@ikarmic/forge-core 5.2.0 → 5.3.0

package/dist/catalog/models-dev.js

@@ -0,0 +1,143 @@
+/**
+ * Model limits and prices from models.dev, the catalog Kilo and OpenCode read at runtime. A surface calls
+ * loadModelCatalog() once at startup: it uses a cached copy (24 h), refreshes it from models.dev, and falls back to
+ * the snapshot bundled with this release. Until then the catalog is empty and the hand-written tables answer.
+ * Lookups match an exact model id only: a newer model is never priced like an older one (RB-34).
+ */
+import { mkdir, readFile, rename, writeFile } from 'node:fs/promises';
+import os from 'node:os';
+import path from 'node:path';
+import { installedFetch } from '../policy/proxy.js';
+import { MODELS_DEV_SNAPSHOT } from './models-dev-snapshot.js';
+export const MODELS_DEV_URL = 'https://models.dev/api.json';
+const CACHE_TTL_MS = 24 * 60 * 60 * 1000;
+const FETCH_TIMEOUT_MS = 10_000;
+/** models.dev provider keys Forge can reach (keep in step with scripts/models-dev-snapshot.mjs). */
+const CATALOG_PROVIDERS = [
+    'anthropic', 'openai', 'google', 'openrouter', 'minimax', 'amazon-bedrock', 'google-vertex', 'azure',
+    'deepseek', 'moonshotai', 'xai', 'mistral', 'alibaba', 'zhipuai', 'groq',
+];
+/** Forge provider -> the models.dev provider whose ids it uses. Others (openai-compatible…) match by id across all. */
+const PROVIDER_KEY = {
+    anthropic: 'anthropic',
+    openai: 'openai',
+    google: 'google',
+    openrouter: 'openrouter',
+    minimax: 'minimax',
+    bedrock: 'amazon-bedrock',
+    vertex: 'google-vertex',
+    azure: 'azure',
+};
+/** Lower-cased id -> row, per provider key. */
+let index;
+function build(data) {
+    index = new Map();
+    for (const [provider, models] of Object.entries(data)) {
+        const byId = new Map();
+        for (const [id, row] of Object.entries(models))
+            byId.set(id.toLowerCase(), row);
+        index.set(provider, byId);
+    }
+}
+/** The fields Forge uses from a models.dev api.json, for the providers it can reach. */
+export function trimModelsDev(api) {
+    const out = {};
+    const root = (api ?? {});
+    for (const key of CATALOG_PROVIDERS) {
+        const models = root[key]?.models;
+        if (!models || typeof models !== 'object')
+            continue;
+        out[key] = {};
+        for (const [id, m] of Object.entries(models)) {
+            const c = m?.cost ?? {};
+            const num = (v) => (typeof v === 'number' && Number.isFinite(v) ? v : null);
+            const row = [num(m?.limit?.context), num(m?.limit?.output), num(c.input), num(c.output), num(c.cache_read), num(c.cache_write)];
+            while (row.length > 2 && row[row.length - 1] === null)
+                row.pop();
+            out[key][id] = row;
+        }
+    }
+    return out;
+}
+function entryOf(row) {
+    const at = (i) => (typeof row[i] === 'number' && row[i] > 0 ? row[i] : undefined);
+    const entry = {};
+    if (at(0))
+        entry.context = at(0);
+    if (at(1))
+        entry.output = at(1);
+    const input = row[2];
+    const output = row[3];
+    if (typeof input === 'number' && typeof output === 'number') {
+        entry.cost = { input, output, ...(typeof row[4] === 'number' ? { cacheRead: row[4] } : {}), ...(typeof row[5] === 'number' ? { cacheWrite: row[5] } : {}) };
+    }
+    return entry;
+}
+/** The catalog's entry for a model, or undefined (no catalog loaded, or an id it does not list exactly). */
+export function catalogEntry(model) {
+    if (!index)
+        return undefined;
+    const id = model.model.toLowerCase().replace(/^models\//, '');
+    const key = PROVIDER_KEY[model.provider];
+    if (key) {
+        const row = index.get(key)?.get(id);
+        return row ? entryOf(row) : undefined;
+    }
+    for (const byId of index.values()) {
+        const row = byId.get(id);
+        if (row)
+            return entryOf(row);
+    }
+    return undefined;
+}
+/** Forget the loaded catalog (tests). */
+export function resetModelCatalog() {
+    index = undefined;
+}
+export function defaultCatalogCacheFile() {
+    return path.join(os.homedir(), '.forge', 'cache', 'models-dev.json');
+}
+/**
+ * Load the catalog: a fresh cache, else models.dev (written back to the cache), else a stale cache, else the
+ * bundled snapshot. Never throws: a broken network or cache only means older data.
+ */
+export async function loadModelCatalog(opts = {}) {
+    const cacheFile = opts.cacheFile ?? defaultCatalogCacheFile();
+    const now = opts.now ?? Date.now();
+    let cached;
+    try {
+        const parsed = JSON.parse(await readFile(cacheFile, 'utf8'));
+        if (typeof parsed.fetchedAt === 'number' && parsed.data && typeof parsed.data === 'object')
+            cached = parsed;
+    }
+    catch {
+        // No cache yet, or an unreadable one: fetch.
+    }
+    if (cached && now - cached.fetchedAt < CACHE_TTL_MS) {
+        build(cached.data);
+        return 'cache';
+    }
+    try {
+        const doFetch = opts.fetchImpl ?? installedFetch() ?? fetch;
+        const res = await doFetch(MODELS_DEV_URL, { signal: AbortSignal.timeout(FETCH_TIMEOUT_MS) });
+        if (!res.ok)
+            throw new Error(`models.dev answered ${res.status}`);
+        const data = trimModelsDev(await res.json());
+        if (Object.keys(data).length === 0)
+            throw new Error('models.dev returned no known provider');
+        build(data);
+        await mkdir(path.dirname(cacheFile), { recursive: true });
+        const tmpFile = `${cacheFile}.${process.pid}.tmp`;
+        await writeFile(tmpFile, JSON.stringify({ fetchedAt: now, data }));
+        await rename(tmpFile, cacheFile).catch(() => undefined);
+        return 'fetched';
+    }
+    catch {
+        if (cached) {
+            build(cached.data);
+            return 'stale-cache';
+        }
+        build(MODELS_DEV_SNAPSHOT);
+        return 'snapshot';
+    }
+}

package/dist/context/compaction.js

@@ -12,6 +12,8 @@
  * dedicated cheaper model or even a deterministic extractive summarizer.
  */
 import { generateText } from 'ai';
+import { withModelRetry } from '../agent/retry.js';
+import { catalogEntry } from '../catalog/models-dev.js';
 import { mediaPartLabel, mediaPartTokens } from '../attachments.js';
 import { stripThinkTags } from '../agent/think-tags.js';
 import { overrideContextTokens } from '../model-overrides.js';
@@ -88,6 +90,9 @@ export function getModelWindowTokens(model) {
     const overridden = overrideContextTokens(model);
     if (overridden)
         return overridden;
+    const listed = typeof model === 'string' ? undefined : catalogEntry(model)?.context;
+    if (listed)
+        return listed;
     const id = typeof model === 'string' ? model : model.model;
     const stripped = id.toLowerCase().replace(/^models\//, '');
     // Direct hit first.
@@ -201,11 +206,12 @@ Here is the conversation to summarize:
 
 ${truncateToBudget(transcript, 60_000)}`;
         const llm = factory(model);
-        const result = await generateText({
+        const result = await withModelRetry(() => generateText({
             model: llm,
             prompt,
             maxOutputTokens: 2000,
-        });
+            maxRetries: 0,
+        }));
         // Reasoning models put an inline <think> block in the reply; it must not be stored as the summary.
         return stripThinkTags(result.text).trim();
     };

package/dist/git/auto-commit.d.ts

@@ -27,11 +27,11 @@ export declare function commitDirty(cwd: string, options?: GitCommitOptions): Pr
 export declare function diffForFiles(cwd: string, files: string[]): Promise<string>;
 /** Deterministic message used when no model is available or it fails. */
 export declare function fallbackCommitMessage(files: string[]): string;
-export declare function commitMessagePrompt(diff: string, task?: string, instruction?: string): string;
+export declare function commitMessagePrompt(diff: string, task?: string, instruction?: string, language?: string): string;
 /** Strip an inline `<think>` block (MiniMax and other reasoning models) and the fences/quotes a model may wrap around the message. */
 export declare function cleanCommitMessage(text: string): string;
 /** Draft a commit message with `model` (typically the cheap model); never throws. */
-export declare function generateCommitMessage(diff: string, files: string[], model: ModelConfig | undefined, task?: string, modelFactory?: (cfg: ModelConfig) => LanguageModel, instruction?: string): Promise<string>;
+export declare function generateCommitMessage(diff: string, files: string[], model: ModelConfig | undefined, task?: string, modelFactory?: (cfg: ModelConfig) => LanguageModel, instruction?: string, language?: string): Promise<string>;
 export type UndoResult = {
     ok: true;
     commit: string;
@@ -60,4 +60,6 @@ export declare function afterRun(cwd: string, state: {
     model?: ModelConfig;
     task?: string;
     modelFactory?: (cfg: ModelConfig) => LanguageModel;
+    instruction?: string;
+    language?: string;
 }): Promise<ForgeCommit | null>;

package/dist/git/auto-commit.js

@@ -6,6 +6,7 @@
 import { execFile } from 'node:child_process';
 import { promisify } from 'node:util';
 import { generateText } from 'ai';
+import { withModelRetry } from '../agent/retry.js';
 import { stripThinkTags } from '../agent/think-tags.js';
 import { createLanguageModel } from '../providers.js';
 const execFileAsync = promisify(execFile);
@@ -112,10 +113,20 @@ export function fallbackCommitMessage(files) {
     return `forge: update ${shown}${more}`;
 }
 const MAX_DIFF_CHARS = 12_000;
-export function commitMessagePrompt(diff, task, instruction) {
+const MAX_LANGUAGE_CHARS = 40;
+/** One short line for the prompt, or '' when English or unset. The value is typed by a person and goes into a model prompt. */
+function languageLine(language) {
+    const lang = (language ?? '').replace(/\s+/g, ' ').trim().slice(0, MAX_LANGUAGE_CHARS).trim();
+    if (!lang || /^(english|en)$/i.test(lang))
+        return '';
+    return `
+
+Write the commit message in ${lang}.`;
+}
+export function commitMessagePrompt(diff, task, instruction, language) {
     const clipped = diff.length > MAX_DIFF_CHARS ? `${diff.slice(0, MAX_DIFF_CHARS)}\n[diff truncated]` : diff;
     const lead = instruction?.trim() || 'Write a git commit message for this diff in conventional-commit style (type(scope): subject, imperative mood, under 72 characters). Add a short body only if the change needs explaining. Reply with the message only, no quotes or code fences.';
-    return `${lead}${task ? `\n\nThe change was made for this request: ${task}` : ''}\n\n${clipped}`;
+    return `${lead}${languageLine(language)}${task ? `\n\nThe change was made for this request: ${task}` : ''}\n\n${clipped}`;
 }
 /** Strip an inline `<think>` block (MiniMax and other reasoning models) and the fences/quotes a model may wrap around the message. */
 export function cleanCommitMessage(text) {
@@ -126,11 +137,11 @@ export function cleanCommitMessage(text) {
         .trim();
 }
 /** Draft a commit message with `model` (typically the cheap model); never throws. */
-export async function generateCommitMessage(diff, files, model, task, modelFactory = createLanguageModel, instruction) {
+export async function generateCommitMessage(diff, files, model, task, modelFactory = createLanguageModel, instruction, language) {
     if (!model || !diff.trim())
         return fallbackCommitMessage(files);
     try {
-        const result = await generateText({ model: modelFactory(model), prompt: commitMessagePrompt(diff, task, instruction) });
+        const result = await withModelRetry(() => generateText({ model: modelFactory(model), prompt: commitMessagePrompt(diff, task, instruction, language), maxRetries: 0 }), { maxRetries: 2 });
         const message = cleanCommitMessage(result.text);
         return message || fallbackCommitMessage(files);
     }
@@ -181,6 +192,6 @@ export async function afterRun(cwd, state, options) {
     if (files.length === 0)
         return null;
     const diff = await diffForFiles(cwd, files);
-    const message = await generateCommitMessage(diff, files, options.model, options.task, options.modelFactory);
+    const message = await generateCommitMessage(diff, files, options.model, options.task, options.modelFactory, options.instruction, options.language);
     return commitFiles(cwd, files, message, options);
 }

package/dist/index.d.ts

@@ -1,6 +1,8 @@
 export { Agent, applySandbox } from './agent/agent.js';
 export { LoopGuard } from './agent/loop-guard.js';
 export { enhancePrompt } from './agent/enhance-prompt.js';
+export { generateShellCommand, shellKindOf, commandRisk } from './agent/shell-command.js';
+export type { ShellKind } from './agent/shell-command.js';
 export { stripThinkTags } from './agent/think-tags.js';
 export { createGitHubCreateTool, createGitHubReadTool, createGitHubTools, githubFromEnv, parseRemote, type GitHubConfig, type PullRequestReport, type RepoRef, } from './github/github-tools.js';
 export { createWebSearchTool, searchWeb, WEB_SEARCH_PROVIDERS, webSearchFromEnv, webSearchProblem, type WebSearchConfig, type WebSearchProvider, type WebSearchResult, } from './tools/web-search.js';
@@ -43,7 +45,7 @@ export { defaultSessionDir, generateSessionId, saveSession, loadSession, deleteS
 export type { Session, ListEntry, FormatOptions, SessionUpdate, WatchSessionOptions, SessionMatch, SearchSessionsOptions, SessionPruneOptions, SessionPruneResult } from './sessions/index.js';
 export { commandDirs, expandCustomCommand, formatCustomCommands, loadCustomCommands, parseCommandFile, type CustomCommand, } from './commands/custom-commands.js';
 export { BUILTIN_TOOLS, editFileTool, fetchUrlTool, findSymbolTool, gitDiffTool, dependencyAuditTool, listFilesTool, memoryReadTool, memoryForgetTool, memoryWriteTool, readFileTool, runCommandTool, searchFilesTool, subAgentTool, writeFileTool, checkPolicyViolation, globToRegex, mergeToolSandbox, normalizePathPattern, pathMatchesAny, redact, countRedactions, buildRules, ToolResultCache, buildCacheKey, cachedExecute, } from './tools/index.js';
-export type { AgentConfig, AgentEvent, AgentRunOptions, AgentRunReason, AgentRunResult, AnyLanguageModel, ApprovalDecision, CommandRunner, ModelRouter, VerifyConfig, ApprovalRequest, LanguageModelFactory, ModelConfig, PricePerMillionTokens, ProviderName, RedactOptions, TodoItem, ToolContext, UserQuestion, ToolDefinition, ToolPolicy, ToolSandbox, } from './types.js';
+export type { AgentConfig, AgentEvent, ApprovalSource, AgentRunOptions, AgentRunReason, AgentRunResult, AnyLanguageModel, ApprovalDecision, CommandRunner, ModelRouter, VerifyConfig, ApprovalRequest, LanguageModelFactory, ModelConfig, PricePerMillionTokens, ProviderName, RedactOptions, TodoItem, ToolContext, UserQuestion, ToolDefinition, ToolPolicy, ToolSandbox, } from './types.js';
 export type { CacheKeyParts, CacheStats } from './tools/index.js';
 export type { RedactionRule, RedactionResult } from './tools/index.js';
 export { buildSkillsBlock, builtinSkills, composeSkillsPrompt, discoverSkills, fetchSkillsCatalog, installSkillFromCatalog, loadSkillsRegistry, loadSkillsRegistryAsync, parseSkill, parseSkillsDir, resolveSkillRoots, scoreSkill, searchSkills, selectSkills, skillsRegistryFromList, DEFAULT_SKILL_CATALOG_URL, GLOBAL_SKILLS_DIR, LOCAL_SKILLS_DIR, PROJECT_SKILLS_DIR, SKILL_CATALOG_VERSION, } from './skills/index.js';
@@ -100,6 +102,9 @@ export { detectStackFacts, stackBlock, MAX_STACK_LIBRARIES, type StackFacts } fr
 export { pickAuditors, type AuditFinding, type AuditorPlan } from './tools/dependency-audit.js';
 export { shellEnv } from './tools/shell-env.js';
 export { previewPatch } from './tools/apply-patch.js';
+export { applyTextEdit } from './tools/edit-file.js';
+export { catalogEntry, loadModelCatalog, type CatalogEntry, type CatalogSource } from './catalog/models-dev.js';
+export { isContextOverflowError, retryDecision, withModelRetry } from './agent/retry.js';
 export type { PatchPreview } from './tools/apply-patch.js';
 export { applyPatchTool, parsePatch, patchedPaths } from './tools/apply-patch.js';
 export { buildEmbedder, type EmbedderSpec } from './semantic/embedder.js';

package/dist/index.js

@@ -1,6 +1,7 @@
 export { Agent, applySandbox } from './agent/agent.js';
 export { LoopGuard } from './agent/loop-guard.js';
 export { enhancePrompt } from './agent/enhance-prompt.js';
+export { generateShellCommand, shellKindOf, commandRisk } from './agent/shell-command.js';
 export { stripThinkTags } from './agent/think-tags.js';
 export { createGitHubCreateTool, createGitHubReadTool, createGitHubTools, githubFromEnv, parseRemote, } from './github/github-tools.js';
 export { createWebSearchTool, searchWeb, WEB_SEARCH_PROVIDERS, webSearchFromEnv, webSearchProblem, } from './tools/web-search.js';
@@ -80,6 +81,9 @@ export { detectStackFacts, stackBlock, MAX_STACK_LIBRARIES } from './agent/stack
 export { pickAuditors } from './tools/dependency-audit.js';
 export { shellEnv } from './tools/shell-env.js';
 export { previewPatch } from './tools/apply-patch.js';
+export { applyTextEdit } from './tools/edit-file.js';
+export { catalogEntry, loadModelCatalog } from './catalog/models-dev.js';
+export { isContextOverflowError, retryDecision, withModelRetry } from './agent/retry.js';
 export { applyPatchTool, parsePatch, patchedPaths } from './tools/apply-patch.js';
 export { buildEmbedder } from './semantic/embedder.js';
 export { parseExtensions } from './semantic/semantic-index.js';

package/dist/memory/session-digest.js

@@ -1,4 +1,5 @@
 import { generateText } from 'ai';
+import { withModelRetry } from '../agent/retry.js';
 import { stripThinkTags } from '../agent/think-tags.js';
 import { createLanguageModel } from '../providers.js';
 const MAX_DIGEST_CHARS = 600;
@@ -38,7 +39,7 @@ export async function generateSessionDigest(items, model, modelFactory = createL
     if (!model || !shouldDigest(items))
         return undefined;
     try {
-        const result = await generateText({ model: modelFactory(model), prompt: `${INSTRUCTION}\n\nConversation:\n${transcript(items)}` });
+        const result = await withModelRetry(() => generateText({ model: modelFactory(model), prompt: `${INSTRUCTION}\n\nConversation:\n${transcript(items)}`, maxRetries: 0 }));
         return cleanDigest(result.text);
     }
     catch {

package/dist/pricing.js

@@ -1,3 +1,4 @@
+import { catalogEntry } from './catalog/models-dev.js';
 import { overrideCost } from './model-overrides.js';
 /**
  * Pricing table. Keys are matched with case-insensitive substring matching
@@ -120,6 +121,17 @@ export function lookupPricing(model, override) {
         return { ...cache, ...configured, known: true };
     if (typeof model !== 'string' && LOCAL_PROVIDERS.has(model.provider))
         return { input: 0, output: 0, known: true };
+    const listed = typeof model === 'string' ? undefined : catalogEntry(model)?.cost;
+    if (listed && listed.input > 0) {
+        return {
+            ...cache,
+            input: listed.input,
+            output: listed.output,
+            ...(listed.cacheRead !== undefined ? { cacheReadMultiplier: listed.cacheRead / listed.input } : {}),
+            ...(listed.cacheWrite !== undefined ? { cacheWriteMultiplier: listed.cacheWrite / listed.input } : {}),
+            known: true,
+        };
+    }
     const id = (typeof model === 'string' ? model : model.model).toLowerCase();
     // Strip only the OpenRouter-style 'models/' prefix so 'models/gemini-1.5-pro'
     // resolves the same way as 'gemini-1.5-pro'. We do NOT strip provider prefixes

package/dist/tools/command-sandbox.d.ts

@@ -0,0 +1,24 @@
+import type { CommandSandbox } from '../types.js';
+export type SandboxedCommand = {
+    kind: 'wrapped';
+    command: string;
+} | {
+    kind: 'unavailable';
+    command: string;
+} | {
+    kind: 'refused';
+    reason: string;
+};
+/** Quote one argument for /bin/sh. */
+export declare function shellQuote(arg: string): string;
+interface Options {
+    cwd: string;
+    sandbox: CommandSandbox;
+    platform: NodeJS.Platform;
+    tmpDir: string;
+    findBinary?: (name: string) => string | undefined;
+    realpath?: (p: string) => string;
+}
+/** The command line that runs `command` inside the sandbox, or why it cannot be sandboxed. */
+export declare function sandboxCommand(command: string, opts: Options): SandboxedCommand;
+export {};

package/dist/tools/command-sandbox.js

@@ -0,0 +1,73 @@
+/**
+ * OS sandbox for run_command (after Kilo's kilo-sandbox): bubblewrap on Linux, sandbox-exec (Seatbelt) on macOS.
+ * Writes are confined to the workspace, the temp folder and any extra folders the user named; the workspace's .git
+ * stays read-only, since a hook written there would later run outside the sandbox; the network is cut unless
+ * allowed. Windows has no comparable tool, so there the command runs as before (approval still applies).
+ */
+import { existsSync, realpathSync } from 'node:fs';
+import path from 'node:path';
+import { resolveOnPath } from '../lsp/client.js';
+/** Quote one argument for /bin/sh. */
+export function shellQuote(arg) {
+    return `'${arg.replace(/'/g, `'\\''`)}'`;
+}
+function defaultFind(name) {
+    for (const dir of ['/usr/bin', '/bin', '/usr/local/bin']) {
+        const full = path.posix.join(dir, name);
+        if (existsSync(full))
+            return full;
+    }
+    return resolveOnPath(name, process.env, process.platform);
+}
+function safeRealpath(p) {
+    try {
+        return realpathSync(p);
+    }
+    catch {
+        return p;
+    }
+}
+/** The command line that runs `command` inside the sandbox, or why it cannot be sandboxed. */
+export function sandboxCommand(command, opts) {
+    const find = opts.findBinary ?? defaultFind;
+    const real = opts.realpath ?? safeRealpath;
+    if (opts.platform === 'linux') {
+        const bwrap = find('bwrap');
+        if (!bwrap)
+            return { kind: 'refused', reason: 'The command sandbox is on, but bubblewrap (bwrap) is not installed. Install it (apt install bubblewrap) or turn the sandbox off.' };
+        const writable = [opts.cwd, opts.tmpDir, ...(opts.sandbox.extraWritable ?? [])];
+        const gitDir = path.join(opts.cwd, '.git');
+        const args = [
+            bwrap,
+            '--die-with-parent',
+            '--new-session',
+            '--unshare-pid',
+            ...(opts.sandbox.network ? [] : ['--unshare-net']),
+            '--ro-bind', '/', '/',
+            '--dev', '/dev',
+            '--proc', '/proc',
+            ...writable.flatMap((p) => ['--bind', p, p]),
+            ...(existsSync(gitDir) ? ['--ro-bind', gitDir, gitDir] : []),
+            '--chdir', opts.cwd,
+            '--', '/bin/sh', '-c', command,
+        ];
+        return { kind: 'wrapped', command: args.map(shellQuote).join(' ') };
+    }
+    if (opts.platform === 'darwin') {
+        const exec = find('sandbox-exec');
+        if (!exec)
+            return { kind: 'refused', reason: 'The command sandbox is on, but sandbox-exec was not found. Turn the sandbox off to run commands.' };
+        const quote = (p) => JSON.stringify(real(p));
+        const writable = [opts.cwd, opts.tmpDir, ...(opts.sandbox.extraWritable ?? [])].map((p) => `(subpath ${quote(p)})`);
+        const profile = [
+            '(version 1)',
+            '(allow default)',
+            '(deny file-write*)',
+            `(allow file-write* ${writable.join(' ')} (subpath "/private/var/folders") (literal "/dev/null") (literal "/dev/stdout") (literal "/dev/stderr") (regex #"^/dev/tty"))`,
+            `(deny file-write* (subpath ${quote(path.posix.join(opts.cwd, '.git'))}))`,
+            ...(opts.sandbox.network ? [] : ['(deny network* (remote ip))']),
+        ].join('\n');
+        return { kind: 'wrapped', command: [exec, '-p', profile, '/bin/sh', '-c', command].map(shellQuote).join(' ') };
+    }
+    return { kind: 'unavailable', command };
+}

package/dist/tools/edit-file.d.ts

@@ -12,4 +12,12 @@ export interface EditFileResult {
     bytes: number;
 }
 export declare const editFileTool: ToolDefinition<z.infer<typeof params>, EditFileResult>;
+/**
+ * What edit_file writes for `original`; throws the message the model sees when old_text cannot be placed.
+ * Shared with the chat's diff preview so the two never disagree.
+ */
+export declare function applyTextEdit(original: string, oldTextIn: string, newTextIn: string, replaceAll: boolean, file: string): {
+    content: string;
+    replacements: number;
+};
 export {};

package/dist/tools/edit-file.js

@@ -24,29 +24,77 @@ export const editFileTool = {
                 throw new Error(`File not found: ${args.path}`);
             throw err;
         });
-        const occurrences = countOccurrences(original, args.old_text);
-        if (occurrences === 0) {
-            throw new Error(`old_text not found in ${args.path}. Re-read the file (it may have changed) and try again.`);
-        }
-        const replaceAll = args.replace_all === true;
-        if (!replaceAll && occurrences > 1) {
-            throw new Error(`old_text matches ${occurrences} times in ${args.path}. Pass more context to make it unique, or set replace_all=true to replace all occurrences.`);
-        }
-        const updated = replaceAll
-            ? original.split(args.old_text).join(args.new_text)
-            // Use a replacer FUNCTION so new_text is inserted literally: a plain
-            // string 2nd arg to String.prototype.replace still honors special
-            // patterns like $&, $1, $$ even though old_text isn't a regex.
-            : original.replace(args.old_text, () => args.new_text);
-        const bytes = encodeText(updated, encoding);
+        const { content, replacements } = applyTextEdit(original, args.old_text, args.new_text, args.replace_all === true, args.path);
+        const bytes = encodeText(content, encoding);
         await writeFile(resolved, bytes);
         return {
             path: resolved,
-            replacements: replaceAll ? occurrences : 1,
+            replacements,
             bytes: bytes.length,
         };
     },
 };
+/**
+ * What edit_file writes for `original`; throws the message the model sees when old_text cannot be placed.
+ * Shared with the chat's diff preview so the two never disagree.
+ */
+export function applyTextEdit(original, oldTextIn, newTextIn, replaceAll, file) {
+    // read_file shows a CRLF file without its \r, so the model sends LF text: match on LF, write back the file's own ending.
+    const crlf = original.includes('\r\n');
+    const content = crlf ? toLf(original) : original;
+    const oldText = toLf(oldTextIn);
+    const newText = toLf(newTextIn);
+    const occurrences = countOccurrences(content, oldText);
+    let updated;
+    if (occurrences === 0) {
+        const span = replaceAll ? undefined : trimmedLineMatch(content, oldText, file);
+        if (!span) {
+            throw new Error(`old_text not found in ${file}. Re-read the file (it may have changed) and try again.`);
+        }
+        updated = content.slice(0, span.start) + newText + content.slice(span.end);
+    }
+    else {
+        if (!replaceAll && occurrences > 1) {
+            throw new Error(`old_text matches ${occurrences} times in ${file}. Pass more context to make it unique, or set replace_all=true to replace all occurrences.`);
+        }
+        updated = replaceAll
+            ? content.split(oldText).join(newText)
+            // Use a replacer FUNCTION so new_text is inserted literally: a plain
+            // string 2nd arg to String.prototype.replace still honors special
+            // patterns like $&, $1, $$ even though old_text isn't a regex.
+            : content.replace(oldText, () => newText);
+    }
+    return { content: crlf ? updated.replace(/\n/g, '\r\n') : updated, replacements: replaceAll ? occurrences : 1 };
+}
+function toLf(text) {
+    return text.replace(/\r\n/g, '\n');
+}
+/**
+ * Fallback when the exact text is absent: the block of whole lines whose trimmed text equals old_text's trimmed
+ * lines (a model often gets indentation or trailing spaces wrong). Only a unique block counts.
+ */
+function trimmedLineMatch(content, oldText, file) {
+    const want = oldText.split('\n').map((l) => l.trim());
+    if (want.length > 1 && want[want.length - 1] === '')
+        want.pop();
+    if (want.every((l) => l === ''))
+        return undefined;
+    const lines = content.split('\n');
+    const starts = [];
+    for (let i = 0; i + want.length <= lines.length; i++) {
+        if (want.every((w, j) => lines[i + j].trim() === w))
+            starts.push(i);
+    }
+    if (starts.length === 0)
+        return undefined;
+    if (starts.length > 1) {
+        throw new Error(`old_text matches more than one place in ${file} once leading and trailing spaces are ignored. Pass more context to make it unique.`);
+    }
+    const offsetOf = (line) => lines.slice(0, line).reduce((n, l) => n + l.length + 1, 0);
+    const first = starts[0];
+    const last = first + want.length - 1;
+    return { start: offsetOf(first), end: offsetOf(last) + lines[last].length };
+}
 function countOccurrences(haystack, needle) {
     if (needle.length === 0)
         return 0;

package/dist/tools/run-command.js

@@ -1,5 +1,7 @@
 import { spawn } from 'node:child_process';
+import { tmpdir } from 'node:os';
 import { z } from 'zod';
+import { sandboxCommand } from './command-sandbox.js';
 import { checkPolicyViolation } from './policy.js';
 import { resolveAndCheckPath } from './shared.js';
 import { shellEnv } from './shell-env.js';
@@ -64,10 +66,18 @@ export const runCommandTool = {
         if (violation)
             throw new Error(`[sandbox] ${violation}`);
         const timeoutMs = args.timeout_ms ?? DEFAULT_TIMEOUT_MS;
+        // The OS sandbox wraps the command line; the result still reports the command the model asked for.
+        let commandLine = args.command;
+        if (ctx.commandSandbox) {
+            const boxed = sandboxCommand(args.command, { cwd, sandbox: ctx.commandSandbox, platform: process.platform, tmpDir: tmpdir() });
+            if (boxed.kind === 'refused')
+                throw new Error(`[sandbox] ${boxed.reason}`);
+            commandLine = boxed.command;
+        }
         if (ctx.commandRunner) {
             const started = Date.now();
             const out = await ctx.commandRunner({
-                command: args.command,
+                command: commandLine,
                 cwd,
                 timeoutMs,
                 ...(ctx.abortSignal ? { signal: ctx.abortSignal } : {}),
@@ -91,7 +101,7 @@ export const runCommandTool = {
         }
         return new Promise((resolve, reject) => {
             const started = Date.now();
-            const child = spawn(args.command, {
+            const child = spawn(commandLine, {
                 shell: true,
                 cwd,
                 // Windows: never run a same-named program the repository ships in its root (see shell-env.ts).