@nanhara/hara 0.121.0 → 0.122.0

package/dist/tools/computer.js

@@ -284,98 +284,104 @@ export function computerBackends() {
         return "PowerShell (built-in)";
     return `unsupported (${process.platform})`;
 }
-registerTool({
-    name: "computer",
-    description: "Control the screen to operate desktop software (not just the browser). ALWAYS `activate` the target app " +
-        "FIRST (e.g. activate WeChat) — otherwise screenshots/clicks hit the terminal hara runs in, not the app. " +
-        "Then prefer grounding over guessing pixels: pass `target` (e.g. 'the Send button') to click/move and it's " +
-        "located by a vision model; or `find` to just get coordinates. Workflow: activate → screenshot → click a " +
-        "target → re-screenshot to verify. When typing, type the ACTUAL text — never placeholders. Opt-in and " +
-        "permission-gated (tier + per-app allowlist).",
-    input_schema: {
-        type: "object",
-        properties: {
-            action: { type: "string", enum: ["screenshot", "activate", "find", "click", "move", "type", "key"] },
-            app: { type: "string", description: "app to bring to the foreground (activate) — e.g. 'WeChat'. Do this BEFORE screenshot/click so they hit the app, not the terminal." },
-            target: { type: "string", description: "describe a UI element to locate (find) or click/move to — e.g. 'the Send button'. Preferred over x,y." },
-            x: { type: "number", description: "x pixel (click/move; or use `target`)" },
-            y: { type: "number", description: "y pixel (click/move; or use `target`)" },
-            text: { type: "string", description: "text to type (type)" },
-            keys: { type: "string", description: "key or combo, e.g. 'return', 'cmd+c' (key)" },
-            focus: { type: "string", description: "screenshot only: what to look for — focuses the read" },
+// Gateway runs get NO computer tool by default (HARA_GATEWAY_COMPUTER=1 opts back in): a chat-driven, full-auto
+// agent reaching for desktop automation is how "check Feishu" turns into blindly clicking another app's windows.
+// In a gateway context the right lever is an API/skill, and send_file already covers delivery — so the safe
+// default is to not offer screen control at all rather than trust the model to decline it.
+if (!process.env.HARA_GATEWAY || process.env.HARA_GATEWAY_COMPUTER === "1") {
+    registerTool({
+        name: "computer",
+        description: "Control the screen to operate desktop software (not just the browser). ALWAYS `activate` the target app " +
+            "FIRST (e.g. activate WeChat) — otherwise screenshots/clicks hit the terminal hara runs in, not the app. " +
+            "Then prefer grounding over guessing pixels: pass `target` (e.g. 'the Send button') to click/move and it's " +
+            "located by a vision model; or `find` to just get coordinates. Workflow: activate → screenshot → click a " +
+            "target → re-screenshot to verify. When typing, type the ACTUAL text — never placeholders. Opt-in and " +
+            "permission-gated (tier + per-app allowlist).",
+        input_schema: {
+            type: "object",
+            properties: {
+                action: { type: "string", enum: ["screenshot", "activate", "find", "click", "move", "type", "key"] },
+                app: { type: "string", description: "app to bring to the foreground (activate) — e.g. 'WeChat'. Do this BEFORE screenshot/click so they hit the app, not the terminal." },
+                target: { type: "string", description: "describe a UI element to locate (find) or click/move to — e.g. 'the Send button'. Preferred over x,y." },
+                x: { type: "number", description: "x pixel (click/move; or use `target`)" },
+                y: { type: "number", description: "y pixel (click/move; or use `target`)" },
+                text: { type: "string", description: "text to type (type)" },
+                keys: { type: "string", description: "key or combo, e.g. 'return', 'cmd+c' (key)" },
+                focus: { type: "string", description: "screenshot only: what to look for — focuses the read" },
+            },
+            required: ["action"],
         },
-        required: ["action"],
-    },
-    kind: "computer",
-    async run(input, ctx) {
-        const cfg = loadConfig();
-        const tier = cfg.computerUse;
-        if (tier === "off")
-            return "Screen control is off. Enable it: `hara config set computerUse read|click|full` (and `hara config set computerApps \"App Name, …\"` for the click/type allowlist).";
-        const action = String(input.action ?? "");
-        if (!actionAllowed(tier, action))
-            return `'${action}' needs a higher tier (current computerUse=${tier}). Raise it with \`hara config set computerUse …\`.`;
-        // Bring the target app to the foreground first — without this, clicks land on the terminal hara runs in.
-        if (action === "activate") {
-            const app = String(input.app ?? input.target ?? "");
-            if (!app)
-                return "activate needs an `app` name (e.g. 'WeChat').";
-            if (!cfg.computerApps.some((a) => a.toLowerCase() === app.toLowerCase()))
-                return `Refused: "${app}" isn't in your allowlist (${cfg.computerApps.join(", ") || "empty"}). Add it: \`hara config set computerApps "${app}"\`.`;
-            const r = activateApp(app);
-            return r.ok ? ok(`✓ ${r.msg} — now screenshot/find/click to act on it`) : fail(r.msg);
-        }
-        if (action !== "screenshot" && action !== "find") {
-            // per-app allowlist: only act when an allowlisted app is frontmost (the key guard against wrong-window clicks)
-            if (!cfg.computerApps.length)
-                return "No apps allowlisted — set `hara config set computerApps \"App Name, …\"` before clicking/typing.";
-            const app = frontmostApp();
-            const allowed = cfg.computerApps.some((a) => a.toLowerCase() === app.toLowerCase());
-            if (!allowed)
-                return `Refused: frontmost app "${app || "unknown"}" isn't in your allowlist (${cfg.computerApps.join(", ")}). Switch to an allowed app or update computerApps.`;
-        }
-        if (action === "screenshot") {
-            const s = screenshot();
-            if (s.error)
-                return fail(`screenshot — ${s.error}`);
-            if (ctx.describeImage) {
-                try {
-                    const desc = await ctx.describeImage(s.path, input.focus ? String(input.focus) : undefined);
-                    if (desc)
-                        return ok(`Screenshot (read via vision):\n${desc}`);
-                }
-                catch {
-                    /* fall through to path */
+        kind: "computer",
+        async run(input, ctx) {
+            const cfg = loadConfig();
+            const tier = cfg.computerUse;
+            if (tier === "off")
+                return "Screen control is off. Enable it: `hara config set computerUse read|click|full` (and `hara config set computerApps \"App Name, …\"` for the click/type allowlist).";
+            const action = String(input.action ?? "");
+            if (!actionAllowed(tier, action))
+                return `'${action}' needs a higher tier (current computerUse=${tier}). Raise it with \`hara config set computerUse …\`.`;
+            // Bring the target app to the foreground first — without this, clicks land on the terminal hara runs in.
+            if (action === "activate") {
+                const app = String(input.app ?? input.target ?? "");
+                if (!app)
+                    return "activate needs an `app` name (e.g. 'WeChat').";
+                if (!cfg.computerApps.some((a) => a.toLowerCase() === app.toLowerCase()))
+                    return `Refused: "${app}" isn't in your allowlist (${cfg.computerApps.join(", ") || "empty"}). Add it: \`hara config set computerApps "${app}"\`.`;
+                const r = activateApp(app);
+                return r.ok ? ok(`✓ ${r.msg} — now screenshot/find/click to act on it`) : fail(r.msg);
+            }
+            if (action !== "screenshot" && action !== "find") {
+                // per-app allowlist: only act when an allowlisted app is frontmost (the key guard against wrong-window clicks)
+                if (!cfg.computerApps.length)
+                    return "No apps allowlisted — set `hara config set computerApps \"App Name, …\"` before clicking/typing.";
+                const app = frontmostApp();
+                const allowed = cfg.computerApps.some((a) => a.toLowerCase() === app.toLowerCase());
+                if (!allowed)
+                    return `Refused: frontmost app "${app || "unknown"}" isn't in your allowlist (${cfg.computerApps.join(", ")}). Switch to an allowed app or update computerApps.`;
+            }
+            if (action === "screenshot") {
+                const s = screenshot();
+                if (s.error)
+                    return fail(`screenshot — ${s.error}`);
+                if (ctx.describeImage) {
+                    try {
+                        const desc = await ctx.describeImage(s.path, input.focus ? String(input.focus) : undefined);
+                        if (desc)
+                            return ok(`Screenshot (read via vision):\n${desc}`);
+                    }
+                    catch {
+                        /* fall through to path */
+                    }
                 }
+                return ok(`Screenshot saved to ${s.path}. Configure a vision model so I can read it: \`hara config set visionModel <model>\`.`);
             }
-            return ok(`Screenshot saved to ${s.path}. Configure a vision model so I can read it: \`hara config set visionModel <model>\`.`);
-        }
-        // Grounding: locate a described element and turn it into screen coordinates (more reliable than guessing
-        // pixels from a text description). Used for `find`, and for click/move when given a `target` and no x,y.
-        const needsLocate = action === "find" || ((action === "click" || action === "move") && input.target != null && (input.x == null || input.y == null));
-        if (needsLocate) {
-            const target = String(input.target ?? "");
-            if (!target)
-                return action === "find" ? "find needs a `target` (what to locate)." : "click/move needs `x,y` or a `target`.";
-            if (!ctx.locate)
-                return "Grounding needs a vision model that can see images — set one: `hara config set visionModel <model>`.";
-            const s = screenshot();
-            if (s.error)
-                return fail(`screenshot — ${s.error}`);
-            const loc = await ctx.locate(s.path, target);
-            if (!loc)
-                return fail(`couldn't locate "${target}" on screen — try a screenshot first, or rephrase the target`);
-            const size = screenSize();
-            if (!size)
-                return fail(`located "${target}" but couldn't read the screen size to convert coordinates`);
-            const gx = Math.round(loc.x * size.w);
-            const gy = Math.round(loc.y * size.h);
-            if (action === "find")
-                return ok(`"${target}" is at ~${gx},${gy} (${Math.round(loc.x * 100)}% across, ${Math.round(loc.y * 100)}% down).`);
-            input.x = gx;
-            input.y = gy;
-        }
-        const r = pointerOrKeyboard(action, input);
-        return r.ok ? ok(`✓ ${r.msg}${needsLocate ? ` (located "${input.target}")` : ""}`) : fail(r.msg);
-    },
-});
+            // Grounding: locate a described element and turn it into screen coordinates (more reliable than guessing
+            // pixels from a text description). Used for `find`, and for click/move when given a `target` and no x,y.
+            const needsLocate = action === "find" || ((action === "click" || action === "move") && input.target != null && (input.x == null || input.y == null));
+            if (needsLocate) {
+                const target = String(input.target ?? "");
+                if (!target)
+                    return action === "find" ? "find needs a `target` (what to locate)." : "click/move needs `x,y` or a `target`.";
+                if (!ctx.locate)
+                    return "Grounding needs a vision model that can see images — set one: `hara config set visionModel <model>`.";
+                const s = screenshot();
+                if (s.error)
+                    return fail(`screenshot — ${s.error}`);
+                const loc = await ctx.locate(s.path, target);
+                if (!loc)
+                    return fail(`couldn't locate "${target}" on screen — try a screenshot first, or rephrase the target`);
+                const size = screenSize();
+                if (!size)
+                    return fail(`located "${target}" but couldn't read the screen size to convert coordinates`);
+                const gx = Math.round(loc.x * size.w);
+                const gy = Math.round(loc.y * size.h);
+                if (action === "find")
+                    return ok(`"${target}" is at ~${gx},${gy} (${Math.round(loc.x * 100)}% across, ${Math.round(loc.y * 100)}% down).`);
+                input.x = gx;
+                input.y = gy;
+            }
+            const r = pointerOrKeyboard(action, input);
+            return r.ok ? ok(`✓ ${r.msg}${needsLocate ? ` (located "${input.target}")` : ""}`) : fail(r.msg);
+        },
+    });
+}

package/dist/tools/edit.js

@@ -1,4 +1,3 @@
-import { readFile } from "node:fs/promises";
 import { isAbsolute, resolve } from "node:path";
 import { registerTool } from "./registry.js";
 import { nearestPaths } from "../fs-walk.js";
@@ -7,6 +6,7 @@ import { applyEdits } from "./apply-core.js";
 import { recordEdit } from "../undo.js";
 import { atomicWriteText } from "../fs-write.js";
 import { invalidateFileCandidates } from "../context/mentions.js";
+import { readRegularFileSnapshot } from "../fs-read.js";
 registerTool({
     name: "edit_file",
     description: "Edit an existing file by replacing exact strings. Provide a single `old_string`/`new_string`, " +
@@ -44,28 +44,31 @@ registerTool({
         const edits = Array.isArray(input.edits) && input.edits.length
             ? input.edits
             : [{ old_string: input.old_string, new_string: input.new_string, replace_all: input.replace_all }];
-        let text;
+        let snapshot;
         try {
-            text = await readFile(p, "utf8");
+            snapshot = await readRegularFileSnapshot(p);
         }
-        catch {
+        catch (error) {
             const near = nearestPaths(ctx.cwd, input.path);
-            return `Error: cannot read ${input.path} (use write_file to create a new file).` + (near.length ? ` Did you mean: ${near.join(", ")}?` : "");
+            return `Error: cannot read ${input.path}: ${error?.message ?? "unknown error"} (use write_file to create a new file).` + (near.length ? ` Did you mean: ${near.join(", ")}?` : "");
         }
+        const text = snapshot.text;
         const res = applyEdits(text, edits);
         if ("error" in res)
             return `Error: ${res.error} in ${input.path}. No changes written.`;
+        let committed;
         try {
-            await atomicWriteText(p, res.text, { expected: text });
+            committed = await atomicWriteText(p, res.text, { expected: text, expectedIdentity: snapshot });
         }
         catch (error) {
             return `Error: cannot edit ${input.path}: ${error?.message ?? String(error)} No changes written.`;
         }
         emitDiff(input.path, text, res.text, ctx.ui);
-        recordEdit([{ path: input.path, absPath: p, before: text }]);
+        recordEdit([{ path: input.path, absPath: p, before: text, beforeMode: snapshot.mode, committed, after: res.text }]);
         invalidateFileCandidates(ctx.cwd);
         const note = res.fuzzy ? " (quote-normalized)" : "";
         const plural = (n, w) => `${n} ${w}${n === 1 ? "" : "s"}`;
-        return `Edited ${input.path}: ${plural(edits.length, "edit")}, ${plural(res.total, "replacement")}${note}.`;
+        return `Edited ${input.path}: ${plural(edits.length, "edit")}, ${plural(res.total, "replacement")}${note}.` +
+            (committed.warnings?.length ? ` Warning: ${committed.warnings.join("; ")}` : "");
     },
 });

package/dist/tools/patch.js

@@ -1,13 +1,158 @@
 // apply_patch — change MULTIPLE files atomically (all-or-nothing). Everything is validated and
 // computed in memory first; nothing is written unless every change applies cleanly.
-import { lstat, readFile, unlink } from "node:fs/promises";
-import { isAbsolute, resolve } from "node:path";
+import { linkSync, lstatSync, readlinkSync, symlinkSync } from "node:fs";
+import { lstat, readlink, rename } from "node:fs/promises";
+import { randomUUID } from "node:crypto";
+import { dirname, isAbsolute, join, resolve } from "node:path";
 import { registerTool } from "./registry.js";
 import { applyEdits } from "./apply-core.js";
 import { emitDiff } from "../diff.js";
 import { recordEdit } from "../undo.js";
-import { atomicWriteText, FileChangedError } from "../fs-write.js";
+import { atomicWriteText, discardClaimedPath, FileChangedError, removeCreatedDirectories } from "../fs-write.js";
 import { invalidateFileCandidates } from "../context/mentions.js";
+import { readRegularFileSnapshot, readRegularFileSnapshotNoFollow } from "../fs-read.js";
+async function restoreMovedFile(quarantine, target) {
+    let identity;
+    try {
+        // Keep source inspection + create-if-absent in one JS turn. The subsequent discard performs another
+        // synchronous identity claim, so a watcher cannot turn cleanup into an unlink of an unrelated entry.
+        const info = lstatSync(quarantine);
+        const linkTarget = info.isSymbolicLink() ? readlinkSync(quarantine) : undefined;
+        if (linkTarget !== undefined)
+            symlinkSync(linkTarget, target);
+        else
+            linkSync(quarantine, target);
+        identity = {
+            dev: info.dev,
+            ino: info.ino,
+            mode: info.mode & 0o777,
+            nlink: info.nlink + (linkTarget === undefined ? 1 : 0),
+            linkTarget,
+        };
+    }
+    catch (error) {
+        if (error?.code === "EEXIST") {
+            throw new Error(`another file appeared at ${target}; the concurrently moved file is preserved at ${quarantine}`);
+        }
+        throw error;
+    }
+    discardClaimedPath(quarantine, identity);
+}
+/** Roll back a file we wrote without read→unlink/rename TOCTOU. First atomically move whichever inode is
+ * currently at the path aside, then inspect that moved inode. A concurrent replacement is restored with
+ * create-if-absent and never deleted/overwritten. */
+async function rollbackWrittenPlan(plan) {
+    if (!plan.committed || plan.after === null)
+        throw new Error(`missing commit identity for ${plan.path}`);
+    const target = plan.committed.target;
+    const quarantine = join(dirname(target), `.hara-rollback-${process.pid}-${randomUUID()}.tmp`);
+    // atomicWriteText follows a destination symlink and replaces its real target. Roll back that exact returned
+    // target path; moving plan.abs would destroy the symlink while leaving the changed target untouched.
+    await rename(target, quarantine);
+    let current;
+    try {
+        current = await readRegularFileSnapshotNoFollow(quarantine);
+    }
+    catch (error) {
+        await restoreMovedFile(quarantine, target);
+        throw error;
+    }
+    const owned = current.dev === plan.committed.dev && current.ino === plan.committed.ino && current.mode === plan.committed.mode && current.nlink === plan.committed.nlink && current.text === plan.after;
+    if (!owned) {
+        await restoreMovedFile(quarantine, target);
+        throw new FileChangedError(plan.path);
+    }
+    if (plan.type === "create") {
+        discardClaimedPath(quarantine, plan.committed);
+        await removeCreatedDirectories(plan.committed.createdDirs);
+        return;
+    }
+    if (plan.beforeMode === undefined) {
+        await restoreMovedFile(quarantine, target);
+        throw new Error(`missing preflight mode for ${plan.path}`);
+    }
+    try {
+        await atomicWriteText(target, plan.before, { expected: null, mode: plan.beforeMode });
+    }
+    catch (error) {
+        try {
+            await restoreMovedFile(quarantine, target);
+        }
+        catch (restoreError) {
+            throw new Error(`${error instanceof Error ? error.message : String(error)}; could not restore quarantine: ${restoreError?.message ?? String(restoreError)}`);
+        }
+        throw error;
+    }
+    discardClaimedPath(quarantine, plan.committed);
+}
+async function quarantineExpectedDelete(plan) {
+    if (!plan.beforeIdentity || !plan.beforePathIdentity || plan.beforeMode === undefined)
+        throw new Error(`missing preflight identity for ${plan.path}`);
+    // Keep the initially moved path private until it has been verified. A directory watcher must not be able
+    // to mistake an unverified staging entry for the durable delete quarantine used by the commit/cleanup
+    // phases. Recording it immediately also lets the outer rollback recover (or accurately report) a failure
+    // that happens after rename but before verification completes.
+    const staging = join(dirname(plan.abs), `.hara-stage-delete-${process.pid}-${randomUUID()}.tmp`);
+    await rename(plan.abs, staging);
+    plan.quarantine = staging;
+    const movedPath = await lstat(staging);
+    const samePath = movedPath.dev === plan.beforePathIdentity.dev && movedPath.ino === plan.beforePathIdentity.ino && (movedPath.mode & 0o777) === plan.beforePathIdentity.mode && movedPath.nlink === plan.beforePathIdentity.nlink;
+    const isExpectedLink = plan.beforeLinkTarget !== undefined;
+    const sameLink = movedPath.isSymbolicLink() === isExpectedLink && (!isExpectedLink || await readlink(staging) === plan.beforeLinkTarget);
+    if (!samePath || !sameLink)
+        throw new FileChangedError(plan.path);
+    const moved = isExpectedLink
+        ? await readRegularFileSnapshot(staging)
+        : await readRegularFileSnapshotNoFollow(staging);
+    if (moved.dev !== plan.beforeIdentity.dev || moved.ino !== plan.beforeIdentity.ino || moved.mode !== plan.beforeMode || moved.nlink !== plan.beforeIdentity.nlink || moved.text !== plan.before) {
+        throw new FileChangedError(plan.path);
+    }
+    const quarantine = join(dirname(plan.abs), `.hara-delete-${process.pid}-${randomUUID()}.tmp`);
+    await rename(staging, quarantine);
+    plan.quarantine = quarantine;
+}
+/** Move a delete quarantine to a fresh name and verify that exact moved path before restore/cleanup. If a
+ * concurrent process replaced the known quarantine name, preserve the unexpected inode and fail closed. */
+async function claimDeleteQuarantine(plan, purpose) {
+    if (!plan.quarantine || !plan.beforePathIdentity || !plan.beforeIdentity || plan.beforeMode === undefined) {
+        throw new Error(`missing delete quarantine identity for ${plan.path}`);
+    }
+    const claimed = join(dirname(plan.quarantine), `.hara-${purpose}-${process.pid}-${randomUUID()}.tmp`);
+    await rename(plan.quarantine, claimed);
+    try {
+        const pathInfo = await lstat(claimed);
+        const expectedPath = plan.beforePathIdentity;
+        const expectedLink = plan.beforeLinkTarget !== undefined;
+        if (pathInfo.dev !== expectedPath.dev ||
+            pathInfo.ino !== expectedPath.ino ||
+            (pathInfo.mode & 0o777) !== expectedPath.mode ||
+            pathInfo.nlink !== expectedPath.nlink ||
+            pathInfo.isSymbolicLink() !== expectedLink ||
+            (expectedLink && await readlink(claimed) !== plan.beforeLinkTarget)) {
+            throw new FileChangedError(plan.path);
+        }
+        if (!expectedLink) {
+            const file = await readRegularFileSnapshotNoFollow(claimed);
+            if (file.dev !== plan.beforeIdentity.dev ||
+                file.ino !== plan.beforeIdentity.ino ||
+                file.mode !== plan.beforeMode ||
+                file.nlink !== plan.beforeIdentity.nlink ||
+                file.text !== plan.before) {
+                throw new FileChangedError(plan.path);
+            }
+        }
+        return claimed;
+    }
+    catch (error) {
+        try {
+            await restoreMovedFile(claimed, plan.quarantine);
+        }
+        catch (restoreError) {
+            throw new Error(`${error instanceof Error ? error.message : String(error)}; unexpected quarantine is preserved at ${claimed}: ${restoreError?.message ?? String(restoreError)}`);
+        }
+        throw error;
+    }
+}
 registerTool({
     name: "apply_patch",
     description: "Change SEVERAL files in one atomic step (all-or-nothing). `changes` is an array of " +
@@ -78,13 +223,29 @@ registerTool({
             }
             if (type === "delete") {
                 let before;
+                let pathInfo;
+                let beforeLinkTarget;
                 try {
-                    before = await readFile(p, "utf8");
+                    pathInfo = await lstat(p);
+                    if (pathInfo.isSymbolicLink())
+                        beforeLinkTarget = await readlink(p);
+                    before = await readRegularFileSnapshot(p);
                 }
-                catch {
-                    return `Error: ${tag} delete ${ch.path}: file not found. Nothing written.`;
+                catch (error) {
+                    return `Error: ${tag} delete ${ch.path}: ${error?.message ?? "file not found"}. Nothing written.`;
                 }
-                plans.push({ path: ch.path, abs: p, type, before, after: null, existed: true });
+                plans.push({
+                    path: ch.path,
+                    abs: p,
+                    type,
+                    before: before.text,
+                    beforeMode: before.mode,
+                    beforeIdentity: { dev: before.dev, ino: before.ino, mode: before.mode, nlink: before.nlink },
+                    beforePathIdentity: { dev: pathInfo.dev, ino: pathInfo.ino, mode: pathInfo.mode & 0o777, nlink: pathInfo.nlink },
+                    beforeLinkTarget,
+                    after: null,
+                    existed: true,
+                });
             }
             else if (type === "create") {
                 if (typeof ch.content !== "string")
@@ -103,19 +264,19 @@ registerTool({
                 // update
                 let before;
                 try {
-                    before = await readFile(p, "utf8");
+                    before = await readRegularFileSnapshot(p);
                 }
-                catch {
-                    return `Error: ${tag} update ${ch.path}: cannot read (use type:create for a new file). Nothing written.`;
+                catch (error) {
+                    return `Error: ${tag} update ${ch.path}: cannot read (${error?.message ?? "unknown error"}; use type:create for a new file). Nothing written.`;
                 }
                 if (typeof ch.content === "string" && !ch.edits) {
-                    plans.push({ path: ch.path, abs: p, type, before, after: ch.content, existed: true });
+                    plans.push({ path: ch.path, abs: p, type, before: before.text, beforeMode: before.mode, beforeIdentity: { dev: before.dev, ino: before.ino, mode: before.mode, nlink: before.nlink }, after: ch.content, existed: true });
                 }
                 else {
-                    const res = applyEdits(before, ch.edits ?? []);
+                    const res = applyEdits(before.text, ch.edits ?? []);
                     if ("error" in res)
                         return `Error: ${tag} ${ch.path} — ${res.error}. Nothing written.`;
-                    plans.push({ path: ch.path, abs: p, type, before, after: res.text, existed: true });
+                    plans.push({ path: ch.path, abs: p, type, before: before.text, beforeMode: before.mode, beforeIdentity: { dev: before.dev, ino: before.ino, mode: before.mode, nlink: before.nlink }, after: res.text, existed: true });
                 }
             }
         }
@@ -125,31 +286,40 @@ registerTool({
         try {
             for (const pl of plans) {
                 if (pl.type === "delete") {
-                    let current;
-                    try {
-                        current = await readFile(pl.abs, "utf8");
-                    }
-                    catch {
-                        throw new FileChangedError(pl.path);
-                    }
-                    if (current !== pl.before)
-                        throw new FileChangedError(pl.path);
-                    await unlink(pl.abs);
+                    // Atomic move-then-inspect: a replacement inode is moved aside and restored, never unlinked.
+                    // The expected inode remains quarantined until every other patch step has committed.
+                    await quarantineExpectedDelete(pl);
                 }
                 else {
-                    await atomicWriteText(pl.abs, pl.after, { expected: pl.existed ? pl.before : null });
+                    pl.committed = await atomicWriteText(pl.abs, pl.after, {
+                        expected: pl.existed ? pl.before : null,
+                        expectedIdentity: pl.existed ? pl.beforeIdentity : undefined,
+                    });
                 }
                 applied.push(pl);
             }
         }
         catch (e) {
             const rollbackFailures = [];
-            for (const pl of applied.reverse()) {
+            // A delete becomes a visible mutation at its first rename, before its verification can finish. Include
+            // that partially staged plan in rollback instead of claiming that an empty `applied` list means the
+            // tree was untouched.
+            const rollbackPlans = [...applied];
+            for (const pl of plans) {
+                if (pl.quarantine && !rollbackPlans.includes(pl))
+                    rollbackPlans.push(pl);
+            }
+            for (const pl of rollbackPlans.reverse()) {
                 try {
-                    if (pl.type === "create" && !pl.existed)
-                        await unlink(pl.abs); // remove a file we created
-                    else
-                        await atomicWriteText(pl.abs, pl.before); // restore an updated/deleted file's prior content
+                    if (pl.type === "delete") {
+                        if (!pl.quarantine)
+                            throw new Error(`missing delete quarantine for ${pl.path}`);
+                        const claimed = await claimDeleteQuarantine(pl, "restore");
+                        await restoreMovedFile(claimed, pl.abs);
+                    }
+                    else {
+                        await rollbackWrittenPlan(pl);
+                    }
                 }
                 catch (rollbackError) {
                     rollbackFailures.push(`${pl.path}: ${rollbackError?.message ?? String(rollbackError)}`);
@@ -160,13 +330,42 @@ registerTool({
             }
             return `Error: apply_patch failed writing a file (${e instanceof Error ? e.message : String(e)}) — rolled back, nothing left changed.`;
         }
+        // Deletes become final only after every commit step succeeds. Cleanup cannot affect visible paths;
+        // report a rare failure rather than rolling back after another quarantine may already be removed.
+        const cleanupFailures = [];
+        for (const pl of plans) {
+            for (const warning of pl.committed?.warnings ?? [])
+                cleanupFailures.push(`${pl.path}: ${warning}`);
+        }
+        for (const pl of plans) {
+            if (!pl.quarantine)
+                continue;
+            try {
+                const claimed = await claimDeleteQuarantine(pl, "cleanup");
+                if (!pl.beforePathIdentity)
+                    throw new Error(`missing delete path identity for ${pl.path}`);
+                discardClaimedPath(claimed, { ...pl.beforePathIdentity, linkTarget: pl.beforeLinkTarget });
+            }
+            catch (error) {
+                cleanupFailures.push(`${pl.path}: old entry cleanup was refused (${error?.message ?? String(error)})`);
+            }
+        }
         // All writes succeeded → now show diffs + record the undo snapshot.
         const summary = plans.map((pl) => {
             emitDiff(pl.path, pl.before, pl.type === "delete" ? "" : pl.after, ctx.ui);
             return pl.type === "delete" ? `deleted ${pl.path}` : `${pl.type === "create" ? "created" : "updated"} ${pl.path}`;
         });
-        recordEdit(plans.map((pl) => ({ path: pl.path, absPath: pl.abs, before: pl.existed ? pl.before : null })));
+        recordEdit(plans.map((pl) => ({
+            path: pl.path,
+            absPath: pl.abs,
+            before: pl.existed ? pl.before : null,
+            beforeMode: pl.beforeMode,
+            linkTarget: pl.type === "delete" ? pl.beforeLinkTarget : undefined,
+            removed: pl.type === "delete",
+            committed: pl.committed,
+            after: pl.after ?? undefined,
+        })));
         invalidateFileCandidates(ctx.cwd);
-        return `apply_patch: ${plans.length} file(s) — ${summary.join("; ")}.`;
+        return `apply_patch: ${plans.length} file(s) — ${summary.join("; ")}.` + (cleanupFailures.length ? ` Warning: ${cleanupFailures.join("; ")}` : "");
     },
 });