@cortexkit/aft-opencode 0.15.3 → 0.15.4

package/dist/index.js

@@ -7803,7 +7803,7 @@ var require_src2 = __commonJS((exports, module) => {
 });
 
 // src/index.ts
-import { existsSync as existsSync8, mkdirSync as mkdirSync8, readFileSync as readFileSync5, writeFileSync as writeFileSync5 } from "fs";
+import { existsSync as existsSync9, mkdirSync as mkdirSync8, readFileSync as readFileSync5, writeFileSync as writeFileSync5 } from "fs";
 import { createRequire as createRequire2 } from "module";
 import { homedir as homedir7 } from "os";
 import { join as join13 } from "path";
@@ -21454,6 +21454,7 @@ var AftConfigSchema = exports_external.object({
   restrict_to_project_root: exports_external.boolean().optional(),
   experimental_search_index: exports_external.boolean().optional(),
   experimental_semantic_search: exports_external.boolean().optional(),
+  url_fetch_allow_private: exports_external.boolean().optional(),
   semantic: SemanticConfigSchema.optional(),
   max_callgraph_files: exports_external.number().int().positive().optional()
 });
@@ -21696,11 +21697,6 @@ async function ensureBinary(version2) {
     log(`No cached binary for ${version2}, downloading...`);
     return downloadBinary(version2);
   }
-  const legacyCached = getCachedBinaryPath();
-  if (legacyCached) {
-    log(`Found cached binary: ${legacyCached}`);
-    return legacyCached;
-  }
   log("No cached binary found, downloading latest...");
   return downloadBinary();
 }
@@ -22093,14 +22089,13 @@ async function downloadOnnxRuntime(info, targetDir) {
     const tmpDir = `${targetDir}.tmp.${process.pid}`;
     mkdirSync3(tmpDir, { recursive: true });
     const archivePath = join5(tmpDir, `onnxruntime.${info.archiveType}`);
-    const { execSync: execSyncDl } = await import("child_process");
-    execSyncDl(`curl -fsSL "${url2}" -o "${archivePath}"`, {
+    const { execFileSync } = await import("child_process");
+    execFileSync("curl", ["-fsSL", url2, "-o", archivePath], {
       stdio: "pipe",
       timeout: 120000
     });
     if (info.archiveType === "tgz") {
-      const { execSync } = await import("child_process");
-      execSync(`tar xzf "${archivePath}" -C "${tmpDir}"`, { stdio: "pipe" });
+      execFileSync("tar", ["xzf", archivePath, "-C", tmpDir], { stdio: "pipe" });
     } else {
       await extractZipArchive(archivePath, tmpDir);
     }
@@ -22199,13 +22194,46 @@ import { homedir as homedir4 } from "os";
 import { join as join6 } from "path";
 var DEFAULT_BRIDGE_TIMEOUT_MS = 30000;
 var SEMANTIC_TIMEOUT_SAFETY_MARGIN_MS = 5000;
+var MAX_STDOUT_BUFFER = 64 * 1024 * 1024;
 function compareSemver(a, b) {
-  const pa = a.split(".").map(Number);
-  const pb = b.split(".").map(Number);
+  const [aMain, aPre] = a.split("-", 2);
+  const [bMain, bPre] = b.split("-", 2);
+  const aParts = aMain.split(".").map(Number);
+  const bParts = bMain.split(".").map(Number);
   for (let i = 0;i < 3; i++) {
-    const diff = (pa[i] ?? 0) - (pb[i] ?? 0);
-    if (diff !== 0)
-      return diff;
+    if (aParts[i] !== bParts[i])
+      return (aParts[i] ?? 0) - (bParts[i] ?? 0);
+  }
+  if (!aPre && !bPre)
+    return 0;
+  if (!aPre)
+    return 1;
+  if (!bPre)
+    return -1;
+  const aIds = aPre.split(".");
+  const bIds = bPre.split(".");
+  for (let i = 0;i < Math.max(aIds.length, bIds.length); i++) {
+    const ai = aIds[i];
+    const bi = bIds[i];
+    if (ai === undefined)
+      return -1;
+    if (bi === undefined)
+      return 1;
+    const aNum = /^\d+$/.test(ai);
+    const bNum = /^\d+$/.test(bi);
+    if (aNum && bNum) {
+      const diff = Number.parseInt(ai, 10) - Number.parseInt(bi, 10);
+      if (diff !== 0)
+        return diff;
+    } else if (aNum) {
+      return -1;
+    } else if (bNum) {
+      return 1;
+    } else {
+      const cmp = ai.localeCompare(bi);
+      if (cmp !== 0)
+        return cmp;
+    }
   }
   return 0;
 }
@@ -22402,6 +22430,7 @@ class BinaryBridge {
       stdio: ["pipe", "pipe", "pipe"],
       env
     });
+    const currentChild = child;
     child.stdout?.on("data", (chunk) => {
       this.onStdoutData(chunk.toString("utf-8"));
     });
@@ -22417,10 +22446,14 @@ class BinaryBridge {
       }
     });
     child.on("error", (err) => {
+      if (this.process !== currentChild)
+        return;
       error48(`Process error: ${err.message}${this.formatStderrTail()}`);
       this.handleCrash();
     });
     child.on("exit", (code, signal) => {
+      if (this.process !== currentChild)
+        return;
       if (this._shuttingDown)
         return;
       log(`Process exited: code=${code}, signal=${signal}`);
@@ -22454,6 +22487,10 @@ class BinaryBridge {
   }
   onStdoutData(data) {
     this.stdoutBuffer += data;
+    if (this.stdoutBuffer.length > MAX_STDOUT_BUFFER) {
+      this.handleCrash(new Error(`aft bridge stdout buffer exceeded ${MAX_STDOUT_BUFFER} bytes \u2014 killing bridge`));
+      return;
+    }
     let newlineIdx;
     while ((newlineIdx = this.stdoutBuffer.indexOf(`
 `)) !== -1) {
@@ -22489,12 +22526,16 @@ class BinaryBridge {
     this.stderrTail = [];
     this.rejectAllPending(new Error(`[aft-plugin] Bridge restarted after timeout${tail}`));
   }
-  handleCrash() {
+  handleCrash(cause) {
+    const proc = this.process;
     this.process = null;
+    if (proc && proc.exitCode === null && !proc.killed) {
+      proc.kill("SIGKILL");
+    }
     this.clearRestartResetTimer();
     this.configured = false;
     const tail = this.formatStderrTail();
-    this.rejectAllPending(new Error(`[aft-plugin] Binary crashed (restarts: ${this._restartCount})${tail}`));
+    this.rejectAllPending(new Error(`[aft-plugin] Binary crashed (restarts: ${this._restartCount})${cause ? `: ${cause.message}` : ""}${tail}`));
     if (this._restartCount < this.maxRestarts) {
       const delay = 100 * 2 ** this._restartCount;
       this._restartCount++;
@@ -22508,8 +22549,10 @@ class BinaryBridge {
           }
         }
       }, delay);
+      this.scheduleRestartCountReset();
     } else {
       error48(`Max restarts (${this.maxRestarts}) reached, giving up. Logs: ${getLogFilePath()}${tail}`);
+      this.scheduleRestartCountReset();
     }
   }
   rejectAllPending(error49) {
@@ -22627,12 +22670,9 @@ class BridgePool {
   }
   async replaceBinary(newPath) {
     this.binaryPath = newPath;
-    for (const [, entry] of this.bridges) {
-      try {
-        entry.bridge.shutdown();
-      } catch {}
-    }
+    const shutdowns = Array.from(this.bridges.values()).map((entry) => entry.bridge.shutdown());
     this.bridges.clear();
+    await Promise.allSettled(shutdowns);
     log(`Binary path updated to ${newPath}. All bridges cleared \u2014 next calls will use the new binary.`);
   }
   get size() {
@@ -22645,7 +22685,7 @@ function normalizeKey(projectRoot) {
 
 // src/resolver.ts
 import { execSync, spawnSync } from "child_process";
-import { chmodSync as chmodSync3, copyFileSync, existsSync as existsSync5, mkdirSync as mkdirSync4 } from "fs";
+import { chmodSync as chmodSync3, copyFileSync, existsSync as existsSync5, mkdirSync as mkdirSync4, renameSync } from "fs";
 import { createRequire } from "module";
 import { homedir as homedir5 } from "os";
 import { join as join7 } from "path";
@@ -22673,7 +22713,6 @@ function copyToVersionedCache(npmBinaryPath) {
     if (process.platform !== "win32") {
       chmodSync3(tmpPath, 493);
     }
-    const { renameSync } = __require("fs");
     renameSync(tmpPath, cachedPath);
     log(`Copied npm binary to versioned cache: ${cachedPath}`);
     return cachedPath;
@@ -22754,7 +22793,7 @@ async function findBinary() {
     "",
     "Install it using one of these methods:",
     "  npm install @cortexkit/aft-opencode        # installs platform-specific binary via npm",
-    "  cargo install aft             # from crates.io",
+    "  cargo install agent-file-tools             # from crates.io",
     "  cargo build --release         # from source (binary at target/release/aft)",
     "",
     "Or add the aft directory to your PATH."
@@ -22763,7 +22802,8 @@ async function findBinary() {
 }
 
 // src/shared/rpc-server.ts
-import { mkdirSync as mkdirSync5, renameSync, unlinkSync as unlinkSync3, writeFileSync as writeFileSync2 } from "fs";
+import { randomBytes } from "crypto";
+import { mkdirSync as mkdirSync5, renameSync as renameSync2, unlinkSync as unlinkSync3, writeFileSync as writeFileSync2 } from "fs";
 import { createServer } from "http";
 import { dirname } from "path";
 
@@ -22783,6 +22823,7 @@ function rpcPortFilePath(storageDir, directory) {
 class AftRpcServer {
   server = null;
   port = 0;
+  token = null;
   handlers = new Map;
   portFilePath;
   constructor(storageDir, directory) {
@@ -22805,13 +22846,14 @@ class AftRpcServer {
           return;
         }
         this.port = addr.port;
+        this.token = randomBytes(32).toString("hex");
         this.server = server;
         try {
           const dir = dirname(this.portFilePath);
           mkdirSync5(dir, { recursive: true });
           const tmpPath = `${this.portFilePath}.tmp`;
-          writeFileSync2(tmpPath, String(this.port), "utf-8");
-          renameSync(tmpPath, this.portFilePath);
+          writeFileSync2(tmpPath, JSON.stringify({ port: this.port, token: this.token }), "utf-8");
+          renameSync2(tmpPath, this.portFilePath);
           log(`RPC server listening on 127.0.0.1:${this.port}`);
         } catch (err) {
           warn(`Failed to write RPC port file: ${err}`);
@@ -22826,6 +22868,7 @@ class AftRpcServer {
       this.server.close();
       this.server = null;
     }
+    this.token = null;
     try {
       unlinkSync3(this.portFilePath);
     } catch {}
@@ -22869,8 +22912,14 @@ class AftRpcServer {
         res.end(JSON.stringify({ error: "Invalid JSON" }));
         return;
       }
-      log(`RPC call: ${method} params=${JSON.stringify(params).slice(0, 200)}`);
-      handler(params).then((result) => {
+      if (params.token !== this.token) {
+        res.writeHead(403, { "Content-Type": "application/json" });
+        res.end(JSON.stringify({ error: "Forbidden" }));
+        return;
+      }
+      const { token: _token, ...handlerParams } = params;
+      log(`RPC call: ${method} params=${JSON.stringify(handlerParams).slice(0, 200)}`);
+      handler(handlerParams).then((result) => {
         log(`RPC result: ${method} => ${JSON.stringify(result).slice(0, 200)}`);
         res.writeHead(200, { "Content-Type": "application/json" });
         res.end(JSON.stringify(result));
@@ -23112,6 +23161,7 @@ function ensureTuiPluginEntry() {
 
 // src/shared/url-fetch.ts
 import { createHash as createHash2 } from "crypto";
+import { lookup } from "dns/promises";
 import {
   existsSync as existsSync7,
   mkdirSync as mkdirSync7,
@@ -23120,10 +23170,12 @@ import {
   unlinkSync as unlinkSync4,
   writeFileSync as writeFileSync4
 } from "fs";
+import { isIP } from "net";
 import { join as join11 } from "path";
 var MAX_RESPONSE_BYTES = 10 * 1024 * 1024;
 var CACHE_TTL_MS = 24 * 60 * 60 * 1000;
 var FETCH_TIMEOUT_MS = 30000;
+var MAX_REDIRECTS = 5;
 function cacheDir(storageDir) {
   return join11(storageDir, "url_cache");
 }
@@ -23136,6 +23188,138 @@ function metaPath(storageDir, hash2) {
 function contentPath(storageDir, hash2, extension) {
   return join11(cacheDir(storageDir), `${hash2}${extension}`);
 }
+function _isPrivateIpv4(address) {
+  const parts = address.split(".").map((part) => Number.parseInt(part, 10));
+  if (parts.length !== 4 || parts.some((part) => !Number.isInteger(part)))
+    return true;
+  const [a, b] = parts;
+  return a === 0 || a === 10 || a === 127 || a === 172 && b >= 16 && b <= 31 || a === 192 && b === 168 || a === 169 && b === 254 || a >= 224;
+}
+function expandIpv6(addr) {
+  if (addr === "::")
+    return [0, 0, 0, 0, 0, 0, 0, 0];
+  const dcMatches = addr.match(/::/g);
+  if (dcMatches && dcMatches.length > 1)
+    return null;
+  let normalized = addr;
+  const lastColon = normalized.lastIndexOf(":");
+  if (lastColon !== -1) {
+    const tail = normalized.slice(lastColon + 1);
+    if (tail.includes(".")) {
+      const octets = tail.split(".").map((p) => Number.parseInt(p, 10));
+      if (octets.length !== 4 || octets.some((o) => Number.isNaN(o) || o < 0 || o > 255)) {
+        return null;
+      }
+      const h1 = (octets[0] << 8 | octets[1]).toString(16);
+      const h2 = (octets[2] << 8 | octets[3]).toString(16);
+      normalized = `${normalized.slice(0, lastColon)}:${h1}:${h2}`;
+    }
+  }
+  let parts;
+  if (normalized.includes("::")) {
+    const [left, right] = normalized.split("::");
+    const leftParts = left ? left.split(":") : [];
+    const rightParts = right ? right.split(":") : [];
+    const fill = 8 - leftParts.length - rightParts.length;
+    if (fill < 0)
+      return null;
+    parts = [...leftParts, ...Array(fill).fill("0"), ...rightParts];
+  } else {
+    parts = normalized.split(":");
+  }
+  if (parts.length !== 8)
+    return null;
+  const hextets = parts.map((p) => {
+    const n = Number.parseInt(p, 16);
+    return Number.isNaN(n) || n < 0 || n > 65535 ? -1 : n;
+  });
+  if (hextets.some((h) => h === -1))
+    return null;
+  return hextets;
+}
+function isPrivateIp(address) {
+  if (!address.includes(":")) {
+    return _isPrivateIpv4(address);
+  }
+  const lower = address.toLowerCase();
+  const noZone = lower.split("%")[0];
+  const hextets = expandIpv6(noZone);
+  if (hextets) {
+    const top6Zero = hextets.slice(0, 6).every((h) => h === 0);
+    const isMapped = hextets[0] === 0 && hextets[1] === 0 && hextets[2] === 0 && hextets[3] === 0 && hextets[4] === 0 && hextets[5] === 65535;
+    if (isMapped || top6Zero) {
+      const a = hextets[6] >> 8 & 255;
+      const b = hextets[6] & 255;
+      const c = hextets[7] >> 8 & 255;
+      const d = hextets[7] & 255;
+      const ipv43 = `${a}.${b}.${c}.${d}`;
+      if (top6Zero && hextets[6] === 0 && hextets[7] <= 1) {
+        return true;
+      }
+      return _isPrivateIpv4(ipv43);
+    }
+    const firstHextet = hextets[0];
+    return firstHextet >= 65152 && firstHextet <= 65215 || firstHextet >= 64512 && firstHextet <= 65023 || firstHextet >= 65280;
+  }
+  return true;
+}
+async function assertPublicUrl(url2, allowPrivate) {
+  if (url2.protocol !== "http:" && url2.protocol !== "https:") {
+    throw new Error(`Only http:// and https:// URLs are supported, got: ${url2.protocol}`);
+  }
+  if (allowPrivate)
+    return;
+  const hostname3 = url2.hostname.replace(/^\[|\]$/g, "");
+  if (isIP(hostname3) || hostname3.includes(":")) {
+    if (isPrivateIp(hostname3)) {
+      throw new Error(`Blocked private URL host ${url2.hostname} (${hostname3})`);
+    }
+    return;
+  }
+  const addresses = await lookup(hostname3, { all: true, verbatim: true });
+  for (const { address } of addresses) {
+    if (isPrivateIp(address)) {
+      throw new Error(`Blocked private URL host ${url2.hostname} (${address})`);
+    }
+  }
+}
+function resolveRedirectUrl(currentUrl, location) {
+  if (!location) {
+    throw new Error(`Redirect from ${currentUrl.href} missing Location header`);
+  }
+  return new URL(location, currentUrl);
+}
+async function fetchWithRedirects(startUrl, allowPrivate) {
+  let currentUrl = startUrl;
+  for (let redirectCount = 0;redirectCount <= MAX_REDIRECTS; redirectCount++) {
+    await assertPublicUrl(currentUrl, allowPrivate);
+    const controller = new AbortController;
+    const timer = setTimeout(() => controller.abort(), FETCH_TIMEOUT_MS);
+    let response;
+    try {
+      response = await fetch(currentUrl.href, {
+        signal: controller.signal,
+        redirect: "manual",
+        headers: {
+          "user-agent": "aft-opencode-plugin",
+          accept: "application/vnd.github.raw, text/markdown, text/x-markdown, text/html;q=0.9, text/plain;q=0.5"
+        }
+      });
+    } catch (err) {
+      throw new Error(`Failed to fetch ${currentUrl.href}: ${err.message}`);
+    } finally {
+      clearTimeout(timer);
+    }
+    if (response.status < 300 || response.status >= 400) {
+      return response;
+    }
+    if (redirectCount === MAX_REDIRECTS) {
+      throw new Error(`Too many redirects fetching ${startUrl.href}`);
+    }
+    currentUrl = resolveRedirectUrl(currentUrl, response.headers.get("location"));
+  }
+  throw new Error(`Too many redirects fetching ${startUrl.href}`);
+}
 function resolveExtension(contentType) {
   const lower = contentType.toLowerCase().split(";")[0].split(",")[0].trim();
   if (lower === "text/html" || lower === "application/xhtml+xml" || lower === "application/vnd.github.html" || lower === "application/vnd.github+html") {
@@ -23149,7 +23333,7 @@ function resolveExtension(contentType) {
   }
   return null;
 }
-async function fetchUrlToTempFile(url2, storageDir) {
+async function fetchUrlToTempFile(url2, storageDir, options = {}) {
   let parsed;
   try {
     parsed = new URL(url2);
@@ -23159,6 +23343,7 @@ async function fetchUrlToTempFile(url2, storageDir) {
   if (parsed.protocol !== "http:" && parsed.protocol !== "https:") {
     throw new Error(`Only http:// and https:// URLs are supported, got: ${parsed.protocol}`);
   }
+  const allowPrivate = options.allowPrivate === true;
   const dir = cacheDir(storageDir);
   mkdirSync7(dir, { recursive: true });
   const hash2 = hashUrl(url2);
@@ -23175,23 +23360,7 @@ async function fetchUrlToTempFile(url2, storageDir) {
     } catch {}
   }
   log(`Fetching URL: ${url2}`);
-  const controller = new AbortController;
-  const timer = setTimeout(() => controller.abort(), FETCH_TIMEOUT_MS);
-  let response;
-  try {
-    response = await fetch(url2, {
-      signal: controller.signal,
-      redirect: "follow",
-      headers: {
-        "user-agent": "aft-opencode-plugin",
-        accept: "application/vnd.github.raw, text/markdown, text/x-markdown, text/html;q=0.9, text/plain;q=0.5"
-      }
-    });
-  } catch (err) {
-    throw new Error(`Failed to fetch ${url2}: ${err.message}`);
-  } finally {
-    clearTimeout(timer);
-  }
+  const response = await fetchWithRedirects(parsed, allowPrivate);
   if (!response.ok) {
     throw new Error(`HTTP ${response.status} ${response.statusText} fetching ${url2}`);
   }
@@ -23230,8 +23399,8 @@ async function fetchUrlToTempFile(url2, storageDir) {
   const contentFile = contentPath(storageDir, hash2, extension);
   const tmpContent = `${contentFile}.tmp-${process.pid}`;
   writeFileSync4(tmpContent, body);
-  const { renameSync: renameSync2 } = await import("fs");
-  renameSync2(tmpContent, contentFile);
+  const { renameSync: renameSync3 } = await import("fs");
+  renameSync3(tmpContent, contentFile);
   const meta3 = {
     url: url2,
     contentType,
@@ -23240,7 +23409,7 @@ async function fetchUrlToTempFile(url2, storageDir) {
   };
   const tmpMeta = `${metaFile}.tmp-${process.pid}`;
   writeFileSync4(tmpMeta, JSON.stringify(meta3));
-  renameSync2(tmpMeta, metaFile);
+  renameSync3(tmpMeta, metaFile);
   log(`URL cached (${total} bytes): ${url2}`);
   return contentFile;
 }
@@ -24380,22 +24549,41 @@ function createApplyPatchTool(ctx) {
       if (hunks.length === 0) {
         throw new Error("Empty patch: no file operations found");
       }
-      const allPaths = hunks.map((h) => path4.relative(context.worktree, path4.resolve(context.directory, h.path)));
+      const affectedAbs = new Set;
+      const newlyCreatedAbs = new Set;
+      for (const h of hunks) {
+        const srcAbs = path4.resolve(context.directory, h.path);
+        affectedAbs.add(srcAbs);
+        if (h.type === "add") {
+          newlyCreatedAbs.add(srcAbs);
+        }
+        if (h.type === "update" && h.move_path) {
+          const dstAbs = path4.resolve(context.directory, h.move_path);
+          affectedAbs.add(dstAbs);
+          if (!fs3.existsSync(dstAbs)) {
+            newlyCreatedAbs.add(dstAbs);
+          }
+        }
+      }
+      const relPaths = Array.from(affectedAbs).map((abs) => path4.relative(context.worktree, abs));
       await context.ask({
         permission: "edit",
-        patterns: allPaths,
+        patterns: relPaths,
         always: ["*"],
         metadata: {}
       });
+      const checkpointPaths = Array.from(affectedAbs).filter((abs) => !newlyCreatedAbs.has(abs));
       const checkpointName = `apply_patch_${Date.now()}`;
       let checkpointCreated = false;
-      try {
-        await callBridge(ctx, context, "checkpoint", {
-          name: checkpointName,
-          files: allPaths.map((p) => path4.resolve(context.directory, p))
-        });
-        checkpointCreated = true;
-      } catch {}
+      if (checkpointPaths.length > 0) {
+        try {
+          await callBridge(ctx, context, "checkpoint", {
+            name: checkpointName,
+            files: checkpointPaths
+          });
+          checkpointCreated = true;
+        } catch {}
+      }
       const results = [];
       const perFileDiffs = [];
       let patchFailed = false;
@@ -24472,16 +24660,32 @@ ${diagLines}`);
         }
       }
       if (patchFailed) {
+        const rollbackNotes = [];
         if (checkpointCreated) {
           try {
             await callBridge(ctx, context, "restore_checkpoint", { name: checkpointName });
-            results.push("Patch failed \u2014 restored files to pre-patch state.");
+            rollbackNotes.push("restored pre-existing files from checkpoint");
           } catch {
-            results.push("Patch failed \u2014 checkpoint restore also failed, files may be inconsistent.");
+            rollbackNotes.push("checkpoint restore FAILED, pre-existing files may be inconsistent");
           }
-        } else {
-          results.push("Patch failed \u2014 no checkpoint was created, files may be inconsistent.");
+        } else if (checkpointPaths.length > 0) {
+          rollbackNotes.push("no checkpoint was created, pre-existing files may be inconsistent");
         }
+        let newlyDeleted = 0;
+        for (const createdAbs of newlyCreatedAbs) {
+          if (!fs3.existsSync(createdAbs))
+            continue;
+          try {
+            await callBridge(ctx, context, "delete_file", { file: createdAbs });
+            newlyDeleted++;
+          } catch {
+            rollbackNotes.push(`failed to delete newly-created ${path4.relative(context.worktree, createdAbs)}`);
+          }
+        }
+        if (newlyDeleted > 0) {
+          rollbackNotes.push(`removed ${newlyDeleted} newly-created file(s)`);
+        }
+        results.push(rollbackNotes.length > 0 ? `Patch failed \u2014 ${rollbackNotes.join("; ")}.` : "Patch failed \u2014 nothing to roll back.");
         return results.join(`
 `);
       }
@@ -24852,7 +25056,9 @@ function readingTools(ctx) {
           throw new Error("Provide exactly ONE of 'filePath', 'files', 'directory', or 'url' \u2014 not multiple");
         }
         if (hasUrl) {
-          const cachedPath = await fetchUrlToTempFile(args.url, ctx.storageDir);
+          const cachedPath = await fetchUrlToTempFile(args.url, ctx.storageDir, {
+            allowPrivate: ctx.config.url_fetch_allow_private === true
+          });
           const response2 = await callBridge(ctx, context, "outline", { file: cachedPath });
           if (response2.success === false) {
             throw new Error(response2.message || "outline failed");
@@ -24919,7 +25125,9 @@ Provide exactly ONE of 'filePath' or 'url'. Pass either 'symbol' for a single lo
         if (hasFilePath && hasUrl) {
           throw new Error("Provide exactly ONE of 'filePath' or 'url' \u2014 not both");
         }
-        const file2 = hasUrl ? await fetchUrlToTempFile(args.url, ctx.storageDir) : args.filePath;
+        const file2 = hasUrl ? await fetchUrlToTempFile(args.url, ctx.storageDir, {
+          allowPrivate: ctx.config.url_fetch_allow_private === true
+        }) : args.filePath;
         if (Array.isArray(args.symbols) && args.symbols.length > 0) {
           const results = await Promise.all(args.symbols.map((sym) => {
             const params2 = { file: file2, symbol: sym };
@@ -25524,8 +25732,7 @@ var plugin = async (input) => {
     configOverrides.formatter = aftConfig.formatter;
   if (aftConfig.checker !== undefined)
     configOverrides.checker = aftConfig.checker;
-  if (aftConfig.restrict_to_project_root !== undefined)
-    configOverrides.restrict_to_project_root = aftConfig.restrict_to_project_root;
+  configOverrides.restrict_to_project_root = aftConfig.restrict_to_project_root ?? true;
   if (aftConfig.experimental_search_index !== undefined)
     configOverrides.experimental_search_index = aftConfig.experimental_search_index;
   if (aftConfig.experimental_semantic_search !== undefined)
@@ -25539,13 +25746,15 @@ var plugin = async (input) => {
   configOverrides.storage_dir = join13(dataHome, "opencode", "storage", "plugin", "aft");
   if (aftConfig.experimental_semantic_search && isFastembedSemanticBackend) {
     const storageDir2 = configOverrides.storage_dir;
-    ensureOnnxRuntime(storageDir2).then((ortDir) => {
-      if (ortDir) {
-        configOverrides._ort_dylib_dir = ortDir;
-      } else if (!isOrtAutoDownloadSupported()) {
-        warn(`Semantic search requires ONNX Runtime. Install: ${getManualInstallHint()}`);
-      }
-    }, (err) => warn(`ONNX Runtime resolution failed: ${err}`));
+    const ortDylibDir = await ensureOnnxRuntime(storageDir2).catch((err) => {
+      warn(`ONNX Runtime setup failed: ${err instanceof Error ? err.message : String(err)}. Semantic search will be unavailable.`);
+      return null;
+    });
+    if (ortDylibDir) {
+      configOverrides._ort_dylib_dir = ortDylibDir;
+    } else if (!isOrtAutoDownloadSupported()) {
+      warn(`Semantic search requires ONNX Runtime. Install: ${getManualInstallHint()}`);
+    }
   }
   let versionUpgradeAttempted = null;
   const pool = new BridgePool(binaryPath, {
@@ -25598,7 +25807,7 @@ var plugin = async (input) => {
     if (storageDir) {
       const versionFile = join13(storageDir, "last_announced_version");
       try {
-        if (existsSync8(versionFile)) {
+        if (existsSync9(versionFile)) {
           const lastVersion = readFileSync5(versionFile, "utf-8").trim();
           if (lastVersion === ANNOUNCEMENT_VERSION)
             return { show: false };

package/dist/onnx-runtime.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"onnx-runtime.d.ts","sourceRoot":"","sources":["../src/onnx-runtime.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AA0DH,4DAA4D;AAC5D,wBAAgB,0BAA0B,IAAI,OAAO,CAEpD;AAED,6EAA6E;AAC7E,wBAAgB,oBAAoB,IAAI,MAAM,CAQ7C;AAED;;;;;;;;GAQG;AACH,wBAAsB,iBAAiB,CAAC,UAAU,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CA4BlF;AA8LD;;GAEG;AACH,wBAAgB,kBAAkB,CAAC,UAAU,EAAE,MAAM,GAAG,IAAI,CAU3D"}
+{"version":3,"file":"onnx-runtime.d.ts","sourceRoot":"","sources":["../src/onnx-runtime.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AA0DH,4DAA4D;AAC5D,wBAAgB,0BAA0B,IAAI,OAAO,CAEpD;AAED,6EAA6E;AAC7E,wBAAgB,oBAAoB,IAAI,MAAM,CAQ7C;AAED;;;;;;;;GAQG;AACH,wBAAsB,iBAAiB,CAAC,UAAU,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CA4BlF;AA6LD;;GAEG;AACH,wBAAgB,kBAAkB,CAAC,UAAU,EAAE,MAAM,GAAG,IAAI,CAU3D"}

package/dist/pool.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"pool.d.ts","sourceRoot":"","sources":["../src/pool.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,YAAY,EAAE,KAAK,aAAa,EAAE,MAAM,UAAU,CAAC;AAY5D,MAAM,WAAW,WAAY,SAAQ,aAAa;IAChD,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,aAAa,CAAC,EAAE,MAAM,CAAC;CACxB;AAED;;;;;;;;;;;;;;;GAeG;AACH,qBAAa,UAAU;IACrB,iEAAiE;IACjE,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAgC;IACxD,OAAO,CAAC,UAAU,CAAS;IAC3B,OAAO,CAAC,QAAQ,CAAC,WAAW,CAAS;IACrC,OAAO,CAAC,QAAQ,CAAC,aAAa,CAAS;IACvC,OAAO,CAAC,QAAQ,CAAC,aAAa,CAAgB;IAC9C,OAAO,CAAC,QAAQ,CAAC,eAAe,CAA0B;IAC1D,OAAO,CAAC,YAAY,CAA+C;gBAGjE,UAAU,EAAE,MAAM,EAClB,OAAO,GAAE,WAAgB,EACzB,eAAe,GAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAM;IAmB/C;;;;;;;OAOG;IACH,kBAAkB,CAAC,WAAW,EAAE,MAAM,GAAG,YAAY,GAAG,IAAI;IAgB5D;;;;;;;OAOG;IACH,SAAS,CAAC,WAAW,EAAE,MAAM,GAAG,YAAY;IAmB5C,wEAAwE;IACxE,OAAO,CAAC,OAAO;IAUf,yDAAyD;IACzD,OAAO,CAAC,QAAQ;IAgBhB,wDAAwD;IAClD,QAAQ,IAAI,OAAO,CAAC,IAAI,CAAC;IAU/B;;;OAGG;IACG,aAAa,CAAC,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAmBnD,4CAA4C;IAC5C,IAAI,IAAI,IAAI,MAAM,CAEjB;CACF"}
+{"version":3,"file":"pool.d.ts","sourceRoot":"","sources":["../src/pool.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,YAAY,EAAE,KAAK,aAAa,EAAE,MAAM,UAAU,CAAC;AAY5D,MAAM,WAAW,WAAY,SAAQ,aAAa;IAChD,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,aAAa,CAAC,EAAE,MAAM,CAAC;CACxB;AAED;;;;;;;;;;;;;;;GAeG;AACH,qBAAa,UAAU;IACrB,iEAAiE;IACjE,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAgC;IACxD,OAAO,CAAC,UAAU,CAAS;IAC3B,OAAO,CAAC,QAAQ,CAAC,WAAW,CAAS;IACrC,OAAO,CAAC,QAAQ,CAAC,aAAa,CAAS;IACvC,OAAO,CAAC,QAAQ,CAAC,aAAa,CAAgB;IAC9C,OAAO,CAAC,QAAQ,CAAC,eAAe,CAA0B;IAC1D,OAAO,CAAC,YAAY,CAA+C;gBAGjE,UAAU,EAAE,MAAM,EAClB,OAAO,GAAE,WAAgB,EACzB,eAAe,GAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAM;IAmB/C;;;;;;;OAOG;IACH,kBAAkB,CAAC,WAAW,EAAE,MAAM,GAAG,YAAY,GAAG,IAAI;IAgB5D;;;;;;;OAOG;IACH,SAAS,CAAC,WAAW,EAAE,MAAM,GAAG,YAAY;IAmB5C,wEAAwE;IACxE,OAAO,CAAC,OAAO;IAUf,yDAAyD;IACzD,OAAO,CAAC,QAAQ;IAgBhB,wDAAwD;IAClD,QAAQ,IAAI,OAAO,CAAC,IAAI,CAAC;IAU/B;;;OAGG;IACG,aAAa,CAAC,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAcnD,4CAA4C;IAC5C,IAAI,IAAI,IAAI,MAAM,CAEjB;CACF"}

package/dist/resolver.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"resolver.d.ts","sourceRoot":"","sources":["../src/resolver.ts"],"names":[],"mappings":"AAqDA;;;;;;;;;GASG;AACH,wBAAgB,WAAW,CACzB,QAAQ,GAAE,MAAyB,EACnC,IAAI,GAAE,MAAqB,GAC1B,MAAM,CAgBR;AAED;;;;;;;;GAQG;AACH,wBAAgB,cAAc,IAAI,MAAM,GAAG,IAAI,CAiD9C;AAED;;;;;;;;;;;;GAYG;AACH,wBAAsB,UAAU,IAAI,OAAO,CAAC,MAAM,CAAC,CAiClD"}
+{"version":3,"file":"resolver.d.ts","sourceRoot":"","sources":["../src/resolver.ts"],"names":[],"mappings":"AAoDA;;;;;;;;;GASG;AACH,wBAAgB,WAAW,CACzB,QAAQ,GAAE,MAAyB,EACnC,IAAI,GAAE,MAAqB,GAC1B,MAAM,CAgBR;AAED;;;;;;;;GAQG;AACH,wBAAgB,cAAc,IAAI,MAAM,GAAG,IAAI,CAiD9C;AAED;;;;;;;;;;;;GAYG;AACH,wBAAsB,UAAU,IAAI,OAAO,CAAC,MAAM,CAAC,CAiClD"}

package/dist/shared/rpc-client.d.ts

@@ -1,5 +1,6 @@
 export declare class AftRpcClient {
     private port;
+    private token;
     private portFilePath;
     private healthChecked;
     constructor(storageDir: string, directory: string);
@@ -8,6 +9,7 @@ export declare class AftRpcClient {
     /** Check if the RPC server is reachable. */
     isAvailable(): Promise<boolean>;
     private resolvePort;
+    private resolvePortInfo;
     private readPortFile;
     private healthCheck;
     private fetchWithTimeout;

package/dist/shared/rpc-client.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"rpc-client.d.ts","sourceRoot":"","sources":["../../src/shared/rpc-client.ts"],"names":[],"mappings":"AAOA,qBAAa,YAAY;IACvB,OAAO,CAAC,IAAI,CAAuB;IACnC,OAAO,CAAC,YAAY,CAAS;IAC7B,OAAO,CAAC,aAAa,CAAS;gBAElB,UAAU,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM;IAIjD,iFAAiF;IAC3E,IAAI,CAAC,CAAC,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EACpC,MAAM,EAAE,MAAM,EACd,MAAM,GAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAM,GACnC,OAAO,CAAC,CAAC,CAAC;IAoBb,4CAA4C;IACtC,WAAW,IAAI,OAAO,CAAC,OAAO,CAAC;YASvB,WAAW;IAkCzB,OAAO,CAAC,YAAY;YAaN,WAAW;YAWX,gBAAgB;IAU9B,KAAK,IAAI,IAAI;CAId"}
+{"version":3,"file":"rpc-client.d.ts","sourceRoot":"","sources":["../../src/shared/rpc-client.ts"],"names":[],"mappings":"AAQA,qBAAa,YAAY;IACvB,OAAO,CAAC,IAAI,CAAuB;IACnC,OAAO,CAAC,KAAK,CAAuB;IACpC,OAAO,CAAC,YAAY,CAAS;IAC7B,OAAO,CAAC,aAAa,CAAS;gBAElB,UAAU,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM;IAIjD,iFAAiF;IAC3E,IAAI,CAAC,CAAC,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EACpC,MAAM,EAAE,MAAM,EACd,MAAM,GAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAM,GACnC,OAAO,CAAC,CAAC,CAAC;IAoBb,4CAA4C;IACtC,WAAW,IAAI,OAAO,CAAC,OAAO,CAAC;YASvB,WAAW;YAIX,eAAe;IAoC7B,OAAO,CAAC,YAAY;YAuBN,WAAW;YAWX,gBAAgB;IAU9B,KAAK,IAAI,IAAI;CAKd"}