@bevel-software/platform-core-backend 0.24.0 → 0.25.0

package/src/modules/tool-manuals/__tests__/tool-manuals.service.test.ts

@@ -183,6 +183,157 @@ describe('ToolManualService', () => {
     expect(manual).toBeNull();
   });
 
+  test('resolves an inline tool that calls Google as a service account, and surfaces the key variable', async () => {
+    // The auth block is what makes the call; the key it names has to reach the
+    // secrets UI as a shared variable or nobody can store it.
+    await writeFile(
+      join(root, wsId, KB_DIR, 'Plugins', 'google_ads.tool'),
+      JSON.stringify({
+        id: 'google_ads',
+        type: 'inline',
+        tools: [
+          {
+            name: 'list_accessible_customers',
+            description: 'List the customers the service account can reach.',
+            inputs: { type: 'object', properties: {} },
+            outputs: { type: 'object', properties: {} },
+            tool_call_template: {
+              call_template_type: 'http',
+              http_method: 'GET',
+              url: 'https://googleads.googleapis.com/v22/customers:listAccessibleCustomers',
+              headers: { 'developer-token': '${DEVELOPER_TOKEN}' },
+              auth: {
+                auth_type: 'google_service_account',
+                credentials: '${GOOGLE_SA_KEY}',
+                scopes: 'https://www.googleapis.com/auth/adwords',
+              },
+            },
+          },
+        ],
+      }),
+    );
+
+    const manual = await svc().resolveInlineManual('user@x.eu', 'google_ads');
+    const tools = (manual as { tools?: { name?: string; tool_call_template?: { auth?: unknown } }[] } | null)?.tools ?? [];
+    expect(tools.map((t) => t.name)).toEqual(['list_accessible_customers']);
+    // The auth block is what makes the call, so resolving must carry it through intact.
+    expect(tools[0]?.tool_call_template?.auth).toEqual({
+      auth_type: 'google_service_account',
+      credentials: '${GOOGLE_SA_KEY}',
+      scopes: 'https://www.googleapis.com/auth/adwords',
+    });
+
+    const summary = (await svc().listAccessible('user@x.eu')).find((m) => m.name === 'google_ads')!;
+    expect(summary.variables?.find((v) => v.name === 'GOOGLE_SA_KEY')?.scope).toBe('admin');
+  });
+
+  test('refuses a Google service-account auth block where no token would be sent, and says where', async () => {
+    // Only the `http` protocol mints the token. On any other template the
+    // block validates and is then sent as no credentials at all, so the file
+    // is refused when it is read rather than left to fail at Google.
+    const serviceAccount = {
+      auth_type: 'google_service_account',
+      credentials: '${GOOGLE_SA_KEY}',
+      scopes: 'https://www.googleapis.com/auth/adwords',
+    };
+    const inlineOver = (callTemplateType: string) =>
+      JSON.stringify({
+        type: 'inline',
+        tools: [
+          {
+            name: 'events',
+            description: 'Stream events.',
+            inputs: { type: 'object', properties: {} },
+            outputs: { type: 'object', properties: {} },
+            tool_call_template: { call_template_type: callTemplateType, url: 'https://api.example.com/events', auth: serviceAccount },
+          },
+        ],
+      });
+    const plugins = join(root, wsId, KB_DIR, 'Plugins');
+    await writeFile(join(plugins, 'over_sse.tool'), inlineOver('sse'));
+    await writeFile(join(plugins, 'over_streamable.tool'), inlineOver('streamable_http'));
+    // Not on a call template at all: a discovered manual takes only a url and headers.
+    await writeFile(
+      join(plugins, 'discovered.tool'),
+      JSON.stringify({ type: 'http', url: 'https://api.example.com/utcp', auth: serviceAccount }),
+    );
+    // Looking like an `http` call template is not enough: a discovered manual
+    // reads neither a block at its root nor a `tools` list, whatever they say.
+    await writeFile(
+      join(plugins, 'dressed_root.tool'),
+      JSON.stringify({ type: 'http', url: 'https://api.example.com/utcp', call_template_type: 'http', auth: serviceAccount }),
+    );
+    await writeFile(
+      join(plugins, 'unread_tools.tool'),
+      JSON.stringify({ ...JSON.parse(inlineOver('http')), type: 'http', url: 'https://api.example.com/utcp' }),
+    );
+    await writeFile(join(plugins, 'over_http.tool'), inlineOver('http'));
+
+    const catalog = await svc().listAccessibleCatalog('user@x.eu');
+
+    const reasonFor = (file: string) => catalog.invalid.find((i) => i.path === `Plugins/${file}`)?.reason ?? '';
+    expect(reasonFor('over_sse.tool')).toContain('a `sse` call template');
+    expect(reasonFor('over_streamable.tool')).toContain('a `streamable_http` call template');
+    expect(reasonFor('discovered.tool')).toContain("not a call template's `auth`");
+    expect(reasonFor('dressed_root.tool')).toContain('no tool is called through');
+    expect(reasonFor('unread_tools.tool')).toContain('no tool is called through');
+    for (const file of ['over_sse.tool', 'over_streamable.tool', 'discovered.tool', 'dressed_root.tool', 'unread_tools.tool']) {
+      expect(reasonFor(file)).toContain('`call_template_type: http`');
+    }
+    // The one place it works is left alone.
+    expect(reasonFor('over_http.tool')).toBe('');
+    expect(catalog.tools.map((m) => m.name)).toContain('overhttp');
+  });
+
+  test('refuses a `.tool` that holds a service-account key itself, wherever the block sits, and never repeats it', async () => {
+    // A `.tool` is committed and read by everyone who can read the knowledge
+    // base, so the key lives in the vault and the file only names it.
+    const key = JSON.stringify({ type: 'service_account', client_email: 'ads@proj.iam.gserviceaccount.com', private_key: 'MIIEvQIBADANBgkq-NOT-A-REAL-KEY' });
+    const withCredentials = (credentials: unknown, callTemplateType = 'http') =>
+      JSON.stringify({
+        type: 'inline',
+        tools: [
+          {
+            name: 'list',
+            description: 'List.',
+            inputs: { type: 'object', properties: {} },
+            outputs: { type: 'object', properties: {} },
+            tool_call_template: {
+              call_template_type: callTemplateType,
+              http_method: 'GET',
+              url: 'https://googleads.googleapis.com/v22/customers',
+              auth: { auth_type: 'google_service_account', credentials, scopes: 'https://www.googleapis.com/auth/adwords' },
+            },
+          },
+        ],
+      });
+    const plugins = join(root, wsId, KB_DIR, 'Plugins');
+    await writeFile(join(plugins, 'pasted_key.tool'), withCredentials(key));
+    await writeFile(join(plugins, 'pasted_base64.tool'), withCredentials(Buffer.from(key).toString('base64')));
+    // A variable with the key, or anything else, written around it is still text in the file.
+    await writeFile(join(plugins, 'beside_a_variable.tool'), withCredentials('${GOOGLE_SA_KEY}' + key));
+    // In a block nothing acts on, the key is just as readable: that it is there is said first.
+    await writeFile(join(plugins, 'key_over_sse.tool'), withCredentials(key, 'sse'));
+    await writeFile(join(plugins, 'braced.tool'), withCredentials('${GOOGLE_SA_KEY}'));
+    await writeFile(join(plugins, 'bare.tool'), withCredentials(' $GOOGLE_SA_KEY '));
+
+    const catalog = await svc().listAccessibleCatalog('user@x.eu');
+
+    const reasonFor = (file: string) => catalog.invalid.find((i) => i.path === `Plugins/${file}`)?.reason ?? '';
+    for (const file of ['pasted_key.tool', 'pasted_base64.tool', 'beside_a_variable.tool', 'key_over_sse.tool']) {
+      expect(reasonFor(file), file).toContain('something other than a vault variable as its `credentials`');
+      expect(reasonFor(file), file).toContain('Secrets Vault');
+    }
+    // Nothing of what was pasted comes back in the answer, in either spelling.
+    const answer = JSON.stringify(catalog);
+    expect(answer).not.toMatch(/NOT-A-REAL-KEY|iam\.gserviceaccount/);
+    expect(answer).not.toContain(Buffer.from(key).toString('base64').slice(0, 40));
+    // Either spelling of one variable is what the field is for.
+    expect(reasonFor('braced.tool')).toBe('');
+    expect(reasonFor('bare.tool')).toBe('');
+    expect(catalog.tools.map((m) => m.name)).toEqual(expect.arrayContaining(['braced', 'bare']));
+  });
+
   test('manual names are alphanumeric (no underscores) for variable namespacing', async () => {
     root = await mkdtemp(join(tmpdir(), 'tools2-'));
     const tools = join(root, wsId, KB_DIR, 'Plugins');

package/src/modules/tool-manuals/tool-manuals.service.ts

@@ -16,6 +16,9 @@ import {
   DefaultVariableSubstitutor,
   type CallTemplate,
 } from '@utcp/sdk';
+// Also a side effect: loading the package registers the 'google_service_account'
+// auth type, so a `.tool` naming it validates here.
+import { findUnservedGoogleServiceAccountAuth, holdsLiteralGoogleServiceAccountKey } from '@bevel-software/platform-mcp-core';
 import { descriptorsFromMcpJson } from './mcp-json-discovery.js';
 import type { PluginSource } from '../plugins/discovery/plugin-source.js';
 import type { WorkspaceService } from '../workspace/workspace.service.js';
@@ -1196,6 +1199,40 @@ export function normalizeToolManual(
     descriptor.remote = false;
   }
 
+  // A service account's KEY IS NEVER WRITTEN IN A `.tool`. The file is
+  // knowledge-base content: committed, and read by everyone and every agent
+  // that can read the knowledge base. So `credentials` names the vault
+  // variable and nothing else, and a file that holds anything else there is
+  // refused before the block's placement is even looked at: a key in a block
+  // nothing acts on is just as readable. The refusal does not quote the value.
+  if (holdsLiteralGoogleServiceAccountKey(obj)) {
+    throw new Error(
+      '`auth_type: google_service_account` has something other than a vault variable as its `credentials`. ' +
+        'Write `credentials: ${GOOGLE_SA_KEY}` and store the key in the Secrets Vault under that name: a `.tool` is ' +
+        'read by everyone who can read the knowledge base. If a real key was saved in this file, treat it as ' +
+        'exposed and replace it at Google; removing it here does not take it out of the history.',
+    );
+  }
+
+  // A Google service-account `auth` block works on one thing: an inline tool's
+  // `http` call template. Anywhere else it validates and is then sent as no
+  // credentials at all, so the tool would save cleanly and call Google
+  // unauthenticated, with Google's 401 the only hint. Refused here instead,
+  // naming where the block was found. The templates below are the only ones
+  // this file's tools are called through: a `tools` list on a file that is not
+  // `inline` is never read, so nothing in it counts.
+  const toolCallTemplates =
+    type === 'inline' && Array.isArray(obj.tools)
+      ? obj.tools.map((tool: unknown) => (tool && typeof tool === 'object' ? (tool as Record<string, unknown>).tool_call_template : undefined))
+      : [];
+  const unserved = findUnservedGoogleServiceAccountAuth(obj, toolCallTemplates);
+  if (unserved) {
+    throw new Error(
+      `\`auth_type: google_service_account\` is on ${unserved}, where no token would be sent. ` +
+        "It works only as the `auth` of an inline tool's `tool_call_template` with `call_template_type: http`.",
+    );
+  }
+
   if (type === 'inline') {
     const tools = Array.isArray(obj.tools) ? obj.tools : undefined;
     if (!tools) throw new Error('inline `.tool` must have a `tools` array');

package/src/modules/workspace/__tests__/workspace.tools.test.ts

@@ -183,6 +183,25 @@ async function start(
     await check?.();
     return plainWriteFile(path, content, options as never);
   };
+  // `LockingFilesystem.rewriteFile`: read, compute and write with the path
+  // "locked". The other writer runs first — where the real filesystem would be
+  // acquiring the lock — so `rewrite` reads what that writer left.
+  (fs as unknown as Record<string, unknown>).rewriteFile = async (
+    path: string,
+    rewrite: (current: Buffer | null) => string | Promise<string>,
+  ) => {
+    await runRaceHook();
+    // Absent is null; any other read failure is a failure, as in the real one.
+    const current = await fs.readFile(path).then(
+      (c) => (Buffer.isBuffer(c) ? c : Buffer.from(String(c), 'utf8')),
+      (err: unknown) => {
+        const code = (err as NodeJS.ErrnoException).code;
+        if (code === 'ENOENT' || code === 'ENOTDIR') return null;
+        throw err;
+      },
+    );
+    return plainWriteFile(path, await rewrite(current));
+  };
   (fs as unknown as Record<string, unknown>).writeFiles = async (
     writes: { path: string; content: string }[],
     _summary: string,
@@ -363,6 +382,98 @@ describe('workspace file primitives', () => {
     expect((await post(`${base}/api/agent/tools/edit_file`, { path: `${KB_DIR}/a.md`, old_string: 'nope', new_string: 'x' })).status).toBe(400);
   });
 
+  it('edit_file writes new_string exactly as sent, `$` patterns included', async () => {
+    const base = await start();
+    const res = await post(`${base}/api/agent/tools/edit_file`, { path: `${KB_DIR}/a.md`, old_string: 'world', new_string: "cost: $& $1 $' $$" });
+    expect(res.status).toBe(200);
+    expect(String(await fs.readFile(`${KB_DIR}/a.md`))).toBe("hello\ncost: $& $1 $' $$\n");
+  });
+
+  /**
+   * An edit is a promise about the text it replaces, so that text has to be
+   * found in the file as it is when the write lands — read with the path's
+   * lock held, not at a preflight anybody may invalidate. `raceHook` is the
+   * other writer, running exactly where the real filesystem acquires the lock.
+   */
+  describe('edit_file looks for old_string in the file the write actually lands on', () => {
+    const EMPTY_OWNER = '# Assignee\n\n# Log';
+    const claim = (base: string, who: string) =>
+      post(`${base}/api/agent/tools/edit_file`, {
+        path: `${KB_DIR}/ticket.md`,
+        old_string: EMPTY_OWNER,
+        new_string: `# Assignee\n${who}\n\n# Log`,
+      });
+
+    it('refuses when another writer replaced that text after the preflight, and keeps their write', async () => {
+      const base = await start();
+      await fs.writeFile(`${KB_DIR}/ticket.md`, '# Assignee\n\n# Log\n- filed\n');
+      raceHook = async () => { await fs.writeFile(`${KB_DIR}/ticket.md`, '# Assignee\ncoder1\n\n# Log\n- filed\n'); };
+      const res = await claim(base, 'coder2');
+      expect(res.status).toBe(400);
+      expect(((await res.json()) as { error: string }).error).toContain('old_string not found');
+      expect(String(await fs.readFile(`${KB_DIR}/ticket.md`))).toBe('# Assignee\ncoder1\n\n# Log\n- filed\n');
+    });
+
+    it('applies the edit to what the other writer left when the text is still there', async () => {
+      const base = await start();
+      await fs.writeFile(`${KB_DIR}/ticket.md`, '# Assignee\n\n# Log\n- filed\n');
+      raceHook = async () => { await fs.writeFile(`${KB_DIR}/ticket.md`, '# Assignee\n\n# Log\n- filed\n- a line added meanwhile\n'); };
+      const res = await claim(base, 'coder2');
+      expect(res.status).toBe(200);
+      // Their line is kept: the new content was computed from the file as it was under the lock.
+      expect(String(await fs.readFile(`${KB_DIR}/ticket.md`))).toBe('# Assignee\ncoder2\n\n# Log\n- filed\n- a line added meanwhile\n');
+    });
+
+    it('refuses when the text became ambiguous after the preflight', async () => {
+      const base = await start();
+      await fs.writeFile(`${KB_DIR}/ticket.md`, '# Assignee\n\n# Log\n- filed\n');
+      raceHook = async () => { await fs.writeFile(`${KB_DIR}/ticket.md`, `${EMPTY_OWNER}\n${EMPTY_OWNER}\n`); };
+      const res = await claim(base, 'coder2');
+      expect(res.status).toBe(400);
+      expect(((await res.json()) as { error: string }).error).toContain('appears 2 times');
+      expect(String(await fs.readFile(`${KB_DIR}/ticket.md`))).toBe(`${EMPTY_OWNER}\n${EMPTY_OWNER}\n`);
+    });
+
+    it('answers not found when the file was deleted after the preflight, and does not recreate it', async () => {
+      const base = await start();
+      await fs.writeFile(`${KB_DIR}/ticket.md`, '# Assignee\n\n# Log\n- filed\n');
+      raceHook = async () => { await fs.deleteFile(`${KB_DIR}/ticket.md`); };
+      const res = await claim(base, 'coder2');
+      expect(res.status).toBe(404);
+      await expect(fs.readFile(`${KB_DIR}/ticket.md`)).rejects.toThrow();
+    });
+
+    // Every question the tool asks of the file is asked of the bytes it is
+    // about to replace. An extensionless file may hold anything, and the app's
+    // own upload can swap it for a binary between the preflight and the lock.
+    // The binary still CONTAINS `old_string` here, so nothing but the
+    // "may these bytes be edited as text" question can refuse it.
+    it('refuses when the file became binary after the preflight, and leaves those bytes alone', async () => {
+      const base = await start();
+      await fs.writeFile(`${KB_DIR}/TICKET`, '# Assignee\n\n# Log\n- filed\n');
+      const binary = Buffer.concat([Buffer.from([0x00, 0xff, 0xfe, 0x00]), Buffer.from(`${EMPTY_OWNER}\n`, 'utf8')]);
+      raceHook = async () => { await fs.writeFile(`${KB_DIR}/TICKET`, binary); };
+      const res = await post(`${base}/api/agent/tools/edit_file`, {
+        path: `${KB_DIR}/TICKET`,
+        old_string: EMPTY_OWNER,
+        new_string: '# Assignee\ncoder2\n\n# Log',
+      });
+      expect(res.status).toBe(415);
+      expect(await res.json()).toMatchObject({ kind: 'binary_not_writable' });
+      const after = await fs.readFile(`${KB_DIR}/TICKET`);
+      expect(Buffer.from(after as Buffer).equals(binary)).toBe(true);
+    });
+
+    it('counts replace_all over the file as it is under the lock', async () => {
+      const base = await start();
+      await fs.writeFile(`${KB_DIR}/ticket.md`, 'x x\n');
+      raceHook = async () => { await fs.writeFile(`${KB_DIR}/ticket.md`, 'x x x\n'); };
+      const res = await post(`${base}/api/agent/tools/edit_file`, { path: `${KB_DIR}/ticket.md`, old_string: 'x', new_string: 'y', replace_all: true });
+      expect(await res.json()).toMatchObject({ replaced: 3 });
+      expect(String(await fs.readFile(`${KB_DIR}/ticket.md`))).toBe('y y y\n');
+    });
+  });
+
   it('list_files + file_stat', async () => {
     const base = await start();
     const root = (await (await post(`${base}/api/agent/tools/list_files`, {})).json()) as { entries: { name: string }[] };
@@ -3445,7 +3556,7 @@ describe('a write refused for permissions says whether and how to propose it', (
       throw err;
     };
     const target = fs as unknown as Record<string, unknown>;
-    for (const m of ['writeFile', 'deleteFile', 'moveFile', 'mkdir']) target[m] = refuse;
+    for (const m of ['writeFile', 'rewriteFile', 'deleteFile', 'moveFile', 'mkdir']) target[m] = refuse;
     target.copyFile = async (_src: string, dest: string) => refuse(dest);
     // `delete_folder` lands through the same batch with NO writes and the
     // folder's files as `deletes` — in production the refusal comes from the

package/src/modules/workspace/workspace.tools.ts

@@ -353,17 +353,17 @@ function assertNotDocumentEdit(readers: FileReaderRegistry, path: string): void
  *
  * Costs one read of the existing file, and only for readers that ask the
  * question. A path with nothing at it is a CREATE: there is nothing to destroy.
- * Returns the bytes it read (so a caller that needs the content next —
- * `edit_file` — does not read the file a second time), or undefined when it
- * had no reason to read or nothing existed.
+ * For the tools that REPLACE a file without needing what it held (`write_file`,
+ * `write_files`); `edit_file` holds the bytes already and asks
+ * `assertBytesTextEditable` of each reading it takes.
  */
 async function assertNotBinaryOverwrite(
   readers: FileReaderRegistry,
   path: string,
   fs: { readFile(p: string): Promise<string | Buffer> },
-): Promise<Buffer | undefined> {
+): Promise<void> {
   const reader = readers.readerFor(path);
-  if (reader.editRefusalForExisting === undefined) return undefined;
+  if (reader.editRefusalForExisting === undefined) return;
   let existing: Buffer;
   try {
     existing = asBytes(await fs.readFile(path));
@@ -372,12 +372,21 @@ async function assertNotBinaryOverwrite(
     // FileNotFoundError carry the disk's absence codes). Any other failure —
     // permissions, I/O — means the existing content could not be inspected:
     // propagate it rather than let the write destroy bytes the gate never saw.
-    if (isAbsence(err)) return undefined; // nothing there yet
+    if (isAbsence(err)) return; // nothing there yet
     throw err;
   }
-  const refusal = reader.editRefusalForExisting(existing, path);
+  assertBytesTextEditable(readers, path, existing);
+}
+
+/**
+ * The same refusal, over bytes the caller already holds. Split out so a tool
+ * that reads the file more than once — `edit_file`, before the lock and again
+ * under it — judges EVERY reading with the one rule, and the bytes it replaces
+ * are always bytes this gate has seen.
+ */
+function assertBytesTextEditable(readers: FileReaderRegistry, path: string, existing: Buffer): void {
+  const refusal = readers.readerFor(path).editRefusalForExisting?.(existing, path) ?? null;
   if (refusal !== null) throw binaryNotWritable('binary', refusal);
-  return existing;
 }
 
 /** What a write is ALLOWED to do at a path. `create` is the default everywhere. */
@@ -2367,20 +2376,49 @@ export function registerWorkspaceTools(
       const path = a.path as string;
       const oldStr = a.old_string as string;
       const newStr = a.new_string as string;
-      // The overwrite gate already read the file when its reader asked the
-      // binary question — reuse those bytes instead of reading twice.
-      const content = await orNotFound(path, async () => {
-        const existing = await assertNotBinaryOverwrite(readers, path, fs);
-        return asText(existing ?? (await fs.readFile(path)));
-      });
-      const count = oldStr ? content.split(oldStr).length - 1 : 0;
-      if (count === 0) throw new ToolError('old_string not found in the file.', 400);
-      if (count > 1 && a.replace_all !== true) {
-        throw new ToolError(`old_string appears ${count} times — add more context to make it unique, or set replace_all.`, 400);
+      // Everything the tool decides about ONE reading of the file: may these
+      // bytes be edited as text at all, is `old_string` there, is it unique,
+      // and what the file becomes. One function, because the file is read
+      // twice — before the lock and under it — and a reading that skipped any
+      // of these questions would let bytes land that were never judged.
+      // `split`/`join`, not `String.replace`, which reads `$&`, `$'`, `` $` ``
+      // and `$$` in `new_string` as patterns and writes something the caller
+      // never sent.
+      const edit = (existing: Buffer): { updated: string; replaced: number } => {
+        assertBytesTextEditable(readers, path, existing);
+        const text = asText(existing);
+        const pieces = oldStr ? text.split(oldStr) : [text];
+        const count = pieces.length - 1;
+        if (count === 0) throw new ToolError('old_string not found in the file.', 400);
+        if (count > 1 && a.replace_all !== true) {
+          throw new ToolError(`old_string appears ${count} times — add more context to make it unique, or set replace_all.`, 400);
+        }
+        return { updated: pieces.join(newStr), replaced: count };
+      };
+      // A first verdict before any lock is taken, so an ordinary refusal costs
+      // no lock cycle. It is a verdict about a file anyone may still change.
+      let result = edit(await orNotFound(path, async () => asBytes(await fs.readFile(path))));
+      // The one the answer carries is taken again with the path's lock HELD,
+      // over the bytes read there (`write: true` guarantees the locking
+      // filesystem): read, verdict and write are one step nobody can get
+      // between. Taken before the lock only, two callers replacing the same
+      // text — two runners claiming a work item by filling its empty owner
+      // field — were BOTH told their edit landed, and the second silently
+      // overwrote the first. A filesystem without the method has no lock to
+      // read under, so the first verdict stands.
+      const locking = fs as unknown as {
+        rewriteFile?(path: string, rewrite: (current: Buffer | null) => string): Promise<void>;
+      };
+      if (typeof locking.rewriteFile === 'function') {
+        await locking.rewriteFile(path, (current) => {
+          if (current === null) throw notFound(path);
+          result = edit(current);
+          return result.updated;
+        });
+      } else {
+        await fs.writeFile(path, result.updated);
       }
-      const updated = a.replace_all === true ? content.split(oldStr).join(newStr) : content.replace(oldStr, newStr);
-      await fs.writeFile(path, updated);
-      return { path, replaced: a.replace_all === true ? count : 1, ...(await saveWarnings(ctx, path, updated)) };
+      return { path, replaced: result.replaced, ...(await saveWarnings(ctx, path, result.updated)) };
     },
   });