Makes read permission rules govern aft_outline and aft_zoom on both OpenCode 1 and 2, including revision reads and re-exported sources. Outline and zoom ask the host once per file whose content they return, hold rendered text until every contributor is authorized, and replace any denied lookup with a permission error while keeping allowed batch entries. Denied single-target requests refuse before dispatch; URL targets do not ask for file-read permission.
Revision reads map the materialized blob back to its checkout path for authorization; manifests never leak Windows verbatim or macOS alias spellings.
Zoom re-export bodies, member menus, and ambiguity signatures are checked against the same source files; non-read-rule denials (e.g. external-directory) also refuse on OpenCode 2.
Batches on both hosts keep allowed entries and report denied ones; denied files trigger a re-render with the path excluded.
Server responses carry a sorted, deduplicated content_files manifest anchored at the configured project root: each source is canonicalized, so symlinked roots and import-canonicalized paths cannot report a different file than the one denied. The requested spelling is never used to derive manifest paths; hosts authorize both spellings, so a denial on either refuses. Capped URL/mixed zoom output and JSON URL outlines preserve the manifest and preview metadata.
Outline file and directory targets check the manifest; exclusions match a walked file's canonical path, so a denial at the real location removes a file reached through a symlinked directory.
Server content that repeats a read-denied file is rejected as an authorization failure.
grep and aft_search permissions are unchanged and documented as separate from read rules.
Confidence Score: 5/5
The PR appears safe to merge; no new actionable issue was established.
Summary
Makes aft_outline and aft_zoom honor file read rules on OpenCode 1 and 2.
Outline and zoom check read rules on both OpenCode hosts.
Outline results name and exclude the files they read.
Zoom results track re-export sources and mask denied lookups.
The search benchmark gets a descriptor for this branch.
The three supplied earlier threads are unnumbered and were not reposted. Current code addresses their reported cases. Each thread was manually resolved without an explanatory reply.
Review used the full PR diff because the ancestry and merge-base checks did not pass. Checks were static; no tests were run.
Diagram
sequenceDiagram
participant Host
participant Plugin
participant Server
Plugin->>Host: Ask read permission for requested files
Plugin->>Server: Request allowed targets
Server-->>Plugin: Held text and content_files
Plugin->>Host: Ask read permission for additional sources
alt A source is denied
Plugin->>Server: Repeat with denied paths excluded
Server-->>Plugin: Allowed results and permission errors
end
Plugin-->>Host: Return authorized text
