@cortexkit/aft-opencode 0.15.3 → 0.15.5

package/dist/onnx-runtime.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"onnx-runtime.d.ts","sourceRoot":"","sources":["../src/onnx-runtime.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AA0DH,4DAA4D;AAC5D,wBAAgB,0BAA0B,IAAI,OAAO,CAEpD;AAED,6EAA6E;AAC7E,wBAAgB,oBAAoB,IAAI,MAAM,CAQ7C;AAED;;;;;;;;GAQG;AACH,wBAAsB,iBAAiB,CAAC,UAAU,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CA4BlF;AA8LD;;GAEG;AACH,wBAAgB,kBAAkB,CAAC,UAAU,EAAE,MAAM,GAAG,IAAI,CAU3D"}
+{"version":3,"file":"onnx-runtime.d.ts","sourceRoot":"","sources":["../src/onnx-runtime.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AA0DH,4DAA4D;AAC5D,wBAAgB,0BAA0B,IAAI,OAAO,CAEpD;AAED,6EAA6E;AAC7E,wBAAgB,oBAAoB,IAAI,MAAM,CAQ7C;AAED;;;;;;;;GAQG;AACH,wBAAsB,iBAAiB,CAAC,UAAU,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CA4BlF;AA6LD;;GAEG;AACH,wBAAgB,kBAAkB,CAAC,UAAU,EAAE,MAAM,GAAG,IAAI,CAU3D"}

package/dist/pool.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"pool.d.ts","sourceRoot":"","sources":["../src/pool.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,YAAY,EAAE,KAAK,aAAa,EAAE,MAAM,UAAU,CAAC;AAY5D,MAAM,WAAW,WAAY,SAAQ,aAAa;IAChD,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,aAAa,CAAC,EAAE,MAAM,CAAC;CACxB;AAED;;;;;;;;;;;;;;;GAeG;AACH,qBAAa,UAAU;IACrB,iEAAiE;IACjE,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAgC;IACxD,OAAO,CAAC,UAAU,CAAS;IAC3B,OAAO,CAAC,QAAQ,CAAC,WAAW,CAAS;IACrC,OAAO,CAAC,QAAQ,CAAC,aAAa,CAAS;IACvC,OAAO,CAAC,QAAQ,CAAC,aAAa,CAAgB;IAC9C,OAAO,CAAC,QAAQ,CAAC,eAAe,CAA0B;IAC1D,OAAO,CAAC,YAAY,CAA+C;gBAGjE,UAAU,EAAE,MAAM,EAClB,OAAO,GAAE,WAAgB,EACzB,eAAe,GAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAM;IAmB/C;;;;;;;OAOG;IACH,kBAAkB,CAAC,WAAW,EAAE,MAAM,GAAG,YAAY,GAAG,IAAI;IAgB5D;;;;;;;OAOG;IACH,SAAS,CAAC,WAAW,EAAE,MAAM,GAAG,YAAY;IAmB5C,wEAAwE;IACxE,OAAO,CAAC,OAAO;IAUf,yDAAyD;IACzD,OAAO,CAAC,QAAQ;IAgBhB,wDAAwD;IAClD,QAAQ,IAAI,OAAO,CAAC,IAAI,CAAC;IAU/B;;;OAGG;IACG,aAAa,CAAC,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAmBnD,4CAA4C;IAC5C,IAAI,IAAI,IAAI,MAAM,CAEjB;CACF"}
+{"version":3,"file":"pool.d.ts","sourceRoot":"","sources":["../src/pool.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,YAAY,EAAE,KAAK,aAAa,EAAE,MAAM,UAAU,CAAC;AAY5D,MAAM,WAAW,WAAY,SAAQ,aAAa;IAChD,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,aAAa,CAAC,EAAE,MAAM,CAAC;CACxB;AAED;;;;;;;;;;;;;;;GAeG;AACH,qBAAa,UAAU;IACrB,iEAAiE;IACjE,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAgC;IACxD,OAAO,CAAC,UAAU,CAAS;IAC3B,OAAO,CAAC,QAAQ,CAAC,WAAW,CAAS;IACrC,OAAO,CAAC,QAAQ,CAAC,aAAa,CAAS;IACvC,OAAO,CAAC,QAAQ,CAAC,aAAa,CAAgB;IAC9C,OAAO,CAAC,QAAQ,CAAC,eAAe,CAA0B;IAC1D,OAAO,CAAC,YAAY,CAA+C;gBAGjE,UAAU,EAAE,MAAM,EAClB,OAAO,GAAE,WAAgB,EACzB,eAAe,GAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAM;IAmB/C;;;;;;;OAOG;IACH,kBAAkB,CAAC,WAAW,EAAE,MAAM,GAAG,YAAY,GAAG,IAAI;IAgB5D;;;;;;;OAOG;IACH,SAAS,CAAC,WAAW,EAAE,MAAM,GAAG,YAAY;IAmB5C,wEAAwE;IACxE,OAAO,CAAC,OAAO;IAUf,yDAAyD;IACzD,OAAO,CAAC,QAAQ;IAgBhB,wDAAwD;IAClD,QAAQ,IAAI,OAAO,CAAC,IAAI,CAAC;IAU/B;;;OAGG;IACG,aAAa,CAAC,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAcnD,4CAA4C;IAC5C,IAAI,IAAI,IAAI,MAAM,CAEjB;CACF"}

package/dist/resolver.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"resolver.d.ts","sourceRoot":"","sources":["../src/resolver.ts"],"names":[],"mappings":"AAqDA;;;;;;;;;GASG;AACH,wBAAgB,WAAW,CACzB,QAAQ,GAAE,MAAyB,EACnC,IAAI,GAAE,MAAqB,GAC1B,MAAM,CAgBR;AAED;;;;;;;;GAQG;AACH,wBAAgB,cAAc,IAAI,MAAM,GAAG,IAAI,CAiD9C;AAED;;;;;;;;;;;;GAYG;AACH,wBAAsB,UAAU,IAAI,OAAO,CAAC,MAAM,CAAC,CAiClD"}
+{"version":3,"file":"resolver.d.ts","sourceRoot":"","sources":["../src/resolver.ts"],"names":[],"mappings":"AAoDA;;;;;;;;;GASG;AACH,wBAAgB,WAAW,CACzB,QAAQ,GAAE,MAAyB,EACnC,IAAI,GAAE,MAAqB,GAC1B,MAAM,CAgBR;AAED;;;;;;;;GAQG;AACH,wBAAgB,cAAc,IAAI,MAAM,GAAG,IAAI,CAiD9C;AAED;;;;;;;;;;;;GAYG;AACH,wBAAsB,UAAU,IAAI,OAAO,CAAC,MAAM,CAAC,CAiClD"}

package/dist/shared/rpc-client.d.ts

@@ -1,5 +1,6 @@
 export declare class AftRpcClient {
     private port;
+    private token;
     private portFilePath;
     private healthChecked;
     constructor(storageDir: string, directory: string);
@@ -8,6 +9,7 @@ export declare class AftRpcClient {
     /** Check if the RPC server is reachable. */
     isAvailable(): Promise<boolean>;
     private resolvePort;
+    private resolvePortInfo;
     private readPortFile;
     private healthCheck;
     private fetchWithTimeout;

package/dist/shared/rpc-client.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"rpc-client.d.ts","sourceRoot":"","sources":["../../src/shared/rpc-client.ts"],"names":[],"mappings":"AAOA,qBAAa,YAAY;IACvB,OAAO,CAAC,IAAI,CAAuB;IACnC,OAAO,CAAC,YAAY,CAAS;IAC7B,OAAO,CAAC,aAAa,CAAS;gBAElB,UAAU,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM;IAIjD,iFAAiF;IAC3E,IAAI,CAAC,CAAC,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EACpC,MAAM,EAAE,MAAM,EACd,MAAM,GAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAM,GACnC,OAAO,CAAC,CAAC,CAAC;IAoBb,4CAA4C;IACtC,WAAW,IAAI,OAAO,CAAC,OAAO,CAAC;YASvB,WAAW;IAkCzB,OAAO,CAAC,YAAY;YAaN,WAAW;YAWX,gBAAgB;IAU9B,KAAK,IAAI,IAAI;CAId"}
+{"version":3,"file":"rpc-client.d.ts","sourceRoot":"","sources":["../../src/shared/rpc-client.ts"],"names":[],"mappings":"AAQA,qBAAa,YAAY;IACvB,OAAO,CAAC,IAAI,CAAuB;IACnC,OAAO,CAAC,KAAK,CAAuB;IACpC,OAAO,CAAC,YAAY,CAAS;IAC7B,OAAO,CAAC,aAAa,CAAS;gBAElB,UAAU,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM;IAIjD,iFAAiF;IAC3E,IAAI,CAAC,CAAC,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EACpC,MAAM,EAAE,MAAM,EACd,MAAM,GAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAM,GACnC,OAAO,CAAC,CAAC,CAAC;IAoBb,4CAA4C;IACtC,WAAW,IAAI,OAAO,CAAC,OAAO,CAAC;YASvB,WAAW;YAIX,eAAe;IAoC7B,OAAO,CAAC,YAAY;YAuBN,WAAW;YAWX,gBAAgB;IAU9B,KAAK,IAAI,IAAI;CAKd"}

package/dist/shared/rpc-server.d.ts

@@ -2,6 +2,7 @@ type RpcHandler = (params: Record<string, unknown>) => Promise<Record<string, un
 export declare class AftRpcServer {
     private server;
     private port;
+    private token;
     private handlers;
     private portFilePath;
     constructor(storageDir: string, directory: string);

package/dist/shared/rpc-server.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"rpc-server.d.ts","sourceRoot":"","sources":["../../src/shared/rpc-server.ts"],"names":[],"mappings":"AAMA,KAAK,UAAU,GAAG,CAAC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,KAAK,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC;AAExF,qBAAa,YAAY;IACvB,OAAO,CAAC,MAAM,CAAuB;IACrC,OAAO,CAAC,IAAI,CAAK;IACjB,OAAO,CAAC,QAAQ,CAAiC;IACjD,OAAO,CAAC,YAAY,CAAS;gBAEjB,UAAU,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM;IAIjD,sCAAsC;IACtC,MAAM,CAAC,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,UAAU,GAAG,IAAI;IAIjD,6DAA6D;IACvD,KAAK,IAAI,OAAO,CAAC,MAAM,CAAC;IAsC9B,8CAA8C;IAC9C,IAAI,IAAI,IAAI;IAYZ,OAAO,CAAC,QAAQ;CA2DjB"}
+{"version":3,"file":"rpc-server.d.ts","sourceRoot":"","sources":["../../src/shared/rpc-server.ts"],"names":[],"mappings":"AAOA,KAAK,UAAU,GAAG,CAAC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,KAAK,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC;AAExF,qBAAa,YAAY;IACvB,OAAO,CAAC,MAAM,CAAuB;IACrC,OAAO,CAAC,IAAI,CAAK;IACjB,OAAO,CAAC,KAAK,CAAuB;IACpC,OAAO,CAAC,QAAQ,CAAiC;IACjD,OAAO,CAAC,YAAY,CAAS;gBAEjB,UAAU,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM;IAIjD,sCAAsC;IACtC,MAAM,CAAC,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,UAAU,GAAG,IAAI;IAIjD,6DAA6D;IACvD,KAAK,IAAI,OAAO,CAAC,MAAM,CAAC;IAuC9B,8CAA8C;IAC9C,IAAI,IAAI,IAAI;IAaZ,OAAO,CAAC,QAAQ;CAmEjB"}

package/dist/shared/url-fetch.d.ts

@@ -1,11 +1,17 @@
+interface FetchUrlOptions {
+    allowPrivate?: boolean;
+}
+/** Exported for unit tests. */
+export declare function _isPrivateIpv4(address: string): boolean;
 /**
  * Fetch a URL to a cached temp file. Uses disk cache with 1-day TTL.
  * Returns the cached file path the Rust outline/zoom command can read.
  * Throws on errors (invalid URL, network failure, unsupported content type, oversized body).
  */
-export declare function fetchUrlToTempFile(url: string, storageDir: string): Promise<string>;
+export declare function fetchUrlToTempFile(url: string, storageDir: string, options?: FetchUrlOptions): Promise<string>;
 /**
  * Remove cache entries older than TTL. Called periodically at plugin startup.
  */
 export declare function cleanupUrlCache(storageDir: string): void;
+export {};
 //# sourceMappingURL=url-fetch.d.ts.map

package/dist/shared/url-fetch.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"url-fetch.d.ts","sourceRoot":"","sources":["../../src/shared/url-fetch.ts"],"names":[],"mappings":"AA4EA;;;;GAIG;AACH,wBAAsB,kBAAkB,CAAC,GAAG,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAoHzF;AAED;;GAEG;AACH,wBAAgB,eAAe,CAAC,UAAU,EAAE,MAAM,GAAG,IAAI,CAkCxD"}
+{"version":3,"file":"url-fetch.d.ts","sourceRoot":"","sources":["../../src/shared/url-fetch.ts"],"names":[],"mappings":"AAsBA,UAAU,eAAe;IACvB,YAAY,CAAC,EAAE,OAAO,CAAC;CACxB;AAyBD,+BAA+B;AAC/B,wBAAgB,cAAc,CAAC,OAAO,EAAE,MAAM,GAAG,OAAO,CAavD;AAoND;;;;GAIG;AACH,wBAAsB,kBAAkB,CACtC,GAAG,EAAE,MAAM,EACX,UAAU,EAAE,MAAM,EAClB,OAAO,GAAE,eAAoB,GAC5B,OAAO,CAAC,MAAM,CAAC,CAgGjB;AAED;;GAEG;AACH,wBAAgB,eAAe,CAAC,UAAU,EAAE,MAAM,GAAG,IAAI,CAkCxD"}

package/dist/tools/hoisted-internals.d.ts

@@ -0,0 +1,9 @@
+/**
+ * Test-only re-exports of internal helpers from hoisted.ts.
+ *
+ * Kept in a separate file so the production import surface of hoisted.ts
+ * stays focused. Bun's test runner imports this directly; the bundled
+ * plugin output never references this module.
+ */
+export { _buildUnifiedDiffForTest } from "./hoisted.js";
+//# sourceMappingURL=hoisted-internals.d.ts.map

package/dist/tools/hoisted-internals.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"hoisted-internals.d.ts","sourceRoot":"","sources":["../../src/tools/hoisted-internals.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,OAAO,EAAE,wBAAwB,EAAE,MAAM,cAAc,CAAC"}

package/dist/tools/hoisted.d.ts

@@ -10,6 +10,8 @@
  */
 import type { ToolDefinition } from "@opencode-ai/plugin";
 import type { PluginContext } from "../types.js";
+/** Test-only export. Production code uses buildUnifiedDiff directly. */
+export declare const _buildUnifiedDiffForTest: (fp: string, before: string, after: string) => string;
 /**
  * Creates the simple read tool. Registers as "read" when hoisted, "aft_read" when not.
  */

package/dist/tools/hoisted.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"hoisted.d.ts","sourceRoot":"","sources":["../../src/tools/hoisted.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAIH,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,qBAAqB,CAAC;AAI1D,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,aAAa,CAAC;AA6EjD;;GAEG;AACH,wBAAgB,cAAc,CAAC,GAAG,EAAE,aAAa,GAAG,cAAc,CA4IjE;AAutBD;;;GAGG;AACH,wBAAgB,YAAY,CAAC,GAAG,EAAE,aAAa,GAAG,MAAM,CAAC,MAAM,EAAE,cAAc,CAAC,CAS/E;AAED;;GAEG;AACH,wBAAgB,gBAAgB,CAAC,GAAG,EAAE,aAAa,GAAG,MAAM,CAAC,MAAM,EAAE,cAAc,CAAC,CAuBnF"}
+{"version":3,"file":"hoisted.d.ts","sourceRoot":"","sources":["../../src/tools/hoisted.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAIH,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,qBAAqB,CAAC;AAI1D,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,aAAa,CAAC;AAcjD,wEAAwE;AACxE,eAAO,MAAM,wBAAwB,GAAI,IAAI,MAAM,EAAE,QAAQ,MAAM,EAAE,OAAO,MAAM,KAAG,MAChD,CAAC;AA2OtC;;GAEG;AACH,wBAAgB,cAAc,CAAC,GAAG,EAAE,aAAa,GAAG,cAAc,CA4IjE;AAkxBD;;;GAGG;AACH,wBAAgB,YAAY,CAAC,GAAG,EAAE,aAAa,GAAG,MAAM,CAAC,MAAM,EAAE,cAAc,CAAC,CAS/E;AAED;;GAEG;AACH,wBAAgB,gBAAgB,CAAC,GAAG,EAAE,aAAa,GAAG,MAAM,CAAC,MAAM,EAAE,cAAc,CAAC,CAuBnF"}

package/dist/tools/reading.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"reading.d.ts","sourceRoot":"","sources":["../../src/tools/reading.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,qBAAqB,CAAC;AAG1D,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,aAAa,CAAC;AA2CjD;;GAEG;AACH,wBAAgB,YAAY,CAAC,GAAG,EAAE,aAAa,GAAG,MAAM,CAAC,MAAM,EAAE,cAAc,CAAC,CAmK/E"}
+{"version":3,"file":"reading.d.ts","sourceRoot":"","sources":["../../src/tools/reading.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,qBAAqB,CAAC;AAG1D,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,aAAa,CAAC;AA2CjD;;GAEG;AACH,wBAAgB,YAAY,CAAC,GAAG,EAAE,aAAa,GAAG,MAAM,CAAC,MAAM,EAAE,cAAc,CAAC,CAuK/E"}

package/dist/tui.js

@@ -2,16 +2,73 @@
 // src/shared/rpc-client.ts
 import { readFileSync } from "fs";
 
+// src/logger.ts
+import * as fs from "fs";
+import * as os from "os";
+import * as path from "path";
+var TAG = "[aft-plugin]";
+var logFile = path.join(os.tmpdir(), "aft-plugin.log");
+var useStderr = process.env.AFT_LOG_STDERR === "1";
+var buffer = [];
+var flushTimer = null;
+var FLUSH_INTERVAL_MS = 500;
+var BUFFER_SIZE_LIMIT = 50;
+function flush() {
+  if (buffer.length === 0)
+    return;
+  const data = buffer.join("");
+  buffer = [];
+  try {
+    if (useStderr) {
+      process.stderr.write(data);
+    } else {
+      fs.appendFileSync(logFile, data);
+    }
+  } catch {}
+}
+function scheduleFlush() {
+  if (flushTimer)
+    return;
+  flushTimer = setTimeout(() => {
+    flushTimer = null;
+    flush();
+  }, FLUSH_INTERVAL_MS);
+  if (flushTimer && typeof flushTimer === "object" && "unref" in flushTimer) {
+    flushTimer.unref();
+  }
+}
+function write(level, message, data) {
+  try {
+    const timestamp = new Date().toISOString();
+    const serialized = data === undefined ? "" : ` ${JSON.stringify(data)}`;
+    const line = `[${timestamp}] ${level} ${TAG} ${message}${serialized}
+`;
+    if (useStderr) {
+      process.stderr.write(line);
+      return;
+    }
+    buffer.push(line);
+    if (buffer.length >= BUFFER_SIZE_LIMIT) {
+      flush();
+    } else {
+      scheduleFlush();
+    }
+  } catch {}
+}
+function warn(message, data) {
+  write("WARN", message, data);
+}
+
 // src/shared/rpc-utils.ts
 import { createHash } from "crypto";
-import { join } from "path";
+import { join as join2 } from "path";
 function projectHash(directory) {
   const normalized = directory.replace(/\/+$/, "");
   return createHash("sha256").update(normalized).digest("hex").slice(0, 16);
 }
 function rpcPortFilePath(storageDir, directory) {
   const hash = projectHash(directory);
-  return join(storageDir, "rpc", hash, "port");
+  return join2(storageDir, "rpc", hash, "port");
 }
 
 // src/shared/rpc-client.ts
@@ -21,20 +78,21 @@ var REQUEST_TIMEOUT_MS = 5000;
 
 class AftRpcClient {
   port = null;
+  token = null;
   portFilePath;
   healthChecked = false;
   constructor(storageDir, directory) {
     this.portFilePath = rpcPortFilePath(storageDir, directory);
   }
   async call(method, params = {}) {
-    const port = await this.resolvePort();
-    if (!port) {
+    const info = await this.resolvePortInfo();
+    if (!info) {
       throw new Error("AFT RPC server not available");
     }
-    const response = await this.fetchWithTimeout(`http://127.0.0.1:${port}/rpc/${method}`, {
+    const response = await this.fetchWithTimeout(`http://127.0.0.1:${info.port}/rpc/${method}`, {
       method: "POST",
       headers: { "Content-Type": "application/json" },
-      body: JSON.stringify(params)
+      body: JSON.stringify({ ...params, token: info.token })
     });
     if (!response.ok) {
       const text = await response.text();
@@ -51,26 +109,31 @@ class AftRpcClient {
     }
   }
   async resolvePort() {
+    return (await this.resolvePortInfo())?.port ?? null;
+  }
+  async resolvePortInfo() {
     if (this.port && this.healthChecked) {
-      return this.port;
+      return { port: this.port, token: this.token };
     }
     if (this.port) {
       const alive = await this.healthCheck(this.port);
       if (alive) {
         this.healthChecked = true;
-        return this.port;
+        return { port: this.port, token: this.token };
       }
       this.port = null;
+      this.token = null;
       this.healthChecked = false;
     }
     for (let attempt = 0;attempt < MAX_RETRIES; attempt++) {
-      const port = this.readPortFile();
-      if (port) {
-        const alive = await this.healthCheck(port);
+      const info = this.readPortFile();
+      if (info) {
+        const alive = await this.healthCheck(info.port);
         if (alive) {
-          this.port = port;
+          this.port = info.port;
+          this.token = info.token;
           this.healthChecked = true;
-          return port;
+          return info;
         }
       }
       if (attempt < MAX_RETRIES - 1) {
@@ -82,11 +145,21 @@ class AftRpcClient {
   readPortFile() {
     try {
       const content = readFileSync(this.portFilePath, "utf-8").trim();
-      const port = Number.parseInt(content, 10);
+      let port;
+      let token;
+      if (content.startsWith("{")) {
+        const parsed = JSON.parse(content);
+        port = typeof parsed.port === "number" ? parsed.port : Number.NaN;
+        token = typeof parsed.token === "string" ? parsed.token : null;
+      } else {
+        warn("RPC port file uses legacy integer format; unauthenticated RPC is deprecated");
+        port = Number.parseInt(content, 10);
+        token = null;
+      }
       if (Number.isNaN(port) || port <= 0 || port > 65535) {
         return null;
       }
-      return port;
+      return { port, token };
     } catch {
       return null;
     }
@@ -112,6 +185,7 @@ class AftRpcClient {
   }
   reset() {
     this.port = null;
+    this.token = null;
     this.healthChecked = false;
   }
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@cortexkit/aft-opencode",
-  "version": "0.15.3",
+  "version": "0.15.5",
   "type": "module",
   "description": "OpenCode plugin for Agent File Tools (AFT) — tree-sitter and lsp powered code analysis",
   "main": "dist/index.js",
@@ -32,11 +32,11 @@
     "zod": "^4.1.8"
   },
   "optionalDependencies": {
-    "@cortexkit/aft-darwin-arm64": "0.15.3",
-    "@cortexkit/aft-darwin-x64": "0.15.3",
-    "@cortexkit/aft-linux-arm64": "0.15.3",
-    "@cortexkit/aft-linux-x64": "0.15.3",
-    "@cortexkit/aft-win32-x64": "0.15.3"
+    "@cortexkit/aft-darwin-arm64": "0.15.5",
+    "@cortexkit/aft-darwin-x64": "0.15.5",
+    "@cortexkit/aft-linux-arm64": "0.15.5",
+    "@cortexkit/aft-linux-x64": "0.15.5",
+    "@cortexkit/aft-win32-x64": "0.15.5"
   },
   "devDependencies": {
     "@types/node": "^22.0.0",

package/src/shared/rpc-client.ts

@@ -1,4 +1,5 @@
 import { readFileSync } from "node:fs";
+import { warn } from "../logger";
 import { rpcPortFilePath } from "./rpc-utils";
 
 const MAX_RETRIES = 10;
@@ -7,6 +8,7 @@ const REQUEST_TIMEOUT_MS = 5000;
 
 export class AftRpcClient {
   private port: number | null = null;
+  private token: string | null = null;
   private portFilePath: string;
   private healthChecked = false;
 
@@ -19,15 +21,15 @@ export class AftRpcClient {
     method: string,
     params: Record<string, unknown> = {},
   ): Promise<T> {
-    const port = await this.resolvePort();
-    if (!port) {
+    const info = await this.resolvePortInfo();
+    if (!info) {
       throw new Error("AFT RPC server not available");
     }
 
-    const response = await this.fetchWithTimeout(`http://127.0.0.1:${port}/rpc/${method}`, {
+    const response = await this.fetchWithTimeout(`http://127.0.0.1:${info.port}/rpc/${method}`, {
       method: "POST",
       headers: { "Content-Type": "application/json" },
-      body: JSON.stringify(params),
+      body: JSON.stringify({ ...params, token: info.token }),
     });
 
     if (!response.ok) {
@@ -49,28 +51,34 @@ export class AftRpcClient {
   }
 
   private async resolvePort(): Promise<number | null> {
+    return (await this.resolvePortInfo())?.port ?? null;
+  }
+
+  private async resolvePortInfo(): Promise<{ port: number; token: string | null } | null> {
     if (this.port && this.healthChecked) {
-      return this.port;
+      return { port: this.port, token: this.token };
     }
 
     if (this.port) {
       const alive = await this.healthCheck(this.port);
       if (alive) {
         this.healthChecked = true;
-        return this.port;
+        return { port: this.port, token: this.token };
       }
       this.port = null;
+      this.token = null;
       this.healthChecked = false;
     }
 
     for (let attempt = 0; attempt < MAX_RETRIES; attempt++) {
-      const port = this.readPortFile();
-      if (port) {
-        const alive = await this.healthCheck(port);
+      const info = this.readPortFile();
+      if (info) {
+        const alive = await this.healthCheck(info.port);
         if (alive) {
-          this.port = port;
+          this.port = info.port;
+          this.token = info.token;
           this.healthChecked = true;
-          return port;
+          return info;
         }
       }
 
@@ -82,14 +90,24 @@ export class AftRpcClient {
     return null;
   }
 
-  private readPortFile(): number | null {
+  private readPortFile(): { port: number; token: string | null } | null {
     try {
       const content = readFileSync(this.portFilePath, "utf-8").trim();
-      const port = Number.parseInt(content, 10);
+      let port: number;
+      let token: string | null;
+      if (content.startsWith("{")) {
+        const parsed = JSON.parse(content) as { port?: unknown; token?: unknown };
+        port = typeof parsed.port === "number" ? parsed.port : Number.NaN;
+        token = typeof parsed.token === "string" ? parsed.token : null;
+      } else {
+        warn("RPC port file uses legacy integer format; unauthenticated RPC is deprecated");
+        port = Number.parseInt(content, 10);
+        token = null;
+      }
       if (Number.isNaN(port) || port <= 0 || port > 65535) {
         return null;
       }
-      return port;
+      return { port, token };
     } catch {
       return null;
     }
@@ -118,6 +136,7 @@ export class AftRpcClient {
 
   reset(): void {
     this.port = null;
+    this.token = null;
     this.healthChecked = false;
   }
 }

package/src/shared/rpc-server.ts

@@ -1,3 +1,4 @@
+import { randomBytes } from "node:crypto";
 import { mkdirSync, renameSync, unlinkSync, writeFileSync } from "node:fs";
 import { createServer, type IncomingMessage, type Server, type ServerResponse } from "node:http";
 import { dirname } from "node:path";
@@ -9,6 +10,7 @@ type RpcHandler = (params: Record<string, unknown>) => Promise<Record<string, un
 export class AftRpcServer {
   private server: Server | null = null;
   private port = 0;
+  private token: string | null = null;
   private handlers = new Map<string, RpcHandler>();
   private portFilePath: string;
 
@@ -38,6 +40,7 @@ export class AftRpcServer {
           return;
         }
         this.port = addr.port;
+        this.token = randomBytes(32).toString("hex");
         this.server = server;
 
         // Write port file atomically
@@ -45,7 +48,7 @@ export class AftRpcServer {
           const dir = dirname(this.portFilePath);
           mkdirSync(dir, { recursive: true });
           const tmpPath = `${this.portFilePath}.tmp`;
-          writeFileSync(tmpPath, String(this.port), "utf-8");
+          writeFileSync(tmpPath, JSON.stringify({ port: this.port, token: this.token }), "utf-8");
           renameSync(tmpPath, this.portFilePath);
           log(`RPC server listening on 127.0.0.1:${this.port}`);
         } catch (err) {
@@ -66,6 +69,7 @@ export class AftRpcServer {
       this.server.close();
       this.server = null;
     }
+    this.token = null;
     try {
       unlinkSync(this.portFilePath);
     } catch {
@@ -118,8 +122,16 @@ export class AftRpcServer {
         return;
       }
 
-      log(`RPC call: ${method} params=${JSON.stringify(params).slice(0, 200)}`);
-      handler(params)
+      if (params.token !== this.token) {
+        res.writeHead(403, { "Content-Type": "application/json" });
+        res.end(JSON.stringify({ error: "Forbidden" }));
+        return;
+      }
+
+      const { token: _token, ...handlerParams } = params;
+
+      log(`RPC call: ${method} params=${JSON.stringify(handlerParams).slice(0, 200)}`);
+      handler(handlerParams)
         .then((result) => {
           log(`RPC result: ${method} => ${JSON.stringify(result).slice(0, 200)}`);
           res.writeHead(200, { "Content-Type": "application/json" });