@cortexkit/aft 0.63.5 → 0.65.0

package/dist/index.js

@@ -263,10 +263,87 @@ function relativePathEscapesRoot(rel, platform = process.platform) {
 }
 var init_path_display = () => {};
 
+// ../aft-bridge/dist/wait-clock.js
+class WaitClock {
+  wallNow;
+  awakeNow;
+  wall;
+  awake;
+  skew = 0;
+  elapsed;
+  suspendCount = 0;
+  lastSuspendEnd = Number.NEGATIVE_INFINITY;
+  constructor(wallNow = Date.now, awakeNow = () => performance.now()) {
+    this.wallNow = wallNow;
+    this.awakeNow = awakeNow;
+    this.wall = wallNow();
+    this.awake = awakeNow();
+    this.elapsed = this.awake;
+  }
+  now() {
+    const wall = this.wallNow();
+    const awake = this.awakeNow();
+    const active = Math.max(0, awake - this.awake);
+    this.skew = Math.max(0, this.skew + wall - this.wall - active);
+    this.elapsed += active;
+    if (this.skew >= SUSPEND_SKEW_MS) {
+      this.elapsed += this.skew;
+      this.lastSuspendEnd = this.elapsed;
+      this.skew = 0;
+      this.suspendCount++;
+    }
+    this.wall = wall;
+    this.awake = awake;
+    return this.elapsed;
+  }
+}
+
+class RequestDeadline {
+  clock;
+  allowResume;
+  deadline;
+  suspendCount;
+  resumed = false;
+  constructor(clock, timeoutMs, allowResume = true) {
+    this.clock = clock;
+    this.allowResume = allowResume;
+    this.deadline = clock.now() + timeoutMs;
+    this.suspendCount = clock.suspendCount;
+  }
+  remaining() {
+    const now = this.clock.now();
+    if (now >= this.deadline && this.allowResume && !this.resumed && this.clock.suspendCount > this.suspendCount && this.clock.lastSuspendEnd >= this.deadline) {
+      this.resumed = true;
+      this.deadline = now + RESUME_ALLOWANCE_MS;
+    }
+    return Math.max(0, this.deadline - now);
+  }
+}
+var SUSPEND_SKEW_MS = 1000, RESUME_ALLOWANCE_MS = 1e4, DEADLINE_POLL_MS = 250;
+
 // ../aft-bridge/dist/bash-hints.js
+function abortableSleep(ms, signal) {
+  if (signal?.aborted)
+    return Promise.resolve();
+  return new Promise((resolve) => {
+    const done = () => {
+      clearTimeout(timer);
+      signal?.removeEventListener("abort", done);
+      resolve();
+    };
+    const timer = setTimeout(done, ms);
+    signal?.addEventListener("abort", done, { once: true });
+  });
+}
+var watchClock;
 var init_bash_hints = __esm(() => {
   init_bash_format();
   init_path_display();
+  watchClock = {
+    source: new WaitClock,
+    now: () => watchClock.source.now(),
+    sleep: abortableSleep
+  };
 });
 
 // ../aft-bridge/dist/test-child-environment.js
@@ -498,12 +575,13 @@ function resolvePluginLogPath(context = {}) {
 var init_storage_paths = () => {};
 
 // ../aft-bridge/dist/bash-host-fallback.js
-var BASH_HOST_FALLBACK_MAX_OUTPUT_BYTES, BASH_HOST_FALLBACK_MAX_TIMEOUT_MS;
+var BASH_HOST_FALLBACK_MAX_OUTPUT_BYTES, BASH_HOST_FALLBACK_MAX_TIMEOUT_MS, BASH_RUNON_MEMORY_DESCRIPTION = "On Linux, add `,Ngb` to ask for N GiB of memory, for example `linux,2c,16gb` for a Rust build.", BASH_RUNON_DESCRIPTION;
 var init_bash_host_fallback = __esm(() => {
   init_child_process();
   init_storage_paths();
   BASH_HOST_FALLBACK_MAX_OUTPUT_BYTES = 100 * 1024;
   BASH_HOST_FALLBACK_MAX_TIMEOUT_MS = 10 * 60 * 1000;
+  BASH_RUNON_DESCRIPTION = 'Run on a remote build server: `linux` (2 vCPUs), or `linux,Nc` for N vCPUs such as `linux,8c`; add ",net" for outbound internet (offline by default). `windows` runs the command in Git Bash on a Windows build machine (no vCPU or network options). `macos` sends the command to a macOS machine for builds and tests that need macOS (no vCPU or network options).' + ` ${BASH_RUNON_MEMORY_DESCRIPTION}`;
 });
 // ../aft-bridge/dist/bash-permissions.js
 var init_bash_permissions = __esm(() => {
@@ -881,6 +959,7 @@ var init_bridge = __esm(() => {
   binaryFingerprintAsyncReader = binaryContentHash;
   SYSTEM_CLOCK = {
     now: () => Date.now(),
+    awakeNow: () => performance.now(),
     setTimeout: (callback, ms) => setTimeout(callback, ms),
     clearTimeout: (timer) => clearTimeout(timer)
   };
@@ -960,6 +1039,7 @@ var init_bridge = __esm(() => {
     hangWindowMinMs;
     hangProbeTimeoutMs;
     clock;
+    waitClock;
     lateShellReplyGraceMs;
     maxRestarts;
     configured = false;
@@ -996,6 +1076,7 @@ var init_bridge = __esm(() => {
       this.hangWindowMinMs = options?.hangWindowMinMs ?? DEFAULT_MIN_HANG_WINDOW_MS;
       this.hangProbeTimeoutMs = options?.hangProbeTimeoutMs ?? DEFAULT_HANG_PROBE_TIMEOUT_MS;
       this.clock = options?.clock ?? SYSTEM_CLOCK;
+      this.waitClock = new WaitClock(() => this.clock.now(), () => this.clock.awakeNow?.() ?? this.clock.now());
       this.lateShellReplyGraceMs = options?.lateShellReplyGraceMs ?? DEFAULT_LATE_SHELL_REPLY_GRACE_MS;
       this.maxRestarts = options?.maxRestarts ?? 3;
       this.errorPrefix = options?.errorPrefix ?? "[aft-bridge]";
@@ -1362,11 +1443,17 @@ var init_bridge = __esm(() => {
         const keepBridgeOnTimeout = passive || command === "bash_drain_completions" || options?.keepBridgeOnTimeout === true;
         const child = this.process;
         const response = await new Promise((resolve, reject) => {
-          const timer = this.clock.setTimeout(() => {
+          const deadline = new RequestDeadline(this.waitClock, effectiveTimeoutMs);
+          const expire = () => {
             const entry = this.pending.get(id);
             if (!entry)
               return;
-            if (keepBridgeOnTimeout && this.holdForLateShellReply(id, entry, effectiveTimeoutMs, requestSessionId)) {
+            const remaining = deadline.remaining();
+            if (remaining > 0) {
+              entry.timer = this.clock.setTimeout(expire, Math.min(remaining, DEADLINE_POLL_MS));
+              return;
+            }
+            if (keepBridgeOnTimeout && !deadline.resumed && this.holdForLateShellReply(id, entry, effectiveTimeoutMs, requestSessionId)) {
               return;
             }
             this.pending.delete(id);
@@ -1379,11 +1466,12 @@ var init_bridge = __esm(() => {
               this.warnVia(timeoutMsg);
             }
             if (keepBridgeOnTimeout) {
-              entry.reject(new BridgeTransportTimeoutError(command, effectiveTimeoutMs, `${this.errorPrefix} Request "${command}" (id=${id}) timed out after ${effectiveTimeoutMs}ms`));
+              entry.reject(new BridgeTransportTimeoutError(command, effectiveTimeoutMs, `${this.errorPrefix} Request "${command}" (id=${id}) timed out after ${effectiveTimeoutMs}ms`, deadline.resumed && SHELL_TASK_COMMANDS.has(command) ? { kind: "unknown" } : undefined));
               return;
             }
             entry.reject(new Error(`${this.errorPrefix} request "${command}" timed out after ${effectiveTimeoutMs}ms (bridge busy/under load); bridge kept warm — retry. A timed-out mutation may still complete; inspect before repeating it.`));
-          }, effectiveTimeoutMs);
+          };
+          const timer = this.clock.setTimeout(expire, Math.min(effectiveTimeoutMs, DEADLINE_POLL_MS));
           const entry = {
             resolve,
             reject,
@@ -1939,14 +2027,21 @@ var init_bridge = __esm(() => {
       };
       entry.resolve = (response) => settle(shellOutcomeFromLateReply(response));
       this.clock.clearTimeout(entry.timer);
-      entry.timer = this.clock.setTimeout(() => {
+      const deadline = new RequestDeadline(this.waitClock, graceMs, false);
+      const expire = () => {
         if (this.pending.get(id) !== entry)
           return;
+        const remaining = deadline.remaining();
+        if (remaining > 0) {
+          entry.timer = this.clock.setTimeout(expire, Math.min(remaining, DEADLINE_POLL_MS));
+          return;
+        }
         this.pending.delete(id);
         entry.onSettled?.();
         this.warnVia(`Request "${entry.command}" (id=${id}) got no reply within ${graceMs}ms after its deadline`);
         settle({ kind: "unknown" });
-      }, graceMs);
+      };
+      entry.timer = this.clock.setTimeout(expire, Math.min(graceMs, DEADLINE_POLL_MS));
       return true;
     }
     accountForBashTaskResponse(command, response) {
@@ -2289,7 +2384,10 @@ function readConfigTiers(opts) {
 var init_config_tiers = () => {};
 
 // ../aft-bridge/dist/config-watch.js
-var init_config_watch = () => {};
+var CONFIG_READ_LIMIT;
+var init_config_watch = __esm(() => {
+  CONFIG_READ_LIMIT = 1024 * 1024;
+});
 
 // ../aft-bridge/dist/platform.js
 var PLATFORM_ARCH_MAP, PLATFORM_ASSET_MAP;
@@ -2836,10 +2934,11 @@ var init_durable_log = __esm(() => {
   init_storage_paths();
   DEFAULT_LOG_BYTES = 32 * 1024 * 1024;
 });
-// ../../node_modules/.bun/@cortexkit+subc-client@0.21.2/node_modules/@cortexkit/subc-client/dist/envelope.js
-var MAX_FRAME_BODY_LEN, FrameType, FRAME_TYPE_MAX, Priority, AdmissionClass;
+// ../../node_modules/.bun/@cortexkit+subc-client@0.24.5/node_modules/@cortexkit/subc-client/dist/envelope.js
+var MAX_FRAME_BODY_LEN, MAX_DELIVERED_FRAME_LEN, FrameType, FRAME_TYPE_MAX, Priority, AdmissionClass;
 var init_envelope = __esm(() => {
   MAX_FRAME_BODY_LEN = 64 * 1024 * 1024;
+  MAX_DELIVERED_FRAME_LEN = 4 * 1024 * 1024;
   (function(FrameType) {
     FrameType[FrameType["Request"] = 0] = "Request";
     FrameType[FrameType["Response"] = 1] = "Response";
@@ -2867,7 +2966,7 @@ var init_envelope = __esm(() => {
   })(AdmissionClass || (AdmissionClass = {}));
 });
 
-// ../../node_modules/.bun/@cortexkit+subc-client@0.21.2/node_modules/@cortexkit/subc-client/dist/socket.js
+// ../../node_modules/.bun/@cortexkit+subc-client@0.24.5/node_modules/@cortexkit/subc-client/dist/socket.js
 var WRITE_BORROWED, WRITE_TRACKED_BORROWED;
 var init_socket = __esm(() => {
   init_envelope();
@@ -2875,17 +2974,17 @@ var init_socket = __esm(() => {
   WRITE_TRACKED_BORROWED = Symbol("subc.socket.writeTrackedBorrowed");
 });
 
-// ../../node_modules/.bun/@cortexkit+subc-client@0.21.2/node_modules/@cortexkit/subc-client/dist/auth.js
+// ../../node_modules/.bun/@cortexkit+subc-client@0.24.5/node_modules/@cortexkit/subc-client/dist/auth.js
 var init_auth = __esm(() => {
   init_socket();
 });
 
-// ../../node_modules/.bun/@cortexkit+subc-client@0.21.2/node_modules/@cortexkit/subc-client/dist/connection-file.js
+// ../../node_modules/.bun/@cortexkit+subc-client@0.24.5/node_modules/@cortexkit/subc-client/dist/connection-file.js
 var init_connection_file = __esm(() => {
   init_envelope();
 });
 
-// ../../node_modules/.bun/@cortexkit+subc-client@0.21.2/node_modules/@cortexkit/subc-client/dist/launch-nonce.js
+// ../../node_modules/.bun/@cortexkit+subc-client@0.24.5/node_modules/@cortexkit/subc-client/dist/launch-nonce.js
 var PROCESS_CELL_KEY, U64_MAX, I32_MAX, RedactedLaunchNonce;
 var init_launch_nonce = __esm(() => {
   PROCESS_CELL_KEY = Symbol.for("@cortexkit/subc-client/launch-nonce/v1");
@@ -2910,15 +3009,14 @@ var init_launch_nonce = __esm(() => {
     }
   };
 });
-
-// ../../node_modules/.bun/@cortexkit+subc-client@0.21.2/node_modules/@cortexkit/subc-client/dist/route-handle.js
+// ../../node_modules/.bun/@cortexkit+subc-client@0.24.5/node_modules/@cortexkit/subc-client/dist/route-handle.js
 var connectionToken, reverseRequests;
 var init_route_handle = __esm(() => {
   connectionToken = new WeakMap;
   reverseRequests = new WeakMap;
 });
 
-// ../../node_modules/.bun/@cortexkit+subc-client@0.21.2/node_modules/@cortexkit/subc-client/dist/client.js
+// ../../node_modules/.bun/@cortexkit+subc-client@0.24.5/node_modules/@cortexkit/subc-client/dist/client.js
 import { debuglog } from "node:util";
 var debug, EMPTY_BODY, errorFrameFlags, SCOPE_ROUTE_CLOSE_REASONS, ROUTE_OPEN_ADMISSION_PRESSURE_REASONS;
 var init_client = __esm(() => {
@@ -2940,8 +3038,7 @@ var init_client = __esm(() => {
   ]);
   ROUTE_OPEN_ADMISSION_PRESSURE_REASONS = new Set(["open_admission_full", "target_binds_full"]);
 });
-
-// ../../node_modules/.bun/@cortexkit+subc-client@0.21.2/node_modules/@cortexkit/subc-client/dist/provider.js
+// ../../node_modules/.bun/@cortexkit+subc-client@0.24.5/node_modules/@cortexkit/subc-client/dist/provider.js
 var init_provider = __esm(() => {
   init_auth();
   init_client();
@@ -2952,7 +3049,7 @@ var init_provider = __esm(() => {
   init_socket();
 });
 
-// ../../node_modules/.bun/@cortexkit+subc-client@0.21.2/node_modules/@cortexkit/subc-client/dist/index.js
+// ../../node_modules/.bun/@cortexkit+subc-client@0.24.5/node_modules/@cortexkit/subc-client/dist/index.js
 var init_dist = __esm(() => {
   init_client();
   init_route_handle();
@@ -3539,6 +3636,45 @@ function dropNoEffectPaths(map, prefix, out) {
     }
   }
 }
+function retiredIdleCheckoutHours(value) {
+  const raw = typeof value === "number" && Number.isSafeInteger(value) ? value : IDLE_CHECKOUT_HOURS_DEFAULT;
+  return Math.min(IDLE_CHECKOUT_HOURS_MAX, Math.max(IDLE_CHECKOUT_HOURS_MIN, raw));
+}
+function translateDataLayerPaths(map, prefix, out) {
+  const [retired, replacement] = RETIRED_IDLE_CHECKOUT_HOURS;
+  const hours = takeNested(map, "views", "idle_checkout_hours");
+  if (hours.found) {
+    recordRetired(out, prefix, retired);
+    if (isRecord(map.idle) && map.idle.checkout_hours !== undefined) {
+      superseded(out, `${prefix}${retired}`, `${retired} is ignored because ${replacement} is set`);
+    } else {
+      if (!Object.hasOwn(map, "idle"))
+        map.idle = {};
+      if (isRecord(map.idle))
+        map.idle.checkout_hours = retiredIdleCheckoutHours(hours.value);
+    }
+  }
+  for (const path of REMOVED_DATA_LAYER_PATHS) {
+    const [container, leaf] = path.split(".");
+    if (container && leaf && takeNested(map, container, leaf).found)
+      recordRetired(out, prefix, path);
+  }
+}
+function dropRemovedDataLayerKeys(map) {
+  const blocks = [map];
+  if (isRecord(map.harnesses)) {
+    for (const block of Object.values(map.harnesses))
+      if (isRecord(block))
+        blocks.push(block);
+  }
+  for (const block of blocks) {
+    for (const path of REMOVED_DATA_LAYER_PATHS) {
+      const [container, leaf] = path.split(".");
+      if (container && leaf)
+        takeNested(block, container, leaf);
+    }
+  }
+}
 function translateExperimentalPaths(map, prefix, out) {
   for (const [oldKey, leaf] of [
     ["experimental_lsp_ty", "lsp_ty"],
@@ -3571,23 +3707,25 @@ function translateExperimentalPaths(map, prefix, out) {
   const experimental = map.experimental;
   const legacy = experimental.bash;
   if (isRecord(legacy)) {
-    if (!["rewrite", "compress", "background"].some((leaf) => Object.hasOwn(legacy, leaf)))
-      return;
+    if (Object.keys(legacy).length === 0)
+      recordRetired(out, prefix, "experimental.bash");
     for (const leaf of Object.keys(legacy))
       recordRetired(out, prefix, `experimental.bash.${leaf}`);
     if (Object.hasOwn(map, "bash")) {
       superseded(out, "experimental.bash", 'experimental.bash is ignored because top-level "bash" is already set');
     } else {
-      const bash = {
-        rewrite: legacy.rewrite === true,
-        compress: legacy.compress === true,
-        background: legacy.background === true
-      };
+      const bash = {};
+      if (["rewrite", "compress", "background"].some((leaf) => Object.hasOwn(legacy, leaf))) {
+        bash.rewrite = legacy.rewrite === true;
+        bash.compress = legacy.compress === true;
+        bash.background = legacy.background === true;
+      }
       for (const leaf of ["long_running_reminder_enabled", "long_running_reminder_interval_ms"]) {
         if (Object.hasOwn(legacy, leaf))
           bash[leaf] = legacy[leaf];
       }
-      map.bash = bash;
+      if (Object.keys(bash).length > 0)
+        map.bash = bash;
     }
   } else {
     recordRetired(out, prefix, "experimental.bash");
@@ -3600,6 +3738,7 @@ function translateBlock(map, userBase, blockLabel, out) {
   const prefix = blockLabel === "base" ? "" : `${blockLabel}.`;
   translateGithubAliases(map, prefix, out);
   translateInspectLspPaths(map, prefix, out);
+  translateDataLayerPaths(map, prefix, out);
   dropNoEffectPaths(map, prefix, out);
   translateExperimentalPaths(map, prefix, out);
   if (isRecord(map.sandbox) && Object.hasOwn(map.sandbox, "enabled")) {
@@ -3638,8 +3777,6 @@ function translateBlock(map, userBase, blockLabel, out) {
     });
   }
   for (const [path] of RETIRED_PATHS) {
-    if (path === "experimental.bash")
-      continue;
     if (hasPath(map, path))
       recordRetired(out, prefix, path);
   }
@@ -3808,7 +3945,7 @@ function mergeIndexes(base, override, restricted) {
   }
   return merged;
 }
-var CANONICAL_TOOLS, HOST_TOOL_NAMES, DEFAULT_DISABLED_TOOLS, LEGACY_TOOL_ALIASES, RETIRED_PATHS, INDEX_INPUTS, LSP_IDLE_MINUTES_DEFAULT = 60, LSP_IDLE_MINUTES_MIN = 5, LSP_IDLE_MINUTES_MAX = 1440, REMOVED_NO_EFFECT_PATHS, RETIRED_ENABLED_FALSE_INDEXES_NOTE = "enabled: false no longer turns AFT off: it is translated to disabling every tool, but the trigram, semantic and callgraph indexes still build. To keep AFT from indexing this repository, also set indexes.trigram, indexes.semantic and indexes.callgraph to false.", SEMANTIC_COST_NOTICE_DIGEST, SECURITY_CONFIG_SECTIONS;
+var CANONICAL_TOOLS, HOST_TOOL_NAMES, DEFAULT_DISABLED_TOOLS, LEGACY_TOOL_ALIASES, REMOVED_DATA_LAYER_PATHS, RETIRED_IDLE_CHECKOUT_HOURS, IDLE_CHECKOUT_HOURS_DEFAULT = 168, IDLE_CHECKOUT_HOURS_MIN = 1, IDLE_CHECKOUT_HOURS_MAX, AFT_PACKAGE_NAMES, RETIRED_PATHS, INDEX_INPUTS, LSP_IDLE_MINUTES_DEFAULT = 60, LSP_IDLE_MINUTES_MIN = 5, LSP_IDLE_MINUTES_MAX = 1440, REMOVED_NO_EFFECT_PATHS, RETIRED_ENABLED_FALSE_INDEXES_NOTE = "enabled: false no longer turns AFT off: it is translated to disabling every tool, but the trigram, semantic and callgraph indexes still build. To keep AFT from indexing this repository, also set indexes.trigram, indexes.semantic and indexes.callgraph to false.", SEMANTIC_COST_NOTICE_DIGEST, SECURITY_CONFIG_SECTIONS;
 var init_feature_config = __esm(() => {
   CANONICAL_TOOLS = [
     "aft_callgraph",
@@ -3854,6 +3991,22 @@ var init_feature_config = __esm(() => {
     aft_glob: "glob",
     aft_bash: "bash"
   };
+  REMOVED_DATA_LAYER_PATHS = [
+    "views.callgraph_copies",
+    "views.enabled",
+    "worktree.ram_overlay"
+  ];
+  RETIRED_IDLE_CHECKOUT_HOURS = [
+    "views.idle_checkout_hours",
+    "idle.checkout_hours"
+  ];
+  IDLE_CHECKOUT_HOURS_MAX = 24 * 365;
+  AFT_PACKAGE_NAMES = new Set([
+    "@cortexkit/aft-bridge",
+    "@cortexkit/aft-opencode",
+    "@cortexkit/aft-pi",
+    "@cortexkit/aft"
+  ]);
   RETIRED_PATHS = [
     ["sandbox.enabled", "sandbox.profile"],
     ["tool_surface", "disabled_tools"],
@@ -3876,7 +4029,10 @@ var init_feature_config = __esm(() => {
     ["semantic", "semantic_search", "experimental_semantic_search"],
     ["callgraph", "callgraph_store", undefined]
   ];
-  REMOVED_NO_EFFECT_PATHS = ["bridge.hang_threshold"];
+  REMOVED_NO_EFFECT_PATHS = [
+    "bridge.hang_threshold",
+    "inspect.tier2_idle_minutes"
+  ];
   SEMANTIC_COST_NOTICE_DIGEST = noticeDigest({ notice: "semantic_default_cost_v1" });
   SECURITY_CONFIG_SECTIONS = new Set([
     "restrict_to_project_root",
@@ -4127,6 +4283,8 @@ function quoteCmdArgument(value) {
   return `"${value}"`;
 }
 function npmInvocation(resolved, npmArgs, platform = process.platform, env = process.env) {
+  if (resolved.cliPath)
+    return { command: resolved.command, args: [resolved.cliPath, ...npmArgs] };
   if (platform !== "win32" || !/\.(?:cmd|bat)$/i.test(resolved.command)) {
     return { command: resolved.command, args: [...npmArgs] };
   }
@@ -4319,6 +4477,12 @@ var init_lsp_npm_policy = __esm(() => {
   NPM_PROBE_RETRY_MS = 5 * 60000;
 });
 
+// ../aft-bridge/dist/lsp-npm-selection.js
+var init_lsp_npm_selection = __esm(() => {
+  init_lsp_npm_policy();
+  init_npm_resolver();
+});
+
 // ../aft-bridge/dist/message-detach.js
 var BASH_WAIT_DETACH_MAGIC_KEYWORD = "&detach", STANDALONE_DETACH_KEYWORD_SOURCE, STANDALONE_DETACH_KEYWORD_PATTERN, STANDALONE_DETACH_KEYWORDS_PATTERN;
 var init_message_detach = __esm(() => {
@@ -5489,6 +5653,7 @@ var init_dist2 = __esm(() => {
   init_lsp_github_probe();
   init_lsp_github_table();
   init_lsp_npm_policy();
+  init_lsp_npm_selection();
   init_message_detach();
   init_migration();
   init_migration_notices();
@@ -14177,27 +14342,54 @@ var init_jsonc = __esm(() => {
   import_comment_json = __toESM(require_src2(), 1);
 });
 
-// src/lib/self-version.ts
-import { createRequire as createRequire2 } from "node:module";
-function getSelfVersion() {
-  const require2 = createRequire2(import.meta.url);
-  for (const relPath of ["../../package.json", "../package.json"]) {
-    try {
-      const version = require2(relPath).version;
-      if (typeof version === "string" && version.length > 0) {
-        return version;
-      }
-    } catch {}
-  }
-  return "unknown";
-}
-var init_self_version = () => {};
-
 // ../../.github/opencode-version.txt
 var opencode_version_default = `1.19.3
 `;
 var init_opencode_version = () => {};
 
+// src/lib/semver.ts
+function parse2(version) {
+  const match = /^(0|[1-9]\d*)\.(0|[1-9]\d*)\.(0|[1-9]\d*)(?:-([0-9A-Za-z-]+(?:\.[0-9A-Za-z-]+)*))?(?:\+[0-9A-Za-z-]+(?:\.[0-9A-Za-z-]+)*)?$/.exec(version);
+  if (!match)
+    return;
+  const prerelease = match[4]?.split(".") ?? [];
+  if (prerelease.some((part) => /^\d+$/.test(part) && part.length > 1 && part[0] === "0")) {
+    return;
+  }
+  return { core: match.slice(1, 4).map(BigInt), prerelease };
+}
+function compareSemver2(left, right) {
+  const a = parse2(left);
+  const b = parse2(right);
+  if (!a || !b)
+    return;
+  for (let i = 0;i < 3; i++) {
+    if (a.core[i] !== b.core[i])
+      return a.core[i] > b.core[i] ? 1 : -1;
+  }
+  if (!a.prerelease.length || !b.prerelease.length) {
+    return a.prerelease.length === b.prerelease.length ? 0 : a.prerelease.length ? -1 : 1;
+  }
+  for (let i = 0;i < Math.max(a.prerelease.length, b.prerelease.length); i++) {
+    const x = a.prerelease[i];
+    const y = b.prerelease[i];
+    if (x === y)
+      continue;
+    if (x === undefined)
+      return -1;
+    if (y === undefined)
+      return 1;
+    const xn = /^\d+$/.test(x);
+    const yn = /^\d+$/.test(y);
+    if (xn && yn)
+      return BigInt(x) > BigInt(y) ? 1 : -1;
+    if (xn !== yn)
+      return xn ? -1 : 1;
+    return x > y ? 1 : -1;
+  }
+  return 0;
+}
+
 // src/setup/opencode-config.ts
 function openCodePluginKey(generation) {
   return generation === "v2" ? "plugins" : "plugin";
@@ -14215,6 +14407,24 @@ function openCodePluginReadKeys(generation) {
 function pinnedPluginEntry(version) {
   return `${AFT_OPENCODE_PACKAGE}@${version}`;
 }
+function preserveDoctorPluginEntry(cli, entry, installed) {
+  const configured = entry ? exactPinnedVersion(entry) : null;
+  const configuredOrder = configured ? compareSemver2(configured, cli) : undefined;
+  const installedOrder = installed ? compareSemver2(installed, cli) : undefined;
+  if (installed && (installedOrder === undefined || installedOrder > 0))
+    return true;
+  if (configured && (configuredOrder === undefined || configuredOrder > 0))
+    return true;
+  if (entry === AFT_OPENCODE_PACKAGE)
+    return false;
+  return Boolean(entry && configuredOrder === undefined && installedOrder === undefined);
+}
+function doctorNoDowngradeMessage(cli, entry, installed) {
+  const configured = entry ? exactPinnedVersion(entry) : null;
+  const newerInstalled = installed && (compareSemver2(installed, cli) ?? 1) > 0;
+  const plugin = newerInstalled ? installed : (configured ?? entry?.slice(AFT_OPENCODE_PACKAGE.length + 1)) || "unknown";
+  return DOCTOR_NO_DOWNGRADE.replace("<cli>", cli).replace("<plugin>", plugin);
+}
 function describePluginEntry(entry) {
   if (entry === AFT_OPENCODE_PACKAGE) {
     return "has no version, so OpenCode may load any release of the plugin";
@@ -14287,8 +14497,8 @@ function findLocalAftEntry(list, hasLocalAftEntry) {
   }
   return null;
 }
-function ensurePinnedPluginConfig(value, version, hasLocalAftEntry = () => false, generation = "unknown") {
-  const entry = pinnedPluginEntry(version);
+function ensurePinnedPluginConfig(value, version, hasLocalAftEntry = () => false, generation = "unknown", policy = {}) {
+  const entry = policy.fallbackEntry ?? pinnedPluginEntry(version);
   const key = openCodePluginKey(generation);
   const hadKey = Array.isArray(value[key]);
   const list = hadKey ? value[key] : [];
@@ -14302,6 +14512,21 @@ function ensurePinnedPluginConfig(value, version, hasLocalAftEntry = () => false
   }
   if (npmIndexes.length > 0) {
     const firstIndex = npmIndexes[0];
+    if (policy.doctor && npmIndexes.some((index) => preserveDoctorPluginEntry(version, pluginEntryPackage(list[index]) ?? undefined, policy.installedVersion))) {
+      let changed = false;
+      for (const index of npmIndexes) {
+        const spec = pluginEntryPackage(list[index]);
+        const shaped = shapePluginEntry(key, spec, pluginEntryOptions(list[index]));
+        changed ||= !sameEntry(list[index], shaped);
+        list[index] = shaped;
+      }
+      return {
+        action: changed ? "updated" : "already_present",
+        changed,
+        entry: pluginEntryPackage(list[firstIndex]),
+        key
+      };
+    }
     const shaped = shapePluginEntry(key, entry, pluginEntryOptions(list[firstIndex]));
     const wasExact = sameEntry(list[firstIndex], shaped);
     list[firstIndex] = shaped;
@@ -14320,13 +14545,24 @@ function ensurePinnedPluginConfig(value, version, hasLocalAftEntry = () => false
   }
   const sibling = value[otherOpenCodePluginKey(key)];
   const siblingList = Array.isArray(sibling) ? sibling : null;
+  if (policy.doctor && siblingList) {
+    const preserved = siblingList.find((candidate) => {
+      const spec = pluginEntryPackage(candidate);
+      return spec !== null && isAftNpmEntry(spec) && preserveDoctorPluginEntry(version, spec, policy.installedVersion);
+    });
+    const spec = pluginEntryPackage(preserved);
+    if (spec) {
+      list.push(shapePluginEntry(key, spec, pluginEntryOptions(preserved)));
+      return { action: "added", changed: true, entry: spec, key };
+    }
+  }
   const carried = siblingList ? findLocalAftEntry(siblingList, hasLocalAftEntry) : null;
   list.push(carried ? shapePluginEntry(key, carried.packageSpec, carried.options) : entry);
   if (carried && siblingList)
     siblingList.splice(carried.index, 1);
   return { action: "added", changed: true, entry, key };
 }
-function pluginConfigNeedsUpdate(value, version, hasLocalAftEntry = () => false, generation = "unknown") {
+function pluginConfigNeedsUpdate(value, version, hasLocalAftEntry = () => false, generation = "unknown", policy = {}) {
   const key = openCodePluginKey(generation);
   const list = value[key];
   if (!Array.isArray(list))
@@ -14336,7 +14572,9 @@ function pluginConfigNeedsUpdate(value, version, hasLocalAftEntry = () => false,
     return packageSpec !== null && isAftNpmEntry(packageSpec);
   });
   if (npmEntries.length > 0) {
-    return npmEntries.length !== 1 || pluginEntryPackage(npmEntries[0]) !== pinnedPluginEntry(version) || !pluginEntryFitsKey(npmEntries[0], key);
+    if (policy.doctor && npmEntries.some((candidate) => preserveDoctorPluginEntry(version, pluginEntryPackage(candidate) ?? undefined, policy.installedVersion)))
+      return npmEntries.some((candidate) => !pluginEntryFitsKey(candidate, key));
+    return npmEntries.length !== 1 || pluginEntryPackage(npmEntries[0]) !== (policy.fallbackEntry ?? pinnedPluginEntry(version)) || !pluginEntryFitsKey(npmEntries[0], key);
   }
   const local = findLocalAftEntry(list, hasLocalAftEntry);
   if (local)
@@ -14386,7 +14624,7 @@ function aftHostReplacementEnabled(userConfig, hostTool) {
   }
   return true;
 }
-var AFT_OPENCODE_PACKAGE = "@cortexkit/aft-opencode", MODERN_V1_VERSION, EXACT_VERSION, OPENCODE_HOST_SHELL_DISABLE_ENTRY = "-opencode.tool.shell", OPENCODE_HOST_PATCH_DISABLE_ENTRY = "-opencode.tool.patch", OPENCODE_HOST_TOOLS, OPENCODE_HOST_TOOL_NAMES;
+var AFT_OPENCODE_PACKAGE = "@cortexkit/aft-opencode", MODERN_V1_VERSION, DOCTOR_NO_DOWNGRADE = "This doctor is AFT <cli>; OpenCode is configured for AFT plugin <plugin>. Doctor will not downgrade that entry. Run doctor with a matching or newer CLI.", EXACT_VERSION, OPENCODE_HOST_SHELL_DISABLE_ENTRY = "-opencode.tool.shell", OPENCODE_HOST_PATCH_DISABLE_ENTRY = "-opencode.tool.patch", OPENCODE_HOST_TOOLS, OPENCODE_HOST_TOOL_NAMES;
 var init_opencode_config = __esm(() => {
   init_opencode_version();
   MODERN_V1_VERSION = opencode_version_default.trim();
@@ -14398,29 +14636,138 @@ var init_opencode_config = __esm(() => {
   OPENCODE_HOST_TOOL_NAMES = Object.keys(OPENCODE_HOST_TOOLS);
 });
 
+// src/lib/opencode-plugin-cache.ts
+import { existsSync as existsSync14, readdirSync as readdirSync6, readFileSync as readFileSync10 } from "node:fs";
+import { dirname as dirname8, join as join18 } from "node:path";
+function discoverLocalOpenCodePlugin(path, cliVersion) {
+  let current = path;
+  for (;; ) {
+    const manifestPath = join18(current, "package.json");
+    try {
+      const pkg = JSON.parse(readFileSync10(manifestPath, "utf8"));
+      if (pkg.name === AFT_OPENCODE_PACKAGE && typeof pkg.version === "string") {
+        return {
+          path: current,
+          manifestPath,
+          cached: pkg.version,
+          version: pkg.version,
+          versionSource: "installed",
+          exists: true,
+          cliVersion,
+          local: true
+        };
+      }
+    } catch {}
+    const parent = dirname8(current);
+    if (parent === current)
+      return;
+    current = parent;
+  }
+}
+function discoverOpenCodePluginCache(root, entry, generation, cliVersion, configuredEntry) {
+  const v1 = join18(root, "packages", entry);
+  const v2 = join18(root, "npm", entry === AFT_OPENCODE_PACKAGE ? `${entry}@latest` : entry);
+  const paths = [];
+  if (generation !== "v1") {
+    try {
+      const timestamps = readdirSync6(v2).filter((name) => /^\d+$/.test(name));
+      timestamps.sort((a, b) => BigInt(a) > BigInt(b) ? -1 : BigInt(a) < BigInt(b) ? 1 : 0);
+      if (timestamps[0])
+        paths.push(join18(v2, timestamps[0]));
+    } catch {}
+  }
+  if (generation === "v1" || generation !== "v2" && paths.length === 0)
+    paths.push(v1);
+  let readError;
+  for (const path of paths) {
+    const manifestPath = join18(path, "node_modules", AFT_OPENCODE_PACKAGE, "package.json");
+    try {
+      const pkg = JSON.parse(readFileSync10(manifestPath, "utf8"));
+      if (pkg.name !== AFT_OPENCODE_PACKAGE || typeof pkg.version !== "string" || compareSemver2(pkg.version, pkg.version) !== 0) {
+        readError = `Invalid plugin identity or version at ${manifestPath}`;
+        continue;
+      }
+      if (typeof pkg.main === "string" && !existsSync14(join18(path, "node_modules", AFT_OPENCODE_PACKAGE, pkg.main))) {
+        readError = `Incomplete plugin installation at ${manifestPath}`;
+        continue;
+      }
+      return {
+        path,
+        manifestPath,
+        cached: pkg.version,
+        version: pkg.version,
+        versionSource: "installed",
+        configuredEntry,
+        exists: true,
+        cliVersion
+      };
+    } catch (error) {
+      if (error.code !== "ENOENT" || existsSync14(path))
+        readError = String(error);
+    }
+  }
+  return {
+    path: paths[0] ?? (generation === "v2" ? v2 : v1),
+    cached: undefined,
+    version: configuredEntry ? exactPinnedVersion(configuredEntry) ?? undefined : undefined,
+    versionSource: configuredEntry && exactPinnedVersion(configuredEntry) ? "configured" : "unknown",
+    readError,
+    exists: false,
+    configuredEntry,
+    cliVersion
+  };
+}
+function doctorInstalledVersion(cache) {
+  return cache.cached ?? (cache.readError ? "unknown" : undefined);
+}
+function describePluginVersion(cache) {
+  const version = cache.version ?? cache.cached;
+  const source = cache.versionSource ?? (cache.cached ? "installed" : "unknown");
+  return `${version ?? "unknown"} (${source}${cache.manifestPath ? `: ${cache.manifestPath}` : source === "configured" && cache.configuredEntry ? `: ${cache.configuredEntry}` : ""})`;
+}
+var init_opencode_plugin_cache = __esm(() => {
+  init_opencode_config();
+});
+
+// src/lib/self-version.ts
+import { createRequire as createRequire2 } from "node:module";
+function getSelfVersion() {
+  const require2 = createRequire2(import.meta.url);
+  for (const relPath of ["../../package.json", "../package.json"]) {
+    try {
+      const version = require2(relPath).version;
+      if (typeof version === "string" && version.length > 0) {
+        return version;
+      }
+    } catch {}
+  }
+  return "unknown";
+}
+var init_self_version = () => {};
+
 // src/setup/host-generation.ts
 import { createHash as createHash4 } from "node:crypto";
 import {
   closeSync as closeSync7,
-  existsSync as existsSync14,
+  existsSync as existsSync15,
   mkdirSync as mkdirSync5,
   mkdtempSync,
   openSync as openSync7,
-  readdirSync as readdirSync6,
-  readFileSync as readFileSync10,
+  readdirSync as readdirSync7,
+  readFileSync as readFileSync11,
   readSync as readSync5,
   realpathSync as realpathSync5,
   rmSync as rmSync4,
   statSync as statSync10
 } from "node:fs";
 import { homedir as homedir14, tmpdir as tmpdir3 } from "node:os";
-import { dirname as dirname8, join as join18, parse as parse2 } from "node:path";
+import { dirname as dirname9, join as join19, parse as parse3 } from "node:path";
 function findExecutableOnPath2(name, pathValue = process.env.PATH ?? "", platform = process.platform) {
   return findExecutableOnPath(name, { pathValue, platform });
 }
 function packageMetadataAt(path, expectedName) {
   try {
-    const metadata = JSON.parse(readFileSync10(path, "utf8"));
+    const metadata = JSON.parse(readFileSync11(path, "utf8"));
     return metadata.name === expectedName ? metadata : null;
   } catch {
     return null;
@@ -14429,16 +14776,16 @@ function packageMetadataAt(path, expectedName) {
 function packageMetadataNearExecutable(executable, expectedName) {
   let current;
   try {
-    current = dirname8(realpathSync5(executable));
+    current = dirname9(realpathSync5(executable));
   } catch {
-    current = dirname8(executable);
+    current = dirname9(executable);
   }
   while (true) {
-    const direct = packageMetadataAt(join18(current, "package.json"), expectedName);
+    const direct = packageMetadataAt(join19(current, "package.json"), expectedName);
     if (direct)
       return direct;
-    const parent = dirname8(current);
-    if (parent === current || current === parse2(current).root)
+    const parent = dirname9(current);
+    if (parent === current || current === parse3(current).root)
       return null;
     current = parent;
   }
@@ -14448,7 +14795,7 @@ function npmLauncherTarget(launcher) {
   try {
     if (statSync10(launcher).size > LAUNCHER_MAX_BYTES)
       return null;
-    source = readFileSync10(launcher, "utf8");
+    source = readFileSync11(launcher, "utf8");
   } catch {
     return null;
   }
@@ -14458,7 +14805,7 @@ function npmLauncherTarget(launcher) {
   const relativeTarget = operands.at(-1)?.[1];
   if (!relativeTarget)
     return null;
-  const target = join18(dirname8(launcher), ...relativeTarget.split(/[\\/]+/).filter(Boolean));
+  const target = join19(dirname9(launcher), ...relativeTarget.split(/[\\/]+/).filter(Boolean));
   try {
     return statSync10(target).isFile() ? target : null;
   } catch {
@@ -14504,7 +14851,7 @@ function hashFileBytes(hash, path, size) {
   }
 }
 function snapshotTree(path) {
-  if (!existsSync14(path))
+  if (!existsSync15(path))
     return "missing";
   const hash = createHash4("sha256");
   const visit = (current, relativePath) => {
@@ -14517,8 +14864,8 @@ function snapshotTree(path) {
     }
     hash.update(`${relativePath}\x00${info.mode}\x00${info.size}\x00${info.mtimeMs}\x00`);
     if (info.isDirectory()) {
-      for (const entry of readdirSync6(current).sort()) {
-        visit(join18(current, entry), join18(relativePath, entry));
+      for (const entry of readdirSync7(current).sort()) {
+        visit(join19(current, entry), join19(relativePath, entry));
       }
       return;
     }
@@ -14534,19 +14881,19 @@ function snapshotTree(path) {
   return hash.digest("hex");
 }
 function snapshotOperatorState(operatorHome) {
-  const database = join18(operatorHome, ".local", "share", "opencode", "opencode.db");
+  const database = join19(operatorHome, ".local", "share", "opencode", "opencode.db");
   return JSON.stringify({
     database: snapshotTree(database),
     databaseWal: snapshotTree(`${database}-wal`),
     databaseShm: snapshotTree(`${database}-shm`),
-    logs: snapshotTree(join18(operatorHome, ".local", "share", "opencode", "log"))
+    logs: snapshotTree(join19(operatorHome, ".local", "share", "opencode", "log"))
   });
 }
 function probeCreatedIsolatedState(dataRoot, stateRoot) {
   return [dataRoot, stateRoot].some((root) => {
-    const opencodeRoot = join18(root, "opencode");
-    const database = join18(opencodeRoot, "opencode.db");
-    return [database, `${database}-wal`, `${database}-shm`, join18(opencodeRoot, "log")].some(existsSync14);
+    const opencodeRoot = join19(root, "opencode");
+    const database = join19(opencodeRoot, "opencode.db");
+    return [database, `${database}-wal`, `${database}-shm`, join19(opencodeRoot, "log")].some(existsSync15);
   });
 }
 function probeOpenCodeV1Version(executable, options = {}) {
@@ -14555,13 +14902,13 @@ function probeOpenCodeV1Version(executable, options = {}) {
     return null;
   const operatorHome = options.operatorHome ?? homedir14();
   const before = snapshotOperatorState(operatorHome);
-  const root = mkdtempSync(join18(options.tempParent ?? tmpdir3(), "aft-opencode-probe-"));
-  const home = join18(root, "home");
-  const config = join18(root, "config");
-  const data = join18(root, "data");
-  const state = join18(root, "state");
-  const cache = join18(root, "cache");
-  const project = join18(root, "project");
+  const root = mkdtempSync(join19(options.tempParent ?? tmpdir3(), "aft-opencode-probe-"));
+  const home = join19(root, "home");
+  const config = join19(root, "config");
+  const data = join19(root, "data");
+  const state = join19(root, "state");
+  const cache = join19(root, "cache");
+  const project = join19(root, "project");
   for (const directory of [home, config, data, state, cache, project]) {
     mkdirSync5(directory, { recursive: true });
   }
@@ -14572,7 +14919,7 @@ function probeOpenCodeV1Version(executable, options = {}) {
     XDG_DATA_HOME: data,
     XDG_STATE_HOME: state,
     XDG_CACHE_HOME: cache,
-    TMPDIR: join18(root, "tmp")
+    TMPDIR: join19(root, "tmp")
   };
   mkdirSync5(env.TMPDIR, { recursive: true });
   delete env.OPENCODE_CONFIG;
@@ -14713,9 +15060,9 @@ var init_host_generation = __esm(() => {
 });
 
 // src/adapters/opencode.ts
-import { existsSync as existsSync15, readFileSync as readFileSync11, rmSync as rmSync5, statSync as statSync11 } from "node:fs";
+import { existsSync as existsSync16, readFileSync as readFileSync12, rmSync as rmSync5, statSync as statSync11 } from "node:fs";
 import { homedir as homedir15 } from "node:os";
-import { dirname as dirname9, join as join19, parse as parse3, resolve as resolve12 } from "node:path";
+import { dirname as dirname10, join as join20, parse as parse4, resolve as resolve12 } from "node:path";
 import { fileURLToPath } from "node:url";
 function getOpenCodeConfigDir() {
   const envDir = process.env.OPENCODE_CONFIG_DIR?.trim();
@@ -14726,13 +15073,13 @@ function getOpenCodeConfigDir() {
 function getLegacyOpenCodePluginCachePath(primaryPath) {
   if (process.platform !== "win32")
     return null;
-  const localAppData = process.env.LOCALAPPDATA ?? join19(homedir15(), "AppData", "Local");
-  const legacyPath = join19(localAppData, "opencode", "packages", LEGACY_PLUGIN_ENTRY);
+  const localAppData = process.env.LOCALAPPDATA ?? join20(homedir15(), "AppData", "Local");
+  const legacyPath = join20(localAppData, "opencode", "packages", LEGACY_PLUGIN_ENTRY);
   return resolve12(legacyPath) === resolve12(primaryPath) ? null : legacyPath;
 }
 function clearLegacyOpenCodePluginCache(primaryPath) {
   const legacyPath = getLegacyOpenCodePluginCachePath(primaryPath);
-  if (!legacyPath || !existsSync15(legacyPath))
+  if (!legacyPath || !existsSync16(legacyPath))
     return { clearedPath: null };
   try {
     rmSync5(legacyPath, { recursive: true, force: true });
@@ -14750,16 +15097,16 @@ function hasOpenCodeCli() {
 function openCodeDesktopAppExists() {
   const candidates = [];
   if (process.platform === "darwin") {
-    candidates.push("/Applications/OpenCode.app", "/Applications/OpenCode Beta.app", join19(homedir15(), "Applications", "OpenCode.app"), join19(homedir15(), "Applications", "OpenCode Beta.app"));
+    candidates.push("/Applications/OpenCode.app", "/Applications/OpenCode Beta.app", join20(homedir15(), "Applications", "OpenCode.app"), join20(homedir15(), "Applications", "OpenCode Beta.app"));
   } else if (process.platform === "win32") {
-    const localAppData = process.env.LOCALAPPDATA ?? join19(homedir15(), "AppData", "Local");
-    candidates.push(join19(localAppData, "Programs", "opencode"), join19(localAppData, "opencode"));
+    const localAppData = process.env.LOCALAPPDATA ?? join20(homedir15(), "AppData", "Local");
+    candidates.push(join20(localAppData, "Programs", "opencode"), join20(localAppData, "opencode"));
   } else {
-    candidates.push("/opt/OpenCode", "/usr/lib/opencode", join19(homedir15(), ".local", "share", "applications", "opencode.desktop"));
+    candidates.push("/opt/OpenCode", "/usr/lib/opencode", join20(homedir15(), ".local", "share", "applications", "opencode.desktop"));
   }
   return candidates.some((p) => {
     try {
-      return existsSync15(p);
+      return existsSync16(p);
     } catch {
       return false;
     }
@@ -14782,24 +15129,24 @@ function pathPointsToOurPlugin(entry) {
   if (!fsPath)
     return false;
   try {
-    if (!existsSync15(fsPath))
+    if (!existsSync16(fsPath))
       return false;
-    let searchDir = statSync11(fsPath).isDirectory() ? fsPath : dirname9(fsPath);
+    let searchDir = statSync11(fsPath).isDirectory() ? fsPath : dirname10(fsPath);
     let pkgJsonPath = null;
     while (true) {
-      const candidate = join19(searchDir, "package.json");
-      if (existsSync15(candidate)) {
+      const candidate = join20(searchDir, "package.json");
+      if (existsSync16(candidate)) {
         pkgJsonPath = candidate;
         break;
       }
-      const parent = dirname9(searchDir);
-      if (parent === searchDir || searchDir === parse3(searchDir).root)
+      const parent = dirname10(searchDir);
+      if (parent === searchDir || searchDir === parse4(searchDir).root)
         break;
       searchDir = parent;
     }
     if (!pkgJsonPath)
       return false;
-    const parsed = JSON.parse(readFileSync11(pkgJsonPath, "utf-8"));
+    const parsed = JSON.parse(readFileSync12(pkgJsonPath, "utf-8"));
     return parsed.name === PLUGIN_NAME;
   } catch {
     return false;
@@ -14833,7 +15180,7 @@ class OpenCodeAdapter {
   pluginEntryWithVersion = PLUGIN_ENTRY;
   hostDetection;
   isInstalled() {
-    if (existsSync15(getOpenCodeConfigDir()))
+    if (existsSync16(getOpenCodeConfigDir()))
       return true;
     if (openCodeDesktopAppExists())
       return true;
@@ -14857,7 +15204,7 @@ class OpenCodeAdapter {
     const configDir = getOpenCodeConfigDir();
     const harness = detectJsoncFile(configDir, "opencode");
     const aftConfigPath = resolveCortexKitUserConfigPath();
-    const aftConfigExists = existsSync15(aftConfigPath);
+    const aftConfigExists = existsSync16(aftConfigPath);
     const tui = detectJsoncFile(configDir, "tui");
     return {
       configDir,
@@ -14874,13 +15221,32 @@ class OpenCodeAdapter {
     const { value } = readJsoncFile(paths.harnessConfig);
     return configRegistersAft(value, this.configGeneration());
   }
-  async ensurePluginEntry() {
+  async ensurePluginEntry(options = {}) {
+    const paths = this.detectConfigPaths();
+    return this.ensureConfigEntry(paths.harnessConfig, paths.harnessConfigFormat, "server config", options);
+  }
+  needsPluginEntryUpdate(options = {}) {
     const paths = this.detectConfigPaths();
-    return this.ensureConfigEntry(paths.harnessConfig, paths.harnessConfigFormat, "server config");
+    return this.configEntryNeedsUpdate(paths.harnessConfig, paths.harnessConfigFormat, options);
   }
-  needsPluginEntryUpdate() {
+  doctorPluginEntry(tui = false) {
     const paths = this.detectConfigPaths();
-    return this.configEntryNeedsUpdate(paths.harnessConfig, paths.harnessConfigFormat);
+    const path = tui ? paths.tuiConfig : paths.harnessConfig;
+    const value = path ? readJsoncFile(path).value : null;
+    const policy = this.doctorVersionPolicy({ doctor: true });
+    if (!value)
+      return policy.fallbackEntry ?? PLUGIN_ENTRY;
+    return ensurePinnedPluginConfig(JSON.parse(JSON.stringify(value)), getSelfVersion(), pathPointsToOurPlugin, this.configGeneration(), policy).entry;
+  }
+  doctorVersionPolicy(policy) {
+    if (!policy.doctor)
+      return policy;
+    const cache = this.getPluginCacheInfo();
+    const installedVersion = doctorInstalledVersion(cache);
+    const configuredVersion = cache.configuredEntry ? exactPinnedVersion(cache.configuredEntry) : null;
+    const newer = configuredVersion && (compareSemver2(configuredVersion, getSelfVersion()) ?? 0) > 0 || cache.cached && (compareSemver2(cache.cached, getSelfVersion()) ?? 0) > 0;
+    const fallbackEntry = newer ? cache.configuredEntry ?? (cache.cached ? pinnedPluginEntry(cache.cached) : undefined) : undefined;
+    return { ...policy, installedVersion, fallbackEntry };
   }
   hasTuiPluginEntry() {
     const paths = this.detectConfigPaths();
@@ -14889,7 +15255,7 @@ class OpenCodeAdapter {
     const { value } = readJsoncFile(paths.tuiConfig);
     return configRegistersAft(value, this.configGeneration());
   }
-  async ensureTuiPluginEntry() {
+  async ensureTuiPluginEntry(options = {}) {
     const paths = this.detectConfigPaths();
     if (this.configGeneration() === "v2") {
       return {
@@ -14907,28 +15273,30 @@ class OpenCodeAdapter {
         configPath: paths.configDir
       };
     }
-    return this.ensureConfigEntry(paths.tuiConfig, paths.tuiConfigFormat ?? "none", "TUI config");
+    return this.ensureConfigEntry(paths.tuiConfig, paths.tuiConfigFormat ?? "none", "TUI config", options);
   }
   tuiPluginEntryApplies() {
     return this.configGeneration() !== "v2";
   }
-  needsTuiPluginEntryUpdate() {
+  needsTuiPluginEntryUpdate(options = {}) {
     if (this.configGeneration() === "v2")
       return false;
     const paths = this.detectConfigPaths();
-    return paths.tuiConfig ? this.configEntryNeedsUpdate(paths.tuiConfig, paths.tuiConfigFormat ?? "none") : true;
+    return paths.tuiConfig ? this.configEntryNeedsUpdate(paths.tuiConfig, paths.tuiConfigFormat ?? "none", options) : true;
   }
-  ensureConfigEntry(configPath, format, label) {
+  ensureConfigEntry(configPath, format, label, policy = {}) {
     const generation = this.configGeneration();
     const key = openCodePluginKey(generation);
+    policy = this.doctorVersionPolicy(policy);
+    const initialEntry = policy.fallbackEntry ?? PLUGIN_ENTRY;
     if (format === "none") {
-      const failed = this.tryWrite(configPath, () => writeJsoncFile(configPath, { [key]: [PLUGIN_ENTRY] }, "json"));
+      const failed = this.tryWrite(configPath, () => writeJsoncFile(configPath, { [key]: [initialEntry] }, "json"));
       if (failed)
         return failed;
       return {
         ok: true,
         action: "added",
-        message: `Created ${configPath} and added ${PLUGIN_ENTRY} under \`${key}\` (${label})`,
+        message: `Created ${configPath} and added ${initialEntry} under \`${key}\` (${label})`,
         configPath
       };
     }
@@ -14941,12 +15309,14 @@ class OpenCodeAdapter {
         configPath
       };
     }
-    const update = ensurePinnedPluginConfig(value, getSelfVersion(), pathPointsToOurPlugin, generation);
+    const update = ensurePinnedPluginConfig(value, getSelfVersion(), pathPointsToOurPlugin, generation, policy);
+    const preserved = policy.doctor && preserveDoctorPluginEntry(getSelfVersion(), update.entry, doctorInstalledVersion(this.getPluginCacheInfo()));
+    const notice = preserved ? doctorNoDowngradeMessage(getSelfVersion(), update.entry, doctorInstalledVersion(this.getPluginCacheInfo())) : "";
     if (!update.changed) {
       return {
         ok: true,
         action: "already_present",
-        message: `${PLUGIN_ENTRY} is already registered under \`${update.key}\` in ${configPath}`,
+        message: notice || `${update.entry} is already registered under \`${update.key}\` in ${configPath}`,
         configPath
       };
     }
@@ -14956,7 +15326,7 @@ class OpenCodeAdapter {
     return {
       ok: true,
       action: update.action,
-      message: `${update.action === "added" ? "Added" : "Updated"} ${PLUGIN_ENTRY} under \`${update.key}\` in ${configPath} (${label})`,
+      message: `${update.action === "added" ? "Added" : "Updated"} ${update.entry} under \`${update.key}\` in ${configPath} (${label})${notice ? `. ${notice}` : ""}`,
       configPath
     };
   }
@@ -15041,38 +15411,27 @@ class OpenCodeAdapter {
       return { ok: false, action: "error", message: formatFsError(error, configPath), configPath };
     }
   }
-  configEntryNeedsUpdate(configPath, format) {
+  configEntryNeedsUpdate(configPath, format, policy = {}) {
     if (format === "none")
       return true;
     const { value, error } = readJsoncFile(configPath);
     if (error || !value)
       return false;
-    return pluginConfigNeedsUpdate(value, getSelfVersion(), pathPointsToOurPlugin, this.configGeneration());
+    return pluginConfigNeedsUpdate(value, getSelfVersion(), pathPointsToOurPlugin, this.configGeneration(), this.doctorVersionPolicy(policy));
   }
   getPluginCacheInfo() {
     const configPath = this.detectConfigPaths().harnessConfig;
     const { value } = readJsoncFile(configPath);
-    const configuredEntry = openCodePluginReadKeys(this.configGeneration()).flatMap((key) => Array.isArray(value?.[key]) ? value[key] : []).map(pluginEntryPackage).find(isAftNpmEntry);
-    const path = join19(getOpenCodeCacheDir(), "packages", configuredEntry ?? PLUGIN_ENTRY);
-    let cached;
-    let readError;
-    try {
-      const installedPkgPath = join19(path, "node_modules", "@cortexkit", "aft-opencode", "package.json");
-      const pkg = JSON.parse(readFileSync11(installedPkgPath, "utf-8"));
-      cached = typeof pkg.version === "string" ? pkg.version : undefined;
-    } catch (error) {
-      if (error.code !== "ENOENT") {
-        readError = error instanceof Error ? error.message : String(error);
-      }
+    const entries = openCodePluginReadKeys(this.configGeneration()).flatMap((key) => Array.isArray(value?.[key]) ? value[key] : []).map(pluginEntryPackage);
+    const configuredEntry = entries.find(isAftNpmEntry);
+    if (!configuredEntry) {
+      const localEntry = entries.find((entry) => entry !== null && pathPointsToOurPlugin(entry));
+      const localPath = localEntry ? pathFromEntry(localEntry) : null;
+      const local = localPath ? discoverLocalOpenCodePlugin(localPath, getSelfVersion()) : undefined;
+      if (local)
+        return local;
     }
-    return {
-      path,
-      cached,
-      readError,
-      latest: getSelfVersion(),
-      exists: existsSync15(path),
-      configuredEntry
-    };
+    return discoverOpenCodePluginCache(getOpenCodeCacheDir(), configuredEntry ?? PLUGIN_ENTRY, this.configGeneration(), getSelfVersion(), configuredEntry);
   }
   getStorageDir() {
     return getCortexKitStorageRoot();
@@ -15085,6 +15444,8 @@ class OpenCodeAdapter {
   }
   async clearPluginCache(force) {
     const info = this.getPluginCacheInfo();
+    if (info.local)
+      return { action: "not_applicable", path: info.path };
     const clearLegacy = force ? clearLegacyOpenCodePluginCache(info.path) : { clearedPath: null };
     if (clearLegacy.error) {
       return {
@@ -15101,12 +15462,12 @@ class OpenCodeAdapter {
         legacy_path_cleared: clearLegacy.clearedPath
       } : { action: "not_found", path: info.path };
     }
-    if (!force && info.cached && info.cached === info.latest) {
+    if (!force && info.cached && info.cached === info.cliVersion) {
       return {
         action: "up_to_date",
         path: info.path,
         cached: info.cached,
-        latest: info.latest
+        latest: info.cliVersion
       };
     }
     try {
@@ -15115,7 +15476,7 @@ class OpenCodeAdapter {
         action: "cleared",
         path: info.path,
         cached: info.cached,
-        latest: info.latest,
+        latest: info.cliVersion,
         ...clearLegacy.clearedPath ? { legacy_path_cleared: clearLegacy.clearedPath } : {}
       };
     } catch (error) {
@@ -15123,7 +15484,7 @@ class OpenCodeAdapter {
         action: "error",
         path: info.path,
         cached: info.cached,
-        latest: info.latest,
+        latest: info.cliVersion,
         error: error instanceof Error ? error.message : String(error)
       };
     }
@@ -15134,12 +15495,12 @@ class OpenCodeAdapter {
   describeStorageSubtrees() {
     const storage = this.getStorageDir();
     return {
-      index: dirSize(join19(storage, "index")),
-      semantic: dirSize(join19(storage, "semantic")),
-      backups: dirSize(join19(storage, "backups")),
-      url_cache: dirSize(join19(storage, "url_cache")),
-      onnxruntime: dirSize(join19(storage, "onnxruntime")),
-      logs: dirSize(join19(storage, "logs"))
+      index: dirSize(join20(storage, "index")),
+      semantic: dirSize(join20(storage, "semantic")),
+      backups: dirSize(join20(storage, "backups")),
+      url_cache: dirSize(join20(storage, "url_cache")),
+      onnxruntime: dirSize(join20(storage, "onnxruntime")),
+      logs: dirSize(join20(storage, "logs"))
     };
   }
 }
@@ -15149,6 +15510,7 @@ var init_opencode = __esm(() => {
   init_fs_errors();
   init_fs_util();
   init_jsonc();
+  init_opencode_plugin_cache();
   init_paths2();
   init_self_version();
   init_host_generation();
@@ -15159,9 +15521,9 @@ var init_opencode = __esm(() => {
 });
 
 // src/adapters/pi.ts
-import { existsSync as existsSync16, readFileSync as readFileSync12 } from "node:fs";
+import { existsSync as existsSync17, readFileSync as readFileSync13 } from "node:fs";
 import { homedir as homedir16 } from "node:os";
-import { isAbsolute as isAbsolute7, join as join20, resolve as resolve13 } from "node:path";
+import { isAbsolute as isAbsolute7, join as join21, resolve as resolve13 } from "node:path";
 import { fileURLToPath as fileURLToPath2 } from "node:url";
 function getPiAgentDir() {
   const configuredDir = process.env.PI_CODING_AGENT_DIR?.trim();
@@ -15169,13 +15531,13 @@ function getPiAgentDir() {
     return resolve13(configuredDir);
   const envHome = process.platform === "win32" ? process.env.USERPROFILE : process.env.HOME;
   const home = envHome && envHome.length > 0 ? envHome : homedir16();
-  return join20(home, ".pi", "agent");
+  return join21(home, ".pi", "agent");
 }
 function readPiExtensionIndex() {
-  const settingsPath = join20(getPiAgentDir(), "settings.json");
-  if (existsSync16(settingsPath)) {
+  const settingsPath = join21(getPiAgentDir(), "settings.json");
+  if (existsSync17(settingsPath)) {
     try {
-      const raw = readFileSync12(settingsPath, "utf-8");
+      const raw = readFileSync13(settingsPath, "utf-8");
       const trimmed = raw.replace(/^\uFEFF/, "");
       const value = JSON.parse(trimmed);
       const packages = value.packages;
@@ -15193,13 +15555,13 @@ function readPiExtensionIndex() {
     } catch {}
   }
   const candidates = [
-    join20(getPiAgentDir(), "extensions.json"),
-    join20(getPiAgentDir(), "extensions.jsonc"),
-    join20(getPiAgentDir(), "config.json"),
-    join20(getPiAgentDir(), "config.jsonc")
+    join21(getPiAgentDir(), "extensions.json"),
+    join21(getPiAgentDir(), "extensions.jsonc"),
+    join21(getPiAgentDir(), "config.json"),
+    join21(getPiAgentDir(), "config.jsonc")
   ];
   for (const path of candidates) {
-    if (!existsSync16(path))
+    if (!existsSync17(path))
       continue;
     try {
       const { value } = readJsoncFile(path);
@@ -15231,17 +15593,17 @@ function piEntryMatchesAft(entry) {
   } else if (isAbsolute7(entry)) {
     resolved = entry;
   } else if (entry.length > 0) {
-    resolved = join20(getPiAgentDir(), entry);
+    resolved = join21(getPiAgentDir(), entry);
   }
   if (!resolved)
     return false;
   try {
-    if (!existsSync16(resolved))
+    if (!existsSync17(resolved))
       return false;
-    const pkgPath = join20(resolved, "package.json");
-    if (!existsSync16(pkgPath))
+    const pkgPath = join21(resolved, "package.json");
+    if (!existsSync17(pkgPath))
       return false;
-    const pkg = JSON.parse(readFileSync12(pkgPath, "utf-8"));
+    const pkg = JSON.parse(readFileSync13(pkgPath, "utf-8"));
     return pkg.name === PLUGIN_NAME2;
   } catch {
     return false;
@@ -15287,10 +15649,10 @@ class PiAdapter {
     const configDir = getPiAgentDir();
     const index = readPiExtensionIndex();
     const aftConfigPath = resolveCortexKitUserConfigPath();
-    const aftConfigExists = existsSync16(aftConfigPath);
+    const aftConfigExists = existsSync17(aftConfigPath);
     return {
       configDir,
-      harnessConfig: index.path ?? join20(configDir, "extensions.json"),
+      harnessConfig: index.path ?? join21(configDir, "extensions.json"),
       harnessConfigFormat: index.path ? "json" : "none",
       aftConfig: aftConfigPath,
       aftConfigFormat: aftConfigExists ? "jsonc" : "none"
@@ -15338,14 +15700,14 @@ class PiAdapter {
   }
   getPluginCacheInfo() {
     const candidates = [
-      join20(getPiAgentDir(), "npm", "node_modules", "@cortexkit", "aft-pi", "package.json"),
-      join20(getPiAgentDir(), "node_modules", "@cortexkit", "aft-pi", "package.json"),
-      join20(getPiAgentDir(), "extensions", "node_modules", "@cortexkit", "aft-pi", "package.json")
+      join21(getPiAgentDir(), "npm", "node_modules", "@cortexkit", "aft-pi", "package.json"),
+      join21(getPiAgentDir(), "node_modules", "@cortexkit", "aft-pi", "package.json"),
+      join21(getPiAgentDir(), "extensions", "node_modules", "@cortexkit", "aft-pi", "package.json")
     ];
     let readError;
     for (const candidate of candidates) {
       try {
-        const pkg = JSON.parse(readFileSync12(candidate, "utf-8"));
+        const pkg = JSON.parse(readFileSync13(candidate, "utf-8"));
         const cached = typeof pkg.version === "string" ? pkg.version : undefined;
         return {
           path: candidate,
@@ -15361,7 +15723,7 @@ class PiAdapter {
       }
     }
     return {
-      path: join20(getPiAgentDir(), "npm", "node_modules", "@cortexkit", "aft-pi", "package.json"),
+      path: join21(getPiAgentDir(), "npm", "node_modules", "@cortexkit", "aft-pi", "package.json"),
       exists: readError !== undefined,
       readError
     };
@@ -15384,12 +15746,12 @@ class PiAdapter {
   describeStorageSubtrees() {
     const storage = this.getStorageDir();
     return {
-      index: dirSize(join20(storage, "index")),
-      semantic: dirSize(join20(storage, "semantic")),
-      backups: dirSize(join20(storage, "backups")),
-      url_cache: dirSize(join20(storage, "url_cache")),
-      onnxruntime: dirSize(join20(storage, "onnxruntime")),
-      logs: dirSize(join20(storage, "logs"))
+      index: dirSize(join21(storage, "index")),
+      semantic: dirSize(join21(storage, "semantic")),
+      backups: dirSize(join21(storage, "backups")),
+      url_cache: dirSize(join21(storage, "url_cache")),
+      onnxruntime: dirSize(join21(storage, "onnxruntime")),
+      logs: dirSize(join21(storage, "logs"))
     };
   }
 }
@@ -16811,10 +17173,10 @@ var init_version = __esm(async () => {
 // src/lib/cli-logger.ts
 import { appendFileSync, mkdirSync as mkdirSync6 } from "node:fs";
 import { tmpdir as tmpdir4 } from "node:os";
-import { dirname as dirname10, join as join21 } from "node:path";
+import { dirname as dirname11, join as join22 } from "node:path";
 function cliLogPath() {
   if (isTestEnvironment())
-    return join21(tmpdir4(), "aft-cli-test.log");
+    return join22(tmpdir4(), "aft-cli-test.log");
   return resolveAftLogPath("aft-cli.log");
 }
 function write(level, message) {
@@ -16829,7 +17191,7 @@ function write(level, message) {
   }
   try {
     const path = cliLogPath();
-    mkdirSync6(dirname10(path), { recursive: true });
+    mkdirSync6(dirname11(path), { recursive: true });
     appendFileSync(path, `${new Date().toISOString()} ${level.toUpperCase()} ${message}
 `);
   } catch {}
@@ -16866,13 +17228,13 @@ var init_cli_logger = __esm(() => {
 });
 
 // src/lib/binary-install.ts
-import { existsSync as existsSync17 } from "node:fs";
-import { join as join22 } from "node:path";
+import { existsSync as existsSync18 } from "node:fs";
+import { join as join23 } from "node:path";
 function cachedBinaryFor(version) {
   const tag = version.startsWith("v") ? version : `v${version}`;
-  const path = join22(getAftBinaryCacheDir(), tag, getAftBinaryName());
+  const path = join23(getAftBinaryCacheDir(), tag, getAftBinaryName());
   try {
-    return existsSync17(path) ? path : null;
+    return existsSync18(path) ? path : null;
   } catch {
     return null;
   }
@@ -17818,8 +18180,8 @@ var init_features = __esm(() => {
 });
 
 // src/doctor/opencode.ts
-import { existsSync as existsSync18, readFileSync as readFileSync13 } from "node:fs";
-import { dirname as dirname11, join as join23 } from "node:path";
+import { existsSync as existsSync19, readFileSync as readFileSync14 } from "node:fs";
+import { dirname as dirname12, join as join24 } from "node:path";
 import { fileURLToPath as fileURLToPath3 } from "node:url";
 function isLoadPath(value) {
   return OPENCODE_LOAD_PATHS.includes(value);
@@ -17882,7 +18244,7 @@ function configuredVersion(entry) {
 }
 function readManifest(path) {
   try {
-    const parsed = JSON.parse(readFileSync13(path, "utf8"));
+    const parsed = JSON.parse(readFileSync14(path, "utf8"));
     return parsed.name === AFT_OPENCODE_PACKAGE ? parsed : null;
   } catch {
     return null;
@@ -17890,13 +18252,13 @@ function readManifest(path) {
 }
 function manifestFromLocalPath(path) {
   let current = path;
-  if (!existsSync18(join23(current, "package.json")))
-    current = dirname11(current);
+  if (!existsSync19(join24(current, "package.json")))
+    current = dirname12(current);
   while (true) {
-    const manifest = readManifest(join23(current, "package.json"));
+    const manifest = readManifest(join24(current, "package.json"));
     if (manifest)
       return manifest;
-    const parent = dirname11(current);
+    const parent = dirname12(current);
     if (parent === current)
       return null;
     current = parent;
@@ -17906,16 +18268,16 @@ function pluginManifest(entry, cachePath) {
   const localRoot = localPluginRoot(entry);
   if (localRoot)
     return manifestFromLocalPath(localRoot);
-  return readManifest(join23(cachePath, "node_modules", "@cortexkit", "aft-opencode", "package.json"));
+  return readManifest(join24(cachePath, "node_modules", "@cortexkit", "aft-opencode", "package.json"));
 }
 function pinProblem(entry, pinned) {
   return `the plugin entry ${entry} ${describePluginEntry(entry)}; run \`${CLI} doctor --fix\` to pin it to ${pinned}`;
 }
 function latestLoggedLoadPath(logPath) {
-  if (!existsSync18(logPath))
+  if (!existsSync19(logPath))
     return null;
   try {
-    const text = readFileSync13(logPath, "utf8");
+    const text = readFileSync14(logPath, "utf8");
     const pattern = /(?:load path|load_path)\s*[:=]\s*(root-default|export-server-effect-bun|export-server-effect-node)/gi;
     let latest = null;
     for (const match of text.matchAll(pattern)) {
@@ -17955,7 +18317,12 @@ function diagnoseOpenCodeLoad(input) {
   const pluginVersion = (typeof manifest?.version === "string" ? manifest.version : null) ?? input.cachedPluginVersion ?? configuredVersion(entry) ?? null;
   const problems = [...describePluginKeyProblems(config, generation)];
   let entryPinProblem = null;
-  if (entry && isAftNpmEntry(entry) && input.expectedPluginEntry && entry !== input.expectedPluginEntry && !(input.acceptExplicitPluginVersion && acceptV1Entry(entry))) {
+  let versionNotice;
+  const cli = input.expectedPluginEntry ? exactPinnedVersion(input.expectedPluginEntry) : null;
+  const installed = input.cachedPluginVersion ?? (typeof manifest?.version === "string" ? manifest.version : undefined);
+  if (cli && entry && isAftNpmEntry(entry) && preserveDoctorPluginEntry(cli, entry, installed)) {
+    versionNotice = doctorNoDowngradeMessage(cli, entry, installed);
+  } else if (entry && isAftNpmEntry(entry) && input.expectedPluginEntry && entry !== input.expectedPluginEntry && !(input.acceptExplicitPluginVersion && acceptV1Entry(entry))) {
     entryPinProblem = pinProblem(entry, input.expectedPluginEntry);
     problems.push(entryPinProblem);
   }
@@ -17967,7 +18334,14 @@ function diagnoseOpenCodeLoad(input) {
   if (expectedLoadPath && takenLoadPath && expectedLoadPath !== takenLoadPath) {
     problems.push(`load path ${takenLoadPath} does not match ${expectedLoadPath} expected for the detected host`);
   }
-  return { expectedLoadPath, takenLoadPath, pluginVersion, problems, pinProblem: entryPinProblem };
+  return {
+    expectedLoadPath,
+    takenLoadPath,
+    pluginVersion,
+    problems,
+    pinProblem: entryPinProblem,
+    versionNotice
+  };
 }
 function describePluginKeyProblems(config, generation) {
   if (!config || generation === "ambiguous" || generation === "unknown")
@@ -18167,11 +18541,11 @@ var init_aft_bridge = __esm(() => {
 });
 
 // src/lib/binary-cache.ts
-import { existsSync as existsSync19, readdirSync as readdirSync7, statSync as statSync12 } from "node:fs";
-import { join as join24 } from "node:path";
+import { existsSync as existsSync20, readdirSync as readdirSync8, statSync as statSync12 } from "node:fs";
+import { join as join25 } from "node:path";
 function getBinaryCacheInfo(activeVersion) {
   const path = getAftBinaryCacheDir();
-  if (!existsSync19(path)) {
+  if (!existsSync20(path)) {
     return {
       versions: [],
       activeVersion: null,
@@ -18179,9 +18553,9 @@ function getBinaryCacheInfo(activeVersion) {
       path
     };
   }
-  const versions = readdirSync7(path).filter((entry) => {
+  const versions = readdirSync8(path).filter((entry) => {
     try {
-      return statSync12(join24(path, entry)).isDirectory();
+      return statSync12(join25(path, entry)).isDirectory();
     } catch {
       return false;
     }
@@ -18216,8 +18590,22 @@ function safeRealpath(p) {
 function looksLikeSecret(value) {
   return value.length >= 16 && /^[A-Za-z0-9_\-.~+/=]+$/.test(value) && /[0-9]/.test(value) && /[A-Z]/.test(value) && /[a-z]/.test(value);
 }
+function looksLikeAssignmentSecret(value) {
+  return !["/", "~/", "./", "../"].some((prefix) => value.startsWith(prefix)) && !value.includes("://") && looksLikeSecret(value);
+}
 function isSensitiveKeyName(keyName) {
-  return SENSITIVE_KEY_WORD.test(keyName) || SEGMENTED_KEY_WORD.test(keyName) || CAMEL_CASE_KEY_WORD.test(keyName);
+  return keyName !== "PWD" && (SENSITIVE_KEY_WORD.test(keyName) || SEGMENTED_KEY_WORD.test(keyName) || CAMEL_CASE_KEY_WORD.test(keyName) || SHORT_PASSWORD_NAME.test(keyName));
+}
+function shouldRedactAssignment(prefix, keyName, value, offset, content, commandContext) {
+  if (keyName.toLowerCase() === "key" && /[?&]/.test(content[offset - 1] ?? "")) {
+    return false;
+  }
+  return isSensitiveKeyName(keyName) || commandContext && prefix.trimEnd().endsWith("=") && looksLikeAssignmentSecret(value);
+}
+function redactAssignments(content, commandContext) {
+  let sanitized = content.replace(unquotedSensitiveKeyValuePattern, (match, prefix, keyName, valueQuote, value, offset, input) => shouldRedactAssignment(prefix, keyName, value, offset, input, commandContext) ? `${prefix}${valueQuote}${SECRET_PLACEHOLDER}${valueQuote}` : match);
+  sanitized = sanitized.replace(bareSensitiveKeyValuePattern, (match, prefix, keyName, value, offset, input) => shouldRedactAssignment(prefix, keyName, value, offset, input, commandContext) ? `${prefix}${SECRET_PLACEHOLDER}` : match);
+  return sanitized;
 }
 function redactSecrets(content) {
   let sanitized = content;
@@ -18230,73 +18618,188 @@ function redactSecrets(content) {
   sanitized = sanitized.replace(CREDENTIAL_QUERY_PATTERN, `$1${SECRET_PLACEHOLDER}`);
   sanitized = sanitized.replace(KEY_QUERY_PATTERN, (match, prefix, value) => looksLikeSecret(value) ? `${prefix}${SECRET_PLACEHOLDER}` : match);
   sanitized = sanitized.replace(quotedSensitiveKeyValuePattern, (match, prefix, _keyQuote, keyName, valueQuote) => isSensitiveKeyName(keyName) ? `${prefix}${valueQuote}${SECRET_PLACEHOLDER}${valueQuote}` : match);
-  sanitized = sanitized.replace(unquotedSensitiveKeyValuePattern, (match, prefix, keyName, valueQuote) => isSensitiveKeyName(keyName) ? `${prefix}${valueQuote}${SECRET_PLACEHOLDER}${valueQuote}` : match);
-  sanitized = sanitized.replace(bareSensitiveKeyValuePattern, (match, prefix, keyName) => isSensitiveKeyName(keyName) ? `${prefix}${SECRET_PLACEHOLDER}` : match);
+  sanitized = redactAssignments(sanitized, false);
   sanitized = sanitized.replace(/\b([a-z][a-z0-9+.-]*:\/\/)[^@\s/?#]+@/gi, `$1${URL_CREDENTIAL_PLACEHOLDER}@`);
   sanitized = sanitized.replace(/\b[A-Z0-9._%+-]+@[A-Z0-9.-]+\.[A-Z]{2,}\b/gi, "<EMAIL>");
+  sanitized = sanitized.replace(/^([^\r\n]*\bbash spawned task=[^\r\n]*? cmd=)([^\r\n]*)/gm, (_match, prefix, command) => `${prefix}${redactAssignments(command, true)}`);
   return sanitized;
 }
-function sanitizeContent(content) {
-  const username = userInfo().username;
-  const home = homedir17();
+function sanitizeContent(content, context = {}) {
+  const username = context.username ?? userInfo().username;
+  const home = context.home ?? homedir17();
   let sanitized = redactSecrets(content);
   const cwd = process.cwd();
-  for (const candidate of new Set([cwd, safeRealpath(cwd)])) {
-    if (candidate && candidate !== "/" && candidate !== home) {
-      sanitized = sanitized.replace(new RegExp(escapeRegex(candidate), "g"), "<PROJECT>");
+  const roots = new Set([
+    cwd,
+    safeRealpath(cwd),
+    ...(context.projectRoots ?? []).flatMap((root) => root.startsWith("~/") ? [root, home + root.slice(1)] : [root]),
+    ...reportProjectRoots(decodedView(content).text)
+  ]);
+  const candidates = [...roots].filter((root) => Boolean(root));
+  for (const root of candidates) {
+    const real = safeRealpath(root);
+    if (real)
+      roots.add(real);
+  }
+  for (const root of [...roots].filter((root) => Boolean(root)).sort((a, b) => b.length - a.length)) {
+    if (/^(?:\/|[A-Za-z]:[/\\]|~\/)/.test(root) && root !== home && !/^(?:[/\\]|[A-Za-z]:[/\\])$/.test(root)) {
+      sanitized = replacePath(sanitized, root, "<PROJECT>");
+    }
+  }
+  if (home && home !== "/")
+    sanitized = replacePath(sanitized, home, "~");
+  sanitized = replaceDecoded(sanitized, /(?:(?<![\p{L}\p{N}_/.-])|(?<=file:\/\/)|(?<=file:\/\/\/))(?:\/(?:home|Users)\/|[A-Za-z]:\/Users\/)([^/\s"'<>`,;:?#&()[\]{}=]+)/gu, (match) => ({ offset: match[0].length - match[1].length, value: "<USER>" }));
+  return redactUsername(sanitized, username);
+}
+function decodedView(content) {
+  let units = Array.from({ length: content.length }, (_, i) => ({
+    char: content[i],
+    start: i,
+    end: i + 1
+  }));
+  const decoded = [];
+  for (let i = 0;i < units.length; ) {
+    const byte = content.slice(i, i + 3);
+    const first = /^%[\da-f]{2}$/i.test(byte) ? Number.parseInt(byte.slice(1), 16) : -1;
+    const width = first < 128 ? 1 : first >= 194 && first <= 223 ? 2 : first <= 239 ? 3 : 4;
+    const spelling = content.slice(i, i + width * 3);
+    if (first >= 0 && /^(?:%[\da-f]{2})+$/i.test(spelling)) {
+      try {
+        const value = decodeURIComponent(spelling);
+        for (const char of value.split(""))
+          decoded.push({ char, start: i, end: i + spelling.length });
+        i += spelling.length;
+        continue;
+      } catch {}
     }
+    decoded.push(units[i++]);
   }
-  if (home) {
-    sanitized = sanitized.replace(new RegExp(escapeRegex(home), "g"), "~");
+  units = [];
+  for (let i = 0;i < decoded.length; i++) {
+    const unit = decoded[i];
+    const next = decoded[i + 1];
+    if (unit.char === "\\" && next && (next.char === "/" || next.char === "\\")) {
+      units.push({ char: "/", start: unit.start, end: next.end });
+      i++;
+    } else
+      units.push({ ...unit, char: unit.char === "\\" ? "/" : unit.char });
   }
-  sanitized = sanitized.replace(/\/Users\/[^/\s"']+/g, "/Users/<USER>");
-  sanitized = sanitized.replace(/\/home\/[^/\s"']+/g, "/home/<USER>");
-  sanitized = sanitized.replace(/([A-Za-z]:\\\\Users\\\\)[^\\\\"'\s]+/g, "$1<USER>");
-  sanitized = sanitized.replace(/([A-Za-z]:\\Users\\)[^\\"'\s]+/g, "$1<USER>");
-  sanitized = sanitized.replace(/([A-Za-z]:\/Users\/)[^/\s"']+/g, "$1<USER>");
-  if (username) {
-    sanitized = redactUsername(sanitized, username);
+  return { text: units.map((unit) => unit.char).join(""), units };
+}
+function replaceDecoded(content, pattern, replacement) {
+  const view = decodedView(content);
+  let result = "";
+  let cursor = 0;
+  for (const match of view.text.matchAll(pattern)) {
+    const change = replacement(match);
+    if (!change)
+      continue;
+    const { offset, value } = change;
+    const start = view.units[match.index + offset].start;
+    const end = view.units[match.index + match[0].length - 1].end;
+    result += content.slice(cursor, start) + value;
+    cursor = end;
   }
-  return sanitized;
+  return result + content.slice(cursor);
+}
+function replacePath(content, path, value) {
+  const normalized = path.replace(/\\/g, "/").replace(/\/+$/, "");
+  if (!normalized)
+    return content;
+  const pattern = new RegExp(`(?:(?<![\\p{L}\\p{N}_/.-])|(?<=file://)|(?<=file:///))${escapeRegex(normalized)}(?=$|[/\\s"'<>\`,;:)\\]?#&])`, /^[A-Za-z]:/.test(path) ? "giu" : "gu");
+  return replaceDecoded(content, pattern, () => ({ offset: 0, value }));
+}
+function reportProjectRoots(content) {
+  return [
+    ...content.matchAll(/(?:project root set: |watcher started: )([^\r\n]+)/g),
+    ...content.matchAll(/(?:\broot=|"(?:projectRoot|project_root|canonical_root)"\s*:\s*)("[^"]+"|'[^']+'|[^\s"'<>`,;]+)/g)
+  ].map((match) => match[1].trim().replace(/^["']|["']$/g, "")).filter((root) => /^(?:\/|[A-Za-z]:\/)/.test(root));
+}
+function sanitizeValue(value, context = {}) {
+  const scoped = {
+    ...context,
+    projectRoots: [...context.projectRoots ?? [], ...projectRootsFromValue(value)]
+  };
+  return sanitizeNestedValue(value, scoped);
 }
-function sanitizeValue(value) {
+function sanitizeNestedValue(value, context) {
   if (typeof value === "string") {
-    return sanitizeContent(value);
+    return sanitizeContent(value, context);
   }
   if (Array.isArray(value)) {
-    return value.map((entry) => sanitizeValue(entry));
+    return value.map((entry) => sanitizeNestedValue(entry, context));
   }
   if (value && typeof value === "object") {
-    return Object.fromEntries(Object.entries(value).map(([key, entry]) => [key, sanitizeValue(entry)]));
+    return Object.fromEntries(Object.entries(value).map(([key, entry]) => [key, sanitizeNestedValue(entry, context)]));
   }
   return value;
 }
+function projectRootsFromValue(value) {
+  if (!value || typeof value !== "object")
+    return [];
+  if (Array.isArray(value))
+    return value.flatMap(projectRootsFromValue);
+  const object = value;
+  const roots = [object.projectRoot, object.project_root, object.canonical_root].filter((root) => typeof root === "string");
+  const index = object.index;
+  if (index && Array.isArray(index.roots)) {
+    for (const root of index.roots)
+      if (root && typeof root.path === "string")
+        roots.push(root.path);
+  }
+  return [...roots, ...Object.values(object).flatMap(projectRootsFromValue)];
+}
 function redactUsername(content, username) {
   if (!username)
     return content;
-  return content.replace(new RegExp(`(?<![\\p{L}\\p{N}_])${escapeRegex(username)}(?![\\p{L}\\p{N}_])`, "gu"), "<USER>");
+  if (!COMMON_ACCOUNT_NAMES.has(username.toLowerCase())) {
+    return replaceDecoded(content, new RegExp(`(?<![\\p{L}\\p{N}_])${escapeRegex(username)}(?![\\p{L}\\p{N}_])`, "gu"), () => ({ offset: 0, value: "<USER>" }));
+  }
+  return replaceDecoded(content, new RegExp(`(?<![\\p{L}\\p{N}_/.-])~${escapeRegex(username)}(?![\\p{L}\\p{N}_])|(?<![\\p{L}\\p{N}_/.-])${escapeRegex(username)}(?=@[\\p{L}\\p{N}])`, "gu"), (match) => ({ offset: match[0].startsWith("~") ? 1 : 0, value: "<USER>" }));
 }
-var SECRET_PLACEHOLDER = "<REDACTED_SECRET>", URL_CREDENTIAL_PLACEHOLDER = "***", KEY_NAME = "[A-Za-z_][A-Za-z0-9_.-]*", SENSITIVE_KEY_WORD, SEGMENTED_KEY_WORD, CAMEL_CASE_KEY_WORD, JWT_PATTERN, AWS_ACCESS_KEY_ID_PATTERN, CREDENTIAL_QUERY_PATTERN, KEY_QUERY_PATTERN, quotedSensitiveKeyValuePattern, unquotedSensitiveKeyValuePattern, bareSensitiveKeyValuePattern;
+var SECRET_PLACEHOLDER = "<REDACTED_SECRET>", URL_CREDENTIAL_PLACEHOLDER = "***", KEY_NAME = "[A-Za-z_][A-Za-z0-9_.-]*", SENSITIVE_KEY_WORD, SEGMENTED_KEY_WORD, CAMEL_CASE_KEY_WORD, SHORT_PASSWORD_NAME, JWT_PATTERN, AWS_ACCESS_KEY_ID_PATTERN, CREDENTIAL_QUERY_PATTERN, KEY_QUERY_PATTERN, quotedSensitiveKeyValuePattern, unquotedSensitiveKeyValuePattern, bareSensitiveKeyValuePattern, COMMON_ACCOUNT_NAMES;
 var init_sanitize = __esm(() => {
   SENSITIVE_KEY_WORD = /(?:token|password|secret|api[_-]?key|passwd|pwd|credential)/i;
   SEGMENTED_KEY_WORD = /(?:^|[_.-])key(?:$|[_.-])/i;
   CAMEL_CASE_KEY_WORD = /[a-z0-9]Key(?:$|[A-Z_.-])/;
+  SHORT_PASSWORD_NAME = /(?:^|_)(?:pw|pass)$/i;
   JWT_PATTERN = /\beyJ[A-Za-z0-9_-]+\.eyJ[A-Za-z0-9_-]+\.[A-Za-z0-9_-]+\b/g;
   AWS_ACCESS_KEY_ID_PATTERN = /\b(?:AKIA|ASIA|AGPA|AIDA|AROA)[A-Z0-9]{16}\b/g;
   CREDENTIAL_QUERY_PATTERN = /([?&](?:[a-z0-9_-]*token|api[_-]?key|apikey|[a-z0-9_-]*secret|password|passwd|pwd)=)[^&\s#"'<>]+/gi;
   KEY_QUERY_PATTERN = /([?&]key=)([^&\s#"'<>]+)/gi;
   quotedSensitiveKeyValuePattern = new RegExp(String.raw`((['"])(${KEY_NAME})\2[^\S\r\n]*:[^\S\r\n]*)(['"])([^'"\r\n]+)\4`, "gi");
   unquotedSensitiveKeyValuePattern = new RegExp(String.raw`\b((${KEY_NAME})[^\S\r\n]*[=:][^\S\r\n]*)(['"])([^'"\r\n]+)\3`, "gi");
-  bareSensitiveKeyValuePattern = new RegExp(String.raw`\b((${KEY_NAME})[^\S\r\n]*[=:][^\S\r\n]*)([^\s,;&'"]+)`, "gi");
+  bareSensitiveKeyValuePattern = new RegExp(String.raw`\b((${KEY_NAME})[^\S\r\n]*[=:][^\S\r\n]*)([^\s,;&|<>()'"]+)`, "gi");
+  COMMON_ACCOUNT_NAMES = new Set([
+    "root",
+    "admin",
+    "administrator",
+    "user",
+    "dev",
+    "developer",
+    "test",
+    "guest",
+    "ubuntu",
+    "debian",
+    "pi",
+    "runner",
+    "vagrant",
+    "ec2-user",
+    "centos",
+    "git",
+    "docker",
+    "build",
+    "ci"
+  ]);
 });
 
 // src/lib/bridge-tool-failures.ts
-import { closeSync as closeSync8, existsSync as existsSync20, openSync as openSync8, readSync as readSync6, statSync as statSync13 } from "node:fs";
+import { closeSync as closeSync8, existsSync as existsSync21, openSync as openSync8, readSync as readSync6, statSync as statSync13 } from "node:fs";
 function resolveBridgePluginLogPath() {
   return resolvePluginLogPath();
 }
 function tailLogFileBytes(path, maxBytes) {
-  if (!existsSync20(path) || maxBytes <= 0)
+  if (!existsSync21(path) || maxBytes <= 0)
     return "";
   let fd = null;
   try {
@@ -18432,9 +18935,9 @@ var init_bridge_tool_failures = __esm(() => {
 });
 
 // src/lib/build-breaker.ts
-import { existsSync as existsSync21, readdirSync as readdirSync8 } from "node:fs";
+import { existsSync as existsSync22, readdirSync as readdirSync9 } from "node:fs";
 import { createRequire as createRequire3 } from "node:module";
-import { join as join25 } from "node:path";
+import { join as join26 } from "node:path";
 function loadDatabaseSync() {
   const require2 = createRequire3(import.meta.url);
   try {
@@ -18448,11 +18951,11 @@ function loadDatabaseSync() {
   }
 }
 function buildBreakerDatabases(storageRoot) {
-  const callgraphRoot = join25(storageRoot, "callgraph");
-  if (!existsSync21(callgraphRoot))
+  const callgraphRoot = join26(storageRoot, "callgraph");
+  if (!existsSync22(callgraphRoot))
     return [];
   try {
-    return readdirSync8(callgraphRoot, { withFileTypes: true }).filter((entry) => entry.isDirectory()).map((entry) => join25(callgraphRoot, entry.name, "build-breaker.sqlite")).filter((path) => existsSync21(path));
+    return readdirSync9(callgraphRoot, { withFileTypes: true }).filter((entry) => entry.isDirectory()).map((entry) => join26(callgraphRoot, entry.name, "build-breaker.sqlite")).filter((path) => existsSync22(path));
   } catch {
     return [];
   }
@@ -18528,15 +19031,15 @@ var init_build_breaker = __esm(() => {
 });
 
 // src/lib/config-migration.ts
-import { existsSync as existsSync22, readFileSync as readFileSync14 } from "node:fs";
+import { existsSync as existsSync23, readFileSync as readFileSync15 } from "node:fs";
 function isRecord2(value) {
   return typeof value === "object" && value !== null && !Array.isArray(value);
 }
 function readPlainConfig(path) {
-  if (!existsSync22(path))
+  if (!existsSync23(path))
     return null;
   try {
-    const plain = JSON.parse(JSON.stringify(import_comment_json2.parse(readFileSync14(path, "utf8"))));
+    const plain = JSON.parse(JSON.stringify(import_comment_json2.parse(readFileSync15(path, "utf8"))));
     return isRecord2(plain) ? plain : null;
   } catch {
     return null;
@@ -18544,10 +19047,10 @@ function readPlainConfig(path) {
 }
 function configMigrationTargets(userConfigPath, cwd = process.cwd()) {
   const targets = [];
-  if (existsSync22(userConfigPath))
+  if (existsSync23(userConfigPath))
     targets.push({ path: userConfigPath, tier: "user" });
   const project = resolveCortexKitProjectConfigPath(cwd);
-  if (project !== userConfigPath && existsSync22(project)) {
+  if (project !== userConfigPath && existsSync23(project)) {
     targets.push({ path: project, tier: "project" });
   }
   return targets;
@@ -18591,6 +19094,7 @@ function previewConfigMigration(targets) {
     const translation = translateConfigDocument(translated, target.tier);
     if (!translation.legacyInput)
       continue;
+    dropRemovedDataLayerKeys(translated);
     const changes = diffConfig(raw, translated);
     previews.push({ ...target, changes });
   }
@@ -18612,21 +19116,27 @@ var init_config_migration = __esm(() => {
   import_comment_json2 = __toESM(require_src2(), 1);
 });
 
+// src/lib/doctor-labels.ts
+function describeCliBinary(version, path) {
+  return CLI_BINARY_LABEL.replace("<version>", version ?? "unknown").replace("<path>", path ?? "unknown");
+}
+var CLI_BINARY_LABEL = "AFT binary this CLI found: <version> at <path> (the plugin may run a different one)", CLI_VERSION_CACHED_LABEL = "Cached binary for this CLI";
+
 // src/lib/legacy-storage.ts
-import { existsSync as existsSync23, readdirSync as readdirSync9, statSync as statSync14 } from "node:fs";
-import { join as join26 } from "node:path";
+import { existsSync as existsSync24, readdirSync as readdirSync10, statSync as statSync14 } from "node:fs";
+import { join as join27 } from "node:path";
 function summarizeLegacyPartitionDuplication(storageRoot) {
-  if (!existsSync23(storageRoot)) {
+  if (!existsSync24(storageRoot)) {
     return { totalPartitions: 0, totalBytes: 0, byHarness: [] };
   }
   const byHarness = [];
   for (const harness of safeReadDir(storageRoot)) {
-    const harnessPath = join26(storageRoot, harness);
+    const harnessPath = join27(storageRoot, harness);
     if (!isDirectory(harnessPath))
       continue;
     const partitions = new Map;
-    collectCallgraphPartitions(join26(harnessPath, "callgraph"), partitions);
-    collectInspectPartitions(join26(harnessPath, "inspect"), partitions);
+    collectCallgraphPartitions(join27(harnessPath, "callgraph"), partitions);
+    collectInspectPartitions(join27(harnessPath, "inspect"), partitions);
     if (partitions.size === 0)
       continue;
     let bytes = 0;
@@ -18645,7 +19155,7 @@ function collectCallgraphPartitions(domainPath, partitions) {
   if (!isDirectory(domainPath))
     return;
   for (const name of safeReadDir(domainPath)) {
-    const path = join26(domainPath, name);
+    const path = join27(domainPath, name);
     if (isDirectory(path)) {
       if (!looksLikePartitionKey(name))
         continue;
@@ -18662,7 +19172,7 @@ function collectInspectPartitions(domainPath, partitions) {
   if (!isDirectory(domainPath))
     return;
   for (const name of safeReadDir(domainPath)) {
-    const path = join26(domainPath, name);
+    const path = join27(domainPath, name);
     if (isDirectory(path)) {
       if (!looksLikePartitionKey(name))
         continue;
@@ -18711,7 +19221,7 @@ function looksLikePartitionKey(value) {
 }
 function safeReadDir(path) {
   try {
-    return readdirSync9(path).sort((left, right) => left.localeCompare(right));
+    return readdirSync10(path).sort((left, right) => left.localeCompare(right));
   } catch {
     return [];
   }
@@ -18737,22 +19247,22 @@ var init_legacy_storage = __esm(() => {
 });
 
 // src/lib/lsp-cache.ts
-import { existsSync as existsSync24, readdirSync as readdirSync10, rmSync as rmSync6, statSync as statSync15 } from "node:fs";
-import { join as join27 } from "node:path";
+import { existsSync as existsSync25, readdirSync as readdirSync11, rmSync as rmSync6, statSync as statSync15 } from "node:fs";
+import { join as join28 } from "node:path";
 function inspectDir(path) {
-  if (!existsSync24(path)) {
+  if (!existsSync25(path)) {
     return { entries: [], totalSize: 0 };
   }
   const entries = [];
   let totalSize = 0;
   let names;
   try {
-    names = readdirSync10(path);
+    names = readdirSync11(path);
   } catch {
     return { entries: [], totalSize: 0 };
   }
   for (const name of names) {
-    const full = join27(path, name);
+    const full = join28(path, name);
     try {
       if (!statSync15(full).isDirectory())
         continue;
@@ -18814,8 +19324,8 @@ var init_lsp_cache = __esm(() => {
 });
 
 // src/lib/onnx.ts
-import { existsSync as existsSync25, readdirSync as readdirSync11, readlinkSync as readlinkSync2, realpathSync as realpathSync7 } from "node:fs";
-import { basename as basename2, isAbsolute as isAbsolute8, join as join28, resolve as resolve14, win32 as win323 } from "node:path";
+import { existsSync as existsSync26, readdirSync as readdirSync12, readlinkSync as readlinkSync2, realpathSync as realpathSync7 } from "node:fs";
+import { basename as basename2, isAbsolute as isAbsolute8, join as join29, resolve as resolve14, win32 as win323 } from "node:path";
 function getOnnxLibraryName() {
   if (process.platform === "darwin")
     return "libonnxruntime.dylib";
@@ -18867,7 +19377,7 @@ function isWindowsSystem32Directory2(dir) {
 }
 function directoryContainsLibrary2(dir, libName) {
   try {
-    const entries = readdirSync11(dir);
+    const entries = readdirSync12(dir);
     if (process.platform === "win32") {
       const expected = libName.toLowerCase();
       return entries.some((entry) => entry.toLowerCase() === expected);
@@ -18885,7 +19395,7 @@ function findIgnoredWindowsSystemOnnxRuntime() {
   for (const root of windowsRoots) {
     if (!root)
       continue;
-    const systemDir = join28(root, "System32");
+    const systemDir = join29(root, "System32");
     const key = win323.resolve(systemDir).toLowerCase();
     if (seen.has(key))
       continue;
@@ -18907,21 +19417,21 @@ function inspectSystemOnnxRuntime(searchPathsOverride) {
     searchPaths.push(...pathEntriesForPlatform2());
     const programFiles = process.env.ProgramFiles ?? "C:\\Program Files";
     const programFilesX86 = process.env["ProgramFiles(x86)"] ?? "C:\\Program Files (x86)";
-    searchPaths.push(join28(programFiles, "onnxruntime", "lib"), join28(programFiles, "Microsoft ONNX Runtime", "lib"), join28(programFiles, "Microsoft Machine Learning", "lib"), join28(programFilesX86, "onnxruntime", "lib"), ...(() => {
+    searchPaths.push(join29(programFiles, "onnxruntime", "lib"), join29(programFiles, "Microsoft ONNX Runtime", "lib"), join29(programFiles, "Microsoft Machine Learning", "lib"), join29(programFilesX86, "onnxruntime", "lib"), ...(() => {
       const nugetPaths = [];
       const userProfile = process.env.USERPROFILE ?? "";
       if (!userProfile)
         return nugetPaths;
-      const nugetPackageDir = join28(userProfile, ".nuget", "packages", "microsoft.ml.onnxruntime");
-      if (!existsSync25(nugetPackageDir))
+      const nugetPackageDir = join29(userProfile, ".nuget", "packages", "microsoft.ml.onnxruntime");
+      if (!existsSync26(nugetPackageDir))
         return nugetPaths;
       try {
-        for (const entry of readdirSync11(nugetPackageDir, { withFileTypes: true })) {
+        for (const entry of readdirSync12(nugetPackageDir, { withFileTypes: true })) {
           if (!entry.isDirectory())
             continue;
           if (entry.name === "__globalPackagesFolder" || entry.name.startsWith("."))
             continue;
-          nugetPaths.push(join28(nugetPackageDir, entry.name, "runtimes", "win-x64", "native"), join28(nugetPackageDir, entry.name, "runtimes", "win-arm64", "native"));
+          nugetPaths.push(join29(nugetPackageDir, entry.name, "runtimes", "win-x64", "native"), join29(nugetPackageDir, entry.name, "runtimes", "win-arm64", "native"));
         }
       } catch {}
       return nugetPaths;
@@ -18940,7 +19450,7 @@ function inspectSystemOnnxRuntime(searchPathsOverride) {
     if (!directoryContainsLibrary2(dir, libName))
       continue;
     if (process.platform !== "win32") {
-      const probe = probeOnnxRuntimeLoadable(join28(dir, libName));
+      const probe = probeOnnxRuntimeLoadable(join29(dir, libName));
       if (!probe.loadable) {
         ignored ??= { path: dir, reason: `unloadable: ${probe.reason} — ignored` };
         continue;
@@ -18960,12 +19470,12 @@ function inspectSystemOnnxRuntime(searchPathsOverride) {
   return { path: unknownVersionPaths[0] ?? null, ignored };
 }
 function findCachedOnnxRuntime2(storageDir) {
-  const ortDir = join28(storageDir, "onnxruntime", ONNX_RUNTIME_VERSION);
+  const ortDir = join29(storageDir, "onnxruntime", ONNX_RUNTIME_VERSION);
   const libName = getOnnxLibraryName();
-  if (existsSync25(join28(ortDir, libName)))
+  if (existsSync26(join29(ortDir, libName)))
     return ortDir;
-  const libSubdir = join28(ortDir, "lib");
-  if (existsSync25(join28(libSubdir, libName)))
+  const libSubdir = join29(ortDir, "lib");
+  if (existsSync26(join29(libSubdir, libName)))
     return libSubdir;
   return null;
 }
@@ -18986,16 +19496,16 @@ function parseOrtVersionFromDirectoryPath(value) {
   return null;
 }
 function detectOrtVersion(libDir) {
-  if (!existsSync25(libDir))
+  if (!existsSync26(libDir))
     return null;
   const libName = getOnnxLibraryName();
   try {
-    const resolved = parseOrtVersionFromPath(realpathSync7(join28(libDir, libName)));
+    const resolved = parseOrtVersionFromPath(realpathSync7(join29(libDir, libName)));
     if (resolved && resolved !== INVALID_ORT_VERSION2)
       return resolved;
   } catch {}
   try {
-    const entries = readdirSync11(libDir);
+    const entries = readdirSync12(libDir);
     const barePrefix = libName.replace(/\.(so|dylib|dll)$/, "");
     const expectedPrefix = process.platform === "win32" ? barePrefix.toLowerCase() : barePrefix;
     for (const entry of entries) {
@@ -19006,8 +19516,8 @@ function detectOrtVersion(libDir) {
       if (version)
         return version;
     }
-    const base = join28(libDir, libName);
-    if (existsSync25(base)) {
+    const base = join29(libDir, libName);
+    if (existsSync26(base)) {
       try {
         const real = realpathSync7(base);
         const version = parseOrtVersionFromPath(real) ?? parseOrtVersionFromDirectoryPath(real);
@@ -19040,17 +19550,17 @@ var init_onnx = __esm(() => {
 });
 
 // src/lib/plugin-load.ts
-import { existsSync as existsSync26, readFileSync as readFileSync15 } from "node:fs";
+import { existsSync as existsSync27, readFileSync as readFileSync16 } from "node:fs";
 import { homedir as homedir18 } from "node:os";
-import { isAbsolute as isAbsolute9, join as join29, normalize } from "node:path";
+import { isAbsolute as isAbsolute9, join as join30, normalize } from "node:path";
 function isRecord3(value) {
   return typeof value === "object" && value !== null && !Array.isArray(value);
 }
 function readConfig(path) {
-  if (!existsSync26(path))
+  if (!existsSync27(path))
     return { value: null, error: null };
   try {
-    const parsed = import_comment_json3.parse(readFileSync15(path, "utf8"));
+    const parsed = import_comment_json3.parse(readFileSync16(path, "utf8"));
     const plain = JSON.parse(JSON.stringify(parsed));
     return isRecord3(plain) ? { value: plain, error: null } : { value: null, error: "the file is not a JSON object" };
   } catch (error) {
@@ -19106,7 +19616,7 @@ function evaluatePluginLoad(input) {
   const raw = typeof subc?.connection_file === "string" ? subc.connection_file.trim() : "";
   if (raw.length > 0) {
     const resolved = resolveSubcConnectionPath(raw, input.home);
-    if (!existsSync26(resolved)) {
+    if (!existsSync27(resolved)) {
       const toolCallError = formatConfigErrorMessage(formatSubcConnectionMissingMessage(raw, resolved));
       blockers.push({
         code: "subc_connection_missing",
@@ -19125,7 +19635,7 @@ function evaluatePluginLoad(input) {
   const storage = loaded.user && isRecord3(loaded.user.storage) ? loaded.user.storage : null;
   const requested = typeof storage?.cache_dir === "string" ? storage.cache_dir : "";
   const home = input.home ?? homedir18();
-  const expanded = requested === "~" ? home : requested.startsWith("~/") || requested.startsWith("~\\") ? join29(home, requested.slice(2)) : requested;
+  const expanded = requested === "~" ? home : requested.startsWith("~/") || requested.startsWith("~\\") ? join30(home, requested.slice(2)) : requested;
   return {
     ...isAbsolute9(expanded) ? { cacheDir: normalize(expanded) } : {},
     blockers,
@@ -19145,15 +19655,16 @@ import {
   accessSync as accessSync3,
   closeSync as closeSync9,
   constants as constants5,
-  existsSync as existsSync27,
+  existsSync as existsSync28,
   openSync as openSync9,
   readSync as readSync7,
   statSync as statSync16
 } from "node:fs";
-import { join as join30 } from "node:path";
+import { join as join31 } from "node:path";
 async function collectDiagnostics(adapters) {
   const cliVersion = getSelfVersion();
-  const binaryVersion = probeBinaryVersion(cliVersion);
+  const binaryProbe = probeAftBinary(cliVersion);
+  const binaryVersion = binaryProbe.version;
   const harnesses = [];
   for (const adapter of adapters) {
     harnesses.push(await diagnoseHarness(adapter));
@@ -19165,6 +19676,7 @@ async function collectDiagnostics(adapters) {
     nodeVersion: process.version,
     cliVersion,
     binaryVersion,
+    binaryPath: binaryProbe.path,
     harnesses,
     binaryCache: getBinaryCacheInfo(cliVersion),
     lspCache: getLspCacheReport(),
@@ -19185,7 +19697,7 @@ async function diagnoseHarness(adapter) {
   const logPath = adapter.getLogFile();
   const pluginCache = adapter.getPluginCacheInfo();
   const storageAccessible = (() => {
-    if (!existsSync27(storage))
+    if (!existsSync28(storage))
       return false;
     try {
       accessSync3(storage, constants5.R_OK | constants5.W_OK);
@@ -19220,7 +19732,7 @@ async function diagnoseHarness(adapter) {
     pluginRegistered: adapter.hasPluginEntry(),
     configPaths,
     aftConfig: {
-      exists: existsSync27(configPaths.aftConfig),
+      exists: existsSync28(configPaths.aftConfig),
       ...aftConfigRead.error ? { parseError: aftConfigRead.error } : {},
       enabled: aftEnabled,
       ...aftEnabledSource ? { enabledSource: aftEnabledSource } : {},
@@ -19229,10 +19741,10 @@ async function diagnoseHarness(adapter) {
     pluginCache,
     storageDir: {
       path: storage,
-      exists: existsSync27(storage),
+      exists: existsSync28(storage),
       accessible: storageAccessible,
       sizesByKey: describeStorage,
-      ...pluginLoad.cacheDir ? { cacheRoot: join30(pluginLoad.cacheDir, "aft") } : {},
+      ...pluginLoad.cacheDir ? { cacheRoot: join31(pluginLoad.cacheDir, "aft") } : {},
       ...legacyDuplication.totalPartitions > 0 ? { legacyDuplication } : {}
     },
     onnxRuntime: {
@@ -19252,8 +19764,8 @@ async function diagnoseHarness(adapter) {
     },
     logFile: {
       path: logPath,
-      exists: existsSync27(logPath),
-      sizeKb: existsSync27(logPath) ? Math.round(statSync16(logPath).size / 1024) : 0
+      exists: existsSync28(logPath),
+      sizeKb: existsSync28(logPath) ? Math.round(statSync16(logPath).size / 1024) : 0
     },
     pluginLoad
   };
@@ -19262,7 +19774,7 @@ function renderDiagnosticsMarkdown(report) {
   const lines = [];
   lines.push(`- Timestamp: ${report.timestamp}`);
   lines.push(`- AFT CLI: v${report.cliVersion}`);
-  lines.push(`- AFT binary: ${report.binaryVersion ?? "unknown"}`);
+  lines.push(`- ${describeCliBinary(report.binaryVersion, report.binaryPath)}`);
   lines.push(`- OS: ${report.platform} ${report.arch}`);
   lines.push(`- Node: ${report.nodeVersion}`);
   const issues = collectDiagnosticIssues(report);
@@ -19279,7 +19791,7 @@ function renderDiagnosticsMarkdown(report) {
     lines.push(`- Host installed: ${h.hostInstalled}`);
     lines.push(`- Host version: ${h.hostVersion ?? "unknown"}`);
     lines.push(`- Plugin registered: ${h.pluginRegistered}`);
-    lines.push(`- Plugin version: ${h.pluginCache.cached ?? "not installed"}`);
+    lines.push(`- Plugin version: ${describePluginVersion(h.pluginCache)}`);
     lines.push(`- AFT enabled: ${h.aftConfig.enabled}${h.aftConfig.enabledSource ? ` (from ${h.aftConfig.enabledSource})` : ""}`);
     lines.push(`- AFT config parse error: ${h.aftConfig.parseError ?? "none"}`);
     lines.push("");
@@ -19314,7 +19826,8 @@ function renderDiagnosticsMarkdown(report) {
   lines.push("");
   lines.push("### Binary cache");
   lines.push("```json");
-  lines.push(JSON.stringify(report.binaryCache, null, 2));
+  const { activeVersion, ...cacheInventory } = report.binaryCache;
+  lines.push(JSON.stringify({ ...cacheInventory, [CLI_VERSION_CACHED_LABEL]: activeVersion }, null, 2));
   lines.push("```");
   lines.push("");
   lines.push("### LSP cache");
@@ -19347,6 +19860,8 @@ function openCodeEntryToPin(harness, cliVersion) {
   if (harness.kind !== "opencode")
     return null;
   const entry = harness.pluginCache.configuredEntry;
+  if (preserveDoctorPluginEntry(normalizeVersion(cliVersion), entry, doctorInstalledVersion(harness.pluginCache)))
+    return null;
   return entry && entry !== pinnedPluginEntry(normalizeVersion(cliVersion)) ? entry : null;
 }
 function pluginVersionSkewRemediation(harness, cliVersion, older) {
@@ -19362,12 +19877,23 @@ function pluginVersionSkewRemediation(harness, cliVersion, older) {
   return entry ? `Run \`${CLI} doctor --fix\` to pin the plugin entry to ${pinnedPluginEntry(version)} and ${change}.` : `Run \`${CLI} doctor --fix\` to ${change}.`;
 }
 function pluginVersionSkewIssue(harness, cliVersion) {
+  if (harness.pluginCache.local)
+    return null;
+  if (harness.kind === "opencode" && preserveDoctorPluginEntry(normalizeVersion(cliVersion), harness.pluginCache.configuredEntry, doctorInstalledVersion(harness.pluginCache))) {
+    return {
+      code: "plugin_cli_version_skew",
+      severity: "info",
+      scope: harness.displayName,
+      message: doctorNoDowngradeMessage(normalizeVersion(cliVersion), harness.pluginCache.configuredEntry, doctorInstalledVersion(harness.pluginCache)),
+      remediation: ""
+    };
+  }
   const pluginVersion = harness.pluginCache.cached;
   if (!pluginVersion)
     return null;
   if (normalizeVersion(pluginVersion) === normalizeVersion(cliVersion))
     return null;
-  const older = compareLooseSemver(pluginVersion, cliVersion) < 0;
+  const older = (compareSemver2(normalizeVersion(pluginVersion), normalizeVersion(cliVersion)) ?? compareLooseSemver(pluginVersion, cliVersion)) < 0;
   const skew = older ? `Plugin version (${pluginVersion}) is older than CLI (${cliVersion}). New binary cache won't be used until you update the plugin.` : `Plugin version (${pluginVersion}) does not match CLI (${cliVersion}). New binary cache may not be used until the plugin and CLI match.`;
   const entry = openCodeEntryToPin(harness, cliVersion);
   return {
@@ -19484,7 +20010,7 @@ function formatDiagnosticIssuesSection(report) {
   return lines;
 }
 function tailLogFile(path, lines) {
-  if (!existsSync27(path))
+  if (!existsSync28(path))
     return "";
   if (lines <= 0)
     return "";
@@ -19529,6 +20055,7 @@ var init_diagnostics = __esm(async () => {
   init_legacy_storage();
   init_lsp_cache();
   init_onnx();
+  init_opencode_plugin_cache();
   init_plugin_load();
   init_sanitize();
   init_self_version();
@@ -19684,14 +20211,14 @@ var init_issue_body = __esm(() => {
 
 // src/lib/onnx-fix.ts
 import { randomBytes as randomBytes2 } from "node:crypto";
-import { existsSync as existsSync28, mkdirSync as mkdirSync7, renameSync as renameSync6, rmSync as rmSync7 } from "node:fs";
-import { isAbsolute as isAbsolute10, join as join31, relative as relative4 } from "node:path";
+import { existsSync as existsSync29, mkdirSync as mkdirSync7, renameSync as renameSync6, rmSync as rmSync7 } from "node:fs";
+import { isAbsolute as isAbsolute10, join as join32, relative as relative4 } from "node:path";
 function findOnnxFixCandidates(report) {
   const candidates = [];
   for (const harness of report.harnesses) {
     if (!harness.onnxRuntime.required)
       continue;
-    const storageOnnxDir = join31(harness.storageDir.path, "onnxruntime");
+    const storageOnnxDir = join32(harness.storageDir.path, "onnxruntime");
     const systemTooOld = harness.onnxRuntime.systemPath !== null && harness.onnxRuntime.systemCompatible === false;
     const cachedTooOld = harness.onnxRuntime.cachedPath !== null && harness.onnxRuntime.cachedCompatible === false;
     const hasCompatibleCached = harness.onnxRuntime.cachedCompatible === true;
@@ -19700,7 +20227,7 @@ function findOnnxFixCandidates(report) {
         harness,
         reason: `cached ONNX Runtime at ${harness.onnxRuntime.cachedPath} is v${harness.onnxRuntime.cachedVersion}, but AFT requires ${harness.onnxRuntime.requirement}. AFT will stage and verify a managed replacement before removing it.`,
         storageOnnxDir,
-        storageOnnxBytes: existsSync28(storageOnnxDir) ? dirSize(storageOnnxDir) : 0
+        storageOnnxBytes: existsSync29(storageOnnxDir) ? dirSize(storageOnnxDir) : 0
       });
       continue;
     }
@@ -19709,7 +20236,7 @@ function findOnnxFixCandidates(report) {
         harness,
         reason: `system ONNX Runtime at ${harness.onnxRuntime.systemPath} is v${harness.onnxRuntime.systemVersion}, but AFT requires ${harness.onnxRuntime.requirement}, and no AFT-managed install is present. AFT will leave the system copy untouched and download v1.24 into managed storage.`,
         storageOnnxDir,
-        storageOnnxBytes: existsSync28(storageOnnxDir) ? dirSize(storageOnnxDir) : 0
+        storageOnnxBytes: existsSync29(storageOnnxDir) ? dirSize(storageOnnxDir) : 0
       });
       continue;
     }
@@ -19721,7 +20248,7 @@ function findOnnxFixCandidates(report) {
         harness,
         reason: `no compatible ONNX Runtime is installed.${ignoredCopy} AFT will download v1.24 into managed storage.`,
         storageOnnxDir,
-        storageOnnxBytes: existsSync28(storageOnnxDir) ? dirSize(storageOnnxDir) : 0
+        storageOnnxBytes: existsSync29(storageOnnxDir) ? dirSize(storageOnnxDir) : 0
       });
     }
   }
@@ -19730,11 +20257,11 @@ function findOnnxFixCandidates(report) {
 async function installManagedReplacement(candidate, ensureFn, rmFn) {
   const suffix = `${process.pid}.${Date.now().toString(36)}.${randomBytes2(6).toString("hex")}`;
   const stagingStorageDir = `${candidate.harness.storageDir.path}.onnx-fix.tmp.${suffix}`;
-  const stagedOnnxDir = join31(stagingStorageDir, "onnxruntime");
+  const stagedOnnxDir = join32(stagingStorageDir, "onnxruntime");
   const backupDir = `${candidate.storageOnnxDir}.backup.${suffix}`;
   try {
     const stagedInstalledPath = await ensureFn(stagingStorageDir);
-    if (!stagedInstalledPath || !existsSync28(stagedInstalledPath)) {
+    if (!stagedInstalledPath || !existsSync29(stagedInstalledPath)) {
       throw new Error("managed ONNX Runtime download was unavailable");
     }
     const installedRelativePath = relative4(stagedOnnxDir, stagedInstalledPath);
@@ -19742,7 +20269,7 @@ async function installManagedReplacement(candidate, ensureFn, rmFn) {
       throw new Error(`managed ONNX Runtime was installed outside staging: ${stagedInstalledPath}`);
     }
     mkdirSync7(candidate.harness.storageDir.path, { recursive: true });
-    const hadPrevious = existsSync28(candidate.storageOnnxDir);
+    const hadPrevious = existsSync29(candidate.storageOnnxDir);
     if (hadPrevious)
       renameSync6(candidate.storageOnnxDir, backupDir);
     try {
@@ -19766,7 +20293,7 @@ async function installManagedReplacement(candidate, ensureFn, rmFn) {
       }
     }
     return {
-      installedPath: join31(candidate.storageOnnxDir, installedRelativePath),
+      installedPath: join32(candidate.storageOnnxDir, installedRelativePath),
       clearedPrevious: hadPrevious && cleanupError === undefined,
       cleanupError
     };
@@ -19915,10 +20442,10 @@ var init_session_log = __esm(() => {
 });
 
 // src/lib/sessions.ts
-import { existsSync as existsSync29, readdirSync as readdirSync12, readFileSync as readFileSync16, statSync as statSync18 } from "node:fs";
+import { existsSync as existsSync30, readdirSync as readdirSync13, readFileSync as readFileSync17, statSync as statSync18 } from "node:fs";
 import { createRequire as createRequire4 } from "node:module";
 import { homedir as homedir19 } from "node:os";
-import { basename as basename3, join as join32 } from "node:path";
+import { basename as basename3, join as join33 } from "node:path";
 function listRecentSessions(adapter) {
   try {
     if (adapter.kind === "opencode")
@@ -19952,8 +20479,8 @@ function mapOpenCodeSessionRows(rows) {
   }).filter((session) => session !== null).sort((a, b) => b.lastActivity - a.lastActivity).slice(0, MAX_RECENT_SESSIONS);
 }
 function listRecentOpenCodeSessions() {
-  const dbPath = join32(getXdgDataHome(), "opencode", "opencode.db");
-  if (!existsSync29(dbPath))
+  const dbPath = join33(getXdgDataHome(), "opencode", "opencode.db");
+  if (!existsSync30(dbPath))
     return [];
   let db = null;
   try {
@@ -19972,10 +20499,10 @@ function listRecentOpenCodeSessions() {
 }
 function getXdgDataHome() {
   const xdgDataHome = process.env.XDG_DATA_HOME;
-  return xdgDataHome && xdgDataHome.length > 0 ? xdgDataHome : join32(homedir19(), ".local", "share");
+  return xdgDataHome && xdgDataHome.length > 0 ? xdgDataHome : join33(homedir19(), ".local", "share");
 }
 function listRecentPiSessions() {
-  return listPiSessionsFromDir(join32(getHomeDir(), ".pi", "agent", "sessions"));
+  return listPiSessionsFromDir(join33(getHomeDir(), ".pi", "agent", "sessions"));
 }
 function getHomeDir() {
   const envHome = process.platform === "win32" ? process.env.USERPROFILE : process.env.HOME;
@@ -19983,7 +20510,7 @@ function getHomeDir() {
 }
 function listPiSessionsFromDir(sessionsDir) {
   try {
-    if (!existsSync29(sessionsDir))
+    if (!existsSync30(sessionsDir))
       return [];
     const files = collectJsonlFiles(sessionsDir).map((filePath) => {
       try {
@@ -19995,7 +20522,7 @@ function listPiSessionsFromDir(sessionsDir) {
     }).filter((entry) => entry !== null).sort((a, b) => b.mtimeMs - a.mtimeMs).slice(0, MAX_RECENT_SESSIONS * 4);
     const sessions = [];
     for (const file of files) {
-      const parsed = parsePiSessionJsonl(readFileSync16(file.filePath, "utf8"), basename3(file.filePath));
+      const parsed = parsePiSessionJsonl(readFileSync17(file.filePath, "utf8"), basename3(file.filePath));
       if (!parsed)
         continue;
       sessions.push({ ...parsed, lastActivity: file.mtimeMs });
@@ -20016,12 +20543,12 @@ function collectJsonlFiles(root) {
       continue;
     let entries;
     try {
-      entries = readdirSync12(dir, { withFileTypes: true });
+      entries = readdirSync13(dir, { withFileTypes: true });
     } catch {
       continue;
     }
     for (const entry of entries) {
-      const path = join32(dir, entry.name);
+      const path = join33(dir, entry.name);
       if (entry.isDirectory()) {
         stack.push(path);
       } else if (entry.isFile() && entry.name.endsWith(".jsonl")) {
@@ -20122,19 +20649,19 @@ var init_sessions = __esm(() => {
 // src/commands/doctor.ts
 import {
   chmodSync as chmodSync4,
-  existsSync as existsSync30,
+  existsSync as existsSync31,
   lstatSync as lstatSync5,
   mkdirSync as mkdirSync8,
   mkdtempSync as mkdtempSync2,
-  readdirSync as readdirSync13,
-  readFileSync as readFileSync17,
+  readdirSync as readdirSync14,
+  readFileSync as readFileSync18,
   realpathSync as realpathSync8,
   rmSync as rmSync8,
   statSync as statSync19,
   writeFileSync as writeFileSync5
 } from "node:fs";
 import { tmpdir as tmpdir5 } from "node:os";
-import { dirname as dirname12, join as join33 } from "node:path";
+import { dirname as dirname13, join as join34 } from "node:path";
 function openCodeAdapter(adapters) {
   return adapters.find((adapter) => adapter.kind === "opencode");
 }
@@ -20157,7 +20684,7 @@ function refuseAmbiguousOpenCodeWrites(detection) {
 function adapterConfigNeedsUpdate(adapter, tui = false) {
   const method = tui ? "needsTuiPluginEntryUpdate" : "needsPluginEntryUpdate";
   const candidate = adapter;
-  return candidate[method]?.() ?? false;
+  return candidate[method]?.({ doctor: true }) ?? false;
 }
 function buildDoctorProfileArgs(argv) {
   const profileIndex = argv.indexOf("--profile");
@@ -20214,12 +20741,12 @@ async function runDoctor(options) {
     configPath: opencodeHarness.configPaths.harnessConfig,
     logPath: opencodeHarness.logFile.path,
     pluginCachePath: opencodeHarness.pluginCache.path,
-    cachedPluginVersion: opencodeHarness.pluginCache.cached,
+    cachedPluginVersion: doctorInstalledVersion(opencodeHarness.pluginCache),
     expectedPluginEntry: opencodeAdapter.pluginEntryWithVersion,
     acceptExplicitPluginVersion: hostDetection.status === "v1"
   }) : null;
   const opencodeSkew = opencodeHarness ? pluginVersionSkewFor(report, opencodeHarness) : null;
-  log2.info(`AFT CLI v${report.cliVersion}, AFT binary ${report.binaryVersion ?? "unknown"}`);
+  log2.info(`AFT CLI v${report.cliVersion}, ${describeCliBinary(report.binaryVersion, report.binaryPath)}`);
   if (!report.binaryVersion) {
     const hasEnabledRegisteredHarness = report.harnesses.some((h) => h.pluginRegistered && h.aftConfig.enabled);
     const hasRegisteredHarness = report.harnesses.some((h) => h.pluginRegistered);
@@ -20235,7 +20762,7 @@ async function runDoctor(options) {
     }
     logUnmatchedBinaryCandidates(report.cliVersion);
   }
-  log2.info(`Binary cache: ${report.binaryCache.versions.length} version(s), ${formatBytes(report.binaryCache.totalSize)} at ${report.binaryCache.path}`);
+  log2.info(`Binary cache: ${report.binaryCache.versions.length} version(s), ${formatBytes(report.binaryCache.totalSize)} at ${report.binaryCache.path}; ${CLI_VERSION_CACHED_LABEL}: ${report.binaryCache.activeVersion ?? "no"}`);
   logBuildBreakerSuspensions(report);
   const features = logFeatureStatus(options.argv, options.runNative, {
     checkGh: options.checkGh ?? checkGhStatus,
@@ -20274,6 +20801,8 @@ async function runDoctor(options) {
       }
       if (opencodeSkew)
         log2.error(`  ${opencodeSkew.message} ${opencodeSkew.remediation}`);
+      else if (opencodeDoctor?.versionNotice)
+        log2.info(`  ${opencodeDoctor.versionNotice}`);
       for (const hostTool of OPENCODE_HOST_TOOL_NAMES) {
         const line = hostToolDoctorLine(opencodeAdapter, hostTool);
         if (line)
@@ -20286,7 +20815,7 @@ async function runDoctor(options) {
     } else {
       log2.info(`  plugin registered: ${h.pluginRegistered ? "yes" : "no"}`);
     }
-    log2.info(`  plugin version: ${h.kind === "opencode" ? opencodeDoctor?.pluginVersion ?? h.pluginCache.cached ?? "not installed" : h.pluginCache.cached ?? "not installed"}`);
+    log2.info(`  plugin version: ${describePluginVersion(h.pluginCache)}`);
     if (!h.aftConfig.enabled) {
       log2.info(`  AFT disabled by config${h.aftConfig.enabledSource ? ` (${h.aftConfig.enabledSource})` : ""}; plugin will stay inert`);
     }
@@ -20545,7 +21074,7 @@ function clearOldBinaries(cliVersion = getSelfVersion(), plugins = getAllAdapter
     errors: [],
     keptVersion: keepTag
   };
-  if (!existsSync30(info.path)) {
+  if (!existsSync31(info.path)) {
     log2.info(`Binary cache: nothing to clear at ${info.path}`);
     return result;
   }
@@ -20576,7 +21105,7 @@ function clearOldBinaries(cliVersion = getSelfVersion(), plugins = getAllAdapter
     return result;
   }
   for (const version of stale) {
-    const dir = join33(info.path, version);
+    const dir = join34(info.path, version);
     let bytes = 0;
     try {
       bytes = statSync19(dir).isDirectory() ? dirSize(dir) : 0;
@@ -20640,9 +21169,14 @@ function findPluginUpdateTargets(adapters, report) {
     if (!harness.hostInstalled || !harness.pluginRegistered)
       continue;
     const cache = harness.pluginCache;
-    if (!cache?.exists || !cache.cached || !cache.latest)
+    if (cache.local)
+      continue;
+    const cliVersion = cache.cliVersion ?? cache.latest ?? report.cliVersion;
+    if (!cache?.exists || !cache.cached)
       continue;
-    if (cache.cached === cache.latest)
+    if (preserveDoctorPluginEntry(cliVersion, cache.configuredEntry, doctorInstalledVersion(cache)))
+      continue;
+    if ((compareSemver2(cache.cached, cliVersion) ?? 0) >= 0)
       continue;
     const adapter = adaptersByKind.get(harness.kind);
     if (!adapter)
@@ -20652,8 +21186,8 @@ function findPluginUpdateTargets(adapters, report) {
       adapter,
       installDir: cache.path,
       cached: cache.cached,
-      latest: cache.latest,
-      oldPin: pin !== null && pin !== cache.latest ? pin : null
+      latest: cliVersion,
+      oldPin: pin !== null && pin !== cliVersion ? pin : null
     });
   }
   return targets;
@@ -20736,9 +21270,9 @@ async function runDoctorNpmInstall(npm, installDir) {
   });
 }
 function installedPluginVersion(installDir) {
-  const manifest = join33(installDir, "node_modules", ...AFT_OPENCODE_PACKAGE.split("/"), "package.json");
+  const manifest = join34(installDir, "node_modules", ...AFT_OPENCODE_PACKAGE.split("/"), "package.json");
   try {
-    const pkg = JSON.parse(readFileSync17(manifest, "utf-8"));
+    const pkg = JSON.parse(readFileSync18(manifest, "utf-8"));
     return typeof pkg.version === "string" ? pkg.version : null;
   } catch {
     return null;
@@ -20838,7 +21372,7 @@ function buildDoctorFixPlan(adapters, report) {
     } else {
       items.push({
         kind: "plugin",
-        message: `Will ${harness.pluginRegistered ? "update" : "add"} ${adapter.pluginEntryWithVersion} ${harness.pluginRegistered ? "in" : "to"} ${harness.configPaths.harnessConfig}`
+        message: `Will ${harness.pluginRegistered ? "update" : "add"} ${adapter instanceof OpenCodeAdapter ? adapter.doctorPluginEntry() : adapter.pluginEntryWithVersion} ${harness.pluginRegistered ? "in" : "to"} ${harness.configPaths.harnessConfig}`
       });
     }
   }
@@ -20855,7 +21389,7 @@ function buildDoctorFixPlan(adapters, report) {
       continue;
     items.push({
       kind: "plugin",
-      message: `Will ${hasTuiEntry ? "update" : "add"} ${adapter.pluginEntryWithVersion} ${hasTuiEntry ? "in" : "to"} ${harness.configPaths.tuiConfig} (TUI sidebar)`
+      message: `Will ${hasTuiEntry ? "update" : "add"} ${adapter instanceof OpenCodeAdapter ? adapter.doctorPluginEntry(true) : adapter.pluginEntryWithVersion} ${hasTuiEntry ? "in" : "to"} ${harness.configPaths.tuiConfig} (TUI sidebar)`
     });
   }
   for (const { adapter, hostTool } of hostToolFixTargets(adapters)) {
@@ -20994,6 +21528,12 @@ async function runFixFlow(argv, detectOpenCodeHost, resolveAdapters = resolveAda
   }
   log2.info("Running diagnostics to identify auto-fixable issues…");
   const report = await collect(adapters);
+  for (const harness of report.harnesses) {
+    const cache = harness.pluginCache;
+    if (harness.kind === "opencode" && preserveDoctorPluginEntry(report.cliVersion, cache.configuredEntry, doctorInstalledVersion(cache))) {
+      log2.info(doctorNoDowngradeMessage(report.cliVersion, cache.configuredEntry, doctorInstalledVersion(cache)));
+    }
+  }
   if (!report.binaryVersion) {
     logUnmatchedBinaryCandidates(report.cliVersion);
   }
@@ -21197,14 +21737,14 @@ function formatDoctorStorageStatus(h) {
   let cacheWarning = "";
   if (h.storageDir.cacheRoot) {
     try {
-      const parent = realpathSync8(dirname12(h.storageDir.cacheRoot));
+      const parent = realpathSync8(dirname13(h.storageDir.cacheRoot));
       let durable = h.storageDir.path;
-      while (!existsSync30(durable) && dirname12(durable) !== durable)
-        durable = dirname12(durable);
+      while (!existsSync31(durable) && dirname13(durable) !== durable)
+        durable = dirname13(durable);
       let registered = false;
-      const history = join33(h.storageDir.path, "retention/cache-parents.json");
-      if (existsSync30(history)) {
-        const saved = JSON.parse(readFileSync17(history, "utf8"));
+      const history = join34(h.storageDir.path, "retention/cache-parents.json");
+      if (existsSync31(history)) {
+        const saved = JSON.parse(readFileSync18(history, "utf8"));
         registered = saved.parents?.some((entry) => entry.path === parent) === true;
       }
       if (!registered && statSync19(parent).dev === statSync19(durable).dev) {
@@ -21246,7 +21786,7 @@ function ensureStorageDirsForRegisteredPlugins(adapters) {
       if (!adapter.isInstalled() || !adapter.hasPluginEntry())
         continue;
       storageDir = adapter.getStorageDir();
-      if (existsSync30(storageDir))
+      if (existsSync31(storageDir))
         continue;
       mkdirSync8(storageDir, { recursive: true });
       summary.created += 1;
@@ -21309,7 +21849,7 @@ async function maybeFixPlugin(adapter) {
     return summary;
   if (!adapter.hasPluginEntry() || adapterConfigNeedsUpdate(adapter)) {
     log2.info(`${adapter.displayName}: attempting to register or update plugin config…`);
-    const result = await adapter.ensurePluginEntry();
+    const result = await adapter.ensurePluginEntry({ doctor: true });
     if (result.ok) {
       if (result.action === "added" || result.action === "updated")
         summary.changed += 1;
@@ -21322,7 +21862,7 @@ async function maybeFixPlugin(adapter) {
   if (adapter.ensureTuiPluginEntry && adapter.hasTuiPluginEntry && adapter.tuiPluginEntryApplies?.() !== false) {
     const hasTuiEntry = adapter.hasTuiPluginEntry();
     if (!hasTuiEntry || adapterConfigNeedsUpdate(adapter, true)) {
-      const result = await adapter.ensureTuiPluginEntry();
+      const result = await adapter.ensureTuiPluginEntry({ doctor: true });
       if (result.ok && (result.action === "added" || result.action === "updated")) {
         summary.changed += 1;
         log2.success(`${adapter.displayName}: ${result.message}`);
@@ -21407,11 +21947,11 @@ function deriveIssueTitleFromBody(body) {
 function writeIssueReviewFile(body) {
   let reviewDir = null;
   try {
-    reviewDir = mkdtempSync2(join33(tmpdir5(), "aft-issue-"));
+    reviewDir = mkdtempSync2(join34(tmpdir5(), "aft-issue-"));
     if (process.platform !== "win32") {
       chmodSync4(reviewDir, 448);
     }
-    const outPath = join33(reviewDir, "issue.md");
+    const outPath = join34(reviewDir, "issue.md");
     writeFileSync5(outPath, `${body}
 `, { encoding: "utf8", mode: 384, flag: "wx" });
     return { path: outPath, realPath: realpathSync8(outPath) };
@@ -21432,7 +21972,7 @@ function readReviewedIssueFile(reviewFile) {
       log2.error(`Review file path changed before filing; refusing to read ${reviewFile.path}.`);
       return null;
     }
-    return readFileSync17(reviewFile.path, "utf8");
+    return readFileSync18(reviewFile.path, "utf8");
   } catch (err) {
     log2.error(`Failed to read reviewed issue report: ${err instanceof Error ? err.message : String(err)}`);
     return null;
@@ -21477,14 +22017,14 @@ function collectIssueLog(path, selectedSession) {
   };
 }
 function collectIssueEngineLog(path, selectedSession) {
-  const directory = dirname12(path);
+  const directory = dirname13(path);
   const files = [];
   try {
-    for (const name of readdirSync13(directory)) {
+    for (const name of readdirSync14(directory)) {
       if (!/^aft-\d+\.log(?:\.1)?$/.test(name))
         continue;
       try {
-        const candidate = join33(directory, name);
+        const candidate = join34(directory, name);
         const stat = lstatSync5(candidate);
         if (stat.isFile())
           files.push({ path: candidate, modified: stat.mtimeMs });
@@ -21519,6 +22059,13 @@ async function runIssueFlow(argv) {
   const selectedSession = await promptForIssueSession(adapters[0]);
   const selectedBareSessionId = selectedSession?.id.replace(/^ses_/, "") ?? null;
   const report = await collectDiagnostics(adapters);
+  const sanitizeContext = {
+    projectRoots: [
+      ...adapters.flatMap((adapter) => projectRootsFromValue(readJsoncFile(adapter.detectConfigPaths().aftConfig).value)),
+      ...adapters.flatMap((adapter) => projectRootsFromValue(listRecentSessions(adapter))),
+      ...projectRootsFromValue(report)
+    ]
+  };
   const logResults = adapters.flatMap((adapter) => {
     const path = adapter.getLogFile();
     const { logText, errors, notice } = collectIssueLog(path, selectedSession);
@@ -21535,7 +22082,7 @@ ${logText || "<no log output>"}
         errors
       },
       {
-        section: `#### Engine logs (${dirname12(path)})
+        section: `#### Engine logs (${dirname13(path)})
 
 ${engine.notice}
 \`\`\`
@@ -21548,7 +22095,7 @@ ${engine.logText || "<no log output>"}
   });
   const logSections = logResults.map((result) => result.section).join(`
 `);
-  const recentErrorLines = extractRecentErrors(logResults.map((result) => sanitizeContent(result.errors)).join(`
+  const recentErrorLines = extractRecentErrors(logResults.map((result) => sanitizeContent(result.errors, sanitizeContext)).join(`
 `), 20);
   const recentErrorsSection = recentErrorLines.length === 0 ? "_No error-shaped log lines found in recent history._" : ["```", recentErrorLines.join(`
 `), "```"].join(`
@@ -21578,7 +22125,7 @@ ${engine.logText || "<no log output>"}
     "_Usernames and home paths have been stripped from this report._"
   ].join(`
 `);
-  const body = capBodyToGithubLimit(sanitizeContent(rawBody));
+  const body = capBodyToGithubLimit(sanitizeContent(rawBody, sanitizeContext));
   const reviewFile = writeIssueReviewFile(body);
   if (!reviewFile) {
     outro("Done — could not write the issue report.");
@@ -21603,7 +22150,7 @@ https://github.com/cortexkit/aft/issues/new and paste the contents of ${outPath}
     outro("Done.");
     return 1;
   }
-  const finalBody = capBodyToGithubLimit(sanitizeContent(reviewedBody));
+  const finalBody = capBodyToGithubLimit(sanitizeContent(reviewedBody, sanitizeContext));
   const finalTitle = deriveIssueTitleFromBody(finalBody);
   if (isGhInstalled()) {
     log2.info("Opening GitHub issue via `gh`…");
@@ -21645,6 +22192,7 @@ var init_doctor = __esm(async () => {
   init_jsonc();
   init_lsp_cache();
   init_onnx_fix();
+  init_opencode_plugin_cache();
   init_paths2();
   init_prompts();
   init_sanitize();
@@ -21677,24 +22225,24 @@ var init_doctor = __esm(async () => {
 });
 
 // src/commands/lsp.ts
-import { existsSync as existsSync31, readdirSync as readdirSync14, statSync as statSync20 } from "node:fs";
+import { existsSync as existsSync32, readdirSync as readdirSync15, statSync as statSync20 } from "node:fs";
 import { createRequire as createRequire5 } from "node:module";
-import { dirname as dirname13, join as join34, resolve as resolve15 } from "node:path";
+import { dirname as dirname14, join as join35, resolve as resolve15 } from "node:path";
 function findProjectRootForFile(filePath, fallbackCwd = process.cwd()) {
   const resolvedFile = resolve15(fallbackCwd, filePath);
-  let dir = dirname13(resolvedFile);
+  let dir = dirname14(resolvedFile);
   try {
-    if (existsSync31(resolvedFile) && statSync20(resolvedFile).isDirectory()) {
+    if (existsSync32(resolvedFile) && statSync20(resolvedFile).isDirectory()) {
       dir = resolvedFile;
     }
   } catch {
-    dir = dirname13(resolvedFile);
+    dir = dirname14(resolvedFile);
   }
   while (true) {
-    if (PROJECT_ROOT_MARKERS.some((marker) => existsSync31(join34(dir, marker)))) {
+    if (PROJECT_ROOT_MARKERS.some((marker) => existsSync32(join35(dir, marker)))) {
       return dir;
     }
-    const parent = dirname13(dir);
+    const parent = dirname14(dir);
     if (parent === dir)
       return resolve15(fallbackCwd);
     dir = parent;
@@ -21840,18 +22388,18 @@ function buildConfigureParams(adapter, projectRoot) {
 function inferLspPathsExtra(_lsp) {
   const paths = new Set;
   for (const entry of childDirs(getAftLspPackagesDir())) {
-    paths.add(join34(entry, "node_modules", ".bin"));
+    paths.add(join35(entry, "node_modules", ".bin"));
   }
   for (const entry of childDirs(getAftLspBinariesDir())) {
-    paths.add(join34(entry, "bin"));
+    paths.add(join35(entry, "bin"));
   }
   return [...paths];
 }
 function childDirs(path) {
-  if (!existsSync31(path))
+  if (!existsSync32(path))
     return [];
   try {
-    return readdirSync14(path).map((entry) => join34(path, entry)).filter((entry) => {
+    return readdirSync15(path).map((entry) => join35(path, entry)).filter((entry) => {
       try {
         return statSync20(entry).isDirectory();
       } catch {
@@ -21895,7 +22443,7 @@ function typescriptPackageWarning(response) {
   if (!typescriptServerSpawned || !response.project_root || diagnosticsCount > 0)
     return null;
   try {
-    createRequire5(join34(response.project_root, "package.json")).resolve("typescript");
+    createRequire5(join35(response.project_root, "package.json")).resolve("typescript");
     return null;
   } catch {
     return "typescript package not resolvable from project — server will produce no diagnostics";
@@ -21935,7 +22483,7 @@ var init_lsp = __esm(async () => {
 });
 
 // src/commands/doctor-filters.ts
-import { existsSync as existsSync32 } from "node:fs";
+import { existsSync as existsSync33 } from "node:fs";
 import { relative as relative5, resolve as resolve16 } from "node:path";
 function printDoctorFiltersHelp() {
   console.log(`Usage: ${CLI} doctor filters [--show <name>] [trust|untrust]`);
@@ -21977,7 +22525,7 @@ async function runDoctorFilters(options) {
     log2.error(list.message ?? list.code ?? "list_filters failed");
     return 1;
   }
-  list.project_dir_exists = list.project_dir ? existsSync32(list.project_dir) : false;
+  list.project_dir_exists = list.project_dir ? existsSync33(list.project_dir) : false;
   if (mode.kind === "list") {
     console.log(renderFilterList(list, projectRoot));
     return 0;
@@ -22191,7 +22739,7 @@ function printHelp() {
   console.log("    setup --answers <file>  Save feature choices from an answers file");
   console.log("    index            Build one configured index snapshot (no scheduler)");
   console.log("    backups purge    Remove undo backups by --path and/or --session (dry run unless --yes)");
-  console.log("    cache prune-legacy  Delete legacy index caches past their rollback window (dry run unless --yes)");
+  console.log("    cache prune-legacy  Delete the index folders AFT used before 0.64 (dry run unless --yes)");
   console.log("    doctor           Check and fix configuration issues");
   console.log("    doctor --profile [seconds]  Profile a running AFT daemon");
   console.log("    doctor lsp <file> Inspect LSP setup for one file");