@namzu/sdk 30.1.0 → 31.0.0

package/src/store/topic/state.ts

@@ -1,11 +1,17 @@
-import { mkdir } from 'node:fs/promises'
 import { join } from 'node:path'
 
+import { TenantIsolationError } from '../../session/errors.js'
 import type { TenantId, TopicId } from '../../types/ids/index.js'
 import type { Message } from '../../types/message/index.js'
 import type { PermissionMode } from '../../types/permission/index.js'
 import { StaleTopicStateError, type TopicState } from '../../types/topic/state.js'
-import { DiskRecordStore } from '../kv/record-store.js'
+import {
+	DiskRevisionRecordStore,
+	type RevisionMutation,
+	type RevisionedRecordLocation,
+	legacyRevisionFileSegment,
+	revisionFileSegment,
+} from '../kv/revision-record-store.js'
 import { defineSchema } from '../schema.js'
 
 /**
@@ -25,8 +31,16 @@ import { defineSchema } from '../schema.js'
  * record is designed to be folded into one if that arrives.
  */
 
-const SCHEMA = defineSchema({ kind: 'topic-state', current: 1, migrations: {} })
-const records = new DiskRecordStore<TopicState>(SCHEMA)
+const SCHEMA = defineSchema({
+	kind: 'topic-state',
+	current: 1,
+	migrations: {},
+})
+const revisionRecords = new DiskRevisionRecordStore<TopicState>(
+	SCHEMA,
+	'topic state store',
+	(record) => record.revision,
+)
 
 export interface TopicStateStore {
 	/** `null` when this topic has never had state written. */
@@ -66,7 +80,10 @@ function next(
 	topicId: TopicId,
 	tenantId: TenantId,
 	previous: TopicState | null,
-	patch: { permissionMode?: PermissionMode; queuedMessages?: readonly Message[] },
+	patch: {
+		permissionMode?: PermissionMode
+		queuedMessages?: readonly Message[]
+	},
 	now: number,
 ): TopicState {
 	return {
@@ -83,6 +100,42 @@ function next(
 	}
 }
 
+function assertTenant(record: TopicState, tenantId: TenantId): void {
+	if (record.tenantId !== tenantId) {
+		throw new TenantIsolationError({
+			requested: tenantId,
+			resource: `topic-state(${record.topicId})`,
+		})
+	}
+}
+
+function assertFresh(topicId: TopicId, actual: number, expected: number): void {
+	if (expected !== actual) {
+		throw new StaleTopicStateError({
+			topicId,
+			expectedRevision: expected,
+			actualRevision: actual,
+		})
+	}
+}
+
+function proposeState(
+	topicId: TopicId,
+	tenantId: TenantId,
+	patch: {
+		permissionMode?: PermissionMode
+		queuedMessages?: readonly Message[]
+	},
+	revision: number,
+	now: () => number,
+	existing: TopicState | null,
+): RevisionMutation<TopicState, TopicState> {
+	if (existing) assertTenant(existing, tenantId)
+	assertFresh(topicId, existing?.revision ?? 0, revision)
+	const record = next(topicId, tenantId, existing, patch, now())
+	return { record, result: record }
+}
+
 export class InMemoryTopicStateStore implements TopicStateStore {
 	private readonly states = new Map<TopicId, TopicState>()
 
@@ -90,9 +143,6 @@ export class InMemoryTopicStateStore implements TopicStateStore {
 
 	async getState(topicId: TopicId, tenantId: TenantId): Promise<TopicState | null> {
 		const found = this.states.get(topicId)
-		// A record from another tenant reads as absent rather than as an
-		// error, for the reason the project listing gives: refusing would
-		// confirm that somebody else's topic is there.
 		return found && found.tenantId === tenantId ? found : null
 	}
 
@@ -102,18 +152,18 @@ export class InMemoryTopicStateStore implements TopicStateStore {
 		mode: PermissionMode,
 		opts: { revision: number },
 	): Promise<TopicState> {
-		const existing = await this.getState(topicId, tenantId)
-		const actual = existing?.revision ?? 0
-		if (opts.revision !== actual) {
-			throw new StaleTopicStateError({
-				topicId,
-				expectedRevision: opts.revision,
-				actualRevision: actual,
-			})
-		}
-		const record = next(topicId, tenantId, existing, { permissionMode: mode }, this.now())
-		this.states.set(topicId, record)
-		return record
+		// Deliberately no await: read, domain checks and publish are one JS turn.
+		// Awaiting an async get here lets two callers capture the same revision.
+		const proposal = proposeState(
+			topicId,
+			tenantId,
+			{ permissionMode: mode },
+			opts.revision,
+			this.now,
+			this.states.get(topicId) ?? null,
+		)
+		this.states.set(topicId, proposal.record)
+		return proposal.result
 	}
 
 	async setQueuedMessages(
@@ -122,18 +172,16 @@ export class InMemoryTopicStateStore implements TopicStateStore {
 		messages: readonly Message[],
 		opts: { revision: number },
 	): Promise<TopicState> {
-		const existing = await this.getState(topicId, tenantId)
-		const actual = existing?.revision ?? 0
-		if (opts.revision !== actual) {
-			throw new StaleTopicStateError({
-				topicId,
-				expectedRevision: opts.revision,
-				actualRevision: actual,
-			})
-		}
-		const record = next(topicId, tenantId, existing, { queuedMessages: messages }, this.now())
-		this.states.set(topicId, record)
-		return record
+		const proposal = proposeState(
+			topicId,
+			tenantId,
+			{ queuedMessages: messages },
+			opts.revision,
+			this.now,
+			this.states.get(topicId) ?? null,
+		)
+		this.states.set(topicId, proposal.record)
+		return proposal.result
 	}
 }
 
@@ -148,12 +196,17 @@ export class DiskTopicStateStore implements TopicStateStore {
 		private readonly now: () => number = Date.now,
 	) {}
 
-	private path(topicId: TopicId): string {
-		return join(this.config.rootDir, 'topic-state', `${topicId}.json`)
+	private location(topicId: TopicId): RevisionedRecordLocation {
+		const root = join(this.config.rootDir, 'topic-state')
+		const segment = revisionFileSegment(topicId)
+		return {
+			legacyPath: join(root, `${legacyRevisionFileSegment(topicId)}.json`),
+			revisionsDir: join(root, '.revisions', segment),
+		}
 	}
 
 	async getState(topicId: TopicId, tenantId: TenantId): Promise<TopicState | null> {
-		const found = await records.read(this.path(topicId))
+		const found = await revisionRecords.read(this.location(topicId))
 		return found && found.tenantId === tenantId ? found : null
 	}
 
@@ -163,18 +216,9 @@ export class DiskTopicStateStore implements TopicStateStore {
 		mode: PermissionMode,
 		opts: { revision: number },
 	): Promise<TopicState> {
-		const existing = await this.getState(topicId, tenantId)
-		const actual = existing?.revision ?? 0
-		if (opts.revision !== actual) {
-			throw new StaleTopicStateError({
-				topicId,
-				expectedRevision: opts.revision,
-				actualRevision: actual,
-			})
-		}
-		const record = next(topicId, tenantId, existing, { permissionMode: mode }, this.now())
-		await this.persist(record)
-		return record
+		return await revisionRecords.transact(this.location(topicId), (existing) =>
+			proposeState(topicId, tenantId, { permissionMode: mode }, opts.revision, this.now, existing),
+		)
 	}
 
 	async setQueuedMessages(
@@ -183,22 +227,15 @@ export class DiskTopicStateStore implements TopicStateStore {
 		messages: readonly Message[],
 		opts: { revision: number },
 	): Promise<TopicState> {
-		const existing = await this.getState(topicId, tenantId)
-		const actual = existing?.revision ?? 0
-		if (opts.revision !== actual) {
-			throw new StaleTopicStateError({
+		return await revisionRecords.transact(this.location(topicId), (existing) =>
+			proposeState(
 				topicId,
-				expectedRevision: opts.revision,
-				actualRevision: actual,
-			})
-		}
-		const record = next(topicId, tenantId, existing, { queuedMessages: messages }, this.now())
-		await this.persist(record)
-		return record
-	}
-
-	private async persist(record: TopicState): Promise<void> {
-		await mkdir(join(this.config.rootDir, 'topic-state'), { recursive: true })
-		await records.write(this.path(record.topicId), record)
+				tenantId,
+				{ queuedMessages: messages },
+				opts.revision,
+				this.now,
+				existing,
+			),
+		)
 	}
 }

package/src/tools/builtins/bash.ts

@@ -98,6 +98,10 @@ export const BashTool = defineTool({
 		'Executes a bash command and returns stdout/stderr output. Command timeout is configurable. The `command` parameter is required — never call this tool with empty arguments. For very long content (e.g. building a large file), prefer `write` for the opening and `edit` with insertLine: "end" for follow-up chunks over a heredoc to avoid hitting the output token limit mid-stream.',
 	inputSchema,
 	category: 'shell',
+	// This tool's own description tells the model to chain with `&&` and `;`,
+	// so a permission rule about it is a rule about several commands more often
+	// than not. Naming the argument is what lets the gate read it that way.
+	commandArgument: 'command',
 	permissions: ['shell_execute'],
 	readOnly: false,
 	destructive: (input: BashInput) => isDangerousCommand(input.command),
@@ -119,6 +123,23 @@ export const BashTool = defineTool({
 		}
 
 		if (input.run_in_background) {
+			// The current registry owns a host process. Foreground execution,
+			// however, goes through `context.sandbox.exec()` below. Treating the
+			// same command as host work just because `run_in_background` changed
+			// would make that boolean an escape hatch from the configured boundary.
+			//
+			// Query-built contexts structurally withhold the registry in this
+			// composition. This explicit check also protects direct tool callers
+			// and says why the capability is absent instead of misdiagnosing the
+			// host as having configured no registry.
+			if (context.sandbox) {
+				return {
+					success: false,
+					output: '',
+					error:
+						'run_in_background is unavailable while a sandbox is active because the host background-job registry cannot preserve that sandbox boundary. Run the command in the foreground, or use a sandbox-aware persistent-process capability.',
+				}
+			}
 			// Refused, not degraded to `cmd &`. The fallback is not a lesser
 			// version of this: under the local sandbox's `linux-namespace` tier
 			// the wrapping `sh` is PID 1 of a fresh PID namespace, so the

package/src/tools/builtins/computer-use.ts

@@ -42,7 +42,15 @@ const actionSchema = z.discriminatedUnion('type', [
 	z.object({ type: z.literal('key'), keys: z.string() }),
 ])
 
-type ActionInput = z.infer<typeof actionSchema>
+/**
+ * The tool's input, inferred from its schema.
+ *
+ * Exported because `createComputerUseTool` returns a `ToolDefinition<ActionInput>`
+ * and a consumer typing that variable, or writing a wrapper around it, had no
+ * name for the parameter — the type was module-private while the function
+ * carrying it was public.
+ */
+export type ActionInput = z.infer<typeof actionSchema>
 
 const DESTRUCTIVE_ACTION_TYPES = new Set<ComputerUseAction['type']>([
 	'mouse_click',

package/src/tools/builtins/content-fingerprint.ts

@@ -3,11 +3,12 @@ import { createHash } from 'node:crypto'
 /**
  * A short, stable fingerprint of a file body.
  *
- * Used to answer one question at mutation time: is the file still what the
- * agent read? An `edit` is computed against a remembered body, and between
- * the read and the write that body can move — a person editing in an
- * editor, another process, a second agent run. The in-process mutation lock
- * serializes this runtime's own writers and is blind to every one of those.
+ * Used to answer one question at mutation admission: is the file still what
+ * the agent read? An `edit` or full replacement is based on a remembered
+ * body, and before the write begins that body can move — a person editing in
+ * an editor, another process, a second agent run. The in-process mutation
+ * lock serializes this runtime's own writers and is blind to every one of
+ * those.
  *
  * Without this the drift is not merely undetected, it is actively
  * misreported: an `old_string` that no longer matches comes back as "not
@@ -23,11 +24,7 @@ export function fingerprintContent(content: string): string {
 	return createHash('sha256').update(content, 'utf-8').digest('hex').slice(0, 16)
 }
 
-/** What a mutation tool tells the agent when the file moved under it. */
-export function staleFileError(path: string): string {
-	return (
-		`${path} changed on disk after you read it, so this edit was computed against a stale copy ` +
-		'and was not applied. Read the file again and redo the edit against its current contents. ' +
-		'Nothing was written.'
-	)
+/** What a mutation tool tells the agent when admission sees a moved file. */
+export function staleFileError(path: string, operation: 'edit' | 'write' = 'edit'): string {
+	return `${path} changed on disk after you read it, so this ${operation} was based on a stale copy and was not applied. Read the file again and redo the ${operation} against its current contents. Nothing was written.`
 }

package/src/tools/builtins/edit.ts

@@ -57,22 +57,79 @@ const inputSchema = z
 			.describe(
 				'Optional line insertion target. Inserts the replacement after this 1-indexed line; 0 inserts before the first line; "end" appends to the file.',
 			),
+		// Optional rather than defaulted, for the reason given on the entry
+		// field below: `execute` takes the schema's OUTPUT type, so a default
+		// here makes `replace_all` mandatory for every hand-built call —
+		// including a batch call, where the top-level flag means nothing at
+		// all. The default is applied in `normalizeEditInput`.
 		replace_all: z
 			.boolean()
-			.default(false)
+			.optional()
 			.describe('Replace all occurrences instead of just the first unique match'),
+		edits: z
+			.array(
+				z
+					.object({
+						old_string: z
+							.string()
+							.min(1)
+							.describe('The exact string to find. Must be unique in the file at this point.'),
+						new_string: z.string().describe('The replacement string.'),
+						// `.optional()` where the top-level field uses `.default(false)`,
+						// and the difference is about the CALLER rather than the
+						// value. `execute` takes the schema's OUTPUT type, so a
+						// defaulted field is required of everyone who builds a call
+						// by hand — and a batch entry is built by hand far more
+						// often than the top-level object is. The default lives in
+						// `normalizeEditInput` instead, where it is applied once for
+						// every entry.
+						replace_all: z
+							.boolean()
+							.optional()
+							.describe('Replace every occurrence of this old_string instead of requiring one.'),
+					})
+					.strict(),
+			)
+			.min(1)
+			.optional()
+			.describe(
+				'Several replacements in one file, applied in order and committed together. Nothing is written unless every one applies.',
+			),
 	})
 	.strict()
-	.refine((value) => typeof value.new_string === 'string' || typeof value.newStr === 'string', {
-		message: 'Either new_string or newStr is required.',
-	})
 	.refine(
 		(value) =>
+			value.edits !== undefined ||
+			typeof value.new_string === 'string' ||
+			typeof value.newStr === 'string',
+		{ message: 'Either new_string or newStr is required.' },
+	)
+	.refine(
+		(value) =>
+			value.edits !== undefined ||
 			value.insertLine !== undefined ||
 			typeof value.old_string === 'string' ||
 			typeof value.oldStr === 'string',
 		{ message: 'Either old_string/oldStr or insertLine is required.' },
 	)
+	// Refused rather than resolved. A call carrying both an `edits` list and a
+	// top-level replacement is two different intentions in one object, and any
+	// precedence this code picked would be a guess about which the model meant
+	// — silently dropping the other. There is no reading of that which is safe:
+	// the dropped half is an edit somebody believes was made.
+	.refine(
+		(value) =>
+			value.edits === undefined ||
+			(value.old_string === undefined &&
+				value.oldStr === undefined &&
+				value.new_string === undefined &&
+				value.newStr === undefined &&
+				value.insertLine === undefined),
+		{
+			message:
+				'Use either `edits` or a single top-level edit, not both. Move the top-level old_string/new_string into the edits list.',
+		},
+	)
 
 type EditInput = z.infer<typeof inputSchema>
 
@@ -134,6 +191,31 @@ const modelInputSchema: Record<string, unknown> = {
 			type: 'boolean',
 			description: 'Replace every occurrence instead of requiring one unique match.',
 		},
+		edits: {
+			// The batch shape. Stated as an array of the same two fields
+			// rather than as a second tool, because a model offered two tools
+			// that both edit a file spends a decision on every turn choosing
+			// between them — and the choice carries no information.
+			type: 'array',
+			items: {
+				type: 'object',
+				properties: {
+					old_string: {
+						type: 'string',
+						description: 'Exact text from the file at this point in the sequence.',
+					},
+					new_string: { type: 'string', description: 'Exact replacement text.' },
+					replace_all: {
+						type: 'boolean',
+						description: 'Replace every occurrence of this old_string.',
+					},
+				},
+				required: ['old_string', 'new_string'],
+				additionalProperties: false,
+			},
+			description:
+				'Several replacements in one file, applied in order and committed together. Nothing is written unless every one applies. Use this instead of several edit calls when the changes only make sense together.',
+		},
 	},
 	// `old_string` is deliberately NOT required, and this is the fix.
 	//
@@ -152,7 +234,13 @@ const modelInputSchema: Record<string, unknown> = {
 	// incomplete call is now expressible and caught at execution rather than
 	// at generation — paid knowingly, because the alternative is that a
 	// working capability stays unreachable.
-	required: ['path', 'new_string'],
+	//
+	// `new_string` left the required list for exactly that reason, one shape
+	// later: a batch call carries its replacements inside `edits` and has no
+	// top-level `new_string` to give. This is the same trade, made the same
+	// way — a third refinement names what is missing at execution, and it also
+	// refuses a call that carries both shapes rather than picking one.
+	required: ['path'],
 	additionalProperties: false,
 }
 
@@ -173,12 +261,12 @@ type NormalizedEditInput =
 export const EditTool = defineTool({
 	name: 'edit',
 	description:
-		'Makes targeted edits to a file using exact string find-and-replace or line insertion. THIS IS THE PREFERRED WAY TO MODIFY AN EXISTING FILE — never reach for `write` to change a file that already exists, because `write` overwrites the whole body and discards earlier work on partial failure. `edit` keeps the rest of the file byte-for-byte intact and is recoverable: if a single edit fails (old_string/oldStr ambiguous, broader restructuring needed), follow up with another `edit` instead of re-emitting the entire file via `write`. The old_string/oldStr must be unique in the file unless replace_all is true. For insertions, pass insertLine plus new_string/newStr; use insertLine: "end" to extend a file at the end. Self-budget new_string/newStr under 12000 characters before emitting the tool call; use repeated bounded edits for long sections. Preserves file formatting and indentation.',
+		'Makes targeted edits to a file using exact string find-and-replace or line insertion. THIS IS THE PREFERRED WAY TO MODIFY AN EXISTING FILE — never reach for `write` to change a file that already exists, because `write` overwrites the whole body and discards earlier work on partial failure. `edit` keeps the rest of the file byte-for-byte intact and is recoverable: if a single edit fails (old_string/oldStr ambiguous, broader restructuring needed), follow up with another `edit` instead of re-emitting the entire file via `write`. The old_string/oldStr must be unique in the file unless replace_all is true. For insertions, pass insertLine plus new_string/newStr; use insertLine: "end" to extend a file at the end. Self-budget new_string/newStr under 12000 characters before emitting the tool call; use repeated bounded edits for long sections. Preserves file formatting and indentation. To make several changes to ONE file that only make sense together, send them as `edits`: a list of {old_string, new_string} applied in order and committed as one write — if any of them does not apply, nothing is written and the reply names which one, so the file is never left half-changed.',
 	inputSchema,
 	modelInputSchema,
 	enforceModelInput: true,
 	validationErrorHint:
-		'Two shapes. Replace: {"path":"file.md","old_string":"exact unique text","new_string":"replacement text"} (optional "replace_all": true). Insert: {"path":"file.md","insertLine":"end","new_string":"text to add"} where insertLine is a non-negative line number or "end". Exactly one of old_string or insertLine.',
+		'Three shapes. Replace: {"path":"file.md","old_string":"exact unique text","new_string":"replacement text"} (optional "replace_all": true). Insert: {"path":"file.md","insertLine":"end","new_string":"text to add"} where insertLine is a non-negative line number or "end". Batch: {"path":"file.md","edits":[{"old_string":"a","new_string":"b"},{"old_string":"c","new_string":"d"}]} applied in order, all or nothing. Exactly one of old_string, insertLine or edits — a call carrying more than one of them is refused rather than resolved.',
 	category: 'filesystem',
 	permissions: ['file_write'],
 	readOnly: false,
@@ -237,14 +325,22 @@ export const EditTool = defineTool({
 		if (!normalized.success) {
 			return { success: false, output: '', error: normalized.error }
 		}
-		if (
-			normalized.operation.operation === 'replace' &&
-			normalized.operation.oldString === normalized.operation.newString
-		) {
+		// Checked per operation, not for the call. A batch whose third entry is
+		// a no-op is still a mistake worth naming: the model believed it was
+		// changing something there, and a silent pass would leave it believing
+		// that after the edit reported success.
+		const noOp = normalized.operations.findIndex(
+			(operation) =>
+				operation.operation === 'replace' && operation.oldString === operation.newString,
+		)
+		if (noOp >= 0) {
 			return {
 				success: false,
 				output: '',
-				error: 'old_string/oldStr and new_string/newStr are identical — no change needed',
+				error:
+					normalized.operations.length === 1
+						? 'old_string/oldStr and new_string/newStr are identical — no change needed'
+						: `edits[${noOp}]: old_string and new_string are identical — no change needed. Nothing was written.`,
 			}
 		}
 
@@ -266,7 +362,7 @@ export const EditTool = defineTool({
 		return withFileMutationLock(lockKey, async () => {
 			if (context.sandbox) {
 				const buffer = await context.sandbox.readFile(parsed.data.path)
-				const result = applyEdit(buffer.toString('utf-8'), normalized.operation)
+				const result = applyEdit(buffer.toString('utf-8'), normalized.operations)
 				if (!result.success) {
 					return { success: false as const, output: '', error: result.error }
 				}
@@ -282,7 +378,7 @@ export const EditTool = defineTool({
 			const hostPath = filePath as string
 			const content = await readFile(hostPath, 'utf-8')
 
-			const result = applyEdit(content, normalized.operation)
+			const result = applyEdit(content, normalized.operations)
 			if (!result.success) {
 				// The anchor did not match what is on disk. Two very different
 				// situations produce that, and the difference is the whole
@@ -327,9 +423,31 @@ export const EditTool = defineTool({
 	},
 })
 
+/**
+ * Turn one call into the ordered list of operations it stands for.
+ *
+ * A list rather than a single operation because the batch shape is not a
+ * different kind of edit, only a longer one. Keeping ONE representation is
+ * what stops the two shapes diverging: everything below this function — the
+ * uniqueness check, the CRLF reconciliation, the identical-text refusal, the
+ * atomic write — sees a list of length one for a single edit and never learns
+ * which shape the caller used.
+ */
 function normalizeEditInput(
 	input: EditInput,
-): { success: true; operation: NormalizedEditInput } | { success: false; error: string } {
+): { success: true; operations: NormalizedEditInput[] } | { success: false; error: string } {
+	if (input.edits !== undefined) {
+		return {
+			success: true,
+			operations: input.edits.map((edit) => ({
+				operation: 'replace' as const,
+				oldString: edit.old_string,
+				newString: edit.new_string,
+				replace_all: edit.replace_all ?? false,
+			})),
+		}
+	}
+
 	const newString = input.new_string ?? input.newStr
 	if (typeof newString !== 'string') {
 		return { success: false, error: 'Either new_string or newStr is required.' }
@@ -340,12 +458,14 @@ function normalizeEditInput(
 		if (!insertLine.success) return insertLine
 		return {
 			success: true,
-			operation: {
-				operation: 'insert',
-				insertLine: insertLine.value,
-				newString,
-				replace_all: input.replace_all,
-			},
+			operations: [
+				{
+					operation: 'insert',
+					insertLine: insertLine.value,
+					newString,
+					replace_all: input.replace_all ?? false,
+				},
+			],
 		}
 	}
 
@@ -355,12 +475,14 @@ function normalizeEditInput(
 	}
 	return {
 		success: true,
-		operation: {
-			operation: 'replace',
-			oldString,
-			newString,
-			replace_all: input.replace_all,
-		},
+		operations: [
+			{
+				operation: 'replace',
+				oldString,
+				newString,
+				replace_all: input.replace_all ?? false,
+			},
+		],
 	}
 }
 
@@ -398,7 +520,48 @@ function normalizeInsertLine(
 	return { success: true, value }
 }
 
+/**
+ * Apply every operation in order, or none of them.
+ *
+ * "Or none" is the whole reason this takes a list. Four related changes sent
+ * as four calls are four chances to stop halfway, and the file left behind
+ * after the third succeeded and the fourth did not is in a state no one wrote
+ * and no one is looking at. Here the fold runs entirely in memory and the
+ * caller writes once, so a failure anywhere leaves the file exactly as it was.
+ *
+ * Each operation matches against the content as the ones before it left it,
+ * not against the original. That is what lets a later edit target text an
+ * earlier one produced — and it is also why a failure names the INDEX: by the
+ * time hunk 3 fails, the string it was looking for may have been consumed by
+ * hunk 1, and "old_string not found" without a position sends the model to
+ * re-check the wrong hunk.
+ */
 function applyEdit(
+	content: string,
+	operations: readonly NormalizedEditInput[],
+): { success: true; content: string; replacements: number } | { success: false; error: string } {
+	let current = content
+	let replacements = 0
+
+	for (const [index, operation] of operations.entries()) {
+		const result = applyOne(current, operation)
+		if (!result.success) {
+			return {
+				success: false,
+				error:
+					operations.length === 1
+						? result.error
+						: `edits[${index}] of ${operations.length}: ${result.error} Nothing was written — the whole batch is refused, so the file is exactly as it was.`,
+			}
+		}
+		current = result.content
+		replacements += result.replacements
+	}
+
+	return { success: true, content: current, replacements }
+}
+
+function applyOne(
 	content: string,
 	input: NormalizedEditInput,
 ): { success: true; content: string; replacements: number } | { success: false; error: string } {