@lazyingart/agintiflow 0.8.10 → 0.8.12

package/README.md

@@ -28,7 +28,7 @@ It is designed for workflows where an AI agent should act, but every tool, log,
 | Core loop | Plan -> use tools -> log events -> finish or resume |
 | Browser control | Playwright, lazy browser startup, domain allowlists |
 | Model layer | Smart routing over DeepSeek fast/pro presets with manual OpenAI-compatible fallback |
-| Local tools | Guarded workspace file tools, optional shell commands, Docker sandbox support, and advisory agent wrappers |
+| Local tools | Guarded workspace file tools, Codex-style patching, optional shell commands, Docker sandbox support, and advisory agent wrappers |
 | Memory | Session state, persisted web settings, chat continuation |
 | Operator UX | Multilingual web UI with provider selection, run output, and conversation history |
 
@@ -65,6 +65,8 @@ aginti chat
 
 Inside chat, type normal requests such as `write a small Python CLI app with tests`. The default is Docker workspace mode with approved package installs, so coding, plotting, and LaTeX tasks can set up project-local tools without touching the host. Use `/help` for commands, `/login` or `/auth` to paste a provider key, `/latex on` for PDF work, `/docker off` only when you intentionally want host mode, `/sessions` to list project runs, and `/resume latest` or `/resume <session-id>` to continue work. Type `/` then Tab for command completion. Esc or Ctrl+C stops the active run cleanly and prints the resume command.
 
+For code edits, AgInTiFlow routes patch/refactor/database-style tasks to DeepSeek v4 pro by default and exposes `apply_patch` as a deterministic workspace tool. It supports exact replacements, Codex-style patch envelopes, and unified diffs, with preflight checks, path guardrails, hashes, and compact per-file diffs. See [docs/patch-tools.md](docs/patch-tools.md).
+
 Launch the local web UI from an installed package:
 
 ```bash

package/docs/patch-tools.md

@@ -0,0 +1,17 @@
+# Patch Tools
+
+AgInTiFlow exposes a deterministic `apply_patch` workspace tool for coding-agent edits. It is designed for DeepSeek v4 pro and other routed models to make auditable code changes without relying on free-form shell redirection.
+
+## Supported Patch Modes
+
+- Exact replacement: pass `path`, `search`, `replace`, and optionally `expectedReplacements` or `baseHash`.
+- Codex-style patch envelope: pass `patch` with `*** Begin Patch`, `*** Update File`, `*** Add File`, `*** Delete File`, and `*** End Patch`.
+- Unified diff: pass `patch` with standard `--- a/file`, `+++ b/file`, and `@@` hunks.
+
+All paths must stay inside the configured workspace. Secret-like paths, `.git`, `node_modules` writes, binary files, and huge files are blocked. Multi-file patches are preflighted before writing, and each changed file records before/after hashes plus a compact diff in the session events.
+
+## Agent Workflow
+
+For large codebases, the model should first use `list_files`, `search_files`, and `read_file` to identify the relevant files. It should then call `apply_patch`, run safe tests or linters when available, and summarize changed files and residual risk.
+
+Smart routing treats patch/refactor/edit/database tasks as complex work, so DeepSeek v4 pro is selected by default unless the user explicitly chooses another route.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@lazyingart/agintiflow",
-  "version": "0.8.10",
+  "version": "0.8.12",
   "type": "module",
   "description": "AgInTiFlow is a resumable Playwright website-control agent with OpenAI-compatible tool calling.",
   "license": "Apache-2.0",

package/scripts/smoke-coding-tools.js

@@ -5,7 +5,9 @@ import path from "node:path";
 import { fileURLToPath } from "node:url";
 import { repairModelMessageHistory, runAgent } from "../src/agent-runner.js";
 import { resolveRuntimeConfig } from "../src/config.js";
+import { selectModelRoute } from "../src/model-routing.js";
 import { SessionStore } from "../src/session-store.js";
+import { executeWorkspaceTool } from "../src/workspace-tools.js";
 
 const repoRoot = path.resolve(path.dirname(fileURLToPath(import.meta.url)), "..");
 const tempRoot = await fs.mkdtemp(path.join(os.tmpdir(), "agintiflow-coding-tools-"));
@@ -78,6 +80,12 @@ try {
     !staleDeepSeekState.messages.some((message) => message.role === "tool" && message.tool_call_id === "stale-call"),
     "repaired DeepSeek history retained an orphan stale tool message"
   );
+  const patchRoute = selectModelRoute({
+    routingMode: "smart",
+    provider: "deepseek",
+    goal: "patch this large codebase and migrate the database tests",
+  });
+  assert(/pro/i.test(patchRoute.model), "patch/refactor task did not route to DeepSeek pro");
 
   const writeRun = await runMock("Create notes/hello.md with a short coding smoke message.", "coding-write");
   const written = await fs.readFile(path.join(workspace, "notes/hello.md"), "utf8");
@@ -106,6 +114,78 @@ try {
   assert(patched === "new\n", "mock patch did not update expected file");
   assert(patchRun.events.some((event) => event.type === "file.changed"), "patch run did not persist file.changed event");
 
+  await fs.writeFile(path.join(workspace, "patch-target.txt"), "old\n", "utf8");
+  const multiPatchRun = await runMock("Apply multi-file Codex patch to replace old and add a note.", "coding-patch-multi");
+  const multiPatched = await fs.readFile(path.join(workspace, "patch-target.txt"), "utf8");
+  const patchNote = await fs.readFile(path.join(workspace, "notes/patch-note.md"), "utf8");
+  assert(multiPatched === "new\n", "mock multi-file patch did not update expected file");
+  assert(patchNote.includes("multi-file patch smoke"), "mock multi-file patch did not add expected file");
+  assert(
+    multiPatchRun.events.filter((event) => event.type === "file.changed").length >= 2,
+    "multi-file patch did not persist per-file change events"
+  );
+
+  await fs.writeFile(path.join(workspace, "unified-target.txt"), "alpha\nold\nomega\n", "utf8");
+  const unified = await executeWorkspaceTool(
+    "apply_patch",
+    {
+      patch: [
+        "--- a/unified-target.txt",
+        "+++ b/unified-target.txt",
+        "@@ -1,3 +1,3 @@",
+        " alpha",
+        "-old",
+        "+new",
+        " omega",
+      ].join("\n"),
+    },
+    {
+      commandCwd: workspace,
+      allowFileTools: true,
+    }
+  );
+  const unifiedText = await fs.readFile(path.join(workspace, "unified-target.txt"), "utf8");
+  assert(unified.ok && unifiedText === "alpha\nnew\nomega\n", "unified apply_patch did not update expected file");
+
+  const blockedPatch = await executeWorkspaceTool(
+    "apply_patch",
+    {
+      patch: ["*** Begin Patch", "*** Add File: .env", "+TOKEN=blocked", "*** End Patch"].join("\n"),
+    },
+    {
+      commandCwd: workspace,
+      allowFileTools: true,
+    }
+  );
+  assert(blockedPatch.blocked, "patch document to sensitive path was not blocked by guardrail");
+
+  await fs.writeFile(path.join(workspace, "move-source.txt"), "source\n", "utf8");
+  await fs.writeFile(path.join(workspace, "move-target.txt"), "target\n", "utf8");
+  const moveOverResult = await executeWorkspaceTool(
+    "apply_patch",
+    {
+      patch: [
+        "*** Begin Patch",
+        "*** Update File: move-source.txt",
+        "*** Move to: move-target.txt",
+        "@@",
+        "-source",
+        "+moved",
+        "*** End Patch",
+      ].join("\n"),
+    },
+    {
+      commandCwd: workspace,
+      allowFileTools: true,
+    }
+  )
+    .then(() => "")
+    .catch((error) => String(error?.message || error));
+  assert(
+    /move over an existing file/.test(moveOverResult),
+    "patch move over an existing file was not rejected"
+  );
+
   const envRun = await runMock("Create file: .env with blocked content.", "coding-block-env");
   await fs
     .access(path.join(workspace, ".env"))
@@ -135,11 +215,16 @@ try {
         workspace,
         checks: [
           "deepseek_history_repair",
+          "deepseek_pro_patch_route",
           "write_file",
           "duplicate_write_failed",
           "resume_session_write",
           "virtual_workspace_path",
           "apply_patch",
+          "multi_file_patch",
+          "unified_patch",
+          "patch_guardrail",
+          "patch_move_no_overwrite",
           "block_env",
           "block_outside",
         ],

package/src/agent-runner.js

@@ -271,7 +271,7 @@ function createInitialState(config, sessionId) {
               : "A host shell command tool is available under the configured trust policy."
             : "No shell command tool is available.",
           config.allowFileTools
-            ? `Workspace file tools are available in ${config.commandCwd}: list_files, read_file, search_files, write_file, apply_patch, open_workspace_file, and preview_workspace. Always use workspace-relative paths such as plot_fx.svg or docs/report.tex, never absolute host paths. Secret paths, .git internals, node_modules writes, and huge files are blocked. For generated local websites/pages, use open_workspace_file or preview_workspace instead of starting a localhost server inside Docker.`
+            ? `Workspace file tools are available in ${config.commandCwd}: list_files, read_file, search_files, write_file, apply_patch, open_workspace_file, and preview_workspace. apply_patch supports exact single-file replacements plus Codex-style/unified multi-file patches; prefer it for source edits after reading/searching the relevant context. Always use workspace-relative paths such as plot_fx.svg or docs/report.tex, never absolute host paths. Secret paths, .git internals, node_modules writes, and huge files are blocked. For generated local websites/pages, use open_workspace_file or preview_workspace instead of starting a localhost server inside Docker.`
             : "No workspace file tools are available.",
           config.allowWrapperTools
             ? `External coding-agent wrappers are available as advisory tools only. Use the selected wrapper only: ${normalizeWrapperName(config.preferredWrapper)}. Wrapper status: ${wrapperStatusText()}.`
@@ -279,7 +279,7 @@ function createInitialState(config, sessionId) {
           `Task profile: ${taskProfile.label}. ${taskProfile.prompt}`,
           "A frontend canvas/artifacts tunnel exists. Use send_to_canvas when important markdown, diffs, screenshots, images, or workspace files should be highlighted in the UI. It is optional and ordinary final text can still go directly to finish.",
           "For visual-output requests such as draw, plot, graph, chart, diagram, figure, image, or visualization, proactively publish a canvas artifact even when the user does not mention canvas. If workspace file tools are enabled, prefer creating a small SVG or markdown artifact and call send_to_canvas with selected=true.",
-          "Work like a practical coding agent: inspect when useful, edit with file tools, run safe checks when they add confidence, and keep outputs inside the workspace.",
+          "Work like a practical coding agent: inspect when useful, patch code with apply_patch, run safe checks when they add confidence, iterate on failures, and keep outputs inside the workspace.",
           "For large projects, decompose into useful files and milestones, implement a coherent minimal version first, then iterate with checks rather than only describing what you would do.",
           "For website/app/code/LaTeX/Python/C/shell tasks, create or edit real workspace files, run available build/compile/test commands, and surface artifacts through the canvas when useful.",
           "For research or web-search tasks, use browser tools or safe shell network tools when the current policy allows; cite or save useful sources in workspace notes when the task needs traceability.",
@@ -304,7 +304,7 @@ function createInitialState(config, sessionId) {
               : `Shell working directory: ${config.commandCwd}`
             : "",
           config.allowFileTools
-            ? `Workspace file tools enabled in: ${config.commandCwd}. Use workspace-relative paths. Local preview tools available: open_workspace_file and preview_workspace.`
+            ? `Workspace file tools enabled in: ${config.commandCwd}. Use workspace-relative paths. Use apply_patch for code edits; it accepts exact replacements or Codex-style/unified multi-file patches. Local preview tools available: open_workspace_file and preview_workspace.`
             : "",
           config.allowWrapperTools
             ? `Agent wrappers: selected=${normalizeWrapperName(config.preferredWrapper)}; ${wrapperStatusText()}`
@@ -499,6 +499,7 @@ function sanitizeToolArgs(toolName, args) {
   if (toolName === "apply_patch") {
     return {
       ...safeArgs,
+      patch: typeof args.patch === "string" ? `[${Buffer.byteLength(args.patch, "utf8")} bytes sha256=${hashForLog(args.patch)}]` : safeArgs.patch,
       search: typeof args.search === "string" ? redactSensitiveText(args.search).slice(0, 160) : safeArgs.search,
       replace: typeof args.replace === "string" ? redactSensitiveText(args.replace).slice(0, 160) : safeArgs.replace,
     };
@@ -610,7 +611,7 @@ async function captureSyntheticSnapshot(store, step, config) {
           : `Shell tool available in: ${config.commandCwd}`
         : "Shell tool disabled.",
       config.allowFileTools
-        ? `Workspace file tools available in: ${config.commandCwd}. Use workspace-relative paths.`
+        ? `Workspace file tools available in: ${config.commandCwd}. Use workspace-relative paths. Use apply_patch for code edits; it supports exact single-file replacement and multi-file Codex-style/unified patches.`
         : "Workspace file tools disabled.",
       config.allowWrapperTools
         ? `Agent wrappers available: selected=${normalizeWrapperName(config.preferredWrapper)}; ${wrapperStatusText()}`
@@ -819,9 +820,10 @@ async function executeTool(browserState, toolCall, snapshot, config, store, obse
 
         await store.appendEvent("tool.completed", eventResult);
         observers.event("tool.completed", eventResult);
-        if (result.change) {
+        const changes = Array.isArray(result.changes) && result.changes.length ? result.changes : result.change ? [result.change] : [];
+        for (const item of changes) {
           const change = {
-            ...result.change,
+            ...item,
             toolName: toolCall.function.name,
             commandCwd: config.commandCwd,
           };

package/src/interactive-cli.js

@@ -60,7 +60,7 @@ function label(name, bgCode) {
 }
 
 function userPrompt() {
-  return `\n${label("user>", ansi.userBg)} `;
+  return `\n${label("user>", ansi.userBg)} ${color("|", ansi.userBg)} `;
 }
 
 function commandCompleter(line = "") {
@@ -70,6 +70,21 @@ function commandCompleter(line = "") {
   return [hits.length > 0 ? hits : SLASH_COMMANDS, trimmed];
 }
 
+function stripAnsi(value) {
+  return String(value || "").replace(/\x1b\[[0-9;?]*[ -/]*[@-~]/g, "");
+}
+
+function promptGutter() {
+  const visible = stripAnsi(userPrompt()).replace(/^\n/, "").length;
+  return " ".repeat(Math.max(visible - 2, 0)) + `${color("|", ansi.userBg)} `;
+}
+
+function commandSuggestions(line = "") {
+  const trimmed = String(line || "");
+  if (!trimmed.startsWith("/") || /\s/.test(trimmed)) return [];
+  return SLASH_COMMANDS.filter((command) => command.startsWith(trimmed)).slice(0, 8);
+}
+
 function stripMarkdown(text) {
   const lines = String(text || "").split(/\r?\n/);
   let inFence = false;
@@ -79,16 +94,26 @@ function stripMarkdown(text) {
     let line = rawLine;
     if (/^\s*```/.test(line)) {
       inFence = !inFence;
-      if (inFence) rendered.push(color("code", ansi.dim));
+      if (inFence) {
+        const language = line.replace(/^\s*```/, "").trim();
+        rendered.push(color(language ? `code ${language}` : "code", ansi.dim));
+      }
       continue;
     }
 
     if (!inFence) {
       if (/^\s*[-*_]{3,}\s*$/.test(line)) {
-        rendered.push("");
+        rendered.push(color("-".repeat(42), ansi.dim));
+        continue;
+      }
+      const heading = line.match(/^\s{0,3}(#{1,6})\s+(.+)$/);
+      if (heading) {
+        rendered.push(color(heading[2].replace(/\s+#*$/, ""), ansi.bold, ansi.cyan));
+        continue;
+      }
+      if (/^\s*\|?\s*:?-{3,}:?\s*(\|\s*:?-{3,}:?\s*)+\|?\s*$/.test(line)) {
         continue;
       }
-      line = line.replace(/^\s{0,3}#{1,6}\s+/, "");
       line = line.replace(/\[([^\]]+)\]\(([^)]+)\)/g, "$1 ($2)");
       line = line.replace(/\*\*([^*]+)\*\*/g, (_, value) => color(value, ansi.bold));
       line = line.replace(/__([^_]+)__/g, (_, value) => color(value, ansi.bold));
@@ -96,7 +121,9 @@ function stripMarkdown(text) {
       line = line.replace(/(^|[^\w])_([^_\n]+)_/g, "$1$2");
       line = line.replace(/`([^`]+)`/g, (_, value) => color(value, ansi.yellow));
       line = line.replace(/^(\s*)[-*+]\s+/, "$1- ");
-      line = line.replace(/^\s*>\s?/, "  ");
+      line = line.replace(/^\s*>\s?(.+)$/, (_, value) => color(`| ${value}`, ansi.dim));
+    } else {
+      line = color(`  ${line}`, ansi.yellow);
     }
 
     rendered.push(line);
@@ -105,10 +132,15 @@ function stripMarkdown(text) {
   return rendered.join("\n").replace(/\n{3,}/g, "\n\n").trimEnd();
 }
 
-function printWrapped(prefix, text) {
+function rolePrefix(name, bgCode) {
+  return `${label(name, bgCode)} ${color("|", bgCode)} `;
+}
+
+function printWrapped(prefix, text, { stripCode = "" } = {}) {
   const rendered = stripMarkdown(text);
   const lines = rendered.split("\n");
-  const gutter = " ".repeat(useColor ? 9 : prefix.length);
+  const visible = stripAnsi(prefix).length;
+  const gutter = `${" ".repeat(Math.max(visible - 2, 0))}${stripCode ? color("|", stripCode) : "|"} `;
   console.log(`${prefix}${lines[0] || ""}`);
   for (const line of lines.slice(1)) {
     console.log(`${gutter}${line}`);
@@ -116,7 +148,7 @@ function printWrapped(prefix, text) {
 }
 
 function printAgentMessage(text) {
-  printWrapped(`${label("aginti>", ansi.agentBg)} `, text);
+  printWrapped(rolePrefix("aginti>", ansi.agentBg), text, { stripCode: ansi.agentBg });
 }
 
 function printSystemLine(text) {
@@ -197,6 +229,113 @@ function printHelp() {
   );
 }
 
+function renderPromptBuffer(buffer, previousLineCount = 0) {
+  for (let index = 0; index < previousLineCount; index += 1) {
+    output.write(`\r${ansi.clearLine}`);
+    if (index < previousLineCount - 1) output.write("\x1b[1A");
+  }
+
+  const lines = String(buffer || "").split("\n");
+  const suggestions = commandSuggestions(lines[0] || "");
+  const rendered = [];
+  rendered.push(`${userPrompt().replace(/^\n/, "")}${lines[0] || ""}`);
+  for (const line of lines.slice(1)) {
+    rendered.push(`${promptGutter()}${line}`);
+  }
+  if (suggestions.length > 0) {
+    rendered.push(`${promptGutter()}${color(`suggest: ${suggestions.join("  ")}`, ansi.dim)}`);
+  }
+  output.write(rendered.join("\n"));
+  return rendered.length;
+}
+
+function createAbortError(message = "Aborted with Ctrl+C") {
+  const error = new Error(message);
+  error.code = "ABORT_ERR";
+  error.name = "AbortError";
+  return error;
+}
+
+function readTtyPrompt() {
+  return new Promise((resolve, reject) => {
+    emitKeypressEvents(input);
+    const wasRaw = Boolean(input.isRaw);
+    let buffer = "";
+    let renderedLines = 0;
+
+    const cleanup = () => {
+      input.off("keypress", handler);
+      if (typeof input.setRawMode === "function") input.setRawMode(wasRaw);
+      input.pause();
+      output.write(ansi.cursorShow);
+    };
+
+    const redraw = () => {
+      renderedLines = renderPromptBuffer(buffer, renderedLines);
+    };
+
+    const submit = () => {
+      cleanup();
+      output.write("\n");
+      resolve(buffer);
+    };
+
+    const handler = (str = "", key = {}) => {
+      if (key.ctrl && key.name === "c") {
+        cleanup();
+        output.write("\n");
+        reject(createAbortError());
+        return;
+      }
+      if ((key.ctrl && key.name === "j") || (key.sequence === "\n" && key.name !== "return" && key.name !== "enter")) {
+        buffer += "\n";
+        redraw();
+        return;
+      }
+      if (key.name === "return" || key.name === "enter" || key.sequence === "\r" || str === "\r") {
+        submit();
+        return;
+      }
+      if (key.name === "backspace") {
+        buffer = buffer.slice(0, -1);
+        redraw();
+        return;
+      }
+      if (key.name === "tab") {
+        const suggestions = commandSuggestions(buffer.split("\n")[0] || "");
+        if (suggestions.length === 1) {
+          buffer = suggestions[0];
+        }
+        redraw();
+        return;
+      }
+      if (key.name === "escape") {
+        buffer = "";
+        redraw();
+        return;
+      }
+      if (key.ctrl || key.meta) return;
+      if (str && !key.sequence?.startsWith("\x1b")) {
+        buffer += str;
+        redraw();
+      }
+    };
+
+    input.resume();
+    input.setRawMode(true);
+    output.write(ansi.cursorHide);
+    input.on("keypress", handler);
+    redraw();
+  });
+}
+
+async function readPromptAnswer(rl) {
+  if (input.isTTY && output.isTTY && typeof input.setRawMode === "function") {
+    return readTtyPrompt();
+  }
+  return rl.question(userPrompt());
+}
+
 function printStatus(state) {
   printSystemLine(`project=${process.cwd()}`);
   printSystemLine(`cwd=${state.commandCwd || process.cwd()}`);
@@ -237,6 +376,7 @@ function attachRunInterrupts(controller) {
 
   emitKeypressEvents(input);
   const wasRaw = Boolean(input.isRaw);
+  input.resume();
   input.setRawMode(true);
   const handler = (_str, key = {}) => {
     const isEscape = key.name === "escape";
@@ -564,12 +704,15 @@ async function runPrompt(prompt, state, packageDir) {
 
 export async function startInteractiveCli(args = {}, { packageDir, packageVersion } = {}) {
   const state = createState(args);
-  const rl = readline.createInterface({
-    input,
-    output,
-    terminal: Boolean(input.isTTY && output.isTTY),
-    completer: commandCompleter,
-  });
+  const rl =
+    input.isTTY && output.isTTY
+      ? null
+      : readline.createInterface({
+          input,
+          output,
+          terminal: false,
+          completer: commandCompleter,
+        });
 
   await renderLaunchHeader(packageVersion);
   printSystemLine(`Project: ${process.cwd()}`);
@@ -581,7 +724,7 @@ export async function startInteractiveCli(args = {}, { packageDir, packageVersio
     while (true) {
       let answer = "";
       try {
-        answer = await rl.question(userPrompt());
+        answer = await readPromptAnswer(rl);
       } catch (error) {
         if (error?.code === "ERR_USE_AFTER_CLOSE") break;
         if (isAbortError(error)) {
@@ -609,6 +752,6 @@ export async function startInteractiveCli(args = {}, { packageDir, packageVersio
       }
     }
   } finally {
-    rl.close();
+    rl?.close();
   }
 }

package/src/model-client.js

@@ -81,6 +81,21 @@ function mockWorkspaceToolForGoal(goal = "") {
   const text = String(goal).toLowerCase();
   const targetPath = mockPathForGoal(goal);
   if (/patch|replace|edit/.test(text)) {
+    if (/multi|codex|unified|several|multiple/i.test(text)) {
+      return mockToolCall("apply_patch", {
+        patch: [
+          "*** Begin Patch",
+          "*** Update File: patch-target.txt",
+          "@@",
+          "-old",
+          "+new",
+          "*** Add File: notes/patch-note.md",
+          "+Created by AgInTiFlow mock mode.",
+          "+Goal: multi-file patch smoke.",
+          "*** End Patch",
+        ].join("\n"),
+      });
+    }
     return mockToolCall("apply_patch", {
       path: targetPath,
       search: "old",
@@ -166,7 +181,7 @@ export async function createPlan(client, config, state) {
             ? `Shell tool is enabled in ${config.commandCwd}. In Docker, this path is mounted as /workspace with persistent /aginti-env and /aginti-cache mounts. Use relative paths or /workspace paths, not absolute host temp paths. Sandbox mode: ${config.sandboxMode}. Package install policy: ${config.packageInstallPolicy}. For npm/pip/conda/venv setup, explain the need and wait for approval unless policy is allow.`
             : "",
           config.allowFileTools
-            ? `Workspace file tools are enabled in ${config.commandCwd}: list_files, read_file, search_files, write_file, apply_patch, open_workspace_file, preview_workspace. Keep all paths workspace-relative, for example plot_fx.svg or docs/report.tex, and avoid secrets. For generated local HTML/SVG/PDF/static sites, plan to use open_workspace_file or preview_workspace rather than starting a localhost server inside Docker.`
+            ? `Workspace file tools are enabled in ${config.commandCwd}: list_files, read_file, search_files, write_file, apply_patch, open_workspace_file, preview_workspace. apply_patch supports exact single-file replacements and Codex-style/unified multi-file patches; prefer it for edits after reading relevant context. Keep all paths workspace-relative, for example plot_fx.svg or docs/report.tex, and avoid secrets. For generated local HTML/SVG/PDF/static sites, plan to use open_workspace_file or preview_workspace rather than starting a localhost server inside Docker.`
             : "",
           config.allowWrapperTools
             ? `Agent wrappers are enabled. Use the selected wrapper only: ${normalizeWrapperName(config.preferredWrapper)}. Status: ${wrapperStatusText()}.`
@@ -456,16 +471,21 @@ export async function requestNextStep(client, config, messages) {
         function: {
           name: "apply_patch",
           description:
-            "Apply a deterministic workspace-local search/replace patch to one small UTF-8 file. Provide exact search and replacement text. The runtime records before/after hashes and a compact diff.",
+            "Apply deterministic workspace-local code edits. Either provide path/search/replace for one exact replacement, or provide patch with a Codex-style patch envelope (*** Begin Patch / *** Update File / *** Add File / *** Delete File / *** End Patch) or unified diff. Use this after reading/searching relevant files. It supports multi-file add/update/delete patches, blocks secrets/.git/node_modules/outside-workspace paths, preflights hunks before writing, and records before/after hashes plus compact diffs.",
           parameters: {
             type: "object",
             properties: {
+              patch: {
+                type: "string",
+                description:
+                  "Optional multi-file patch document. Supports Codex-style patch envelope or unified diff. Use workspace-relative paths only.",
+              },
               path: { type: "string", description: "Workspace-relative file path." },
-              search: { type: "string" },
-              replace: { type: "string" },
+              search: { type: "string", description: "Exact text to replace when using single-file patch mode." },
+              replace: { type: "string", description: "Replacement text when using single-file patch mode." },
               expectedReplacements: { type: "integer" },
+              baseHash: { type: "string", description: "Optional sha256 from read_file; rejects if file changed before patching." },
             },
-            required: ["path", "search", "replace"],
             additionalProperties: false,
           },
         },
@@ -538,7 +558,13 @@ export async function requestNextStep(client, config, messages) {
         toolPayload.error,
         toolPayload.reason,
         toolPayload.path ? `Path: ${toolPayload.path}` : "",
-        toolPayload.change?.diff ? `Diff:\n${toolPayload.change.diff}` : "",
+        Array.isArray(toolPayload.changes)
+          ? toolPayload.changes
+              .map((change) => [change.path ? `Path: ${change.path}` : "", change.diff ? `Diff:\n${change.diff}` : ""].filter(Boolean).join("\n"))
+              .filter(Boolean)
+              .join("\n\n")
+          : "",
+        !Array.isArray(toolPayload.changes) && toolPayload.change?.diff ? `Diff:\n${toolPayload.change.diff}` : "",
       ]
         .filter(Boolean)
         .join("\n");

package/src/model-routing.js

@@ -5,6 +5,10 @@ const COMPLEXITY_KEYWORDS = [
   "failing",
   "test",
   "implement",
+  "patch",
+  "apply_patch",
+  "edit",
+  "large codebase",
   "design",
   "review",
   "migrate",

package/src/workspace-tools.js

@@ -8,6 +8,7 @@ export const WORKSPACE_WRITE_TOOL_NAMES = ["write_file", "apply_patch"];
 
 const MAX_READ_BYTES = 220_000;
 const MAX_WRITE_BYTES = 220_000;
+const MAX_PATCH_BYTES = 260_000;
 const MAX_LIST_ENTRIES = 360;
 const MAX_SEARCH_RESULTS = 80;
 const DEFAULT_MAX_DEPTH = 4;
@@ -52,6 +53,23 @@ function compactPreview(value, limit = 180) {
   return text.length <= limit ? text : `${text.slice(0, limit)}...`;
 }
 
+function countOccurrences(text, search) {
+  if (!search) return 0;
+  let count = 0;
+  let index = 0;
+  while ((index = text.indexOf(search, index)) !== -1) {
+    count += 1;
+    index += search.length;
+  }
+  return count;
+}
+
+function replaceOnce(text, search, replace) {
+  const index = text.indexOf(search);
+  if (index === -1) return text;
+  return `${text.slice(0, index)}${replace}${text.slice(index + search.length)}`;
+}
+
 function sanitizePathInput(inputPath) {
   const value = String(inputPath || ".").trim();
   if (!value) return ".";
@@ -130,6 +148,16 @@ export function checkWorkspaceToolUse(toolName, args, config) {
   }
 
   try {
+    if (toolName === "apply_patch" && typeof args.patch === "string" && args.patch.trim()) {
+      for (const operation of parsePatchDocument(args.patch)) {
+        for (const candidate of [operation.path, operation.newPath].filter(Boolean)) {
+          const target = resolveWorkspacePath(config, candidate);
+          const policy = pathPolicy(toolName, target.relativePath);
+          if (!policy.allowed) return policy;
+        }
+      }
+      return { allowed: true };
+    }
     const target = resolveWorkspacePath(config, args.path || ".");
     return pathPolicy(toolName, target.relativePath);
   } catch (error) {
@@ -150,6 +178,7 @@ export function summarizeWorkspaceTools(config) {
     limits: {
       maxReadBytes: MAX_READ_BYTES,
       maxWriteBytes: MAX_WRITE_BYTES,
+      maxPatchBytes: MAX_PATCH_BYTES,
       maxListEntries: MAX_LIST_ENTRIES,
       maxSearchResults: MAX_SEARCH_RESULTS,
     },
@@ -333,7 +362,8 @@ async function writeChange(target, nextContent, action, details = {}) {
     beforeText = before.toString("utf8");
     beforeHash = hashBuffer(before);
     beforeBytes = before.length;
-  } catch {
+  } catch (error) {
+    if (error?.code !== "ENOENT") throw error;
     // Missing files are valid for create/overwrite actions.
   }
 
@@ -357,6 +387,27 @@ async function writeChange(target, nextContent, action, details = {}) {
   };
 }
 
+async function deleteChange(target, action = "delete_file", details = {}) {
+  const before = await fs.readFile(target.absolutePath);
+  if (before.length > MAX_READ_BYTES) throw new Error(`Existing file is too large to delete safely: ${target.relativePath}`);
+  if (before.includes(0)) throw new Error(`Binary files cannot be deleted through this tool: ${target.relativePath}`);
+  const beforeText = before.toString("utf8");
+  const beforeHash = hashBuffer(before);
+  await fs.unlink(target.absolutePath);
+  return {
+    ok: true,
+    action,
+    path: target.relativePath,
+    beforeHash,
+    afterHash: null,
+    beforeBytes: before.length,
+    afterBytes: 0,
+    deleted: true,
+    diff: compactDiff(target.relativePath, beforeText, ""),
+    ...details,
+  };
+}
+
 async function writeFile(config, args) {
   const target = resolveWorkspacePath(config, args.path);
   const mode = args.mode === "overwrite" ? "overwrite" : "create";
@@ -380,8 +431,15 @@ async function writeFile(config, args) {
 }
 
 async function applyPatch(config, args) {
+  if (typeof args.patch === "string" && args.patch.trim()) {
+    return applyPatchDocument(config, args);
+  }
+
   const target = resolveWorkspacePath(config, args.path);
-  const { content: beforeText } = await readTextFile(target);
+  const { content: beforeText, hash } = await readTextFile(target);
+  if (args.baseHash && args.baseHash !== hash) {
+    throw new Error(`Base hash mismatch for ${target.relativePath}; read the file again before patching.`);
+  }
   const search = String(args.search || "");
   const replace = String(args.replace ?? "");
   if (!search) throw new Error("Patch search text is required.");
@@ -409,6 +467,247 @@ async function applyPatch(config, args) {
   };
 }
 
+function ensurePatchSize(patch) {
+  const bytes = Buffer.byteLength(String(patch || ""), "utf8");
+  if (bytes > MAX_PATCH_BYTES) throw new Error(`Patch is too large for safe workspace tools (${bytes} bytes).`);
+}
+
+function cleanPatchPath(rawPath) {
+  let value = String(rawPath || "").trim();
+  value = value.replace(/^"|"$/g, "");
+  if (!value || value === "/dev/null") return "";
+  value = value.replace(/^\.[/\\]/, "");
+  value = value.replace(/^[ab]\//, "");
+  return value;
+}
+
+function flushPatchHunk(hunks, oldLines, newLines) {
+  if (!oldLines.length && !newLines.length) return;
+  hunks.push({
+    search: oldLines.join("\n"),
+    replace: newLines.join("\n"),
+  });
+  oldLines.length = 0;
+  newLines.length = 0;
+}
+
+function parsePrefixedHunks(lines) {
+  const hunks = [];
+  const oldLines = [];
+  const newLines = [];
+
+  for (const line of lines) {
+    if (line.startsWith("@@")) {
+      flushPatchHunk(hunks, oldLines, newLines);
+      continue;
+    }
+    if (line.startsWith("\\ No newline")) continue;
+    const marker = line[0];
+    const content = line.slice(1);
+    if (marker === " ") {
+      oldLines.push(content);
+      newLines.push(content);
+    } else if (marker === "-") {
+      oldLines.push(content);
+    } else if (marker === "+") {
+      newLines.push(content);
+    }
+  }
+
+  flushPatchHunk(hunks, oldLines, newLines);
+  return hunks.filter((hunk) => hunk.search !== hunk.replace);
+}
+
+function parseCodexPatchDocument(patch) {
+  const lines = String(patch || "").replace(/\r\n?/g, "\n").split("\n");
+  const operations = [];
+  let index = 0;
+
+  while (index < lines.length) {
+    const line = lines[index];
+    const add = line.match(/^\*\*\* Add File:\s+(.+)$/);
+    const update = line.match(/^\*\*\* Update File:\s+(.+)$/);
+    const remove = line.match(/^\*\*\* Delete File:\s+(.+)$/);
+
+    if (add) {
+      const filePath = cleanPatchPath(add[1]);
+      const contentLines = [];
+      index += 1;
+      while (index < lines.length && !lines[index].startsWith("*** ")) {
+        contentLines.push(lines[index].startsWith("+") ? lines[index].slice(1) : lines[index]);
+        index += 1;
+      }
+      operations.push({ type: "add", path: filePath, content: contentLines.join("\n") });
+      continue;
+    }
+
+    if (remove) {
+      operations.push({ type: "delete", path: cleanPatchPath(remove[1]) });
+      index += 1;
+      continue;
+    }
+
+    if (update) {
+      const filePath = cleanPatchPath(update[1]);
+      const hunkLines = [];
+      let moveTo = "";
+      index += 1;
+      while (index < lines.length) {
+        const move = lines[index].match(/^\*\*\* Move to:\s+(.+)$/);
+        if (move) {
+          moveTo = cleanPatchPath(move[1]);
+          index += 1;
+          continue;
+        }
+        if (lines[index].startsWith("*** ")) break;
+        hunkLines.push(lines[index]);
+        index += 1;
+      }
+      operations.push({ type: "update", path: filePath, newPath: moveTo, hunks: parsePrefixedHunks(hunkLines) });
+      continue;
+    }
+
+    index += 1;
+  }
+
+  return operations;
+}
+
+function parseUnifiedPatchDocument(patch) {
+  const lines = String(patch || "").replace(/\r\n?/g, "\n").split("\n");
+  const operations = [];
+  let index = 0;
+
+  while (index < lines.length) {
+    const oldHeader = lines[index]?.match(/^---\s+(.+)$/);
+    const newHeader = lines[index + 1]?.match(/^\+\+\+\s+(.+)$/);
+    if (!oldHeader || !newHeader) {
+      index += 1;
+      continue;
+    }
+
+    const oldPath = cleanPatchPath(oldHeader[1].split(/\s+/)[0]);
+    const newPath = cleanPatchPath(newHeader[1].split(/\s+/)[0]);
+    const hunkLines = [];
+    index += 2;
+    while (index < lines.length && !/^---\s+/.test(lines[index])) {
+      hunkLines.push(lines[index]);
+      index += 1;
+    }
+
+    if (!oldPath && newPath) {
+      const content = hunkLines
+        .filter((line) => line.startsWith("+") && !line.startsWith("+++"))
+        .map((line) => line.slice(1))
+        .join("\n");
+      operations.push({ type: "add", path: newPath, content });
+    } else if (oldPath && !newPath) {
+      operations.push({ type: "delete", path: oldPath });
+    } else {
+      operations.push({ type: "update", path: oldPath, newPath: newPath && newPath !== oldPath ? newPath : "", hunks: parsePrefixedHunks(hunkLines) });
+    }
+  }
+
+  return operations;
+}
+
+function parsePatchDocument(patch) {
+  const text = String(patch || "").trim();
+  if (!text) throw new Error("Patch content is required.");
+  ensurePatchSize(text);
+  const operations = text.includes("*** Begin Patch") ? parseCodexPatchDocument(text) : parseUnifiedPatchDocument(text);
+  if (!operations.length) throw new Error("Patch did not contain any supported file operations.");
+  return operations;
+}
+
+async function applyPatchDocument(config, args) {
+  const operations = parsePatchDocument(args.patch);
+  const planned = [];
+  const seenPaths = new Set();
+
+  for (const operation of operations) {
+    if (!operation.path) throw new Error("Patch operation is missing a file path.");
+    if (seenPaths.has(operation.path)) throw new Error(`Patch contains duplicate file operations for ${operation.path}.`);
+    seenPaths.add(operation.path);
+
+    const target = resolveWorkspacePath(config, operation.path);
+    const policy = pathPolicy("apply_patch", target.relativePath);
+    if (!policy.allowed) throw new Error(policy.reason);
+    const newTarget = operation.newPath ? resolveWorkspacePath(config, operation.newPath) : null;
+    if (newTarget) {
+      const newPolicy = pathPolicy("apply_patch", newTarget.relativePath);
+      if (!newPolicy.allowed) throw new Error(newPolicy.reason);
+      const newTargetExists = await fs
+        .stat(newTarget.absolutePath)
+        .then(() => true)
+        .catch((error) => {
+          if (error?.code === "ENOENT") return false;
+          throw error;
+        });
+      if (newTargetExists) throw new Error(`Patch cannot move over an existing file: ${newTarget.relativePath}`);
+    }
+
+    if (operation.type === "add") {
+      const exists = await fs
+        .stat(target.absolutePath)
+        .then(() => true)
+        .catch((error) => {
+          if (error?.code === "ENOENT") return false;
+          throw error;
+        });
+      if (exists) throw new Error(`Patch cannot add an existing file: ${target.relativePath}`);
+      planned.push({ operation, target, afterText: String(operation.content ?? "") });
+      continue;
+    }
+
+    if (operation.type === "delete") {
+      await readTextFile(target);
+      planned.push({ operation, target, delete: true });
+      continue;
+    }
+
+    const { content: beforeText } = await readTextFile(target);
+    let afterText = beforeText;
+    for (const hunk of operation.hunks || []) {
+      if (!hunk.search) throw new Error(`Patch hunk for ${target.relativePath} has no removable/context lines.`);
+      const matches = countOccurrences(afterText, hunk.search);
+      if (matches !== 1) {
+        throw new Error(`Patch hunk for ${target.relativePath} expected exactly 1 match, found ${matches}. Add more context or read the file again.`);
+      }
+      afterText = replaceOnce(afterText, hunk.search, hunk.replace);
+    }
+    if (afterText === beforeText && !operation.newPath) throw new Error(`Patch made no changes to ${target.relativePath}.`);
+    planned.push({ operation, target, afterText });
+  }
+
+  const changes = [];
+  for (const item of planned) {
+    const { operation, target } = item;
+    if (item.delete) {
+      changes.push(await deleteChange(target, "apply_patch_delete", { patchFormat: "multi-file" }));
+      continue;
+    }
+    if (operation.newPath) {
+      const newTarget = resolveWorkspacePath(config, operation.newPath);
+      const policy = pathPolicy("apply_patch", newTarget.relativePath);
+      if (!policy.allowed) throw new Error(policy.reason);
+      changes.push(await writeChange(newTarget, item.afterText, "apply_patch_move", { fromPath: target.relativePath, patchFormat: "multi-file" }));
+      await fs.unlink(target.absolutePath);
+      continue;
+    }
+    changes.push(await writeChange(target, item.afterText, operation.type === "add" ? "apply_patch_add" : "apply_patch_update", { patchFormat: "multi-file" }));
+  }
+
+  return {
+    ok: true,
+    toolName: "apply_patch",
+    path: changes.length === 1 ? changes[0].path : "",
+    changes,
+    change: changes[0],
+    summary: `${changes.length} file change(s) applied`,
+  };
+}
+
 export async function executeWorkspaceTool(toolName, args, config) {
   const guard = checkWorkspaceToolUse(toolName, args, config);
   if (!guard.allowed) {