Replaces the OpenCode 2 HTTP permission-prompt server with in-process permission.assert calls and requires OpenCode 2.0.29 or newer. The test harness now provisions the lifecycle probe's storage root, and the Docker harness resolves the effect package from the Bun store so the image builds.
Behavior changes
The opencode config block (server_url, server_password_env) is removed; AFT rejects it with removed_config_key errors and aft doctor --fix strips it. Rejection triggers only in the base and first-level harness blocks, ignoring deeper harness entries.
Cancelling a tool call also cancels its pending permission prompt.
Rejecting a prompt without feedback ends the model's current step, not just the tool call.
Edit prompts keep the built-in diff view.
effect is bumped to 4.0.1, and the host plugin peers (@opencode/plugin pinned to ^2.0.29) are now optional.
Migration
Requires OpenCode 2.0.29 or newer.
Upgrading invalidates each project's cached call graph and checkout-view call-graph data; the first graph-dependent request per project rebuilds it and may take longer.
Confidence Score: 5/5
The latest changes appear safe to merge, with no new actionable issues found.
Summary
AFT now uses OpenCode’s in-process permission.assert and requires OpenCode 2.0.29 or newer.
OpenCode asks for tool permission inside the host process.
The old OpenCode prompt-server settings no longer configure prompts.
The OpenCode plugin requires a host with permission.assert.
The search benchmark includes a descriptor for the permission-assert branch.
Diagram
%%{init: {'theme': 'neutral'}}%%
flowchart TD
A[AFT tool requests permission] --> B[Read agent and session rules]
B --> C{Decision}
C -->|Allow| D[Run tool]
C -->|Deny| E[Fail tool call]
C -->|Ask| F[Host permission.assert]
F -->|Approved| D
F -->|Feedback| E
F -->|Rejected without feedback| G[End current step]
