@cortexkit/aft-opencode 0.47.2 → 0.48.0

package/dist/config.d.ts

@@ -71,6 +71,11 @@ export declare const AftConfigSchema: z.ZodPreprocess<z.ZodObject<{
         max_depth: z.ZodOptional<z.ZodNumber>;
         max_file_size: z.ZodOptional<z.ZodNumber>;
     }, z.core.$strip>>;
+    sandbox: z.ZodOptional<z.ZodObject<{
+        enabled: z.ZodOptional<z.ZodBoolean>;
+        write_allow: z.ZodOptional<z.ZodArray<z.ZodString>>;
+        read_deny: z.ZodOptional<z.ZodArray<z.ZodString>>;
+    }, z.core.$strip>>;
     bash: z.ZodOptional<z.ZodUnion<readonly [z.ZodBoolean, z.ZodObject<{
         rewrite: z.ZodOptional<z.ZodBoolean>;
         compress: z.ZodOptional<z.ZodBoolean>;

package/dist/config.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"config.d.ts","sourceRoot":"","sources":["../src/config.ts"],"names":[],"mappings":"AACA,OAAO,EACL,KAAK,4BAA4B,EACjC,KAAK,UAAU,EAQhB,MAAM,uBAAuB,CAAC;AAE/B,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAiCxB,oGAAoG;AACpG,eAAO,MAAM,6BAA6B;;;;EAAmC,CAAC;AAC9E,MAAM,MAAM,yBAAyB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,6BAA6B,CAAC,CAAC;AAsMtF,eAAO,MAAM,eAAe;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;mBAkH3B,CAAC;AAEF,MAAM,MAAM,SAAS,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,eAAe,CAAC,CAAC;AAExD,MAAM,WAAW,kBAAkB;IACjC,EAAE,EAAE,MAAM,CAAC;IACX,2EAA2E;IAC3E,UAAU,CAAC,EAAE,MAAM,EAAE,CAAC;IACtB,uEAAuE;IACvE,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,IAAI,EAAE,MAAM,EAAE,CAAC;IACf,YAAY,EAAE,MAAM,EAAE,CAAC;IACvB,QAAQ,EAAE,OAAO,CAAC;IAClB,GAAG,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAC7B,sBAAsB,CAAC,EAAE,OAAO,CAAC;CAClC;AAED,MAAM,WAAW,qBAAqB;IACpC,mBAAmB,CAAC,EAAE,OAAO,CAAC;IAC9B,WAAW,CAAC,EAAE,kBAAkB,EAAE,CAAC;IACnC,YAAY,CAAC,EAAE,MAAM,EAAE,CAAC;CACzB;AAED,MAAM,WAAW,8BAA8B;IAC7C,yBAAyB,CAAC,EAAE,OAAO,CAAC;IACpC,0BAA0B,CAAC,EAAE,OAAO,CAAC;IACrC,4BAA4B,CAAC,EAAE,OAAO,CAAC;IACvC,kCAAkC,CAAC,EAAE,OAAO,CAAC;IAC7C,sCAAsC,CAAC,EAAE,MAAM,CAAC;IAChD,mBAAmB,CAAC,EAAE,OAAO,CAAC;CAC/B;AAMD,wBAAgB,4BAA4B,CAAC,MAAM,EAAE,SAAS,GAAG,qBAAqB,CAuDrF;AAED;;;;;;;;;;;;;;;;;GAiBG;AACH,wBAAgB,mCAAmC,CAAC,MAAM,EAAE,SAAS,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CA+B9F;AAED;;;;;;;;;;GAUG;AACH,MAAM,WAAW,kBAAkB;IACjC,OAAO,EAAE,OAAO,CAAC;IACjB,OAAO,EAAE,OAAO,CAAC;IACjB,QAAQ,EAAE,OAAO,CAAC;IAClB,UAAU,EAAE,OAAO,CAAC;IACpB,iEAAiE;IACjE,mBAAmB,EAAE,OAAO,CAAC;IAC7B,6BAA6B,CAAC,EAAE,OAAO,CAAC;IACxC,iCAAiC,CAAC,EAAE,MAAM,CAAC;IAC3C;;;OAGG;IACH,yBAAyB,EAAE,MAAM,CAAC;CACnC;AAED,iEAAiE;AACjE,eAAO,MAAM,iCAAiC,QAAS,CAAC;AACxD,4EAA4E;AAC5E,eAAO,MAAM,6BAA6B,OAAQ,CAAC;AAEnD;;;;;;;;;;;;;;;;;;;GAmBG;AACH,wBAAgB,iBAAiB,CAAC,MAAM,EAAE,SAAS,GAAG,kBAAkB,CA0FvE;AAED,wBAAgB,qCAAqC,CACnD,MAAM,EAAE,SAAS,GAChB,8BAA8B,CAsBhC;AAED,KAAK,MAAM,GAAG;IACZ,GAAG,EAAE,CAAC,OAAO,EAAE,MAAM,KAAK,IAAI,CAAC;IAC/B,IAAI,EAAE,CAAC,OAAO,EAAE,MAAM,KAAK,IAAI,CAAC;CACjC,CAAC;AAoMF,wBAAgB,oBAAoB,CAClC,UAAU,EAAE,MAAM,EAClB,MAAM,GAAE,MAAsB,GAC7B;IAAE,QAAQ,EAAE,OAAO,CAAC;IAAC,OAAO,EAAE,MAAM,EAAE,CAAA;CAAE,CAwD1C;AAgDD,MAAM,MAAM,eAAe,GAAG;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,MAAM,CAAA;CAAE,CAAC;AAIhE,oFAAoF;AACpF,wBAAgB,mBAAmB,IAAI,SAAS,eAAe,EAAE,CAEhE;AAED,wBAAgB,+BAA+B,CAAC,UAAU,EAAE,MAAM,EAAE,YAAY,EAAE,MAAM,GAAG,MAAM,CAKhG;AAgVD,8DAA8D;AAC9D,eAAO,MAAM,iCAAiC,QAAS,CAAC;AACxD,eAAO,MAAM,6BAA6B,IAAI,CAAC;AAE/C,8EAA8E;AAC9E,wBAAgB,iCAAiC,CAAC,MAAM,EAAE,SAAS,GAAG;IACpE,SAAS,EAAE,MAAM,CAAC;IAClB,aAAa,EAAE,MAAM,CAAC;CACvB,CAKA;AAED,MAAM,WAAW,sBAAsB;IACrC,cAAc,EAAE,MAAM,CAAC;IACvB,iBAAiB,EAAE,MAAM,CAAC;CAC3B;AAED,wBAAgB,yBAAyB,CACvC,gBAAgB,EAAE,MAAM,EACxB,MAAM,GAAE,MAAsB,GAC7B,4BAA4B,EAAE,CAmBhC;AAED,wBAAgB,qBAAqB,CAAC,gBAAgB,EAAE,MAAM,GAAG,sBAAsB,CAKtF;AAED,wBAAgB,8BAA8B,CAC5C,gBAAgB,EAAE,MAAM,EACxB,YAAY,GAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAM,GACzC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG;IAAE,MAAM,EAAE,UAAU,EAAE,CAAC;IAAC,0BAA0B,EAAE,MAAM,CAAA;CAAE,CAOxF;AAMD,wBAAgB,aAAa,CAAC,gBAAgB,EAAE,MAAM,GAAG,SAAS,CAoCjE"}
+{"version":3,"file":"config.d.ts","sourceRoot":"","sources":["../src/config.ts"],"names":[],"mappings":"AACA,OAAO,EACL,KAAK,4BAA4B,EACjC,KAAK,UAAU,EAQhB,MAAM,uBAAuB,CAAC;AAE/B,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAiCxB,oGAAoG;AACpG,eAAO,MAAM,6BAA6B;;;;EAAmC,CAAC;AAC9E,MAAM,MAAM,yBAAyB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,6BAA6B,CAAC,CAAC;AAgNtF,eAAO,MAAM,eAAe;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;mBAoH3B,CAAC;AAEF,MAAM,MAAM,SAAS,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,eAAe,CAAC,CAAC;AAExD,MAAM,WAAW,kBAAkB;IACjC,EAAE,EAAE,MAAM,CAAC;IACX,2EAA2E;IAC3E,UAAU,CAAC,EAAE,MAAM,EAAE,CAAC;IACtB,uEAAuE;IACvE,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,IAAI,EAAE,MAAM,EAAE,CAAC;IACf,YAAY,EAAE,MAAM,EAAE,CAAC;IACvB,QAAQ,EAAE,OAAO,CAAC;IAClB,GAAG,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAC7B,sBAAsB,CAAC,EAAE,OAAO,CAAC;CAClC;AAED,MAAM,WAAW,qBAAqB;IACpC,mBAAmB,CAAC,EAAE,OAAO,CAAC;IAC9B,WAAW,CAAC,EAAE,kBAAkB,EAAE,CAAC;IACnC,YAAY,CAAC,EAAE,MAAM,EAAE,CAAC;CACzB;AAED,MAAM,WAAW,8BAA8B;IAC7C,yBAAyB,CAAC,EAAE,OAAO,CAAC;IACpC,0BAA0B,CAAC,EAAE,OAAO,CAAC;IACrC,4BAA4B,CAAC,EAAE,OAAO,CAAC;IACvC,kCAAkC,CAAC,EAAE,OAAO,CAAC;IAC7C,sCAAsC,CAAC,EAAE,MAAM,CAAC;IAChD,mBAAmB,CAAC,EAAE,OAAO,CAAC;CAC/B;AAMD,wBAAgB,4BAA4B,CAAC,MAAM,EAAE,SAAS,GAAG,qBAAqB,CAuDrF;AAED;;;;;;;;;;;;;;;;;GAiBG;AACH,wBAAgB,mCAAmC,CAAC,MAAM,EAAE,SAAS,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAgC9F;AAED;;;;;;;;;;GAUG;AACH,MAAM,WAAW,kBAAkB;IACjC,OAAO,EAAE,OAAO,CAAC;IACjB,OAAO,EAAE,OAAO,CAAC;IACjB,QAAQ,EAAE,OAAO,CAAC;IAClB,UAAU,EAAE,OAAO,CAAC;IACpB,iEAAiE;IACjE,mBAAmB,EAAE,OAAO,CAAC;IAC7B,6BAA6B,CAAC,EAAE,OAAO,CAAC;IACxC,iCAAiC,CAAC,EAAE,MAAM,CAAC;IAC3C;;;OAGG;IACH,yBAAyB,EAAE,MAAM,CAAC;CACnC;AAED,iEAAiE;AACjE,eAAO,MAAM,iCAAiC,QAAS,CAAC;AACxD,4EAA4E;AAC5E,eAAO,MAAM,6BAA6B,OAAQ,CAAC;AAEnD;;;;;;;;;;;;;;;;;;;GAmBG;AACH,wBAAgB,iBAAiB,CAAC,MAAM,EAAE,SAAS,GAAG,kBAAkB,CA0FvE;AAED,wBAAgB,qCAAqC,CACnD,MAAM,EAAE,SAAS,GAChB,8BAA8B,CAsBhC;AAED,KAAK,MAAM,GAAG;IACZ,GAAG,EAAE,CAAC,OAAO,EAAE,MAAM,KAAK,IAAI,CAAC;IAC/B,IAAI,EAAE,CAAC,OAAO,EAAE,MAAM,KAAK,IAAI,CAAC;CACjC,CAAC;AAoMF,wBAAgB,oBAAoB,CAClC,UAAU,EAAE,MAAM,EAClB,MAAM,GAAE,MAAsB,GAC7B;IAAE,QAAQ,EAAE,OAAO,CAAC;IAAC,OAAO,EAAE,MAAM,EAAE,CAAA;CAAE,CAwD1C;AAgDD,MAAM,MAAM,eAAe,GAAG;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,MAAM,CAAA;CAAE,CAAC;AAIhE,oFAAoF;AACpF,wBAAgB,mBAAmB,IAAI,SAAS,eAAe,EAAE,CAEhE;AAED,wBAAgB,+BAA+B,CAAC,UAAU,EAAE,MAAM,EAAE,YAAY,EAAE,MAAM,GAAG,MAAM,CAKhG;AAqWD,8DAA8D;AAC9D,eAAO,MAAM,iCAAiC,QAAS,CAAC;AACxD,eAAO,MAAM,6BAA6B,IAAI,CAAC;AAE/C,8EAA8E;AAC9E,wBAAgB,iCAAiC,CAAC,MAAM,EAAE,SAAS,GAAG;IACpE,SAAS,EAAE,MAAM,CAAC;IAClB,aAAa,EAAE,MAAM,CAAC;CACvB,CAKA;AAED,MAAM,WAAW,sBAAsB;IACrC,cAAc,EAAE,MAAM,CAAC;IACvB,iBAAiB,EAAE,MAAM,CAAC;CAC3B;AAED,wBAAgB,yBAAyB,CACvC,gBAAgB,EAAE,MAAM,EACxB,MAAM,GAAE,MAAsB,GAC7B,4BAA4B,EAAE,CAmBhC;AAED,wBAAgB,qBAAqB,CAAC,gBAAgB,EAAE,MAAM,GAAG,sBAAsB,CAKtF;AAED,wBAAgB,8BAA8B,CAC5C,gBAAgB,EAAE,MAAM,EACxB,YAAY,GAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAM,GACzC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG;IAAE,MAAM,EAAE,UAAU,EAAE,CAAC;IAAC,0BAA0B,EAAE,MAAM,CAAA;CAAE,CAOxF;AAMD,wBAAgB,aAAa,CAAC,gBAAgB,EAAE,MAAM,GAAG,SAAS,CAoCjE"}

package/dist/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAcA,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,qBAAqB,CAAC;AAoNlD;;;;;;;;;;;;;;;;GAgBG;AAQH,QAAA,MAAM,MAAM,EAAE,MAA6D,CAAC;AAsjC5E,eAAe,MAAM,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAcA,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,qBAAqB,CAAC;AAiNlD;;;;;;;;;;;;;;;;GAgBG;AAQH,QAAA,MAAM,MAAM,EAAE,MAA6D,CAAC;AAsjC5E,eAAe,MAAM,CAAC"}

package/dist/index.js

@@ -14328,6 +14328,9 @@ class SubcTransportPool {
         if (record.routeEntry === entry2) {
           entry2.closed = true;
           record.routeEntry = null;
+          if (entry2.handle != null) {
+            safeCloseRoute(entry2.client, entry2.handle);
+          }
         }
       };
       const handleRequestFailure = (err, entry2) => {
@@ -30137,6 +30140,11 @@ var BashFeaturesSchema = exports_external.object({
   foreground_wait_window_ms: exports_external.number().int().positive().optional()
 });
 var BashConfigSchema = exports_external.union([exports_external.boolean(), BashFeaturesSchema]);
+var SandboxConfigSchema = exports_external.object({
+  enabled: exports_external.boolean().optional(),
+  write_allow: exports_external.array(exports_external.string()).optional(),
+  read_deny: exports_external.array(exports_external.string()).optional()
+});
 var BridgeConfigSchema = exports_external.object({
   request_timeout_ms: exports_external.number().int().min(1000, { message: "bridge.request_timeout_ms must be at least 1000" }).optional(),
   hang_threshold: exports_external.number().int().min(1, { message: "bridge.hang_threshold must be at least 1" }).optional()
@@ -30178,6 +30186,7 @@ var AftConfigSchema = exports_external.preprocess((value) => stripHarnessSpecifi
   callgraph_chunk_size: exports_external.number().optional(),
   inspect: InspectConfigSchema.optional(),
   backup: BackupConfigSchema.optional(),
+  sandbox: SandboxConfigSchema.optional(),
   bash: BashConfigSchema.optional(),
   experimental: ExperimentalConfigSchema.optional(),
   lsp: LspConfigSchema.optional(),
@@ -30511,6 +30520,15 @@ function mergeInspectConfig(baseInspect, overrideInspect) {
   }
   return Object.fromEntries(Object.entries(inspect).filter(([, value]) => value !== undefined));
 }
+function mergeSandboxConfig(base, project) {
+  const readDeny = [...new Set([...base?.read_deny ?? [], ...project?.read_deny ?? []])];
+  const merged = {
+    ...base,
+    ...readDeny.length > 0 ? { read_deny: readDeny } : {},
+    ...project?.enabled === true ? { enabled: true } : {}
+  };
+  return Object.keys(merged).length > 0 ? merged : undefined;
+}
 function mergeBashConfig(baseBash, overrideBash) {
   if (baseBash === undefined && overrideBash === undefined)
     return;
@@ -30599,6 +30617,10 @@ function getStrippedTopLevelKeys(override) {
     stripped.push("bridge");
   if (override.backup !== undefined)
     stripped.push("backup");
+  if (override.sandbox?.enabled === false)
+    stripped.push("sandbox.enabled");
+  if (override.sandbox?.write_allow !== undefined)
+    stripped.push("sandbox.write_allow");
   if (override.subc !== undefined)
     stripped.push("subc");
   if (override.disabled_tools?.includes("aft_safety"))
@@ -30617,6 +30639,7 @@ function mergeConfigs(base, override) {
   const experimental = mergeExperimentalConfig(base.experimental, override.experimental);
   const bash = mergeBashConfig(base.bash, override.bash);
   const inspect = mergeInspectConfig(base.inspect, override.inspect);
+  const sandbox = mergeSandboxConfig(base.sandbox, override.sandbox);
   const bridge = base.bridge;
   const safeOverride = pickProjectSafeFields(override);
   delete safeOverride.bash;
@@ -30629,6 +30652,7 @@ function mergeConfigs(base, override) {
     ...lsp ? { lsp } : {},
     ...bash !== undefined ? { bash } : {},
     ...inspect !== undefined ? { inspect } : {},
+    ...sandbox !== undefined ? { sandbox } : {},
     experimental,
     semantic,
     ...bridge !== undefined ? { bridge } : {},
@@ -35016,7 +35040,6 @@ function astTools(ctx) {
 }
 
 // src/tools/bash.ts
-import * as fs4 from "node:fs/promises";
 import { tool as tool4 } from "@opencode-ai/plugin";
 
 // src/shared/subagent-detect.ts
@@ -35110,8 +35133,8 @@ function groupBashPermissionAsks(asks) {
         bashAsk = { kind: "bash", patterns: [], always: [] };
         grouped.push(bashAsk);
       }
-      pushUnique(bashAsk.patterns, ask.patterns);
-      pushUnique(bashAsk.always, ask.always);
+      pushUnique(bashAsk.patterns ?? [], ask.patterns ?? []);
+      pushUnique(bashAsk.always ?? [], ask.always ?? []);
       continue;
     }
     grouped.push(ask);
@@ -35119,27 +35142,53 @@ function groupBashPermissionAsks(asks) {
   return grouped;
 }
 function permissionsGrantedForRetry(asks) {
-  return asks.flatMap((ask) => ask.always.length > 0 ? ask.always : ask.patterns);
+  return asks.flatMap((ask) => {
+    if (ask.kind === "escalation")
+      return ask.grant_id ? [ask.grant_id] : [];
+    const always = ask.always ?? [];
+    return always.length > 0 ? always : ask.patterns ?? [];
+  });
+}
+function escalationAskText(ask) {
+  return `This command will run UNSANDBOXED on the host.
+
+Exact command:
+${ask.command ?? ""}
+
+Working directory:
+${ask.cwd ?? ""}`;
 }
 async function withPermissionLoop(ctx, runtime, params, bridgeCall, options) {
-  const first = await bridgeCall(ctx, runtime, "bash", params, options);
-  if (first.success !== false || first.code !== "permission_required")
-    return first;
-  const asks = Array.isArray(first.asks) ? first.asks : [];
-  for (const ask of groupBashPermissionAsks(asks)) {
-    const permission = ask.kind === "external_directory" ? "external_directory" : "bash";
-    await runAsk(runtime.ask({
-      permission,
-      patterns: ask.patterns,
-      always: ask.always,
-      metadata: {}
-    }));
-  }
-  const second = await bridgeCall(ctx, runtime, "bash", { ...params, permissions_granted: permissionsGrantedForRetry(asks) }, options);
-  if (second.success === false && second.code === "permission_required") {
-    throw new Error("bash permission retry failed");
+  const granted = Array.isArray(params.permissions_granted) ? params.permissions_granted.filter((value) => typeof value === "string") : [];
+  let response = await bridgeCall(ctx, runtime, "bash", params, options);
+  for (let round = 0;round < 8; round++) {
+    if (response.success !== false || response.code !== "permission_required")
+      return response;
+    const asks = Array.isArray(response.asks) ? response.asks : [];
+    if (asks.length === 0)
+      throw new Error("bash permission retry failed: no asks returned");
+    for (const ask of groupBashPermissionAsks(asks)) {
+      const permission = ask.kind === "external_directory" ? "external_directory" : "bash";
+      const escalation = ask.kind === "escalation";
+      await runAsk(runtime.ask({
+        permission,
+        patterns: escalation ? [escalationAskText(ask)] : ask.patterns ?? [],
+        always: escalation ? [] : ask.always ?? [],
+        metadata: escalation ? {
+          command: ask.command ?? "",
+          cwd: ask.cwd ?? "",
+          grant_id: ask.grant_id ?? "",
+          unsandboxed: true
+        } : {}
+      }));
+    }
+    for (const grant of permissionsGrantedForRetry(asks)) {
+      if (!granted.includes(grant))
+        granted.push(grant);
+    }
+    response = await bridgeCall(ctx, runtime, "bash", { ...params, permissions_granted: granted }, options);
   }
-  return second;
+  throw new Error("bash permission retry failed: too many rounds");
 }
 function createBashTool(ctx, aftSearchRegisteredOverride) {
   const initialBashCfg = resolveBashConfig(ctx.config);
@@ -35157,6 +35206,7 @@ function createBashTool(ctx, aftSearchRegisteredOverride) {
     workdir: z4.string().optional().describe("Working directory for command execution. Relative paths resolve through the bridge; defaults to the current tool context/project root when omitted."),
     description: z4.string().optional().describe("Short 5-10 word human-readable summary shown in OpenCode UI metadata instead of raw shell syntax."),
     wait: z4.boolean().optional().describe("When true, run in the foreground without auto-promoting and wait until the command finishes or reaches its timeout; if you send a new message, the wait detaches to background. Use only when you know the result is required before doing anything else."),
+    sandbox: z4.literal("host").optional().describe("Request one-command approval to run unsandboxed on the host; use only when native sandboxing blocks required work, and note that it is a no-op when sandboxing is disabled."),
     ...backgroundFlagArg,
     compressed: z4.boolean().optional().describe("When true or omitted, return compressed output with noisy terminal control sequences reduced. Set to false for raw output."),
     ...ptyArgs
@@ -35219,7 +35269,8 @@ function createBashTool(ctx, aftSearchRegisteredOverride) {
         permissions_requested: true,
         foreground_orchestrate: true,
         block_to_completion: blockToCompletion,
-        wait: requestedWait
+        wait: requestedWait,
+        sandbox: args2.sandbox
       }, callBashBridge, {
         transportTimeoutMs: orchestratedTransportTimeoutMs(blockToCompletion, requestedWait, effectiveTimeout, foregroundWaitMs),
         onProgress: ({ text }) => {
@@ -35315,19 +35366,15 @@ A completion reminder will be delivered automatically; don't poll.`;
   return text;
 }
 async function formatPtyStatus(_runtime, taskId, data, requestedOutputMode) {
-  const outputPath = data.output_path;
-  if (!outputPath)
-    return `
-[PTY output path unavailable]`;
   const outputMode = requestedOutputMode ?? "screen";
-  const raw = outputMode === "raw" || outputMode === "both" ? await fs4.readFile(outputPath) : undefined;
+  const raw = typeof data.pty_raw === "string" ? data.pty_raw : "";
   let suffix = "";
   if (outputMode === "raw") {
-    suffix = raw && raw.length > 0 ? `
-${raw.toString("utf8")}` : "";
+    suffix = raw.length > 0 ? `
+${raw}` : "";
   } else if (outputMode === "both") {
     suffix = `
-${JSON.stringify({ screen: String(data.pty_screen ?? ""), raw: raw?.toString("utf8") ?? "" }, null, 2)}`;
+${JSON.stringify({ screen: String(data.pty_screen ?? ""), raw }, null, 2)}`;
   } else {
     const screen = data.pty_screen;
     suffix = screen ? `
@@ -35401,12 +35448,11 @@ function conflictTools(ctx) {
 }
 
 // src/tools/hoisted.ts
-import * as fs6 from "node:fs";
+import * as fs4 from "node:fs";
 import * as path4 from "node:path";
 import { tool as tool8 } from "@opencode-ai/plugin";
 
 // src/tools/bash_watch.ts
-import * as fs5 from "node:fs/promises";
 import { tool as tool6 } from "@opencode-ai/plugin";
 var z6 = tool6.schema;
 var BASH_WAIT_POLL_INTERVAL_MS = 100;
@@ -35538,8 +35584,13 @@ ${preview2}`;
   }
   return text;
 }
-async function bashStatusSnapshot2(ctx, runtime, taskId, outputMode, options) {
-  const data = await callBashBridge(ctx, runtime, "bash_status", { task_id: taskId, output_mode: outputMode }, options);
+async function bashStatusSnapshot2(ctx, runtime, taskId, outputMode, cursor, options) {
+  const data = await callBashBridge(ctx, runtime, "bash_status", {
+    task_id: taskId,
+    output_mode: outputMode,
+    output_offset: cursor?.output,
+    stderr_offset: cursor?.stderr
+  }, options);
   if (data.success === false)
     throw new Error(data.message ?? "bash_status failed");
   return data;
@@ -35564,7 +35615,7 @@ async function waitForBashStatus(ctx, runtime, taskId, outputMode, waitFor, effe
     while (true) {
       let data;
       try {
-        data = await bashStatusSnapshot2(ctx, runtime, taskId, outputMode, bridgeOptions);
+        data = await bashStatusSnapshot2(ctx, runtime, taskId, outputMode, waitFor ? spillCursor : undefined, bridgeOptions);
       } catch (err) {
         if (!isBridgeTransportTimeout(err))
           throw err;
@@ -35643,14 +35694,9 @@ async function waitForBashStatus(ctx, runtime, taskId, outputMode, waitFor, effe
   }
 }
 async function readNewTaskOutput(data, cursor) {
-  const outputPath = data.output_path;
-  const stderrPath = data.mode === "pty" ? undefined : data.stderr_path;
-  if (!outputPath && !stderrPath)
-    return;
-  const stdoutBytes = outputPath ? await readFileBytesFrom(outputPath, cursor.output) : Buffer.alloc(0);
-  const stderrBytes = stderrPath ? await readFileBytesFrom(stderrPath, cursor.stderr) : Buffer.alloc(0);
-  const bytesRead = stdoutBytes.length + stderrBytes.length;
-  if (bytesRead === 0)
+  const stdoutBytes = typeof data.output_chunk_base64 === "string" ? Buffer.from(data.output_chunk_base64, "base64") : Buffer.alloc(0);
+  const stderrBytes = typeof data.stderr_chunk_base64 === "string" ? Buffer.from(data.stderr_chunk_base64, "base64") : Buffer.alloc(0);
+  if (stdoutBytes.length + stderrBytes.length === 0)
     return;
   const chunks = [];
   if (stdoutBytes.length > 0) {
@@ -35670,31 +35716,11 @@ async function readNewTaskOutput(data, cursor) {
   return {
     chunks,
     nextCursor: {
-      output: cursor.output + stdoutBytes.length,
-      stderr: cursor.stderr + stderrBytes.length
+      output: typeof data.output_next_offset === "number" ? data.output_next_offset : cursor.output + stdoutBytes.length,
+      stderr: typeof data.stderr_next_offset === "number" ? data.stderr_next_offset : cursor.stderr + stderrBytes.length
     }
   };
 }
-async function readFileBytesFrom(outputPath, cursor) {
-  const handle = await fs5.open(outputPath, "r");
-  try {
-    const chunks = [];
-    let offset = cursor;
-    while (true) {
-      const buffer2 = Buffer.allocUnsafe(64 * 1024);
-      const { bytesRead } = await handle.read(buffer2, 0, buffer2.length, offset);
-      if (bytesRead === 0)
-        break;
-      chunks.push(Buffer.from(buffer2.subarray(0, bytesRead)));
-      offset += bytesRead;
-    }
-    return Buffer.concat(chunks);
-  } finally {
-    await handle.close().catch(() => {
-      return;
-    });
-  }
-}
 function parseWaitPattern(value) {
   if (typeof value === "string")
     return { kind: "substring", value };
@@ -35973,7 +35999,7 @@ function diagnosticsOnEditDefault(ctx) {
 }
 async function readCurrentFileForPreview(filePath) {
   try {
-    return await fs6.promises.readFile(filePath, "utf-8");
+    return await fs4.promises.readFile(filePath, "utf-8");
   } catch (error53) {
     if (error53 && typeof error53 === "object" && "code" in error53 && error53.code === "ENOENT") {
       return "";
@@ -37355,7 +37381,7 @@ function safetyTools(ctx) {
 }
 
 // src/tools/search.ts
-import * as fs7 from "node:fs";
+import * as fs5 from "node:fs";
 import * as path6 from "node:path";
 function arg2(schema) {
   return schema;
@@ -37364,7 +37390,7 @@ function absoluteSearchPath(projectRoot, target) {
   return resolvePathFromProjectRoot(projectRoot, expandTilde2(target));
 }
 function searchPathExists(projectRoot, target) {
-  return fs7.existsSync(absoluteSearchPath(projectRoot, target));
+  return fs5.existsSync(absoluteSearchPath(projectRoot, target));
 }
 function splitSearchPathArg(projectRoot, raw) {
   if (searchPathExists(projectRoot, raw) || !/\s/.test(raw)) {
@@ -37407,7 +37433,7 @@ ${note}` : note;
 }
 function searchPathKind(projectRoot, target, defaultKind) {
   try {
-    const stat2 = fs7.lstatSync(absoluteSearchPath(projectRoot, target));
+    const stat2 = fs5.lstatSync(absoluteSearchPath(projectRoot, target));
     if (defaultKind === "file") {
       return stat2.isDirectory() ? "directory" : "file";
     }
@@ -37702,14 +37728,11 @@ var PLUGIN_VERSION = (() => {
     return "0.0.0";
   }
 })();
-var ANNOUNCEMENT_VERSION = "0.47.2";
+var ANNOUNCEMENT_VERSION = "0.48.0";
 var ANNOUNCEMENT_FEATURES = [
-  "Fixed: apply_patch wrote mixed line endings when editing CRLF (Windows) files; the file's dominant line ending is now preserved.",
-  "Fixed: inlining a function argument like twice(1 + 2) could change operator precedence; non-atomic arguments are now parenthesized.",
-  "Fixed: removing one name from a Python import with an aliased sibling (from m import a, b as c) could delete the whole line.",
-  "Fixed: bash_watch could report a match that spanned the stdout/stderr seam; streams are now scanned independently.",
-  "GitHub and GitLab file links (…/blob/…) now read raw file content in aft_outline/aft_zoom, and documentation heading lookups tolerate numeric prefixes, link labels, emoji, and anchor slugs.",
-  "bash now finds tools on a PATH exported from your shell rc (e.g. zsh .zshrc), and several warm hot paths got faster."
+  "New (beta, off by default): an optional native sandbox for hoisted bash. Confines commands to your project and blocks reads of your credentials (~/.ssh, ~/.aws, cloud configs). Enable with sandbox.enabled in aft.jsonc — macOS and Linux; see docs/config.md for the platform matrix.",
+  "Fixed: Windows background bash tasks could report failed with no exit code after a detach/rebind — completion is now recorded reliably.",
+  "Fixed: search no longer rebuilds its index unnecessarily for repositories with grafted history."
 ];
 var ANNOUNCEMENT_FOOTER = "Join us on Discord: https://discord.gg/DSa65w8wuf";
 var plugin = async (input) => initializePluginForDirectory(input);

package/dist/tools/bash.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"bash.d.ts","sourceRoot":"","sources":["../../src/tools/bash.ts"],"names":[],"mappings":"AAOA,OAAO,KAAK,EAAe,cAAc,EAAE,MAAM,qBAAqB,CAAC;AAMvE,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,aAAa,CAAC;AAuCjD;;;;;;;;;;;;;;;;GAgBG;AACH,wBAAgB,mBAAmB,CACjC,mBAAmB,EAAE,OAAO,EAC5B,aAAa,EAAE,OAAO,EACtB,YAAY,EAAE,OAAO,GACpB,MAAM,CAaR;AA6ED,wBAAgB,cAAc,CAC5B,GAAG,EAAE,aAAa,EAClB,2BAA2B,CAAC,EAAE,OAAO,GACpC,cAAc,CA2NhB;AAED,wBAAgB,oBAAoB,CAAC,GAAG,EAAE,aAAa,GAAG,cAAc,CA2BvE;AAED,wBAAgB,kBAAkB,CAAC,GAAG,EAAE,aAAa,GAAG,cAAc,CAwBrE"}
+{"version":3,"file":"bash.d.ts","sourceRoot":"","sources":["../../src/tools/bash.ts"],"names":[],"mappings":"AAMA,OAAO,KAAK,EAAe,cAAc,EAAE,MAAM,qBAAqB,CAAC;AAMvE,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,aAAa,CAAC;AAuCjD;;;;;;;;;;;;;;;;GAgBG;AACH,wBAAgB,mBAAmB,CACjC,mBAAmB,EAAE,OAAO,EAC5B,aAAa,EAAE,OAAO,EACtB,YAAY,EAAE,OAAO,GACpB,MAAM,CAaR;AAwGD,wBAAgB,cAAc,CAC5B,GAAG,EAAE,aAAa,EAClB,2BAA2B,CAAC,EAAE,OAAO,GACpC,cAAc,CAkOhB;AAED,wBAAgB,oBAAoB,CAAC,GAAG,EAAE,aAAa,GAAG,cAAc,CA2BvE;AAED,wBAAgB,kBAAkB,CAAC,GAAG,EAAE,aAAa,GAAG,cAAc,CAwBrE"}

package/dist/tools/bash_watch.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"bash_watch.d.ts","sourceRoot":"","sources":["../../src/tools/bash_watch.ts"],"names":[],"mappings":"AAQA,OAAO,KAAK,EAAE,WAAW,EAAE,cAAc,EAAE,MAAM,qBAAqB,CAAC;AAavE,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,aAAa,CAAC;AASjD,MAAM,MAAM,eAAe,GACvB;IAAE,IAAI,EAAE,WAAW,CAAC;IAAC,KAAK,EAAE,MAAM,CAAA;CAAE,GACpC;IAAE,IAAI,EAAE,OAAO,CAAC;IAAC,MAAM,EAAE,MAAM,CAAA;CAAE,CAAC;AACtC,MAAM,MAAM,gBAAgB,GAAG;IAC7B,MAAM,EAAE,SAAS,GAAG,QAAQ,GAAG,SAAS,GAAG,cAAc,GAAG,aAAa,CAAC;IAC1E,UAAU,EAAE,MAAM,CAAC;IACnB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,YAAY,CAAC,EAAE,QAAQ,GAAG,QAAQ,CAAC;CACpC,CAAC;AAUF,KAAK,kBAAkB,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG;IAAE,MAAM,CAAC,EAAE,gBAAgB,CAAA;CAAE,CAAC;AAMlF,wBAAgB,mBAAmB,CAAC,GAAG,EAAE,aAAa,GAAG,cAAc,CA0GtE;AAiHD,wBAAsB,iBAAiB,CACrC,GAAG,EAAE,aAAa,EAClB,OAAO,EAAE,WAAW,EACpB,MAAM,EAAE,MAAM,EACd,UAAU,EAAE,MAAM,GAAG,SAAS,EAC9B,OAAO,EAAE,eAAe,GAAG,SAAS,EACpC,eAAe,EAAE,MAAM,GACtB,OAAO,CAAC,kBAAkB,CAAC,CAoH7B;AA2DD,wBAAgB,gBAAgB,CAAC,KAAK,EAAE,OAAO,GAAG,eAAe,GAAG,SAAS,CAI5E;AAkGD,wBAAgB,4BAA4B,CAC1C,IAAI,EAAE,MAAM,EACZ,UAAU,EAAE,MAAM,EAClB,OAAO,EAAE,eAAe,GACvB;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,UAAU,EAAE,MAAM,CAAA;CAAE,CAEtC"}
+{"version":3,"file":"bash_watch.d.ts","sourceRoot":"","sources":["../../src/tools/bash_watch.ts"],"names":[],"mappings":"AAOA,OAAO,KAAK,EAAE,WAAW,EAAE,cAAc,EAAE,MAAM,qBAAqB,CAAC;AAavE,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,aAAa,CAAC;AASjD,MAAM,MAAM,eAAe,GACvB;IAAE,IAAI,EAAE,WAAW,CAAC;IAAC,KAAK,EAAE,MAAM,CAAA;CAAE,GACpC;IAAE,IAAI,EAAE,OAAO,CAAC;IAAC,MAAM,EAAE,MAAM,CAAA;CAAE,CAAC;AACtC,MAAM,MAAM,gBAAgB,GAAG;IAC7B,MAAM,EAAE,SAAS,GAAG,QAAQ,GAAG,SAAS,GAAG,cAAc,GAAG,aAAa,CAAC;IAC1E,UAAU,EAAE,MAAM,CAAC;IACnB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,YAAY,CAAC,EAAE,QAAQ,GAAG,QAAQ,CAAC;CACpC,CAAC;AAUF,KAAK,kBAAkB,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG;IAAE,MAAM,CAAC,EAAE,gBAAgB,CAAA;CAAE,CAAC;AAMlF,wBAAgB,mBAAmB,CAAC,GAAG,EAAE,aAAa,GAAG,cAAc,CA0GtE;AAuHD,wBAAsB,iBAAiB,CACrC,GAAG,EAAE,aAAa,EAClB,OAAO,EAAE,WAAW,EACpB,MAAM,EAAE,MAAM,EACd,UAAU,EAAE,MAAM,GAAG,SAAS,EAC9B,OAAO,EAAE,eAAe,GAAG,SAAS,EACpC,eAAe,EAAE,MAAM,GACtB,OAAO,CAAC,kBAAkB,CAAC,CA2H7B;AA6CD,wBAAgB,gBAAgB,CAAC,KAAK,EAAE,OAAO,GAAG,eAAe,GAAG,SAAS,CAI5E;AAkGD,wBAAgB,4BAA4B,CAC1C,IAAI,EAAE,MAAM,EACZ,UAAU,EAAE,MAAM,EAClB,OAAO,EAAE,eAAe,GACvB;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,UAAU,EAAE,MAAM,CAAA;CAAE,CAEtC"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@cortexkit/aft-opencode",
-  "version": "0.47.2",
+  "version": "0.48.0",
   "type": "module",
   "description": "OpenCode plugin for Agent File Tools (AFT) — tree-sitter and lsp powered code analysis",
   "main": "dist/index.js",
@@ -34,7 +34,7 @@
   },
   "dependencies": {
     "@clack/prompts": "^1.6.0",
-    "@cortexkit/aft-bridge": "0.47.2",
+    "@cortexkit/aft-bridge": "0.48.0",
     "@opentui/core": "0.4.3",
     "@opentui/solid": "0.4.3",
     "comment-json": "^4.6.2",
@@ -43,12 +43,12 @@
     "zod": "^4.4.3"
   },
   "optionalDependencies": {
-    "@cortexkit/aft-darwin-arm64": "0.47.2",
-    "@cortexkit/aft-darwin-x64": "0.47.2",
-    "@cortexkit/aft-linux-arm64": "0.47.2",
-    "@cortexkit/aft-linux-x64": "0.47.2",
-    "@cortexkit/aft-win32-arm64": "0.47.2",
-    "@cortexkit/aft-win32-x64": "0.47.2"
+    "@cortexkit/aft-darwin-arm64": "0.48.0",
+    "@cortexkit/aft-darwin-x64": "0.48.0",
+    "@cortexkit/aft-linux-arm64": "0.48.0",
+    "@cortexkit/aft-linux-x64": "0.48.0",
+    "@cortexkit/aft-win32-arm64": "0.48.0",
+    "@cortexkit/aft-win32-x64": "0.48.0"
   },
   "devDependencies": {
     "@opencode-ai/plugin": "^1.17.11",