync6(candidate.storageOnnxDir, backupDir);
     try {
-      renameSync5(stagedOnnxDir, candidate.storageOnnxDir);
+      renameSync6(stagedOnnxDir, candidate.storageOnnxDir);
     } catch (installError) {
       if (hadPrevious) {
         try {
-          renameSync5(backupDir, candidate.storageOnnxDir);
+          renameSync6(backupDir, candidate.storageOnnxDir);
         } catch (restoreError) {
           throw new Error(`managed ONNX Runtime replacement failed and the previous runtime could not be restored from ${backupDir}: ${restoreError}`, { cause: installError });
         }
@@ -19333,13 +19766,13 @@ async function installManagedReplacement(candidate, ensureFn, rmFn) {
       }
     }
     return {
-      installedPath: join29(candidate.storageOnnxDir, installedRelativePath),
+      installedPath: join31(candidate.storageOnnxDir, installedRelativePath),
       clearedPrevious: hadPrevious && cleanupError === undefined,
       cleanupError
     };
   } finally {
     try {
-      rmSync6(stagingStorageDir, { recursive: true, force: true });
+      rmSync7(stagingStorageDir, { recursive: true, force: true });
     } catch {}
   }
 }
@@ -19364,7 +19797,7 @@ async function runOnnxFix(adapters, report, options = {}) {
     return null;
   }
   const result = { cleared: 0, installed: 0, bytesReclaimed: 0, errors: [] };
-  const rmFn = options.rmFn ?? rmSync6;
+  const rmFn = options.rmFn ?? rmSync7;
   const ensureFn = options.ensureFn ?? ensureOnnxRuntime;
   for (const candidate of candidates) {
     try {
@@ -19402,21 +19835,24 @@ var init_onnx_fix = __esm(() => {
 // src/lib/session-log.ts
 import { closeSync as closeSync10, openSync as openSync10, readSync as readSync8, statSync as statSync17 } from "node:fs";
 function readSessionLog(path, session, maxBytes = MAX_SCAN_BYTES) {
+  return readLogHistory([path, `${path}.1`], session, maxBytes);
+}
+function readLogHistory(files, session, maxBytes = MAX_SCAN_BYTES) {
   const lines = [];
   const errors = [];
   let remaining = maxBytes;
   let boundHit = false;
-  const bareId = session.id.replace(/^ses_/, "");
+  const bareId = session?.id.replace(/^ses_/, "");
   const selectedTags = [`[ses_${bareId}]`, `[${bareId}]`];
   const tagPattern = /\[ses_[^\]\s]+\]|\[[0-9a-fA-F]{8}(?:-[0-9a-fA-F]{4}){3}-[0-9a-fA-F]{12}\]/;
   const accept = (line) => {
     if (!line)
       return;
     const tag = tagPattern.exec(line)?.[0];
-    if (tag && !selectedTags.includes(tag))
+    if (session && tag && !selectedTags.includes(tag))
       return;
-    if (!tag) {
-      const stamp = /^\[([^\]]+)\]/.exec(line)?.[1];
+    if (session && !tag) {
+      const stamp = /^\[([^\]]+)\]/.exec(line)?.[1] ?? /^(\d{4}-\d{2}-\d{2}T\d{2}:\d{2}:\d{2}\.\d{3}Z) \[aft(?:-lsp)?\] /.exec(line)?.[1];
       const time = stamp ? Date.parse(stamp) : NaN;
       const inWindow = Number.isFinite(time) && (session.startedAt === undefined || time >= session.startedAt) && time <= session.lastActivity;
       if (session.projectRoot) {
@@ -19433,7 +19869,7 @@ function readSessionLog(path, session, maxBytes = MAX_SCAN_BYTES) {
     if (errors.length < 20 && isErrorLogLine(line))
       errors.push(line);
   };
-  for (const file of [path, `${path}.1`]) {
+  for (const file of files) {
     if (remaining <= 0 || lines.length >= 200 && errors.length >= 20)
       break;
     let fd;
@@ -19481,8 +19917,8 @@ var init_session_log = __esm(() => {
 // src/lib/sessions.ts
 import { existsSync as existsSync29, readdirSync as readdirSync12, readFileSync as readFileSync16, statSync as statSync18 } from "node:fs";
 import { createRequire as createRequire4 } from "node:module";
-import { homedir as homedir18 } from "node:os";
-import { basename as basename3, join as join30 } from "node:path";
+import { homedir as homedir19 } from "node:os";
+import { basename as basename3, join as join32 } from "node:path";
 function listRecentSessions(adapter) {
   try {
     if (adapter.kind === "opencode")
@@ -19516,7 +19952,7 @@ function mapOpenCodeSessionRows(rows) {
   }).filter((session) => session !== null).sort((a, b) => b.lastActivity - a.lastActivity).slice(0, MAX_RECENT_SESSIONS);
 }
 function listRecentOpenCodeSessions() {
-  const dbPath = join30(getXdgDataHome(), "opencode", "opencode.db");
+  const dbPath = join32(getXdgDataHome(), "opencode", "opencode.db");
   if (!existsSync29(dbPath))
     return [];
   let db = null;
@@ -19536,14 +19972,14 @@ function listRecentOpenCodeSessions() {
 }
 function getXdgDataHome() {
   const xdgDataHome = process.env.XDG_DATA_HOME;
-  return xdgDataHome && xdgDataHome.length > 0 ? xdgDataHome : join30(homedir18(), ".local", "share");
+  return xdgDataHome && xdgDataHome.length > 0 ? xdgDataHome : join32(homedir19(), ".local", "share");
 }
 function listRecentPiSessions() {
-  return listPiSessionsFromDir(join30(getHomeDir(), ".pi", "agent", "sessions"));
+  return listPiSessionsFromDir(join32(getHomeDir(), ".pi", "agent", "sessions"));
 }
 function getHomeDir() {
   const envHome = process.platform === "win32" ? process.env.USERPROFILE : process.env.HOME;
-  return envHome && envHome.length > 0 ? envHome : homedir18();
+  return envHome && envHome.length > 0 ? envHome : homedir19();
 }
 function listPiSessionsFromDir(sessionsDir) {
   try {
@@ -19585,7 +20021,7 @@ function collectJsonlFiles(root) {
       continue;
     }
     for (const entry of entries) {
-      const path = join30(dir, entry.name);
+      const path = join32(dir, entry.name);
       if (entry.isDirectory()) {
         stack.push(path);
       } else if (entry.isFile() && entry.name.endsWith(".jsonl")) {
@@ -19685,18 +20121,20 @@ var init_sessions = __esm(() => {
 
 // src/commands/doctor.ts
 import {
-  chmodSync as chmodSync3,
+  chmodSync as chmodSync4,
   existsSync as existsSync30,
+  lstatSync as lstatSync5,
   mkdirSync as mkdirSync8,
   mkdtempSync as mkdtempSync2,
+  readdirSync as readdirSync13,
   readFileSync as readFileSync17,
-  realpathSync as realpathSync7,
-  rmSync as rmSync7,
+  realpathSync as realpathSync8,
+  rmSync as rmSync8,
   statSync as statSync19,
   writeFileSync as writeFileSync5
 } from "node:fs";
 import { tmpdir as tmpdir5 } from "node:os";
-import { join as join31 } from "node:path";
+import { dirname as dirname12, join as join33 } from "node:path";
 function openCodeAdapter(adapters) {
   return adapters.find((adapter) => adapter.kind === "opencode");
 }
@@ -20097,8 +20535,8 @@ async function clearDoctorCaches(adapters, targets, options = {}) {
   }
   return summary;
 }
-function clearOldBinaries() {
-  const cliVersion = getSelfVersion();
+function clearOldBinaries(cliVersion = getSelfVersion(), plugins = getAllAdapters()) {
+  const knownVersion = /^(?:v)?\d+\.\d+\.\d+(?:-[0-9A-Za-z.-]+)?$/;
   const keepTag = `v${cliVersion.replace(/^v/, "")}`;
   const info = getBinaryCacheInfo(cliVersion);
   const result = {
@@ -20111,13 +20549,34 @@ function clearOldBinaries() {
     log2.info(`Binary cache: nothing to clear at ${info.path}`);
     return result;
   }
-  const stale = info.versions.filter((v) => v !== keepTag);
+  if (!knownVersion.test(cliVersion)) {
+    result.keptVersion = null;
+    return result;
+  }
+  const retained = new Set([keepTag]);
+  for (const plugin of plugins) {
+    try {
+      const info = plugin.getPluginCacheInfo();
+      if (info.readError !== undefined)
+        return result;
+      const entry = (info.configuredEntry ?? plugin.getConfiguredPluginEntry?.())?.replace(/^npm:/, "");
+      const prefix = `${plugin.pluginPackageName}@`;
+      const pinned = entry?.startsWith(prefix) ? entry.slice(prefix.length) : undefined;
+      for (const version of [info.cached, pinned]) {
+        if (version && knownVersion.test(version))
+          retained.add(`v${version.replace(/^v/, "")}`);
+      }
+    } catch {
+      return result;
+    }
+  }
+  const stale = info.versions.filter((v) => !retained.has(v));
   if (stale.length === 0) {
     log2.info(`Binary cache: only the active version (${keepTag}) is present at ${info.path}; nothing to clear`);
     return result;
   }
   for (const version of stale) {
-    const dir = join31(info.path, version);
+    const dir = join33(info.path, version);
     let bytes = 0;
     try {
       bytes = statSync19(dir).isDirectory() ? dirSize(dir) : 0;
@@ -20125,7 +20584,7 @@ function clearOldBinaries() {
       bytes = 0;
     }
     try {
-      rmSync7(dir, { recursive: true, force: true });
+      rmSync8(dir, { recursive: true, force: true });
       result.cleared += 1;
       result.bytesReclaimed += bytes;
       log2.success(`Binary cache: cleared ${dir} (reclaimed ${formatBytes(bytes)})`);
@@ -20277,7 +20736,7 @@ async function runDoctorNpmInstall(npm, installDir) {
   });
 }
 function installedPluginVersion(installDir) {
-  const manifest = join31(installDir, "node_modules", ...AFT_OPENCODE_PACKAGE.split("/"), "package.json");
+  const manifest = join33(installDir, "node_modules", ...AFT_OPENCODE_PACKAGE.split("/"), "package.json");
   try {
     const pkg = JSON.parse(readFileSync17(manifest, "utf-8"));
     return typeof pkg.version === "string" ? pkg.version : null;
@@ -20695,6 +21154,22 @@ function applyConfigMigration(run, binaryDownloadFailed = false, targets = []) {
     for (const line of file.notes)
       log2.warn(`  ${line}`);
   }
+  for (const path of result.cacheCleanup?.removed ?? []) {
+    changed += 1;
+    log2.success(`Removed inactive rebuildable cache ${path}`);
+  }
+  for (const skipped of result.cacheCleanup?.skipped ?? [])
+    log2.warn(`Inactive cache retained: ${skipped}`);
+  for (const partial of result.cacheCleanup?.partial ?? []) {
+    changed += 1;
+    log2.warn(`Partially cleared ${partial.path}: removed ${partial.removed_entries} file/directory entries before repair stopped`);
+  }
+  for (const warning of result.cacheCleanup?.warnings ?? [])
+    log2.warn(warning);
+  if (result.cacheCleanup?.error) {
+    errors += 1;
+    log2.error(`Inactive cache cleanup refused: ${result.cacheCleanup.error}`);
+  }
   return { changed, errors };
 }
 function logDoctorIssues(report, heading) {
@@ -20719,7 +21194,28 @@ function logDoctorIssues(report, heading) {
 function formatDoctorStorageStatus(h) {
   const state = h.storageDir.exists ? h.storageDir.path : `${h.storageDir.path} (${h.pluginRegistered ? "not yet created (lazy — created on first tool call)" : "not created"})`;
   const legacyDuplication = formatLegacyDuplication(h.storageDir.legacyDuplication);
-  return `${state} (${[formatStorageSizes(h.storageDir.sizesByKey), legacyDuplication].filter((part) => Boolean(part)).join("; ")})`;
+  let cacheWarning = "";
+  if (h.storageDir.cacheRoot) {
+    try {
+      const parent = realpathSync8(dirname12(h.storageDir.cacheRoot));
+      let durable = h.storageDir.path;
+      while (!existsSync30(durable) && dirname12(durable) !== durable)
+        durable = dirname12(durable);
+      let registered = false;
+      const history = join33(h.storageDir.path, "retention/cache-parents.json");
+      if (existsSync30(history)) {
+        const saved = JSON.parse(readFileSync17(history, "utf8"));
+        registered = saved.parents?.some((entry) => entry.path === parent) === true;
+      }
+      if (!registered && statSync19(parent).dev === statSync19(durable).dev) {
+        cacheWarning = "; cache_dir_on_storage_device: first enrollment requires another volume";
+      }
+    } catch {}
+  }
+  return `${state}${h.storageDir.cacheRoot ? `; cache root: ${h.storageDir.cacheRoot} (configured; unavailable roots disable caches)${cacheWarning}` : ""} (${[
+    formatStorageSizes(h.storageDir.sizesByKey),
+    legacyDuplication
+  ].filter((part) => Boolean(part)).join("; ")})`;
 }
 async function confirmBinaryDownloadDespitePluginSkew(report, argv) {
   const skews = findPluginCliVersionSkews(report);
@@ -20911,18 +21407,18 @@ function deriveIssueTitleFromBody(body) {
 function writeIssueReviewFile(body) {
   let reviewDir = null;
   try {
-    reviewDir = mkdtempSync2(join31(tmpdir5(), "aft-issue-"));
+    reviewDir = mkdtempSync2(join33(tmpdir5(), "aft-issue-"));
     if (process.platform !== "win32") {
-      chmodSync3(reviewDir, 448);
+      chmodSync4(reviewDir, 448);
     }
-    const outPath = join31(reviewDir, "issue.md");
+    const outPath = join33(reviewDir, "issue.md");
     writeFileSync5(outPath, `${body}
 `, { encoding: "utf8", mode: 384, flag: "wx" });
-    return { path: outPath, realPath: realpathSync7(outPath) };
+    return { path: outPath, realPath: realpathSync8(outPath) };
   } catch (err) {
     if (reviewDir) {
       try {
-        rmSync7(reviewDir, { recursive: true, force: true });
+        rmSync8(reviewDir, { recursive: true, force: true });
       } catch {}
     }
     log2.error(`Failed to write sanitized issue report: ${err instanceof Error ? err.message : String(err)}`);
@@ -20931,7 +21427,7 @@ function writeIssueReviewFile(body) {
 }
 function readReviewedIssueFile(reviewFile) {
   try {
-    const realPath = realpathSync7(reviewFile.path);
+    const realPath = realpathSync8(reviewFile.path);
     if (realPath !== reviewFile.realPath) {
       log2.error(`Review file path changed before filing; refusing to read ${reviewFile.path}.`);
       return null;
@@ -20980,6 +21476,31 @@ function collectIssueLog(path, selectedSession) {
 `)
   };
 }
+function collectIssueEngineLog(path, selectedSession) {
+  const directory = dirname12(path);
+  const files = [];
+  try {
+    for (const name of readdirSync13(directory)) {
+      if (!/^aft-\d+\.log(?:\.1)?$/.test(name))
+        continue;
+      try {
+        const candidate = join33(directory, name);
+        const stat = lstatSync5(candidate);
+        if (stat.isFile())
+          files.push({ path: candidate, modified: stat.mtimeMs });
+      } catch {}
+    }
+  } catch {}
+  files.sort((a, b) => b.modified - a.modified || a.path.localeCompare(b.path));
+  const result = readLogHistory(files.map((file) => file.path), selectedSession);
+  return {
+    logText: result.lines.join(`
+`),
+    errors: result.errors.join(`
+`),
+    notice: result.boundHit ? "[scan limit reached; older engine lines may be missing]" : ""
+  };
+}
 async function runIssueFlow(argv) {
   intro(`${CLI} doctor --issue`);
   if (!isInteractiveTerminal()) {
@@ -20998,19 +21519,32 @@ async function runIssueFlow(argv) {
   const selectedSession = await promptForIssueSession(adapters[0]);
   const selectedBareSessionId = selectedSession?.id.replace(/^ses_/, "") ?? null;
   const report = await collectDiagnostics(adapters);
-  const logResults = adapters.map((adapter) => {
+  const logResults = adapters.flatMap((adapter) => {
     const path = adapter.getLogFile();
     const { logText, errors, notice } = collectIssueLog(path, selectedSession);
-    return {
-      section: `#### ${adapter.displayName} log (${path})
+    const engine = collectIssueEngineLog(path, selectedSession);
+    return [
+      {
+        section: `#### ${adapter.displayName} log (${path})
 
 ${notice}
 \`\`\`
 ${logText || "<no log output>"}
 \`\`\`
 `,
-      errors
-    };
+        errors
+      },
+      {
+        section: `#### Engine logs (${dirname12(path)})
+
+${engine.notice}
+\`\`\`
+${engine.logText || "<no log output>"}
+\`\`\`
+`,
+        errors: engine.errors
+      }
+    ];
   });
   const logSections = logResults.map((result) => result.section).join(`
 `);
@@ -21039,7 +21573,7 @@ ${logText || "<no log output>"}
     "",
     toolFailuresSection,
     "",
-    selectedSession ? `## Logs (last 200 lines for session ${selectedSession.id}; project ${selectedSession.projectRoot ?? "unknown"}, ${selectedSession.startedAt !== undefined ? new Date(selectedSession.startedAt).toISOString() : "unknown start"}–${new Date(selectedSession.lastActivity).toISOString()})` : "## Logs (last 200 lines per harness)",
+    selectedSession ? `## Logs (last 200 lines per source for session ${selectedSession.id}; project ${selectedSession.projectRoot ?? "unknown"}, ${selectedSession.startedAt !== undefined ? new Date(selectedSession.startedAt).toISOString() : "unknown start"}–${new Date(selectedSession.lastActivity).toISOString()})` : "## Logs (last 200 lines per source)",
     logSections,
     "_Usernames and home paths have been stripped from this report._"
   ].join(`
@@ -21092,6 +21626,7 @@ https://github.com/cortexkit/aft/issues/new and paste the contents of ${outPath}
 var DOCTOR_CLEAR_TARGET_OPTIONS, DOCTOR_FORCE_CLEAR_TARGETS;
 var init_doctor = __esm(async () => {
   init_dist2();
+  init_adapters();
   init_opencode();
   init_features();
   init_opencode2();
@@ -21142,24 +21677,24 @@ var init_doctor = __esm(async () => {
 });
 
 // src/commands/lsp.ts
-import { existsSync as existsSync31, readdirSync as readdirSync13, statSync as statSync20 } from "node:fs";
+import { existsSync as existsSync31, readdirSync as readdirSync14, statSync as statSync20 } from "node:fs";
 import { createRequire as createRequire5 } from "node:module";
-import { dirname as dirname12, join as join32, resolve as resolve15 } from "node:path";
+import { dirname as dirname13, join as join34, resolve as resolve15 } from "node:path";
 function findProjectRootForFile(filePath, fallbackCwd = process.cwd()) {
   const resolvedFile = resolve15(fallbackCwd, filePath);
-  let dir = dirname12(resolvedFile);
+  let dir = dirname13(resolvedFile);
   try {
     if (existsSync31(resolvedFile) && statSync20(resolvedFile).isDirectory()) {
       dir = resolvedFile;
     }
   } catch {
-    dir = dirname12(resolvedFile);
+    dir = dirname13(resolvedFile);
   }
   while (true) {
-    if (PROJECT_ROOT_MARKERS.some((marker) => existsSync31(join32(dir, marker)))) {
+    if (PROJECT_ROOT_MARKERS.some((marker) => existsSync31(join34(dir, marker)))) {
       return dir;
     }
-    const parent = dirname12(dir);
+    const parent = dirname13(dir);
     if (parent === dir)
       return resolve15(fallbackCwd);
     dir = parent;
@@ -21305,10 +21840,10 @@ function buildConfigureParams(adapter, projectRoot) {
 function inferLspPathsExtra(_lsp) {
   const paths = new Set;
   for (const entry of childDirs(getAftLspPackagesDir())) {
-    paths.add(join32(entry, "node_modules", ".bin"));
+    paths.add(join34(entry, "node_modules", ".bin"));
   }
   for (const entry of childDirs(getAftLspBinariesDir())) {
-    paths.add(join32(entry, "bin"));
+    paths.add(join34(entry, "bin"));
   }
   return [...paths];
 }
@@ -21316,7 +21851,7 @@ function childDirs(path) {
   if (!existsSync31(path))
     return [];
   try {
-    return readdirSync13(path).map((entry) => join32(path, entry)).filter((entry) => {
+    return readdirSync14(path).map((entry) => join34(path, entry)).filter((entry) => {
       try {
         return statSync20(entry).isDirectory();
       } catch {
@@ -21360,7 +21895,7 @@ function typescriptPackageWarning(response) {
   if (!typescriptServerSpawned || !response.project_root || diagnosticsCount > 0)
     return null;
   try {
-    createRequire5(join32(response.project_root, "package.json")).resolve("typescript");
+    createRequire5(join34(response.project_root, "package.json")).resolve("typescript");
     return null;
   } catch {
     return "typescript package not resolvable from project — server will produce no diagnostics";
@@ -21660,7 +22195,7 @@ function printHelp() {
   console.log("    doctor           Check and fix configuration issues");
   console.log("    doctor --profile [seconds]  Profile a running AFT daemon");
   console.log("    doctor lsp <file> Inspect LSP setup for one file");
-  console.log("    doctor --fix     Auto-fix common issues (e.g. ONNX Runtime mismatch, retired config keys)");
+  console.log("    doctor --fix     Auto-fix common issues (e.g. ONNX Runtime mismatch, retired config keys)", "    doctor --clean-old-caches  Confirm removal of old storage-root caches after moving them");
   console.log("    doctor --reconfigure  Rerun the feature wizard");
   console.log("    --verbose        Also print AFT's internal log lines (always kept in aft-cli.log)");
   console.log("    doctor --clear   Select caches to clear with an interactive prompt");
@@ -21708,6 +22243,10 @@ async function main() {
     return runCache(args);
   }
   if (command === "doctor") {
+    if (args.includes("--clean-old-caches")) {
+      await init_clean_old_caches();
+      return runOldCacheCleanup(args);
+    }
     if (args.includes("--profile")) {
       await init_doctor();
       return runDoctorProfile(args);