@namzu/sdk 3.0.0 → 3.2.0

package/src/tools/builtins/__tests__/stale-file-refusal.test.ts

@@ -0,0 +1,258 @@
+import { lstatSync, mkdtempSync, readFileSync, symlinkSync, writeFileSync } from 'node:fs'
+import { tmpdir } from 'node:os'
+import { join } from 'node:path'
+import { describe, expect, it } from 'vitest'
+
+import type { FileReadTracker, ToolContext } from '../../../types/tool/index.js'
+import { atomicWriteFile } from '../atomic-write-file.js'
+import { fingerprintContent } from '../content-fingerprint.js'
+import { EditTool } from '../edit.js'
+
+/**
+ * The mutation lock serializes THIS runtime's writers. It cannot see a
+ * person editing in an editor, another process, or a second agent run —
+ * and an edit computed against a body that has since moved is a lost
+ * update whichever of those did the moving.
+ *
+ * Worse than undetected, it was misreported: an `old_string` that no
+ * longer matches came back as "not found in file — make sure the string
+ * matches exactly", which tells the agent its input was wrong when the
+ * file changed underneath it. The agent then retries the same edit
+ * against the same moved file.
+ */
+
+function trackerOver(store: Map<string, string>): FileReadTracker {
+	return {
+		recordRead: (key, content) => {
+			if (content !== undefined) store.set(key, fingerprintContent(content))
+		},
+		hasRead: (key) => store.has(key),
+		fingerprint: (key) => store.get(key),
+	}
+}
+
+function contextWith(workingDirectory: string, tracker?: FileReadTracker): ToolContext {
+	return {
+		runId: 'run_stale' as ToolContext['runId'],
+		workingDirectory,
+		abortSignal: new AbortController().signal,
+		env: {},
+		log: () => {},
+		...(tracker ? { fileReadTracker: tracker } : {}),
+	}
+}
+
+describe('an edit against a file that moved is refused, not applied', () => {
+	it('refuses when the body changed since the agent read it', async () => {
+		const dir = mkdtempSync(join(tmpdir(), 'namzu-stale-'))
+		const file = join(dir, 'doc.md')
+		writeFileSync(file, 'alpha\nbeta\n')
+
+		const store = new Map<string, string>()
+		const tracker = trackerOver(store)
+		tracker.recordRead(file, 'alpha\nbeta\n')
+
+		// Somebody else rewrites the very line this edit anchors on.
+		writeFileSync(file, 'alpha\nBETA WAS REWRITTEN\n')
+
+		const result = await EditTool.execute(
+			{ path: 'doc.md', old_string: 'beta', new_string: 'gamma', replace_all: false },
+			contextWith(dir, tracker),
+		)
+
+		expect(result.success).toBe(false)
+		expect(result.error).toContain('changed on disk after you read it')
+		// The refusal has to be actionable, and "nothing was written" is the
+		// part that stops the agent re-running the same edit blind.
+		expect(result.error).toContain('Read the file again')
+		expect(result.error).toContain('Nothing was written')
+		expect(readFileSync(file, 'utf-8')).toBe('alpha\nBETA WAS REWRITTEN\n')
+	})
+
+	it('applies normally when the file is untouched', async () => {
+		const dir = mkdtempSync(join(tmpdir(), 'namzu-stale-'))
+		const file = join(dir, 'doc.md')
+		writeFileSync(file, 'alpha\nbeta\n')
+
+		const tracker = trackerOver(new Map())
+		tracker.recordRead(file, 'alpha\nbeta\n')
+
+		const result = await EditTool.execute(
+			{ path: 'doc.md', old_string: 'beta', new_string: 'gamma', replace_all: false },
+			contextWith(dir, tracker),
+		)
+
+		expect(result.success).toBe(true)
+		expect(readFileSync(file, 'utf-8')).toBe('alpha\ngamma\n')
+	})
+
+	it('lets a second edit in the same turn proceed against what the first wrote', async () => {
+		const dir = mkdtempSync(join(tmpdir(), 'namzu-stale-'))
+		const file = join(dir, 'doc.md')
+		writeFileSync(file, 'alpha\nbeta\n')
+
+		const tracker = trackerOver(new Map())
+		tracker.recordRead(file, 'alpha\nbeta\n')
+		const context = contextWith(dir, tracker)
+
+		const first = await EditTool.execute(
+			{ path: 'doc.md', old_string: 'beta', new_string: 'gamma', replace_all: false },
+			context,
+		)
+		// Without re-fingerprinting after a successful write, this second edit
+		// would see its own predecessor's output as someone else's drift.
+		const second = await EditTool.execute(
+			{ path: 'doc.md', old_string: 'alpha', new_string: 'omega', replace_all: false },
+			context,
+		)
+
+		expect(first.success).toBe(true)
+		expect(second.success).toBe(true)
+		expect(readFileSync(file, 'utf-8')).toBe('omega\ngamma\n')
+	})
+
+	it('proceeds when the host tracks nothing, which is the older contract', async () => {
+		const dir = mkdtempSync(join(tmpdir(), 'namzu-stale-'))
+		writeFileSync(join(dir, 'doc.md'), 'alpha\nbeta\n')
+
+		// `fingerprint` is optional. A host that never captured one must not
+		// have every edit refused.
+		const result = await EditTool.execute(
+			{ path: 'doc.md', old_string: 'beta', new_string: 'gamma', replace_all: false },
+			contextWith(dir),
+		)
+
+		expect(result.success).toBe(true)
+	})
+
+	it('proceeds when the path was never read, so there is nothing to be stale against', async () => {
+		const dir = mkdtempSync(join(tmpdir(), 'namzu-stale-'))
+		writeFileSync(join(dir, 'doc.md'), 'alpha\nbeta\n')
+
+		const result = await EditTool.execute(
+			{ path: 'doc.md', old_string: 'beta', new_string: 'gamma', replace_all: false },
+			contextWith(dir, trackerOver(new Map())),
+		)
+
+		expect(result.success).toBe(true)
+	})
+})
+
+describe('the fingerprint distinguishes bodies', () => {
+	it('is stable for identical content', () => {
+		expect(fingerprintContent('alpha\n')).toBe(fingerprintContent('alpha\n'))
+	})
+
+	it('differs on a one-character change', () => {
+		expect(fingerprintContent('alpha\n')).not.toBe(fingerprintContent('alphb\n'))
+	})
+
+	it('differs on trailing whitespace, which a diff would also treat as a change', () => {
+		expect(fingerprintContent('alpha')).not.toBe(fingerprintContent('alpha '))
+	})
+})
+
+describe('an atomic commit writes through a symlink rather than over it', () => {
+	/** Creating one needs a privilege this platform does not always grant. */
+	function symlinkOrSkip(target: string, link: string): boolean {
+		try {
+			symlinkSync(target, link)
+			return true
+		} catch {
+			return false
+		}
+	}
+
+	it('keeps the link and updates its target', async () => {
+		const dir = mkdtempSync(join(tmpdir(), 'namzu-symlink-'))
+		const real = join(dir, 'real.md')
+		const link = join(dir, 'link.md')
+		writeFileSync(real, 'original\n')
+		if (!symlinkOrSkip(real, link)) return
+
+		await atomicWriteFile(link, 'replaced\n')
+
+		// `rename` onto the link path would have swapped the link for a plain
+		// file, silently detaching every other path that pointed through it.
+		expect(lstatSync(link).isSymbolicLink()).toBe(true)
+		expect(readFileSync(real, 'utf-8')).toBe('replaced\n')
+		expect(readFileSync(link, 'utf-8')).toBe('replaced\n')
+	})
+
+	it('still creates a file that does not exist yet', async () => {
+		const dir = mkdtempSync(join(tmpdir(), 'namzu-symlink-'))
+		const fresh = join(dir, 'new.md')
+
+		await atomicWriteFile(fresh, 'created\n')
+
+		expect(readFileSync(fresh, 'utf-8')).toBe('created\n')
+	})
+})
+
+describe('drift that does not touch the anchor is not a conflict', () => {
+	it('applies when someone changed an unrelated part of the file', async () => {
+		const dir = mkdtempSync(join(tmpdir(), 'namzu-stale-'))
+		const file = join(dir, 'doc.md')
+		writeFileSync(file, 'alpha\nbeta\n')
+
+		const tracker = trackerOver(new Map())
+		tracker.recordRead(file, 'alpha\nbeta\n')
+
+		// Someone appends a line. The edit's anchor is untouched, so the edit
+		// is still exactly as well defined as when it was computed —
+		// refusing here would reject a safe edit every time anybody wrote
+		// anywhere in the file.
+		writeFileSync(file, 'alpha\nbeta\nan unrelated new line\n')
+
+		const result = await EditTool.execute(
+			{ path: 'doc.md', old_string: 'beta', new_string: 'gamma', replace_all: false },
+			contextWith(dir, tracker),
+		)
+
+		expect(result.success).toBe(true)
+		expect(readFileSync(file, 'utf-8')).toBe('alpha\ngamma\nan unrelated new line\n')
+	})
+
+	it('reports a genuinely wrong anchor as wrong, not as drift', async () => {
+		const dir = mkdtempSync(join(tmpdir(), 'namzu-stale-'))
+		const file = join(dir, 'doc.md')
+		writeFileSync(file, 'alpha\nbeta\n')
+
+		const tracker = trackerOver(new Map())
+		tracker.recordRead(file, 'alpha\nbeta\n')
+
+		// Nothing moved. The anchor is simply not in the file, and telling
+		// the agent to re-read would send it to look for a change that never
+		// happened.
+		const result = await EditTool.execute(
+			{ path: 'doc.md', old_string: 'nowhere', new_string: 'x', replace_all: false },
+			contextWith(dir, tracker),
+		)
+
+		expect(result.success).toBe(false)
+		expect(result.error).toContain('not found in file')
+		expect(result.error).not.toContain('changed on disk')
+	})
+
+	it('reports drift when the anchor became ambiguous because of it', async () => {
+		const dir = mkdtempSync(join(tmpdir(), 'namzu-stale-'))
+		const file = join(dir, 'doc.md')
+		writeFileSync(file, 'alpha\nbeta\n')
+
+		const tracker = trackerOver(new Map())
+		tracker.recordRead(file, 'alpha\nbeta\n')
+
+		// A second copy of the anchor appears. "not unique — add more
+		// context" would send the agent to widen an anchor that was unique
+		// when it read the file.
+		writeFileSync(file, 'alpha\nbeta\nbeta\n')
+
+		const result = await EditTool.execute(
+			{ path: 'doc.md', old_string: 'beta', new_string: 'gamma', replace_all: false },
+			contextWith(dir, tracker),
+		)
+
+		expect(result.success).toBe(false)
+		expect(result.error).toContain('changed on disk')
+	})
+})

package/src/tools/builtins/atomic-write-file.ts

@@ -1,5 +1,5 @@
 import { randomUUID } from 'node:crypto'
-import { type FileHandle, mkdir, open, rename, stat, unlink } from 'node:fs/promises'
+import { type FileHandle, mkdir, open, realpath, rename, stat, unlink } from 'node:fs/promises'
 import { basename, dirname, join } from 'node:path'
 
 interface AtomicWriteHooks {
@@ -14,10 +14,17 @@ interface AtomicWriteHooks {
  * filesystem. A failed pre-commit write leaves the original untouched.
  */
 export async function atomicWriteFile(
-	filePath: string,
+	requestedPath: string,
 	content: string,
 	hooks: AtomicWriteHooks = {},
 ): Promise<void> {
+	// Write THROUGH a symlink, not over it. `rename` replaces whatever sits
+	// at the destination, so committing onto a link path swaps the link for
+	// a regular file: the link is gone, and every other path that pointed
+	// through it now reads stale content. Resolving first keeps the link and
+	// updates what it points at, which is what a caller editing a linked
+	// file means. A path that does not exist yet resolves to itself.
+	const filePath = await realpath(requestedPath).catch(() => requestedPath)
 	const directory = dirname(filePath)
 	await mkdir(directory, { recursive: true })
 
@@ -47,11 +54,32 @@ export async function atomicWriteFile(
 	}
 }
 
+/**
+ * Best-effort, and only after the rename has already committed.
+ *
+ * Syncing the directory is what makes the RENAME survive a power loss on a
+ * POSIX filesystem. Not every platform permits it — opening a directory and
+ * calling fsync raises `EPERM` on Windows — and there the whole builtin was
+ * unusable: every `edit` and every `write` failed with `EPERM: operation not
+ * permitted, fsync` after correctly writing the file.
+ *
+ * Swallowing is right here and nowhere else in this file. By this point the
+ * destination already holds the complete new body; the only thing still at
+ * stake is durability across an OS-level crash, and on a platform that
+ * refuses the call there is no second way to ask. Failing the write would
+ * trade a durability refinement for a guaranteed error on every write.
+ *
+ * The sibling in `utils/atomic-write.ts` — the one the disk stores use, and
+ * the one that has run on this platform all along — does not sync the
+ * directory at all.
+ */
 async function syncDirectory(directory: string): Promise<void> {
 	let handle: FileHandle | undefined
 	try {
 		handle = await open(directory, 'r')
 		await handle.sync()
+	} catch {
+		// Unsupported on this platform; the rename already landed.
 	} finally {
 		await handle?.close().catch(() => undefined)
 	}

package/src/tools/builtins/content-fingerprint.ts

@@ -0,0 +1,33 @@
+import { createHash } from 'node:crypto'
+
+/**
+ * A short, stable fingerprint of a file body.
+ *
+ * Used to answer one question at mutation time: is the file still what the
+ * agent read? An `edit` is computed against a remembered body, and between
+ * the read and the write that body can move — a person editing in an
+ * editor, another process, a second agent run. The in-process mutation lock
+ * serializes this runtime's own writers and is blind to every one of those.
+ *
+ * Without this the drift is not merely undetected, it is actively
+ * misreported: an `old_string` that no longer matches comes back as "not
+ * found in file — make sure the string matches exactly", which tells the
+ * agent its input was wrong when the file changed underneath it. The agent
+ * then retries the same edit against the same moved file.
+ *
+ * Truncated deliberately. This distinguishes two bodies; it is not a
+ * security boundary, and a full digest per read costs bytes in a structure
+ * that lives for the whole run.
+ */
+export function fingerprintContent(content: string): string {
+	return createHash('sha256').update(content, 'utf-8').digest('hex').slice(0, 16)
+}
+
+/** What a mutation tool tells the agent when the file moved under it. */
+export function staleFileError(path: string): string {
+	return (
+		`${path} changed on disk after you read it, so this edit was computed against a stale copy ` +
+		'and was not applied. Read the file again and redo the edit against its current contents. ' +
+		'Nothing was written.'
+	)
+}

package/src/tools/builtins/edit.ts

@@ -1,17 +1,38 @@
-import { readFile, writeFile } from 'node:fs/promises'
+import { readFile } from 'node:fs/promises'
 import { resolve } from 'node:path'
 import { z } from 'zod'
 import { defineTool } from '../defineTool.js'
+import { atomicWriteFile } from './atomic-write-file.js'
+import { fingerprintContent, staleFileError } from './content-fingerprint.js'
+import { withFileMutationLock } from './file-mutation-lock.js'
 
+/**
+ * Two schemas, on purpose.
+ *
+ * `inputSchema` is what a HOST may send, and it accepts the `oldStr`/`newStr`
+ * aliases and `insertLine` because hosts that expose replacement under those
+ * names are real. `modelInputSchema` below is what a MODEL is constrained to
+ * — one closed canonical shape — because giving a model four spellings of the
+ * same field is how it learns to guess between them.
+ *
+ * `.strict()` is what makes the accepted set closed. Without it zod's default
+ * is to STRIP an unknown key, so a hallucinated or misspelled field is
+ * silently dropped and the edit proceeds against an input nobody wrote.
+ */
 const inputSchema = z
 	.object({
-		path: z.string().describe('Path to the file to edit'),
+		path: z
+			.string()
+			.refine((value) => value.trim().length > 0, 'Path must not be empty.')
+			.describe('Path to the file to edit. Must not be empty.'),
 		old_string: z
 			.string()
+			.min(1)
 			.optional()
 			.describe('The exact string to find and replace. Must be unique in the file.'),
 		oldStr: z
 			.string()
+			.min(1)
 			.optional()
 			.describe(
 				'Alias for old_string. Used by hosts that expose text replacement as oldStr/newStr.',
@@ -39,6 +60,7 @@ const inputSchema = z
 			.default(false)
 			.describe('Replace all occurrences instead of just the first unique match'),
 	})
+	.strict()
 	.refine((value) => typeof value.new_string === 'string' || typeof value.newStr === 'string', {
 		message: 'Either new_string or newStr is required.',
 	})
@@ -52,6 +74,40 @@ const inputSchema = z
 
 type EditInput = z.infer<typeof inputSchema>
 
+/**
+ * What a capable provider constrains the model to emit: one shape, closed.
+ *
+ * The aliases above exist for hosts, not for models. A model offered
+ * `old_string` and `oldStr` as separate optional fields has to guess which
+ * one this deployment wants, and `additionalProperties: false` is what turns
+ * an invented field into a generation-time refusal rather than a silent drop.
+ */
+const modelInputSchema: Record<string, unknown> = {
+	type: 'object',
+	properties: {
+		path: {
+			type: 'string',
+			description: 'Path to the file to edit. Must not be empty.',
+		},
+		old_string: {
+			type: 'string',
+			description:
+				'Exact unique text from the file, without read-tool line-number prefixes. Must not be empty.',
+		},
+		new_string: {
+			type: 'string',
+			description:
+				'Exact replacement text. May be empty to delete old_string. Keep under 12000 characters.',
+		},
+		replace_all: {
+			type: 'boolean',
+			description: 'Replace every occurrence instead of requiring one unique match.',
+		},
+	},
+	required: ['path', 'old_string', 'new_string'],
+	additionalProperties: false,
+}
+
 type NormalizedEditInput =
 	| {
 			operation: 'replace'
@@ -71,6 +127,10 @@ export const EditTool = defineTool({
 	description:
 		'Makes targeted edits to a file using exact string find-and-replace or line insertion. THIS IS THE PREFERRED WAY TO MODIFY AN EXISTING FILE — never reach for `write` to change a file that already exists, because `write` overwrites the whole body and discards earlier work on partial failure. `edit` keeps the rest of the file byte-for-byte intact and is recoverable: if a single edit fails (old_string/oldStr ambiguous, broader restructuring needed), follow up with another `edit` instead of re-emitting the entire file via `write`. The old_string/oldStr must be unique in the file unless replace_all is true. For insertions, pass insertLine plus new_string/newStr; use insertLine: "end" to extend a file at the end. Self-budget new_string/newStr under 12000 characters before emitting the tool call; use repeated bounded edits for long sections. Preserves file formatting and indentation.',
 	inputSchema,
+	modelInputSchema,
+	enforceModelInput: true,
+	validationErrorHint:
+		'Required shape: {"path":"file.md","old_string":"exact unique text","new_string":"replacement text"}. Optional: "replace_all": true.',
 	category: 'filesystem',
 	permissions: ['file_write'],
 	readOnly: false,
@@ -78,7 +138,19 @@ export const EditTool = defineTool({
 	concurrencySafe: false,
 
 	async execute(input: EditInput, context) {
-		const normalized = normalizeEditInput(input)
+		// Re-validated here rather than trusted from the registry: `execute` is
+		// reachable directly, and the closed contract is only closed if the
+		// check runs on the path a caller can actually take.
+		const parsed = inputSchema.safeParse(input)
+		if (!parsed.success) {
+			return {
+				success: false,
+				output: '',
+				error: `Invalid edit input: ${parsed.error.issues.map((issue) => issue.message).join('; ')}`,
+			}
+		}
+
+		const normalized = normalizeEditInput(parsed.data)
 		if (!normalized.success) {
 			return { success: false, output: '', error: normalized.error }
 		}
@@ -93,38 +165,75 @@ export const EditTool = defineTool({
 			}
 		}
 
-		// Sandbox-aware: route through sandbox when available
-		if (context.sandbox) {
-			const buffer = await context.sandbox.readFile(input.path)
-			const content = buffer.toString('utf-8')
+		const filePath = resolve(context.workingDirectory, parsed.data.path)
+		// Read-modify-write is not atomic on its own: two edits to the same
+		// path interleave their reads, and the second write lands on content
+		// the first had already replaced — so one edit vanishes and the loser
+		// reports "old_string not found", blaming the model for a race. The
+		// key spans both branches because sandbox and local are distinct
+		// files even when the path string matches.
+		const lockKey = `${context.sandbox ? 'sandbox' : 'local'}:${filePath}`
+
+		return withFileMutationLock(lockKey, async () => {
+			if (context.sandbox) {
+				const buffer = await context.sandbox.readFile(parsed.data.path)
+				const result = applyEdit(buffer.toString('utf-8'), normalized.operation)
+				if (!result.success) {
+					return { success: false as const, output: '', error: result.error }
+				}
+
+				await context.sandbox.writeFile(parsed.data.path, result.content)
+				return {
+					success: true as const,
+					output: `Edited ${parsed.data.path}: ${result.replacements} replacement(s) [sandboxed]`,
+					data: { path: parsed.data.path, replacements: result.replacements, sandboxed: true },
+				}
+			}
+
+			const content = await readFile(filePath, 'utf-8')
 
 			const result = applyEdit(content, normalized.operation)
 			if (!result.success) {
-				return { success: false, output: '', error: result.error }
+				// The anchor did not match what is on disk. Two very different
+				// situations produce that, and the difference is the whole
+				// value of the fingerprint:
+				//
+				// The file is as the agent left it, and the anchor is simply
+				// wrong — "not found, match the whitespace exactly" is the
+				// right thing to say.
+				//
+				// Or the file moved after the read — a person in an editor,
+				// another process, a second agent — and the same message is a
+				// lie that sends the agent to re-check text that was never the
+				// problem, so it retries the identical edit against the same
+				// moved file.
+				//
+				// Deliberately NOT a gate on the successful path. An anchor
+				// that still matches uniquely is well defined however much
+				// changed elsewhere in the file, and refusing there would
+				// reject safe edits every time anyone touched an unrelated
+				// line.
+				const seen = context.fileReadTracker?.fingerprint?.(filePath)
+				if (seen !== undefined && seen !== fingerprintContent(content)) {
+					return { success: false as const, output: '', error: staleFileError(filePath) }
+				}
+				return { success: false as const, output: '', error: result.error }
 			}
 
-			await context.sandbox.writeFile(input.path, result.content)
+			// Temp file, fsync, rename — a reader sees the old body or the new
+			// one, never a half-written one. A plain `writeFile` that fails
+			// partway leaves the user's source truncated.
+			await atomicWriteFile(filePath, result.content)
+			// This runtime is now the last writer, so the next edit in the same
+			// turn compares against what we just wrote rather than the read
+			// before it.
+			context.fileReadTracker?.recordRead(filePath, result.content)
 			return {
-				success: true,
-				output: `Edited ${input.path}: ${result.replacements} replacement(s) [sandboxed]`,
-				data: { path: input.path, replacements: result.replacements, sandboxed: true },
+				success: true as const,
+				output: `Edited ${filePath}: ${result.replacements} replacement(s)`,
+				data: { path: filePath, replacements: result.replacements },
 			}
-		}
-
-		const filePath = resolve(context.workingDirectory, input.path)
-		const content = await readFile(filePath, 'utf-8')
-
-		const result = applyEdit(content, normalized.operation)
-		if (!result.success) {
-			return { success: false, output: '', error: result.error }
-		}
-
-		await writeFile(filePath, result.content, 'utf-8')
-		return {
-			success: true,
-			output: `Edited ${filePath}: ${result.replacements} replacement(s)`,
-			data: { path: filePath, replacements: result.replacements },
-		}
+		})
 	},
 })
 
@@ -188,7 +297,9 @@ function applyEdit(
 		return applyLineInsert(content, input)
 	}
 
-	if (!content.includes(input.oldString)) {
+	const replacement = normalizeLineEndings(content, input)
+
+	if (!content.includes(replacement.oldString)) {
 		return {
 			success: false,
 			error:
@@ -196,19 +307,19 @@ function applyEdit(
 		}
 	}
 
-	if (input.replace_all) {
-		const parts = content.split(input.oldString)
+	if (replacement.replace_all) {
+		const parts = content.split(replacement.oldString)
 		const replacements = parts.length - 1
 		return {
 			success: true,
-			content: parts.join(input.newString),
+			content: parts.join(replacement.newString),
 			replacements,
 		}
 	}
 
 	// Uniqueness check: old_string/oldStr must appear exactly once
-	const firstIndex = content.indexOf(input.oldString)
-	const secondIndex = content.indexOf(input.oldString, firstIndex + 1)
+	const firstIndex = content.indexOf(replacement.oldString)
+	const secondIndex = content.indexOf(replacement.oldString, firstIndex + 1)
 
 	if (secondIndex !== -1) {
 		const lineNumber = content.slice(0, firstIndex).split('\n').length
@@ -223,8 +334,8 @@ function applyEdit(
 		success: true,
 		content:
 			content.slice(0, firstIndex) +
-			input.newString +
-			content.slice(firstIndex + input.oldString.length),
+			replacement.newString +
+			content.slice(firstIndex + replacement.oldString.length),
 		replacements: 1,
 	}
 }
@@ -251,3 +362,44 @@ function applyLineInsert(
 		replacements: 1,
 	}
 }
+
+/**
+ * Reconcile the caller's line endings with the file's.
+ *
+ * A model reading a CRLF file and writing back LF (or the reverse) produces
+ * an `old_string` that is correct in every visible way and matches nothing.
+ * The failure reads as "your text is wrong" when the text is right and only
+ * the invisible half of each line break differs.
+ *
+ * Only applied when the file is CONSISTENT. A mixed-ending file has no
+ * single right answer, and rewriting boundaries there would corrupt the
+ * half that was already correct.
+ */
+function normalizeLineEndings(
+	content: string,
+	input: Extract<NormalizedEditInput, { operation: 'replace' }>,
+): Extract<NormalizedEditInput, { operation: 'replace' }> {
+	const withoutCrlf = content.replaceAll('\r\n', '')
+	const usesOnlyCrlf = content.includes('\r\n') && !withoutCrlf.includes('\n')
+	if (usesOnlyCrlf) {
+		return {
+			...input,
+			oldString: content.includes(input.oldString)
+				? input.oldString
+				: input.oldString.replaceAll('\r\n', '\n').replaceAll('\n', '\r\n'),
+			newString: input.newString.replaceAll('\r\n', '\n').replaceAll('\n', '\r\n'),
+		}
+	}
+
+	const usesOnlyLf = content.includes('\n') && !content.includes('\r\n')
+	if (usesOnlyLf) {
+		return {
+			...input,
+			oldString: content.includes(input.oldString)
+				? input.oldString
+				: input.oldString.replaceAll('\r\n', '\n'),
+			newString: input.newString.replaceAll('\r\n', '\n'),
+		}
+	}
+	return input
+}

package/src/tools/builtins/read-file.ts

@@ -55,7 +55,10 @@ export const ReadFileTool = defineTool({
 
 			const numberedLines = selectedLines.map((line, i) => `${start + i + 1}\t${line}`).join('\n')
 
-			context.fileReadTracker?.recordRead(input.path)
+			// The WHOLE body, not the selected window: a later edit is checked
+			// against the file, and a partial read must not fingerprint a
+			// fragment as if it were the file.
+			context.fileReadTracker?.recordRead(input.path, content)
 
 			const partial = selectedLines.length < lines.length
 			return {
@@ -92,7 +95,7 @@ export const ReadFileTool = defineTool({
 
 		const numberedLines = selectedLines.map((line, i) => `${start + i + 1}\t${line}`).join('\n')
 
-		context.fileReadTracker?.recordRead(filePath)
+		context.fileReadTracker?.recordRead(filePath, content)
 
 		const isPartial = selectedLines.length < lines.length