@cortexkit/aft-opencode 0.15.3 → 0.15.5

package/dist/index.js

@@ -7803,7 +7803,7 @@ var require_src2 = __commonJS((exports, module) => {
 });
 
 // src/index.ts
-import { existsSync as existsSync8, mkdirSync as mkdirSync8, readFileSync as readFileSync5, writeFileSync as writeFileSync5 } from "fs";
+import { existsSync as existsSync9, mkdirSync as mkdirSync8, readFileSync as readFileSync5, writeFileSync as writeFileSync5 } from "fs";
 import { createRequire as createRequire2 } from "module";
 import { homedir as homedir7 } from "os";
 import { join as join13 } from "path";
@@ -21454,6 +21454,7 @@ var AftConfigSchema = exports_external.object({
   restrict_to_project_root: exports_external.boolean().optional(),
   experimental_search_index: exports_external.boolean().optional(),
   experimental_semantic_search: exports_external.boolean().optional(),
+  url_fetch_allow_private: exports_external.boolean().optional(),
   semantic: SemanticConfigSchema.optional(),
   max_callgraph_files: exports_external.number().int().positive().optional()
 });
@@ -21696,11 +21697,6 @@ async function ensureBinary(version2) {
     log(`No cached binary for ${version2}, downloading...`);
     return downloadBinary(version2);
   }
-  const legacyCached = getCachedBinaryPath();
-  if (legacyCached) {
-    log(`Found cached binary: ${legacyCached}`);
-    return legacyCached;
-  }
   log("No cached binary found, downloading latest...");
   return downloadBinary();
 }
@@ -22093,14 +22089,13 @@ async function downloadOnnxRuntime(info, targetDir) {
     const tmpDir = `${targetDir}.tmp.${process.pid}`;
     mkdirSync3(tmpDir, { recursive: true });
     const archivePath = join5(tmpDir, `onnxruntime.${info.archiveType}`);
-    const { execSync: execSyncDl } = await import("child_process");
-    execSyncDl(`curl -fsSL "${url2}" -o "${archivePath}"`, {
+    const { execFileSync } = await import("child_process");
+    execFileSync("curl", ["-fsSL", url2, "-o", archivePath], {
       stdio: "pipe",
       timeout: 120000
     });
     if (info.archiveType === "tgz") {
-      const { execSync } = await import("child_process");
-      execSync(`tar xzf "${archivePath}" -C "${tmpDir}"`, { stdio: "pipe" });
+      execFileSync("tar", ["xzf", archivePath, "-C", tmpDir], { stdio: "pipe" });
     } else {
       await extractZipArchive(archivePath, tmpDir);
     }
@@ -22199,13 +22194,46 @@ import { homedir as homedir4 } from "os";
 import { join as join6 } from "path";
 var DEFAULT_BRIDGE_TIMEOUT_MS = 30000;
 var SEMANTIC_TIMEOUT_SAFETY_MARGIN_MS = 5000;
+var MAX_STDOUT_BUFFER = 64 * 1024 * 1024;
 function compareSemver(a, b) {
-  const pa = a.split(".").map(Number);
-  const pb = b.split(".").map(Number);
+  const [aMain, aPre] = a.split("-", 2);
+  const [bMain, bPre] = b.split("-", 2);
+  const aParts = aMain.split(".").map(Number);
+  const bParts = bMain.split(".").map(Number);
   for (let i = 0;i < 3; i++) {
-    const diff = (pa[i] ?? 0) - (pb[i] ?? 0);
-    if (diff !== 0)
-      return diff;
+    if (aParts[i] !== bParts[i])
+      return (aParts[i] ?? 0) - (bParts[i] ?? 0);
+  }
+  if (!aPre && !bPre)
+    return 0;
+  if (!aPre)
+    return 1;
+  if (!bPre)
+    return -1;
+  const aIds = aPre.split(".");
+  const bIds = bPre.split(".");
+  for (let i = 0;i < Math.max(aIds.length, bIds.length); i++) {
+    const ai = aIds[i];
+    const bi = bIds[i];
+    if (ai === undefined)
+      return -1;
+    if (bi === undefined)
+      return 1;
+    const aNum = /^\d+$/.test(ai);
+    const bNum = /^\d+$/.test(bi);
+    if (aNum && bNum) {
+      const diff = Number.parseInt(ai, 10) - Number.parseInt(bi, 10);
+      if (diff !== 0)
+        return diff;
+    } else if (aNum) {
+      return -1;
+    } else if (bNum) {
+      return 1;
+    } else {
+      const cmp = ai.localeCompare(bi);
+      if (cmp !== 0)
+        return cmp;
+    }
   }
   return 0;
 }
@@ -22402,6 +22430,7 @@ class BinaryBridge {
       stdio: ["pipe", "pipe", "pipe"],
       env
     });
+    const currentChild = child;
     child.stdout?.on("data", (chunk) => {
       this.onStdoutData(chunk.toString("utf-8"));
     });
@@ -22417,10 +22446,14 @@ class BinaryBridge {
       }
     });
     child.on("error", (err) => {
+      if (this.process !== currentChild)
+        return;
       error48(`Process error: ${err.message}${this.formatStderrTail()}`);
       this.handleCrash();
     });
     child.on("exit", (code, signal) => {
+      if (this.process !== currentChild)
+        return;
       if (this._shuttingDown)
         return;
       log(`Process exited: code=${code}, signal=${signal}`);
@@ -22454,6 +22487,10 @@ class BinaryBridge {
   }
   onStdoutData(data) {
     this.stdoutBuffer += data;
+    if (this.stdoutBuffer.length > MAX_STDOUT_BUFFER) {
+      this.handleCrash(new Error(`aft bridge stdout buffer exceeded ${MAX_STDOUT_BUFFER} bytes \u2014 killing bridge`));
+      return;
+    }
     let newlineIdx;
     while ((newlineIdx = this.stdoutBuffer.indexOf(`
 `)) !== -1) {
@@ -22489,12 +22526,16 @@ class BinaryBridge {
     this.stderrTail = [];
     this.rejectAllPending(new Error(`[aft-plugin] Bridge restarted after timeout${tail}`));
   }
-  handleCrash() {
+  handleCrash(cause) {
+    const proc = this.process;
     this.process = null;
+    if (proc && proc.exitCode === null && !proc.killed) {
+      proc.kill("SIGKILL");
+    }
     this.clearRestartResetTimer();
     this.configured = false;
     const tail = this.formatStderrTail();
-    this.rejectAllPending(new Error(`[aft-plugin] Binary crashed (restarts: ${this._restartCount})${tail}`));
+    this.rejectAllPending(new Error(`[aft-plugin] Binary crashed (restarts: ${this._restartCount})${cause ? `: ${cause.message}` : ""}${tail}`));
     if (this._restartCount < this.maxRestarts) {
       const delay = 100 * 2 ** this._restartCount;
       this._restartCount++;
@@ -22508,8 +22549,10 @@ class BinaryBridge {
           }
         }
       }, delay);
+      this.scheduleRestartCountReset();
     } else {
       error48(`Max restarts (${this.maxRestarts}) reached, giving up. Logs: ${getLogFilePath()}${tail}`);
+      this.scheduleRestartCountReset();
     }
   }
   rejectAllPending(error49) {
@@ -22627,12 +22670,9 @@ class BridgePool {
   }
   async replaceBinary(newPath) {
     this.binaryPath = newPath;
-    for (const [, entry] of this.bridges) {
-      try {
-        entry.bridge.shutdown();
-      } catch {}
-    }
+    const shutdowns = Array.from(this.bridges.values()).map((entry) => entry.bridge.shutdown());
     this.bridges.clear();
+    await Promise.allSettled(shutdowns);
     log(`Binary path updated to ${newPath}. All bridges cleared \u2014 next calls will use the new binary.`);
   }
   get size() {
@@ -22645,7 +22685,7 @@ function normalizeKey(projectRoot) {
 
 // src/resolver.ts
 import { execSync, spawnSync } from "child_process";
-import { chmodSync as chmodSync3, copyFileSync, existsSync as existsSync5, mkdirSync as mkdirSync4 } from "fs";
+import { chmodSync as chmodSync3, copyFileSync, existsSync as existsSync5, mkdirSync as mkdirSync4, renameSync } from "fs";
 import { createRequire } from "module";
 import { homedir as homedir5 } from "os";
 import { join as join7 } from "path";
@@ -22673,7 +22713,6 @@ function copyToVersionedCache(npmBinaryPath) {
     if (process.platform !== "win32") {
       chmodSync3(tmpPath, 493);
     }
-    const { renameSync } = __require("fs");
     renameSync(tmpPath, cachedPath);
     log(`Copied npm binary to versioned cache: ${cachedPath}`);
     return cachedPath;
@@ -22754,7 +22793,7 @@ async function findBinary() {
     "",
     "Install it using one of these methods:",
     "  npm install @cortexkit/aft-opencode        # installs platform-specific binary via npm",
-    "  cargo install aft             # from crates.io",
+    "  cargo install agent-file-tools             # from crates.io",
     "  cargo build --release         # from source (binary at target/release/aft)",
     "",
     "Or add the aft directory to your PATH."
@@ -22763,7 +22802,8 @@ async function findBinary() {
 }
 
 // src/shared/rpc-server.ts
-import { mkdirSync as mkdirSync5, renameSync, unlinkSync as unlinkSync3, writeFileSync as writeFileSync2 } from "fs";
+import { randomBytes } from "crypto";
+import { mkdirSync as mkdirSync5, renameSync as renameSync2, unlinkSync as unlinkSync3, writeFileSync as writeFileSync2 } from "fs";
 import { createServer } from "http";
 import { dirname } from "path";
 
@@ -22783,6 +22823,7 @@ function rpcPortFilePath(storageDir, directory) {
 class AftRpcServer {
   server = null;
   port = 0;
+  token = null;
   handlers = new Map;
   portFilePath;
   constructor(storageDir, directory) {
@@ -22805,13 +22846,14 @@ class AftRpcServer {
           return;
         }
         this.port = addr.port;
+        this.token = randomBytes(32).toString("hex");
         this.server = server;
         try {
           const dir = dirname(this.portFilePath);
           mkdirSync5(dir, { recursive: true });
           const tmpPath = `${this.portFilePath}.tmp`;
-          writeFileSync2(tmpPath, String(this.port), "utf-8");
-          renameSync(tmpPath, this.portFilePath);
+          writeFileSync2(tmpPath, JSON.stringify({ port: this.port, token: this.token }), "utf-8");
+          renameSync2(tmpPath, this.portFilePath);
           log(`RPC server listening on 127.0.0.1:${this.port}`);
         } catch (err) {
           warn(`Failed to write RPC port file: ${err}`);
@@ -22826,6 +22868,7 @@ class AftRpcServer {
       this.server.close();
       this.server = null;
     }
+    this.token = null;
     try {
       unlinkSync3(this.portFilePath);
     } catch {}
@@ -22869,8 +22912,14 @@ class AftRpcServer {
         res.end(JSON.stringify({ error: "Invalid JSON" }));
         return;
       }
-      log(`RPC call: ${method} params=${JSON.stringify(params).slice(0, 200)}`);
-      handler(params).then((result) => {
+      if (params.token !== this.token) {
+        res.writeHead(403, { "Content-Type": "application/json" });
+        res.end(JSON.stringify({ error: "Forbidden" }));
+        return;
+      }
+      const { token: _token, ...handlerParams } = params;
+      log(`RPC call: ${method} params=${JSON.stringify(handlerParams).slice(0, 200)}`);
+      handler(handlerParams).then((result) => {
         log(`RPC result: ${method} => ${JSON.stringify(result).slice(0, 200)}`);
         res.writeHead(200, { "Content-Type": "application/json" });
         res.end(JSON.stringify(result));
@@ -23112,6 +23161,7 @@ function ensureTuiPluginEntry() {
 
 // src/shared/url-fetch.ts
 import { createHash as createHash2 } from "crypto";
+import { lookup } from "dns/promises";
 import {
   existsSync as existsSync7,
   mkdirSync as mkdirSync7,
@@ -23120,10 +23170,12 @@ import {
   unlinkSync as unlinkSync4,
   writeFileSync as writeFileSync4
 } from "fs";
+import { isIP } from "net";
 import { join as join11 } from "path";
 var MAX_RESPONSE_BYTES = 10 * 1024 * 1024;
 var CACHE_TTL_MS = 24 * 60 * 60 * 1000;
 var FETCH_TIMEOUT_MS = 30000;
+var MAX_REDIRECTS = 5;
 function cacheDir(storageDir) {
   return join11(storageDir, "url_cache");
 }
@@ -23136,6 +23188,138 @@ function metaPath(storageDir, hash2) {
 function contentPath(storageDir, hash2, extension) {
   return join11(cacheDir(storageDir), `${hash2}${extension}`);
 }
+function _isPrivateIpv4(address) {
+  const parts = address.split(".").map((part) => Number.parseInt(part, 10));
+  if (parts.length !== 4 || parts.some((part) => !Number.isInteger(part)))
+    return true;
+  const [a, b] = parts;
+  return a === 0 || a === 10 || a === 127 || a === 172 && b >= 16 && b <= 31 || a === 192 && b === 168 || a === 169 && b === 254 || a >= 224;
+}
+function expandIpv6(addr) {
+  if (addr === "::")
+    return [0, 0, 0, 0, 0, 0, 0, 0];
+  const dcMatches = addr.match(/::/g);
+  if (dcMatches && dcMatches.length > 1)
+    return null;
+  let normalized = addr;
+  const lastColon = normalized.lastIndexOf(":");
+  if (lastColon !== -1) {
+    const tail = normalized.slice(lastColon + 1);
+    if (tail.includes(".")) {
+      const octets = tail.split(".").map((p) => Number.parseInt(p, 10));
+      if (octets.length !== 4 || octets.some((o) => Number.isNaN(o) || o < 0 || o > 255)) {
+        return null;
+      }
+      const h1 = (octets[0] << 8 | octets[1]).toString(16);
+      const h2 = (octets[2] << 8 | octets[3]).toString(16);
+      normalized = `${normalized.slice(0, lastColon)}:${h1}:${h2}`;
+    }
+  }
+  let parts;
+  if (normalized.includes("::")) {
+    const [left, right] = normalized.split("::");
+    const leftParts = left ? left.split(":") : [];
+    const rightParts = right ? right.split(":") : [];
+    const fill = 8 - leftParts.length - rightParts.length;
+    if (fill < 0)
+      return null;
+    parts = [...leftParts, ...Array(fill).fill("0"), ...rightParts];
+  } else {
+    parts = normalized.split(":");
+  }
+  if (parts.length !== 8)
+    return null;
+  const hextets = parts.map((p) => {
+    const n = Number.parseInt(p, 16);
+    return Number.isNaN(n) || n < 0 || n > 65535 ? -1 : n;
+  });
+  if (hextets.some((h) => h === -1))
+    return null;
+  return hextets;
+}
+function isPrivateIp(address) {
+  if (!address.includes(":")) {
+    return _isPrivateIpv4(address);
+  }
+  const lower = address.toLowerCase();
+  const noZone = lower.split("%")[0];
+  const hextets = expandIpv6(noZone);
+  if (hextets) {
+    const top6Zero = hextets.slice(0, 6).every((h) => h === 0);
+    const isMapped = hextets[0] === 0 && hextets[1] === 0 && hextets[2] === 0 && hextets[3] === 0 && hextets[4] === 0 && hextets[5] === 65535;
+    if (isMapped || top6Zero) {
+      const a = hextets[6] >> 8 & 255;
+      const b = hextets[6] & 255;
+      const c = hextets[7] >> 8 & 255;
+      const d = hextets[7] & 255;
+      const ipv43 = `${a}.${b}.${c}.${d}`;
+      if (top6Zero && hextets[6] === 0 && hextets[7] <= 1) {
+        return true;
+      }
+      return _isPrivateIpv4(ipv43);
+    }
+    const firstHextet = hextets[0];
+    return firstHextet >= 65152 && firstHextet <= 65215 || firstHextet >= 64512 && firstHextet <= 65023 || firstHextet >= 65280;
+  }
+  return true;
+}
+async function assertPublicUrl(url2, allowPrivate) {
+  if (url2.protocol !== "http:" && url2.protocol !== "https:") {
+    throw new Error(`Only http:// and https:// URLs are supported, got: ${url2.protocol}`);
+  }
+  if (allowPrivate)
+    return;
+  const hostname3 = url2.hostname.replace(/^\[|\]$/g, "");
+  if (isIP(hostname3) || hostname3.includes(":")) {
+    if (isPrivateIp(hostname3)) {
+      throw new Error(`Blocked private URL host ${url2.hostname} (${hostname3})`);
+    }
+    return;
+  }
+  const addresses = await lookup(hostname3, { all: true, verbatim: true });
+  for (const { address } of addresses) {
+    if (isPrivateIp(address)) {
+      throw new Error(`Blocked private URL host ${url2.hostname} (${address})`);
+    }
+  }
+}
+function resolveRedirectUrl(currentUrl, location) {
+  if (!location) {
+    throw new Error(`Redirect from ${currentUrl.href} missing Location header`);
+  }
+  return new URL(location, currentUrl);
+}
+async function fetchWithRedirects(startUrl, allowPrivate) {
+  let currentUrl = startUrl;
+  for (let redirectCount = 0;redirectCount <= MAX_REDIRECTS; redirectCount++) {
+    await assertPublicUrl(currentUrl, allowPrivate);
+    const controller = new AbortController;
+    const timer = setTimeout(() => controller.abort(), FETCH_TIMEOUT_MS);
+    let response;
+    try {
+      response = await fetch(currentUrl.href, {
+        signal: controller.signal,
+        redirect: "manual",
+        headers: {
+          "user-agent": "aft-opencode-plugin",
+          accept: "application/vnd.github.raw, text/markdown, text/x-markdown, text/html;q=0.9, text/plain;q=0.5"
+        }
+      });
+    } catch (err) {
+      throw new Error(`Failed to fetch ${currentUrl.href}: ${err.message}`);
+    } finally {
+      clearTimeout(timer);
+    }
+    if (response.status < 300 || response.status >= 400) {
+      return response;
+    }
+    if (redirectCount === MAX_REDIRECTS) {
+      throw new Error(`Too many redirects fetching ${startUrl.href}`);
+    }
+    currentUrl = resolveRedirectUrl(currentUrl, response.headers.get("location"));
+  }
+  throw new Error(`Too many redirects fetching ${startUrl.href}`);
+}
 function resolveExtension(contentType) {
   const lower = contentType.toLowerCase().split(";")[0].split(",")[0].trim();
   if (lower === "text/html" || lower === "application/xhtml+xml" || lower === "application/vnd.github.html" || lower === "application/vnd.github+html") {
@@ -23149,7 +23333,7 @@ function resolveExtension(contentType) {
   }
   return null;
 }
-async function fetchUrlToTempFile(url2, storageDir) {
+async function fetchUrlToTempFile(url2, storageDir, options = {}) {
   let parsed;
   try {
     parsed = new URL(url2);
@@ -23159,6 +23343,7 @@ async function fetchUrlToTempFile(url2, storageDir) {
   if (parsed.protocol !== "http:" && parsed.protocol !== "https:") {
     throw new Error(`Only http:// and https:// URLs are supported, got: ${parsed.protocol}`);
   }
+  const allowPrivate = options.allowPrivate === true;
   const dir = cacheDir(storageDir);
   mkdirSync7(dir, { recursive: true });
   const hash2 = hashUrl(url2);
@@ -23175,23 +23360,7 @@ async function fetchUrlToTempFile(url2, storageDir) {
     } catch {}
   }
   log(`Fetching URL: ${url2}`);
-  const controller = new AbortController;
-  const timer = setTimeout(() => controller.abort(), FETCH_TIMEOUT_MS);
-  let response;
-  try {
-    response = await fetch(url2, {
-      signal: controller.signal,
-      redirect: "follow",
-      headers: {
-        "user-agent": "aft-opencode-plugin",
-        accept: "application/vnd.github.raw, text/markdown, text/x-markdown, text/html;q=0.9, text/plain;q=0.5"
-      }
-    });
-  } catch (err) {
-    throw new Error(`Failed to fetch ${url2}: ${err.message}`);
-  } finally {
-    clearTimeout(timer);
-  }
+  const response = await fetchWithRedirects(parsed, allowPrivate);
   if (!response.ok) {
     throw new Error(`HTTP ${response.status} ${response.statusText} fetching ${url2}`);
   }
@@ -23230,8 +23399,8 @@ async function fetchUrlToTempFile(url2, storageDir) {
   const contentFile = contentPath(storageDir, hash2, extension);
   const tmpContent = `${contentFile}.tmp-${process.pid}`;
   writeFileSync4(tmpContent, body);
-  const { renameSync: renameSync2 } = await import("fs");
-  renameSync2(tmpContent, contentFile);
+  const { renameSync: renameSync3 } = await import("fs");
+  renameSync3(tmpContent, contentFile);
   const meta3 = {
     url: url2,
     contentType,
@@ -23240,7 +23409,7 @@ async function fetchUrlToTempFile(url2, storageDir) {
   };
   const tmpMeta = `${metaFile}.tmp-${process.pid}`;
   writeFileSync4(tmpMeta, JSON.stringify(meta3));
-  renameSync2(tmpMeta, metaFile);
+  renameSync3(tmpMeta, metaFile);
   log(`URL cached (${total} bytes): ${url2}`);
   return contentFile;
 }
@@ -23879,44 +24048,156 @@ function buildUnifiedDiff(fp, before, after) {
 `);
   const afterLines = after.split(`
 `);
-  let diff = `Index: ${fp}
+  const ops = diffLines(beforeLines, afterLines);
+  if (ops.every((op) => op.tag === "eq")) {
+    return `Index: ${fp}
 ===================================================================
 --- ${fp}
 +++ ${fp}
 `;
-  let firstChange = -1;
-  let lastChange = -1;
-  const maxLen = Math.max(beforeLines.length, afterLines.length);
-  for (let i = 0;i < maxLen; i++) {
-    if ((beforeLines[i] ?? "") !== (afterLines[i] ?? "")) {
-      if (firstChange === -1)
-        firstChange = i;
-      lastChange = i;
-    }
-  }
-  if (firstChange === -1)
-    return diff;
-  const ctxStart = Math.max(0, firstChange - 2);
-  const ctxEnd = Math.min(maxLen - 1, lastChange + 2);
-  diff += `@@ -${ctxStart + 1},${Math.min(beforeLines.length, ctxEnd + 1) - ctxStart} +${ctxStart + 1},${Math.min(afterLines.length, ctxEnd + 1) - ctxStart} @@
-`;
-  for (let i = ctxStart;i <= ctxEnd; i++) {
-    const bl = i < beforeLines.length ? beforeLines[i] : undefined;
-    const al = i < afterLines.length ? afterLines[i] : undefined;
-    if (bl === al) {
-      diff += ` ${bl}
+  }
+  const CONTEXT = 3;
+  const HUNK_GAP = CONTEXT * 2;
+  const hunks = groupIntoHunks(ops, CONTEXT, HUNK_GAP, beforeLines.length, afterLines.length);
+  let diff = `Index: ${fp}
+===================================================================
+--- ${fp}
++++ ${fp}
 `;
-    } else {
-      if (bl !== undefined)
-        diff += `-${bl}
+  for (const hunk of hunks) {
+    diff += `@@ -${hunk.beforeStart},${hunk.beforeCount} +${hunk.afterStart},${hunk.afterCount} @@
 `;
-      if (al !== undefined)
-        diff += `+${al}
+    for (const line of hunk.lines) {
+      diff += `${line}
 `;
     }
   }
   return diff;
 }
+function diffLines(a, b) {
+  const n = a.length;
+  const m = b.length;
+  const dp = new Uint32Array((n + 1) * (m + 1));
+  const w = m + 1;
+  for (let i2 = 1;i2 <= n; i2++) {
+    for (let j2 = 1;j2 <= m; j2++) {
+      if (a[i2 - 1] === b[j2 - 1]) {
+        dp[i2 * w + j2] = dp[(i2 - 1) * w + (j2 - 1)] + 1;
+      } else {
+        const up = dp[(i2 - 1) * w + j2];
+        const left = dp[i2 * w + (j2 - 1)];
+        dp[i2 * w + j2] = up >= left ? up : left;
+      }
+    }
+  }
+  const ops = [];
+  let i = n;
+  let j = m;
+  while (i > 0 && j > 0) {
+    if (a[i - 1] === b[j - 1]) {
+      ops.push({ tag: "eq", beforeIdx: i - 1, afterIdx: j - 1, line: a[i - 1] });
+      i--;
+      j--;
+    } else if (dp[(i - 1) * w + j] >= dp[i * w + (j - 1)]) {
+      ops.push({ tag: "del", beforeIdx: i - 1, line: a[i - 1] });
+      i--;
+    } else {
+      ops.push({ tag: "ins", afterIdx: j - 1, line: b[j - 1] });
+      j--;
+    }
+  }
+  while (i > 0) {
+    ops.push({ tag: "del", beforeIdx: i - 1, line: a[i - 1] });
+    i--;
+  }
+  while (j > 0) {
+    ops.push({ tag: "ins", afterIdx: j - 1, line: b[j - 1] });
+    j--;
+  }
+  ops.reverse();
+  return ops;
+}
+function groupIntoHunks(ops, context, gap, beforeLen, afterLen) {
+  const changeIdx = [];
+  for (let k = 0;k < ops.length; k++) {
+    if (ops[k].tag !== "eq")
+      changeIdx.push(k);
+  }
+  if (changeIdx.length === 0)
+    return [];
+  const ranges = [];
+  for (const idx of changeIdx) {
+    const start = Math.max(0, idx - context);
+    const end = Math.min(ops.length - 1, idx + context);
+    if (ranges.length > 0 && start <= ranges[ranges.length - 1][1] + gap) {
+      ranges[ranges.length - 1][1] = Math.max(ranges[ranges.length - 1][1], end);
+    } else {
+      ranges.push([start, end]);
+    }
+  }
+  const hunks = [];
+  for (const [start, end] of ranges) {
+    let beforeStart = -1;
+    let afterStart = -1;
+    let beforeCount = 0;
+    let afterCount = 0;
+    const lines = [];
+    for (let k = start;k <= end; k++) {
+      const op = ops[k];
+      if (op.tag === "eq") {
+        if (beforeStart === -1)
+          beforeStart = op.beforeIdx + 1;
+        if (afterStart === -1)
+          afterStart = op.afterIdx + 1;
+        beforeCount++;
+        afterCount++;
+        lines.push(` ${op.line}`);
+      } else if (op.tag === "del") {
+        if (beforeStart === -1)
+          beforeStart = op.beforeIdx + 1;
+        if (afterStart === -1) {
+          afterStart = inferAfterStart(ops, k, afterLen);
+        }
+        beforeCount++;
+        lines.push(`-${op.line}`);
+      } else {
+        if (afterStart === -1)
+          afterStart = op.afterIdx + 1;
+        if (beforeStart === -1) {
+          beforeStart = inferBeforeStart(ops, k, beforeLen);
+        }
+        afterCount++;
+        lines.push(`+${op.line}`);
+      }
+    }
+    if (beforeCount === 0)
+      beforeStart = 0;
+    if (afterCount === 0)
+      afterStart = 0;
+    hunks.push({ beforeStart, beforeCount, afterStart, afterCount, lines });
+  }
+  return hunks;
+}
+function inferAfterStart(ops, from, afterLen) {
+  for (let k = from;k < ops.length; k++) {
+    const op = ops[k];
+    if (op.tag === "eq")
+      return op.afterIdx + 1;
+    if (op.tag === "ins")
+      return op.afterIdx + 1;
+  }
+  return afterLen;
+}
+function inferBeforeStart(ops, from, beforeLen) {
+  for (let k = from;k < ops.length; k++) {
+    const op = ops[k];
+    if (op.tag === "eq")
+      return op.beforeIdx + 1;
+    if (op.tag === "del")
+      return op.beforeIdx + 1;
+  }
+  return beforeLen;
+}
 var z3 = tool3.schema;
 var READ_DESCRIPTION = `Read file contents or list directory entries.
 
@@ -24380,22 +24661,41 @@ function createApplyPatchTool(ctx) {
       if (hunks.length === 0) {
         throw new Error("Empty patch: no file operations found");
       }
-      const allPaths = hunks.map((h) => path4.relative(context.worktree, path4.resolve(context.directory, h.path)));
+      const affectedAbs = new Set;
+      const newlyCreatedAbs = new Set;
+      for (const h of hunks) {
+        const srcAbs = path4.resolve(context.directory, h.path);
+        affectedAbs.add(srcAbs);
+        if (h.type === "add") {
+          newlyCreatedAbs.add(srcAbs);
+        }
+        if (h.type === "update" && h.move_path) {
+          const dstAbs = path4.resolve(context.directory, h.move_path);
+          affectedAbs.add(dstAbs);
+          if (!fs3.existsSync(dstAbs)) {
+            newlyCreatedAbs.add(dstAbs);
+          }
+        }
+      }
+      const relPaths = Array.from(affectedAbs).map((abs) => path4.relative(context.worktree, abs));
       await context.ask({
         permission: "edit",
-        patterns: allPaths,
+        patterns: relPaths,
         always: ["*"],
         metadata: {}
       });
+      const checkpointPaths = Array.from(affectedAbs).filter((abs) => !newlyCreatedAbs.has(abs));
       const checkpointName = `apply_patch_${Date.now()}`;
       let checkpointCreated = false;
-      try {
-        await callBridge(ctx, context, "checkpoint", {
-          name: checkpointName,
-          files: allPaths.map((p) => path4.resolve(context.directory, p))
-        });
-        checkpointCreated = true;
-      } catch {}
+      if (checkpointPaths.length > 0) {
+        try {
+          await callBridge(ctx, context, "checkpoint", {
+            name: checkpointName,
+            files: checkpointPaths
+          });
+          checkpointCreated = true;
+        } catch {}
+      }
       const results = [];
       const perFileDiffs = [];
       let patchFailed = false;
@@ -24472,16 +24772,32 @@ ${diagLines}`);
         }
       }
       if (patchFailed) {
+        const rollbackNotes = [];
         if (checkpointCreated) {
           try {
             await callBridge(ctx, context, "restore_checkpoint", { name: checkpointName });
-            results.push("Patch failed \u2014 restored files to pre-patch state.");
+            rollbackNotes.push("restored pre-existing files from checkpoint");
           } catch {
-            results.push("Patch failed \u2014 checkpoint restore also failed, files may be inconsistent.");
+            rollbackNotes.push("checkpoint restore FAILED, pre-existing files may be inconsistent");
+          }
+        } else if (checkpointPaths.length > 0) {
+          rollbackNotes.push("no checkpoint was created, pre-existing files may be inconsistent");
+        }
+        let newlyDeleted = 0;
+        for (const createdAbs of newlyCreatedAbs) {
+          if (!fs3.existsSync(createdAbs))
+            continue;
+          try {
+            await callBridge(ctx, context, "delete_file", { file: createdAbs });
+            newlyDeleted++;
+          } catch {
+            rollbackNotes.push(`failed to delete newly-created ${path4.relative(context.worktree, createdAbs)}`);
           }
-        } else {
-          results.push("Patch failed \u2014 no checkpoint was created, files may be inconsistent.");
         }
+        if (newlyDeleted > 0) {
+          rollbackNotes.push(`removed ${newlyDeleted} newly-created file(s)`);
+        }
+        results.push(rollbackNotes.length > 0 ? `Patch failed \u2014 ${rollbackNotes.join("; ")}.` : "Patch failed \u2014 nothing to roll back.");
         return results.join(`
 `);
       }
@@ -24852,7 +25168,9 @@ function readingTools(ctx) {
           throw new Error("Provide exactly ONE of 'filePath', 'files', 'directory', or 'url' \u2014 not multiple");
         }
         if (hasUrl) {
-          const cachedPath = await fetchUrlToTempFile(args.url, ctx.storageDir);
+          const cachedPath = await fetchUrlToTempFile(args.url, ctx.storageDir, {
+            allowPrivate: ctx.config.url_fetch_allow_private === true
+          });
           const response2 = await callBridge(ctx, context, "outline", { file: cachedPath });
           if (response2.success === false) {
             throw new Error(response2.message || "outline failed");
@@ -24919,7 +25237,9 @@ Provide exactly ONE of 'filePath' or 'url'. Pass either 'symbol' for a single lo
         if (hasFilePath && hasUrl) {
           throw new Error("Provide exactly ONE of 'filePath' or 'url' \u2014 not both");
         }
-        const file2 = hasUrl ? await fetchUrlToTempFile(args.url, ctx.storageDir) : args.filePath;
+        const file2 = hasUrl ? await fetchUrlToTempFile(args.url, ctx.storageDir, {
+          allowPrivate: ctx.config.url_fetch_allow_private === true
+        }) : args.filePath;
         if (Array.isArray(args.symbols) && args.symbols.length > 0) {
           const results = await Promise.all(args.symbols.map((sym) => {
             const params2 = { file: file2, symbol: sym };
@@ -25524,8 +25844,7 @@ var plugin = async (input) => {
     configOverrides.formatter = aftConfig.formatter;
   if (aftConfig.checker !== undefined)
     configOverrides.checker = aftConfig.checker;
-  if (aftConfig.restrict_to_project_root !== undefined)
-    configOverrides.restrict_to_project_root = aftConfig.restrict_to_project_root;
+  configOverrides.restrict_to_project_root = aftConfig.restrict_to_project_root ?? true;
   if (aftConfig.experimental_search_index !== undefined)
     configOverrides.experimental_search_index = aftConfig.experimental_search_index;
   if (aftConfig.experimental_semantic_search !== undefined)
@@ -25539,13 +25858,15 @@ var plugin = async (input) => {
   configOverrides.storage_dir = join13(dataHome, "opencode", "storage", "plugin", "aft");
   if (aftConfig.experimental_semantic_search && isFastembedSemanticBackend) {
     const storageDir2 = configOverrides.storage_dir;
-    ensureOnnxRuntime(storageDir2).then((ortDir) => {
-      if (ortDir) {
-        configOverrides._ort_dylib_dir = ortDir;
-      } else if (!isOrtAutoDownloadSupported()) {
-        warn(`Semantic search requires ONNX Runtime. Install: ${getManualInstallHint()}`);
-      }
-    }, (err) => warn(`ONNX Runtime resolution failed: ${err}`));
+    const ortDylibDir = await ensureOnnxRuntime(storageDir2).catch((err) => {
+      warn(`ONNX Runtime setup failed: ${err instanceof Error ? err.message : String(err)}. Semantic search will be unavailable.`);
+      return null;
+    });
+    if (ortDylibDir) {
+      configOverrides._ort_dylib_dir = ortDylibDir;
+    } else if (!isOrtAutoDownloadSupported()) {
+      warn(`Semantic search requires ONNX Runtime. Install: ${getManualInstallHint()}`);
+    }
   }
   let versionUpgradeAttempted = null;
   const pool = new BridgePool(binaryPath, {
@@ -25598,7 +25919,7 @@ var plugin = async (input) => {
     if (storageDir) {
       const versionFile = join13(storageDir, "last_announced_version");
       try {
-        if (existsSync8(versionFile)) {
+        if (existsSync9(versionFile)) {
           const lastVersion = readFileSync5(versionFile, "utf-8").trim();
           if (lastVersion === ANNOUNCEMENT_VERSION)
             return { show: false };