@cortexkit/aft-opencode 0.18.3 → 0.18.4

package/dist/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAIA,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,qBAAqB,CAAC;AAgKlD;;;;;;;;;;;;;;;;;;GAkBG;AACH,QAAA,MAAM,MAAM,EAAE,MAkiBb,CAAC;AAEF,eAAe,MAAM,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAIA,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,qBAAqB,CAAC;AAiKlD;;;;;;;;;;;;;;;;;;GAkBG;AACH,QAAA,MAAM,MAAM,EAAE,MAskBb,CAAC;AAEF,eAAe,MAAM,CAAC"}

package/dist/index.js

@@ -25108,6 +25108,9 @@ function isProcessAlive2(pid) {
   }
 }
 
+// src/pool.ts
+import { realpathSync as realpathSync3 } from "fs";
+
 // src/bridge.ts
 import { spawn as spawn3 } from "child_process";
 import { homedir as homedir7 } from "os";
@@ -25630,6 +25633,14 @@ class BridgePool {
     }
     return null;
   }
+  getActiveBridgeForRoot(projectRoot) {
+    const key = normalizeKey(projectRoot);
+    const entry = this.bridges.get(key);
+    if (!entry?.bridge.isAlive())
+      return null;
+    entry.lastUsed = Date.now();
+    return entry.bridge;
+  }
   getBridge(projectRoot) {
     const key = normalizeKey(projectRoot);
     const existing = this.bridges.get(key);
@@ -25689,7 +25700,12 @@ class BridgePool {
   }
 }
 function normalizeKey(projectRoot) {
-  return projectRoot.replace(/[/\\]+$/, "");
+  const stripped = projectRoot.replace(/[/\\]+$/, "");
+  try {
+    return realpathSync3(stripped);
+  } catch {
+    return stripped;
+  }
 }
 
 // src/resolver.ts
@@ -26179,6 +26195,7 @@ import {
 } from "fs";
 import { isIP } from "net";
 import { join as join17 } from "path";
+import { Agent, fetch as undiciFetch } from "undici";
 var MAX_RESPONSE_BYTES = 10 * 1024 * 1024;
 var CACHE_TTL_MS2 = 24 * 60 * 60 * 1000;
 var FETCH_TIMEOUT_MS = 30000;
@@ -26270,7 +26287,7 @@ function isPrivateIp(address) {
   }
   return true;
 }
-async function assertPublicUrl(url2, allowPrivate) {
+async function assertPublicUrl(url2, allowPrivate, dnsLookup = lookup) {
   if (url2.protocol !== "http:" && url2.protocol !== "https:") {
     throw new Error(`Only http:// and https:// URLs are supported, got: ${url2.protocol}`);
   }
@@ -26281,14 +26298,27 @@ async function assertPublicUrl(url2, allowPrivate) {
     if (isPrivateIp(hostname3)) {
       throw new Error(`Blocked private URL host ${url2.hostname} (${hostname3})`);
     }
-    return;
+    return hostname3;
   }
-  const addresses = await lookup(hostname3, { all: true, verbatim: true });
+  const addresses = await dnsLookup(hostname3, { all: true, verbatim: true });
   for (const { address } of addresses) {
     if (isPrivateIp(address)) {
       throw new Error(`Blocked private URL host ${url2.hostname} (${address})`);
     }
   }
+  if (addresses.length === 0) {
+    throw new Error(`Failed to resolve URL host ${url2.hostname}`);
+  }
+  return addresses[0].address;
+}
+function createPinnedDispatcher(validatedIp) {
+  return new Agent({
+    connect: {
+      lookup: (_hostname, _opts, callback) => {
+        callback(null, validatedIp, validatedIp.includes(":") ? 6 : 4);
+      }
+    }
+  });
 }
 function resolveRedirectUrl(currentUrl, location) {
   if (!location) {
@@ -26296,17 +26326,21 @@ function resolveRedirectUrl(currentUrl, location) {
   }
   return new URL(location, currentUrl);
 }
-async function fetchWithRedirects(startUrl, allowPrivate) {
+async function fetchWithRedirects(startUrl, allowPrivate, deps = {}) {
   let currentUrl = startUrl;
+  const fetchImpl = deps.fetchImpl ?? undiciFetch;
+  const dnsLookup = deps.lookup ?? lookup;
   for (let redirectCount = 0;redirectCount <= MAX_REDIRECTS; redirectCount++) {
-    await assertPublicUrl(currentUrl, allowPrivate);
+    const validatedIp = await assertPublicUrl(currentUrl, allowPrivate, dnsLookup);
+    const dispatcher = validatedIp ? (deps.dispatcherFactory ?? createPinnedDispatcher)(validatedIp) : undefined;
     const controller = new AbortController;
     const timer = setTimeout(() => controller.abort(), FETCH_TIMEOUT_MS);
     let response;
     try {
-      response = await fetch(currentUrl.href, {
+      response = await fetchImpl(currentUrl.href, {
         signal: controller.signal,
         redirect: "manual",
+        dispatcher,
         headers: {
           "user-agent": "aft-opencode-plugin",
           accept: "application/vnd.github.raw, text/markdown, text/x-markdown, text/html;q=0.9, text/plain;q=0.5"
@@ -26367,7 +26401,7 @@ async function fetchUrlToTempFile(url2, storageDir, options = {}) {
     } catch {}
   }
   log(`Fetching URL: ${url2}`);
-  const response = await fetchWithRedirects(parsed, allowPrivate);
+  const response = await fetchWithRedirects(parsed, allowPrivate, options);
   if (!response.ok) {
     throw new Error(`HTTP ${response.status} ${response.statusText} fetching ${url2}`);
   }
@@ -28742,9 +28776,12 @@ Provide exactly ONE of 'filePath' or 'url'. Pass either 'symbol' for a single lo
             const params2 = { file: file2, symbol: sym };
             if (args.contextLines !== undefined)
               params2.context_lines = args.contextLines;
-            return callBridge(ctx, context, "zoom", params2);
+            return callBridge(ctx, context, "zoom", params2).catch((err) => ({
+              success: false,
+              message: err instanceof Error ? err.message : String(err)
+            }));
           }));
-          return JSON.stringify(results);
+          return JSON.stringify(formatZoomBatchResult(args.symbols, results), null, 2);
         }
         const params = { file: file2 };
         if (typeof args.symbol === "string")
@@ -28760,6 +28797,40 @@ Provide exactly ONE of 'filePath' or 'url'. Pass either 'symbol' for a single lo
     }
   };
 }
+function formatZoomBatchResult(symbols, responses) {
+  const entries = symbols.map((name, index) => {
+    const response = responses[index] ?? { success: false, message: "missing zoom response" };
+    if (response.success === false) {
+      const message = typeof response.message === "string" && response.message.length > 0 ? response.message : "zoom failed";
+      return { name, success: false, error: message };
+    }
+    return { name, success: true, content: zoomResponseContent(response) };
+  });
+  const complete = entries.every((entry) => entry.success);
+  const lines = [];
+  if (!complete) {
+    lines.push("Incomplete zoom results: one or more symbols failed.");
+  }
+  for (const entry of entries) {
+    if (entry.success) {
+      lines.push(`Symbol "${entry.name}":
+${entry.content ?? ""}`.trimEnd());
+    } else {
+      lines.push(`Symbol "${entry.name}" not found: ${entry.error ?? "zoom failed"}`);
+    }
+  }
+  return { complete, symbols: entries, text: lines.join(`
+
+`) };
+}
+function zoomResponseContent(response) {
+  if (typeof response.content === "string")
+    return response.content;
+  if (typeof response.text === "string")
+    return response.text;
+  const { success: _success2, ...rest } = response;
+  return JSON.stringify(rest, null, 2);
+}
 var SKIP_DIRS = new Set([
   "node_modules",
   ".git",
@@ -29322,6 +29393,58 @@ function structureTools(ctx) {
   };
 }
 
+// src/workflow-hints.ts
+var HEADING = "## Prefer AFT tools for token efficiency";
+function buildWorkflowHints(opts) {
+  const sections = [];
+  const grepName = opts.hoistBuiltins ? "grep" : "aft_grep";
+  const bashName = opts.hoistBuiltins ? "bash" : "aft_bash";
+  const bashStatusName = "bash_status";
+  const hasOutline = !opts.disabledTools.has("aft_outline");
+  const hasZoom = !opts.disabledTools.has("aft_zoom");
+  const hasGrep = opts.toolSurface !== "minimal" && !opts.disabledTools.has(grepName);
+  const hasSearch = opts.toolSurface !== "minimal" && opts.semanticEnabled && !opts.disabledTools.has("aft_search");
+  const hasNavigate = opts.toolSurface === "all" && !opts.disabledTools.has("aft_navigate");
+  const hasBgBash = opts.bashBackgroundEnabled && !opts.disabledTools.has(bashName) && !opts.disabledTools.has(bashStatusName);
+  if (hasOutline && hasZoom) {
+    sections.push(`**Web/URL access**: \`aft_outline({ url })\` first for structure, then \`aft_zoom({ url, symbol: "<heading>" })\` for the specific section.`);
+  }
+  if (hasOutline && hasZoom && (hasGrep || hasSearch)) {
+    const locator = hasGrep && hasSearch ? `\`${grepName}\` or \`aft_search\`` : hasGrep ? `\`${grepName}\`` : "`aft_search`";
+    sections.push(`**Code exploration**: ${locator} to locate \u2192 \`aft_outline\` for structure \u2192 \`aft_zoom\` for symbol(s).`);
+  }
+  if (hasNavigate) {
+    sections.push([
+      "Use `aft_navigate` instead of grep + read chains for relationship questions:",
+      "- `callers` \u2014 find all call sites before changing a function signature",
+      "- `impact` \u2014 blast radius (which functions/files will need updates)",
+      "- `trace_to` \u2014 how execution reaches this code from entry points (routes, exports, main)",
+      "- `trace_data` \u2014 follow a value through assignments and parameters across files"
+    ].join(`
+`));
+  }
+  if (hasBgBash) {
+    sections.push(`**Long-running commands** (builds, installs, full test suites): \`${bashName}({ background: true })\` returns immediately with a \`taskId\`. Check progress with \`${bashStatusName}({ taskId })\`.`);
+  }
+  if (sections.length === 0) {
+    return null;
+  }
+  return `${HEADING}
+
+${sections.join(`
+
+`)}`;
+}
+function buildHintsFromConfig(config2, disabledTools) {
+  return buildWorkflowHints({
+    toolSurface: config2.tool_surface ?? "recommended",
+    hoistBuiltins: config2.hoist_builtin_tools !== false,
+    semanticEnabled: config2.semantic_search === true,
+    bashBackgroundEnabled: config2.experimental?.bash?.background === true,
+    disabledTools
+  });
+}
+
 // src/index.ts
 var STATUS_COMMAND = "aft-status";
 var SENTINEL_PREFIX = "__AFT_STATUS_";
@@ -29554,7 +29677,7 @@ ${lines}
   });
   rpcServer.handle("status", async (params) => {
     const sessionID = params.sessionID || "rpc";
-    const bridge = pool.getAnyActiveBridge(input.directory) ?? pool.getBridge(input.directory);
+    const bridge = pool.getActiveBridgeForRoot(input.directory) ?? pool.getBridge(input.directory);
     return await bridge.send("status", { session_id: sessionID });
   });
   const storageDir = configOverrides.storage_dir;
@@ -29664,8 +29787,34 @@ Install: ${getManualInstallHint()}`).catch(() => {});
     autoUpdate: aftConfig.auto_update ?? true,
     signal: autoUpdateAbort.signal
   });
+  const HINTS_TOOL_NAMES = [
+    "aft_outline",
+    "aft_zoom",
+    "aft_search",
+    "aft_navigate",
+    "grep",
+    "aft_grep",
+    "bash",
+    "aft_bash",
+    "bash_status"
+  ];
+  const registeredTools = new Set(Object.keys(allTools));
+  const hintsAbsentTools = new Set;
+  for (const name of HINTS_TOOL_NAMES) {
+    if (!registeredTools.has(name))
+      hintsAbsentTools.add(name);
+  }
+  const hintsBlock = buildHintsFromConfig(aftConfig, hintsAbsentTools);
+  if (hintsBlock) {
+    log(`Workflow hints injected (${hintsBlock.length} chars)`);
+  }
   return {
     tool: allTools,
+    "experimental.chat.system.transform": async (_input, output) => {
+      if (hintsBlock) {
+        output.system.push(hintsBlock);
+      }
+    },
     event: async (eventInput) => {
       await autoUpdateEventHook(eventInput);
       if (eventInput.event.type !== "session.idle")
@@ -29687,7 +29836,7 @@ Install: ${getManualInstallHint()}`).catch(() => {});
       if (isTuiMode2() || commandInput.command !== STATUS_COMMAND) {
         return;
       }
-      const bridge = ctx.pool.getAnyActiveBridge(input.directory) ?? ctx.pool.getBridge(input.directory);
+      const bridge = ctx.pool.getActiveBridgeForRoot(input.directory) ?? ctx.pool.getBridge(input.directory);
       const response = await bridge.send("status", { session_id: commandInput.sessionID });
       if (response.success === false) {
         throw new Error(response.message || "status failed");

package/dist/pool.d.ts

@@ -38,6 +38,8 @@ export declare class BridgePool {
      * cold-start cost on a cheap query.
      */
     getAnyActiveBridge(projectRoot: string): BinaryBridge | null;
+    /** Get an alive bridge only when it belongs to the requested project root. */
+    getActiveBridgeForRoot(projectRoot: string): BinaryBridge | null;
     /**
      * Get or create the bridge for `projectRoot`.
      *

package/dist/pool.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"pool.d.ts","sourceRoot":"","sources":["../src/pool.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,YAAY,EAAE,KAAK,aAAa,EAAE,MAAM,UAAU,CAAC;AAY5D,MAAM,WAAW,WAAY,SAAQ,aAAa;IAChD,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,aAAa,CAAC,EAAE,MAAM,CAAC;CACxB;AAED;;;;;;;;;;;;;;;GAeG;AACH,qBAAa,UAAU;IACrB,iEAAiE;IACjE,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAgC;IACxD,OAAO,CAAC,UAAU,CAAS;IAC3B,OAAO,CAAC,QAAQ,CAAC,WAAW,CAAS;IACrC,OAAO,CAAC,QAAQ,CAAC,aAAa,CAAS;IACvC,OAAO,CAAC,QAAQ,CAAC,aAAa,CAAgB;IAC9C,OAAO,CAAC,QAAQ,CAAC,eAAe,CAA0B;IAC1D,OAAO,CAAC,YAAY,CAA+C;gBAGjE,UAAU,EAAE,MAAM,EAClB,OAAO,GAAE,WAAgB,EACzB,eAAe,GAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAM;IAqB/C;;;;;;;OAOG;IACH,kBAAkB,CAAC,WAAW,EAAE,MAAM,GAAG,YAAY,GAAG,IAAI;IAgB5D;;;;;;;OAOG;IACH,SAAS,CAAC,WAAW,EAAE,MAAM,GAAG,YAAY;IAmB5C,wEAAwE;IACxE,OAAO,CAAC,OAAO;IAUf,yDAAyD;IACzD,OAAO,CAAC,QAAQ;IAgBhB,wDAAwD;IAClD,QAAQ,IAAI,OAAO,CAAC,IAAI,CAAC;IAU/B;;;OAGG;IACG,aAAa,CAAC,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAcnD,4CAA4C;IAC5C,IAAI,IAAI,IAAI,MAAM,CAEjB;CACF"}
+{"version":3,"file":"pool.d.ts","sourceRoot":"","sources":["../src/pool.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,YAAY,EAAE,KAAK,aAAa,EAAE,MAAM,UAAU,CAAC;AAY5D,MAAM,WAAW,WAAY,SAAQ,aAAa;IAChD,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,aAAa,CAAC,EAAE,MAAM,CAAC;CACxB;AAED;;;;;;;;;;;;;;;GAeG;AACH,qBAAa,UAAU;IACrB,iEAAiE;IACjE,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAgC;IACxD,OAAO,CAAC,UAAU,CAAS;IAC3B,OAAO,CAAC,QAAQ,CAAC,WAAW,CAAS;IACrC,OAAO,CAAC,QAAQ,CAAC,aAAa,CAAS;IACvC,OAAO,CAAC,QAAQ,CAAC,aAAa,CAAgB;IAC9C,OAAO,CAAC,QAAQ,CAAC,eAAe,CAA0B;IAC1D,OAAO,CAAC,YAAY,CAA+C;gBAGjE,UAAU,EAAE,MAAM,EAClB,OAAO,GAAE,WAAgB,EACzB,eAAe,GAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAM;IAqB/C;;;;;;;OAOG;IACH,kBAAkB,CAAC,WAAW,EAAE,MAAM,GAAG,YAAY,GAAG,IAAI;IAgB5D,8EAA8E;IAC9E,sBAAsB,CAAC,WAAW,EAAE,MAAM,GAAG,YAAY,GAAG,IAAI;IAQhE;;;;;;;OAOG;IACH,SAAS,CAAC,WAAW,EAAE,MAAM,GAAG,YAAY;IAmB5C,wEAAwE;IACxE,OAAO,CAAC,OAAO;IAUf,yDAAyD;IACzD,OAAO,CAAC,QAAQ;IAgBhB,wDAAwD;IAClD,QAAQ,IAAI,OAAO,CAAC,IAAI,CAAC;IAU/B;;;OAGG;IACG,aAAa,CAAC,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAcnD,4CAA4C;IAC5C,IAAI,IAAI,IAAI,MAAM,CAEjB;CACF"}

package/dist/shared/rpc-client.d.ts

@@ -6,6 +6,8 @@ export declare class AftRpcClient {
     constructor(storageDir: string, directory: string);
     /** Call an RPC method. Retries port resolution if the server isn't ready yet. */
     call<T = Record<string, unknown>>(method: string, params?: Record<string, unknown>): Promise<T>;
+    private callResolved;
+    private retryAfterReset;
     /** Check if the RPC server is reachable. */
     isAvailable(): Promise<boolean>;
     private resolvePort;

package/dist/shared/rpc-client.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"rpc-client.d.ts","sourceRoot":"","sources":["../../src/shared/rpc-client.ts"],"names":[],"mappings":"AAQA,qBAAa,YAAY;IACvB,OAAO,CAAC,IAAI,CAAuB;IACnC,OAAO,CAAC,KAAK,CAAuB;IACpC,OAAO,CAAC,YAAY,CAAS;IAC7B,OAAO,CAAC,aAAa,CAAS;gBAElB,UAAU,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM;IAIjD,iFAAiF;IAC3E,IAAI,CAAC,CAAC,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EACpC,MAAM,EAAE,MAAM,EACd,MAAM,GAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAM,GACnC,OAAO,CAAC,CAAC,CAAC;IAoBb,4CAA4C;IACtC,WAAW,IAAI,OAAO,CAAC,OAAO,CAAC;YASvB,WAAW;YAIX,eAAe;IAoC7B,OAAO,CAAC,YAAY;YAuBN,WAAW;YAWX,gBAAgB;IAU9B,KAAK,IAAI,IAAI;CAKd"}
+{"version":3,"file":"rpc-client.d.ts","sourceRoot":"","sources":["../../src/shared/rpc-client.ts"],"names":[],"mappings":"AAQA,qBAAa,YAAY;IACvB,OAAO,CAAC,IAAI,CAAuB;IACnC,OAAO,CAAC,KAAK,CAAuB;IACpC,OAAO,CAAC,YAAY,CAAS;IAC7B,OAAO,CAAC,aAAa,CAAS;gBAElB,UAAU,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM;IAIjD,iFAAiF;IAC3E,IAAI,CAAC,CAAC,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EACpC,MAAM,EAAE,MAAM,EACd,MAAM,GAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAM,GACnC,OAAO,CAAC,CAAC,CAAC;YASC,YAAY;YA6BZ,eAAe;IAe7B,4CAA4C;IACtC,WAAW,IAAI,OAAO,CAAC,OAAO,CAAC;YASvB,WAAW;YAIX,eAAe;IAoC7B,OAAO,CAAC,YAAY;YAuBN,WAAW;YAWX,gBAAgB;IAU9B,KAAK,IAAI,IAAI;CAKd"}

package/dist/shared/url-fetch.d.ts

@@ -1,6 +1,22 @@
+import { lookup } from "node:dns/promises";
+import { type Dispatcher } from "undici";
 interface FetchUrlOptions {
     allowPrivate?: boolean;
+    /** Test-only injection point. Production fetches use undici with DNS pinning. */
+    fetchImpl?: FetchImpl;
+    /** Test-only injection point. Production DNS resolution uses node:dns/promises.lookup. */
+    lookup?: LookupFn;
+    /** Test-only injection point for observing the DNS-pinned dispatcher. */
+    dispatcherFactory?: (validatedIp: string) => Dispatcher;
 }
+type LookupFn = typeof lookup;
+interface FetchInit {
+    signal?: AbortSignal;
+    redirect?: "manual";
+    dispatcher?: Dispatcher;
+    headers?: Record<string, string>;
+}
+type FetchImpl = (input: string, init: FetchInit) => Promise<Response>;
 /** Exported for unit tests. */
 export declare function _isPrivateIpv4(address: string): boolean;
 /**

package/dist/shared/url-fetch.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"url-fetch.d.ts","sourceRoot":"","sources":["../../src/shared/url-fetch.ts"],"names":[],"mappings":"AAsBA,UAAU,eAAe;IACvB,YAAY,CAAC,EAAE,OAAO,CAAC;CACxB;AAyBD,+BAA+B;AAC/B,wBAAgB,cAAc,CAAC,OAAO,EAAE,MAAM,GAAG,OAAO,CAavD;AAoND;;;;GAIG;AACH,wBAAsB,kBAAkB,CACtC,GAAG,EAAE,MAAM,EACX,UAAU,EAAE,MAAM,EAClB,OAAO,GAAE,eAAoB,GAC5B,OAAO,CAAC,MAAM,CAAC,CAgGjB;AAED;;GAEG;AACH,wBAAgB,eAAe,CAAC,UAAU,EAAE,MAAM,GAAG,IAAI,CAkCxD"}
+{"version":3,"file":"url-fetch.d.ts","sourceRoot":"","sources":["../../src/shared/url-fetch.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,MAAM,EAAE,MAAM,mBAAmB,CAAC;AAW3C,OAAO,EAAS,KAAK,UAAU,EAAwB,MAAM,QAAQ,CAAC;AAWtE,UAAU,eAAe;IACvB,YAAY,CAAC,EAAE,OAAO,CAAC;IACvB,iFAAiF;IACjF,SAAS,CAAC,EAAE,SAAS,CAAC;IACtB,0FAA0F;IAC1F,MAAM,CAAC,EAAE,QAAQ,CAAC;IAClB,yEAAyE;IACzE,iBAAiB,CAAC,EAAE,CAAC,WAAW,EAAE,MAAM,KAAK,UAAU,CAAC;CACzD;AAED,KAAK,QAAQ,GAAG,OAAO,MAAM,CAAC;AAC9B,UAAU,SAAS;IACjB,MAAM,CAAC,EAAE,WAAW,CAAC;IACrB,QAAQ,CAAC,EAAE,QAAQ,CAAC;IACpB,UAAU,CAAC,EAAE,UAAU,CAAC;IACxB,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;CAClC;AAED,KAAK,SAAS,GAAG,CAAC,KAAK,EAAE,MAAM,EAAE,IAAI,EAAE,SAAS,KAAK,OAAO,CAAC,QAAQ,CAAC,CAAC;AAyBvE,+BAA+B;AAC/B,wBAAgB,cAAc,CAAC,OAAO,EAAE,MAAM,GAAG,OAAO,CAavD;AAgPD;;;;GAIG;AACH,wBAAsB,kBAAkB,CACtC,GAAG,EAAE,MAAM,EACX,UAAU,EAAE,MAAM,EAClB,OAAO,GAAE,eAAoB,GAC5B,OAAO,CAAC,MAAM,CAAC,CAgGjB;AAED;;GAEG;AACH,wBAAgB,eAAe,CAAC,UAAU,EAAE,MAAM,GAAG,IAAI,CAkCxD"}

package/dist/tools/reading.d.ts

@@ -1,7 +1,21 @@
 import type { ToolDefinition } from "@opencode-ai/plugin";
 import type { PluginContext } from "../types.js";
+interface ZoomBatchSymbolResult {
+    name: string;
+    success: boolean;
+    content?: string;
+    error?: string;
+}
+interface ZoomBatchResult {
+    complete: boolean;
+    symbols: ZoomBatchSymbolResult[];
+    text: string;
+}
 /**
  * Tool definitions for code reading commands: outline + zoom.
  */
 export declare function readingTools(ctx: PluginContext): Record<string, ToolDefinition>;
+/** Exported for regression tests. */
+export declare function formatZoomBatchResult(symbols: string[], responses: Record<string, unknown>[]): ZoomBatchResult;
+export {};
 //# sourceMappingURL=reading.d.ts.map

package/dist/tools/reading.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"reading.d.ts","sourceRoot":"","sources":["../../src/tools/reading.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,qBAAqB,CAAC;AAG1D,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,aAAa,CAAC;AA2CjD;;GAEG;AACH,wBAAgB,YAAY,CAAC,GAAG,EAAE,aAAa,GAAG,MAAM,CAAC,MAAM,EAAE,cAAc,CAAC,CAuK/E"}
+{"version":3,"file":"reading.d.ts","sourceRoot":"","sources":["../../src/tools/reading.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,qBAAqB,CAAC;AAG1D,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,aAAa,CAAC;AA2CjD,UAAU,qBAAqB;IAC7B,IAAI,EAAE,MAAM,CAAC;IACb,OAAO,EAAE,OAAO,CAAC;IACjB,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB;AAED,UAAU,eAAe;IACvB,QAAQ,EAAE,OAAO,CAAC;IAClB,OAAO,EAAE,qBAAqB,EAAE,CAAC;IACjC,IAAI,EAAE,MAAM,CAAC;CACd;AAED;;GAEG;AACH,wBAAgB,YAAY,CAAC,GAAG,EAAE,aAAa,GAAG,MAAM,CAAC,MAAM,EAAE,cAAc,CAAC,CA0K/E;AAED,qCAAqC;AACrC,wBAAgB,qBAAqB,CACnC,OAAO,EAAE,MAAM,EAAE,EACjB,SAAS,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAAE,GACnC,eAAe,CA0BjB"}

package/dist/tui.js

@@ -2,7 +2,7 @@
 // package.json
 var package_default = {
   name: "@cortexkit/aft-opencode",
-  version: "0.18.3",
+  version: "0.18.4",
   type: "module",
   description: "OpenCode plugin for Agent File Tools (AFT) \u2014 tree-sitter and lsp powered code analysis",
   main: "dist/index.js",
@@ -33,14 +33,15 @@ var package_default = {
     "@opencode-ai/plugin": "^1.2.26",
     "@opencode-ai/sdk": "^1.2.26",
     "comment-json": "^4.6.2",
+    undici: "^7.25.0",
     zod: "^4.1.8"
   },
   optionalDependencies: {
-    "@cortexkit/aft-darwin-arm64": "0.18.3",
-    "@cortexkit/aft-darwin-x64": "0.18.3",
-    "@cortexkit/aft-linux-arm64": "0.18.3",
-    "@cortexkit/aft-linux-x64": "0.18.3",
-    "@cortexkit/aft-win32-x64": "0.18.3"
+    "@cortexkit/aft-darwin-arm64": "0.18.4",
+    "@cortexkit/aft-darwin-x64": "0.18.4",
+    "@cortexkit/aft-linux-arm64": "0.18.4",
+    "@cortexkit/aft-linux-x64": "0.18.4",
+    "@cortexkit/aft-win32-x64": "0.18.4"
   },
   devDependencies: {
     "@types/node": "^22.0.0",
@@ -157,17 +158,40 @@ class AftRpcClient {
     if (!info) {
       throw new Error("AFT RPC server not available");
     }
-    const response = await this.fetchWithTimeout(`http://127.0.0.1:${info.port}/rpc/${method}`, {
-      method: "POST",
-      headers: { "Content-Type": "application/json" },
-      body: JSON.stringify({ ...params, token: info.token })
-    });
+    return this.callResolved(method, params, info, true);
+  }
+  async callResolved(method, params, info, retryOnConnectionFailure) {
+    let response;
+    try {
+      response = await this.fetchWithTimeout(`http://127.0.0.1:${info.port}/rpc/${method}`, {
+        method: "POST",
+        headers: { "Content-Type": "application/json" },
+        body: JSON.stringify({ ...params, token: info.token })
+      });
+    } catch (err) {
+      if (!retryOnConnectionFailure)
+        throw err;
+      return this.retryAfterReset(method, params, err);
+    }
     if (!response.ok) {
       const text = await response.text();
+      if (response.status >= 500 && retryOnConnectionFailure) {
+        return this.retryAfterReset(method, params, `HTTP ${response.status}: ${text}`);
+      }
       throw new Error(`RPC ${method} failed (${response.status}): ${text}`);
     }
     return await response.json();
   }
+  async retryAfterReset(method, params, reason) {
+    const message = reason instanceof Error ? reason.message : String(reason);
+    warn(`RPC ${method} failed on cached port; retrying after port refresh (${message})`);
+    this.reset();
+    const refreshed = await this.resolvePortInfo();
+    if (!refreshed) {
+      throw new Error("AFT RPC server not available after port refresh");
+    }
+    return this.callResolved(method, params, refreshed, false);
+  }
   async isAvailable() {
     try {
       const port = await this.resolvePort();

package/dist/workflow-hints.d.ts

@@ -0,0 +1,25 @@
+import type { AftConfig } from "./config.js";
+export interface WorkflowHintsOpts {
+    /** `tool_surface` setting — controls which tools are registered. */
+    toolSurface: "minimal" | "recommended" | "all";
+    /** `hoist_builtin_tools` setting — affects tool name (read vs aft_read). */
+    hoistBuiltins: boolean;
+    /** `experimental.semantic_search` — gates `aft_search` mention. */
+    semanticEnabled: boolean;
+    /** `experimental.bash.background` — gates background-bash paragraph. */
+    bashBackgroundEnabled: boolean;
+    /** Set of disabled tool names (after surface filtering). */
+    disabledTools: Set<string>;
+}
+/**
+ * Build the workflow hints block. Returns `null` when no hints are
+ * applicable for the configured surface (e.g. `tool_surface: "minimal"`
+ * with no aft_outline/aft_zoom available — only safety tool is registered).
+ */
+export declare function buildWorkflowHints(opts: WorkflowHintsOpts): string | null;
+/**
+ * Resolve workflow-hints opts from a loaded AftConfig and the active
+ * disabled-tools set computed at registration time.
+ */
+export declare function buildHintsFromConfig(config: AftConfig, disabledTools: Set<string>): string | null;
+//# sourceMappingURL=workflow-hints.d.ts.map

package/dist/workflow-hints.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"workflow-hints.d.ts","sourceRoot":"","sources":["../src/workflow-hints.ts"],"names":[],"mappings":"AAUA,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,aAAa,CAAC;AAE7C,MAAM,WAAW,iBAAiB;IAChC,oEAAoE;IACpE,WAAW,EAAE,SAAS,GAAG,aAAa,GAAG,KAAK,CAAC;IAC/C,4EAA4E;IAC5E,aAAa,EAAE,OAAO,CAAC;IACvB,mEAAmE;IACnE,eAAe,EAAE,OAAO,CAAC;IACzB,wEAAwE;IACxE,qBAAqB,EAAE,OAAO,CAAC;IAC/B,4DAA4D;IAC5D,aAAa,EAAE,GAAG,CAAC,MAAM,CAAC,CAAC;CAC5B;AAID;;;;GAIG;AACH,wBAAgB,kBAAkB,CAAC,IAAI,EAAE,iBAAiB,GAAG,MAAM,GAAG,IAAI,CAoEzE;AAED;;;GAGG;AACH,wBAAgB,oBAAoB,CAAC,MAAM,EAAE,SAAS,EAAE,aAAa,EAAE,GAAG,CAAC,MAAM,CAAC,GAAG,MAAM,GAAG,IAAI,CAQjG"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@cortexkit/aft-opencode",
-  "version": "0.18.3",
+  "version": "0.18.4",
   "type": "module",
   "description": "OpenCode plugin for Agent File Tools (AFT) — tree-sitter and lsp powered code analysis",
   "main": "dist/index.js",
@@ -31,14 +31,15 @@
     "@opencode-ai/plugin": "^1.2.26",
     "@opencode-ai/sdk": "^1.2.26",
     "comment-json": "^4.6.2",
+    "undici": "^7.25.0",
     "zod": "^4.1.8"
   },
   "optionalDependencies": {
-    "@cortexkit/aft-darwin-arm64": "0.18.3",
-    "@cortexkit/aft-darwin-x64": "0.18.3",
-    "@cortexkit/aft-linux-arm64": "0.18.3",
-    "@cortexkit/aft-linux-x64": "0.18.3",
-    "@cortexkit/aft-win32-x64": "0.18.3"
+    "@cortexkit/aft-darwin-arm64": "0.18.4",
+    "@cortexkit/aft-darwin-x64": "0.18.4",
+    "@cortexkit/aft-linux-arm64": "0.18.4",
+    "@cortexkit/aft-linux-x64": "0.18.4",
+    "@cortexkit/aft-win32-x64": "0.18.4"
   },
   "devDependencies": {
     "@types/node": "^22.0.0",

package/src/shared/rpc-client.ts

@@ -26,20 +26,53 @@ export class AftRpcClient {
       throw new Error("AFT RPC server not available");
     }
 
-    const response = await this.fetchWithTimeout(`http://127.0.0.1:${info.port}/rpc/${method}`, {
-      method: "POST",
-      headers: { "Content-Type": "application/json" },
-      body: JSON.stringify({ ...params, token: info.token }),
-    });
+    return this.callResolved<T>(method, params, info, true);
+  }
+
+  private async callResolved<T>(
+    method: string,
+    params: Record<string, unknown>,
+    info: { port: number; token: string | null },
+    retryOnConnectionFailure: boolean,
+  ): Promise<T> {
+    let response: Response;
+    try {
+      response = await this.fetchWithTimeout(`http://127.0.0.1:${info.port}/rpc/${method}`, {
+        method: "POST",
+        headers: { "Content-Type": "application/json" },
+        body: JSON.stringify({ ...params, token: info.token }),
+      });
+    } catch (err) {
+      if (!retryOnConnectionFailure) throw err;
+      return this.retryAfterReset<T>(method, params, err);
+    }
 
     if (!response.ok) {
       const text = await response.text();
+      if (response.status >= 500 && retryOnConnectionFailure) {
+        return this.retryAfterReset<T>(method, params, `HTTP ${response.status}: ${text}`);
+      }
       throw new Error(`RPC ${method} failed (${response.status}): ${text}`);
     }
 
     return (await response.json()) as T;
   }
 
+  private async retryAfterReset<T>(
+    method: string,
+    params: Record<string, unknown>,
+    reason: unknown,
+  ): Promise<T> {
+    const message = reason instanceof Error ? reason.message : String(reason);
+    warn(`RPC ${method} failed on cached port; retrying after port refresh (${message})`);
+    this.reset();
+    const refreshed = await this.resolvePortInfo();
+    if (!refreshed) {
+      throw new Error("AFT RPC server not available after port refresh");
+    }
+    return this.callResolved<T>(method, params, refreshed, false);
+  }
+
   /** Check if the RPC server is reachable. */
   async isAvailable(): Promise<boolean> {
     try {

package/src/shared/url-fetch.ts

@@ -10,6 +10,7 @@ import {
 } from "node:fs";
 import { isIP } from "node:net";
 import { join } from "node:path";
+import { Agent, type Dispatcher, fetch as undiciFetch } from "undici";
 import { log, warn } from "../logger";
 
 /** Max response body size (10 MB) */
@@ -22,8 +23,24 @@ const MAX_REDIRECTS = 5;
 
 interface FetchUrlOptions {
   allowPrivate?: boolean;
+  /** Test-only injection point. Production fetches use undici with DNS pinning. */
+  fetchImpl?: FetchImpl;
+  /** Test-only injection point. Production DNS resolution uses node:dns/promises.lookup. */
+  lookup?: LookupFn;
+  /** Test-only injection point for observing the DNS-pinned dispatcher. */
+  dispatcherFactory?: (validatedIp: string) => Dispatcher;
 }
 
+type LookupFn = typeof lookup;
+interface FetchInit {
+  signal?: AbortSignal;
+  redirect?: "manual";
+  dispatcher?: Dispatcher;
+  headers?: Record<string, string>;
+}
+
+type FetchImpl = (input: string, init: FetchInit) => Promise<Response>;
+
 interface CacheMeta {
   url: string;
   contentType: string;
@@ -163,11 +180,15 @@ function isPrivateIp(address: string): boolean {
   return true;
 }
 
-async function assertPublicUrl(url: URL, allowPrivate: boolean): Promise<void> {
+async function assertPublicUrl(
+  url: URL,
+  allowPrivate: boolean,
+  dnsLookup: LookupFn = lookup,
+): Promise<string | undefined> {
   if (url.protocol !== "http:" && url.protocol !== "https:") {
     throw new Error(`Only http:// and https:// URLs are supported, got: ${url.protocol}`);
   }
-  if (allowPrivate) return;
+  if (allowPrivate) return undefined;
 
   // URL.hostname returns IPv6 literals wrapped in brackets ("[::1]") per WHATWG.
   // Strip them before checking the address.
@@ -180,15 +201,29 @@ async function assertPublicUrl(url: URL, allowPrivate: boolean): Promise<void> {
     if (isPrivateIp(hostname)) {
       throw new Error(`Blocked private URL host ${url.hostname} (${hostname})`);
     }
-    return;
+    return hostname;
   }
 
-  const addresses = await lookup(hostname, { all: true, verbatim: true });
+  const addresses = await dnsLookup(hostname, { all: true, verbatim: true });
   for (const { address } of addresses) {
     if (isPrivateIp(address)) {
       throw new Error(`Blocked private URL host ${url.hostname} (${address})`);
     }
   }
+  if (addresses.length === 0) {
+    throw new Error(`Failed to resolve URL host ${url.hostname}`);
+  }
+  return addresses[0].address;
+}
+
+function createPinnedDispatcher(validatedIp: string): Dispatcher {
+  return new Agent({
+    connect: {
+      lookup: (_hostname, _opts, callback) => {
+        callback(null, validatedIp, validatedIp.includes(":") ? 6 : 4);
+      },
+    },
+  });
 }
 
 function resolveRedirectUrl(currentUrl: URL, location: string | null): URL {
@@ -198,19 +233,29 @@ function resolveRedirectUrl(currentUrl: URL, location: string | null): URL {
   return new URL(location, currentUrl);
 }
 
-async function fetchWithRedirects(startUrl: URL, allowPrivate: boolean): Promise<Response> {
+async function fetchWithRedirects(
+  startUrl: URL,
+  allowPrivate: boolean,
+  deps: Pick<FetchUrlOptions, "dispatcherFactory" | "fetchImpl" | "lookup"> = {},
+): Promise<Response> {
   let currentUrl = startUrl;
+  const fetchImpl = deps.fetchImpl ?? (undiciFetch as FetchImpl);
+  const dnsLookup = deps.lookup ?? lookup;
 
   for (let redirectCount = 0; redirectCount <= MAX_REDIRECTS; redirectCount++) {
-    await assertPublicUrl(currentUrl, allowPrivate);
+    const validatedIp = await assertPublicUrl(currentUrl, allowPrivate, dnsLookup);
+    const dispatcher = validatedIp
+      ? (deps.dispatcherFactory ?? createPinnedDispatcher)(validatedIp)
+      : undefined;
 
     const controller = new AbortController();
     const timer = setTimeout(() => controller.abort(), FETCH_TIMEOUT_MS);
     let response: Response;
     try {
-      response = await fetch(currentUrl.href, {
+      response = await fetchImpl(currentUrl.href, {
         signal: controller.signal,
         redirect: "manual",
+        dispatcher,
         headers: {
           "user-agent": "aft-opencode-plugin",
           // Prioritize markdown for content-negotiating servers (GitHub API, many docs sites).
@@ -316,7 +361,7 @@ export async function fetchUrlToTempFile(
   }
 
   log(`Fetching URL: ${url}`);
-  const response = await fetchWithRedirects(parsed, allowPrivate);
+  const response = await fetchWithRedirects(parsed, allowPrivate, options);
 
   if (!response.ok) {
     throw new Error(`HTTP ${response.status} ${response.statusText} fetching ${url}`);