@nanhara/hara 0.121.1 → 0.122.1

package/dist/tools/external_agent.js

@@ -7,9 +7,11 @@
 // privileged tool — and because fan-out sub-agents only get the read-only allow-list (READONLY_TOOLS), they
 // never see this tool. Trust tiers (off|gated|full) gate the dangerous bypass/full-access sub-modes.
 import { spawn, execFileSync } from "node:child_process";
+import { platform } from "node:os";
 import { registerTool } from "./registry.js";
 import { capHeadTail } from "./builtin.js";
 import { loadConfig } from "../config.js";
+import { createToolOutputLineRedactor, redactToolSubprocessOutput, terminateSubprocessTree, toolSubprocessEnv, } from "../security/subprocess-env.js";
 /** Pure: build the spawn (cmd, args) for a backend, or null if unknown. Maps hara's sandbox/trust → the agent's
  *  own permission flags; the dangerous bypass/full-access modes are only reachable at trust "full". */
 export function buildExternalArgv(backend, task, o) {
@@ -24,6 +26,20 @@ export function buildExternalArgv(backend, task, o) {
     return null;
 }
 const BUILTIN_BACKENDS = ["claude", "codex"];
+const EXTERNAL_CAPTURE_PER_STREAM = 2 * 1024 * 1024;
+const EXTERNAL_OUTPUT_KILL_LIMIT = 4 * 1024 * 1024;
+export function appendBoundedExternalOutput(current, chunk, limit = EXTERNAL_CAPTURE_PER_STREAM) {
+    if (!Number.isSafeInteger(limit) || limit < 1)
+        return "";
+    const combined = current + chunk;
+    if (combined.length <= limit)
+        return combined;
+    const marker = "\n…[external output truncated]…\n";
+    const retained = Math.max(0, limit - marker.length);
+    const head = Math.floor(retained / 4);
+    const tail = retained - head;
+    return combined.slice(0, head) + marker.slice(0, limit - head - tail) + (tail ? combined.slice(-tail) : "");
+}
 /** Probe a CLI's availability via `<bin> --version` (cached per process). */
 const availCache = new Map();
 function available(bin) {
@@ -31,7 +47,7 @@ function available(bin) {
         return availCache.get(bin);
     let ok = false;
     try {
-        execFileSync(bin, ["--version"], { stdio: "ignore", timeout: 5000 });
+        execFileSync(bin, ["--version"], { stdio: "ignore", timeout: 5000, env: toolSubprocessEnv() });
         ok = true;
     }
     catch {
@@ -52,6 +68,7 @@ registerTool({
         "another agent to own end-to-end. It can read/write/run on the host, so it's gated by approval. " +
         "Args: task (required), backend (claude|codex; default = first installed), model (optional).",
     kind: "exec", // → approval gate; never exposed to read-only fan-out sub-agents
+    trustBoundary: "external",
     input_schema: {
         type: "object",
         properties: {
@@ -63,6 +80,10 @@ registerTool({
         required: ["task"],
     },
     async run(input, ctx) {
+        if (!ctx.ask && process.env.HARA_ALLOW_TRUSTED_EXTENSIONS !== "1") {
+            return ("Blocked: external_agent runs another host coding agent outside Hara's protected-file boundary. " +
+                "Use it interactively after approval, or restart with HARA_ALLOW_TRUSTED_EXTENSIONS=1 only after reviewing that agent.");
+        }
         const trust = resolveTrust();
         if (trust === "off")
             return "external_agent is disabled (set externalAgentTrust to gated|full, or HARA_EXTERNAL_AGENT_TRUST).";
@@ -80,37 +101,110 @@ registerTool({
             return `Unknown backend '${backend}'.`;
         const timeout = Math.min(Math.max(30_000, Number(input.timeout_ms) || 600_000), 1_800_000);
         return await new Promise((resolve) => {
-            const child = spawn(built.cmd, built.args, { cwd: ctx.cwd, env: process.env });
+            const processGroup = platform() !== "win32";
+            let child;
+            try {
+                child = spawn(built.cmd, built.args, {
+                    cwd: ctx.cwd,
+                    env: toolSubprocessEnv(),
+                    detached: processGroup,
+                });
+            }
+            catch (error) {
+                resolve(redactToolSubprocessOutput(`[${backend}] failed to start: ${error instanceof Error ? error.message : String(error)}`));
+                return;
+            }
             let out = "";
             let err = "";
+            let outputBytes = 0;
             let done = false;
+            let stoppingReason = null;
+            let forceIssued = false;
+            let closeBeforeForce = false;
+            let cancelTermination;
+            const liveOut = ctx.ui ? createToolOutputLineRedactor((line) => ctx.ui.notice(line.replace(/\r?\n$/, ""))) : null;
+            const liveErr = ctx.ui ? createToolOutputLineRedactor((line) => ctx.ui.notice(line.replace(/\r?\n$/, ""))) : null;
             const finish = (s) => {
                 if (done)
                     return;
                 done = true;
                 clearTimeout(timer);
-                resolve(capHeadTail(s));
+                // A stopped tree must still receive its scheduled group KILL even if the direct shell closed first.
+                // The default cancellation removes only the wall-clock fallback, not the force timer.
+                cancelTermination?.();
+                liveOut?.flush();
+                liveErr?.flush();
+                resolve(capHeadTail(redactToolSubprocessOutput(s)));
+            };
+            const stoppedText = () => {
+                const text = out.trim() || "(external agent produced no output)";
+                return `${stoppingReason}\n${text}${err ? `\n[stderr]\n${err.trim()}` : ""}`;
+            };
+            const stopTree = (reason) => {
+                if (done || stoppingReason)
+                    return;
+                stoppingReason = reason;
+                cancelTermination = terminateSubprocessTree(child, {
+                    processGroup,
+                    graceMs: 2_000,
+                    fallbackMs: 3_000,
+                    onForce: () => {
+                        forceIssued = true;
+                        if (closeBeforeForce)
+                            finish(stoppedText());
+                    },
+                    onFallback: () => {
+                        // A deliberately daemonized descendant may retain the pipes after escaping the owned group.
+                        child.stdout?.destroy();
+                        child.stderr?.destroy();
+                        finish(stoppedText());
+                    },
+                });
             };
             const timer = setTimeout(() => {
-                try {
-                    child.kill("SIGKILL");
+                stopTree(`[${backend}] timed out after ${timeout}ms`);
+            }, timeout);
+            child.stdin?.on("error", () => { });
+            child.stdin?.end(); // task is passed via argv
+            child.stdout?.on("data", (d) => {
+                if (done || stoppingReason)
+                    return;
+                const text = d.toString();
+                outputBytes += d.length;
+                out = appendBoundedExternalOutput(out, text);
+                liveOut?.push(text);
+                if (outputBytes > EXTERNAL_OUTPUT_KILL_LIMIT) {
+                    stopTree(`[${backend}] stopped after exceeding ${EXTERNAL_OUTPUT_KILL_LIMIT} output bytes`);
                 }
-                catch {
-                    /* already gone */
+            });
+            child.stderr?.on("data", (d) => {
+                if (done || stoppingReason)
+                    return;
+                const text = d.toString();
+                outputBytes += d.length;
+                err = appendBoundedExternalOutput(err, text);
+                liveErr?.push(text);
+                if (outputBytes > EXTERNAL_OUTPUT_KILL_LIMIT) {
+                    stopTree(`[${backend}] stopped after exceeding ${EXTERNAL_OUTPUT_KILL_LIMIT} output bytes`);
                 }
-                finish(`[${backend}] timed out after ${timeout}ms\n${out}`);
-            }, timeout);
-            child.stdin.end(); // task is passed via argv
-            child.stdout.on("data", (d) => {
-                out += d.toString();
-                ctx.ui?.notice?.(d.toString().trimEnd());
             });
-            child.stderr.on("data", (d) => {
-                err += d.toString();
+            child.on("error", (e) => {
+                if (stoppingReason && !forceIssued) {
+                    closeBeforeForce = true;
+                    return;
+                }
+                finish(stoppingReason ? stoppedText() : `[${backend}] failed to start: ${e.message} (is it installed?)`);
             });
-            child.on("error", (e) => finish(`[${backend}] failed to start: ${e.message} (is it installed?)`));
             child.on("close", (code) => {
                 const text = out.trim() || "(external agent produced no output)";
+                if (stoppingReason) {
+                    if (!forceIssued) {
+                        closeBeforeForce = true;
+                        return;
+                    }
+                    finish(stoppedText());
+                    return;
+                }
                 finish(code === 0 ? text : `[${backend} exit ${code}]\n${text}${err ? `\n[stderr]\n${err.trim()}` : ""}`);
             });
         });

package/dist/tools/memory.js

@@ -1,13 +1,16 @@
 // Memory tools — the agent's interface to durable memory. memory_search/get are read-only
 // (parallel-safe, never prompt); memory_write/forget are edits (gated by the approval mode).
-import { readFileSync, writeFileSync, mkdirSync, existsSync } from "node:fs";
-import { isAbsolute, resolve, join } from "node:path";
+import { existsSync } from "node:fs";
+import { isAbsolute, resolve, join, relative, sep } from "node:path";
 import { registerTool } from "./registry.js";
 import { searchAssets, assetSearchRoots } from "../recall.js";
 import { searchHybrid } from "../search/hybrid.js";
 import { memoryRoots, appendMemory, replaceMemory, forgetMemory } from "../memory/store.js";
 import { scanMemory, redactSecrets, scrubLocal } from "../memory/guard.js";
 import { globalSkillsDir, skillsDir, invalidateSkillsCache } from "../skills/skills.js";
+import { sensitiveFileError } from "../security/sensitive-files.js";
+import { readModelContextFileSync, readVerifiedRegularFileSnapshot } from "../fs-read.js";
+import { atomicWriteText, bindAtomicWritePath } from "../fs-write.js";
 const asTarget = (v) => (["memory", "user", "log"].includes(v) ? v : "memory");
 const asScope = (v) => (v === "global" ? "global" : "project");
 registerTool({
@@ -34,12 +37,18 @@ registerTool({
     kind: "read",
     async run(input, ctx) {
         const p = isAbsolute(String(input.path)) ? String(input.path) : resolve(ctx.cwd, String(input.path));
-        if (!memoryRoots(ctx.cwd).some((r) => p.startsWith(r)))
+        if (!memoryRoots(ctx.cwd).some((root) => {
+            const rel = relative(resolve(root), p);
+            return rel === "" || (rel !== ".." && !rel.startsWith(`..${sep}`) && !isAbsolute(rel));
+        }))
             return `Error: ${input.path} is outside the memory store.`;
+        const denied = sensitiveFileError(p, "read");
+        if (denied)
+            return denied;
         if (!existsSync(p))
             return `Error: no memory file at ${p}.`;
         try {
-            return readFileSync(p, "utf8").slice(0, 50_000);
+            return readModelContextFileSync(p, 64 * 1024).slice(0, 50_000);
         }
         catch (e) {
             return `Error: ${e.message}`;
@@ -70,7 +79,9 @@ registerTool({
             return `Blocked: this looks unsafe to store (${scan.hits.join(", ")}). Rephrase without secrets/injection text.`;
         const scope = asScope(input.scope);
         const target = asTarget(input.target);
-        const f = input.mode === "replace" ? replaceMemory(scope, target, content, ctx.cwd) : appendMemory(scope, target, content, ctx.cwd);
+        const f = input.mode === "replace"
+            ? await replaceMemory(scope, target, content, ctx.cwd)
+            : await appendMemory(scope, target, content, ctx.cwd);
         return `Saved to ${f}`;
     },
 });
@@ -117,8 +128,27 @@ registerTool({
         const f = join(dir, "SKILL.md");
         // dedup: surface a near-duplicate so the agent updates instead of piling up (lexical signal, not a block)
         const dups = searchAssets(`${slug} ${description}`, 3, assetSearchRoots(ctx.cwd)).filter((h) => h.path !== f && h.score >= 2);
-        mkdirSync(dir, { recursive: true });
-        writeFileSync(f, `---\nname: ${slug}\ndescription: ${description}\n---\n\n${body.trim()}\n`, "utf8");
+        const skillText = `---\nname: ${slug}\ndescription: ${description}\n---\n\n${body.trim()}\n`;
+        let boundary;
+        let snapshot = null;
+        try {
+            boundary = bindAtomicWritePath(f, "create skill");
+            try {
+                snapshot = await readVerifiedRegularFileSnapshot(boundary.target, undefined, "create skill");
+            }
+            catch (error) {
+                if (error?.code !== "ENOENT")
+                    throw error;
+            }
+            await atomicWriteText(boundary.target, skillText, {
+                expected: snapshot?.text ?? null,
+                expectedIdentity: snapshot ?? undefined,
+                boundary,
+            });
+        }
+        catch (error) {
+            return `Error: cannot save skill ${slug}: ${error?.message ?? String(error)} No changes written.`;
+        }
         invalidateSkillsCache();
         const notes = [
             redactions.length ? `redacted ${redactions.length} secret(s)` : "",
@@ -141,7 +171,7 @@ registerTool({
     },
     kind: "edit",
     async run(input, ctx) {
-        const n = forgetMemory(asScope(input.scope), asTarget(input.target), String(input.match ?? ""), ctx.cwd);
+        const n = await forgetMemory(asScope(input.scope), asTarget(input.target), String(input.match ?? ""), ctx.cwd);
         return n ? `Removed ${n} line(s).` : "(no matching lines)";
     },
 });

package/dist/tools/patch.js

@@ -1,13 +1,164 @@
 // apply_patch — change MULTIPLE files atomically (all-or-nothing). Everything is validated and
 // computed in memory first; nothing is written unless every change applies cleanly.
-import { lstat, readFile, unlink } from "node:fs/promises";
-import { isAbsolute, resolve } from "node:path";
+import { linkSync, lstatSync, readlinkSync, renameSync, symlinkSync } from "node:fs";
+import { lstat, readlink, rename } from "node:fs/promises";
+import { randomUUID } from "node:crypto";
+import { dirname, isAbsolute, join, resolve } from "node:path";
 import { registerTool } from "./registry.js";
 import { applyEdits } from "./apply-core.js";
 import { emitDiff } from "../diff.js";
 import { recordEdit } from "../undo.js";
-import { atomicWriteText, FileChangedError } from "../fs-write.js";
+import { atomicWriteText, bindAtomicParentEntryPath, bindAtomicWritePath, discardClaimedPath, FileChangedError, removeCreatedDirectories, verifyAtomicWriteBoundary, } from "../fs-write.js";
 import { invalidateFileCandidates } from "../context/mentions.js";
+import { readRegularFileSnapshot, readRegularFileSnapshotNoFollow, readVerifiedRegularFileSnapshot, resolveVerifiedModelPath, } from "../fs-read.js";
+import { sensitiveFileError } from "../security/sensitive-files.js";
+async function restoreMovedFile(quarantine, target) {
+    let identity;
+    try {
+        // Keep source inspection + create-if-absent in one JS turn. The subsequent discard performs another
+        // synchronous identity claim, so a watcher cannot turn cleanup into an unlink of an unrelated entry.
+        const info = lstatSync(quarantine);
+        const linkTarget = info.isSymbolicLink() ? readlinkSync(quarantine) : undefined;
+        if (linkTarget !== undefined)
+            symlinkSync(linkTarget, target);
+        else
+            linkSync(quarantine, target);
+        identity = {
+            dev: info.dev,
+            ino: info.ino,
+            mode: info.mode & 0o777,
+            nlink: info.nlink + (linkTarget === undefined ? 1 : 0),
+            linkTarget,
+        };
+    }
+    catch (error) {
+        if (error?.code === "EEXIST") {
+            throw new Error(`another file appeared at ${target}; the concurrently moved file is preserved at ${quarantine}`);
+        }
+        throw error;
+    }
+    discardClaimedPath(quarantine, identity);
+}
+/** Roll back a file we wrote without read→unlink/rename TOCTOU. First atomically move whichever inode is
+ * currently at the path aside, then inspect that moved inode. A concurrent replacement is restored with
+ * create-if-absent and never deleted/overwritten. */
+async function rollbackWrittenPlan(plan) {
+    if (!plan.committed || plan.after === null)
+        throw new Error(`missing commit identity for ${plan.path}`);
+    const target = plan.committed.target;
+    const quarantine = join(dirname(target), `.hara-rollback-${process.pid}-${randomUUID()}.tmp`);
+    // atomicWriteText follows a destination symlink and replaces its real target. Roll back that exact returned
+    // target path; moving plan.abs would destroy the symlink while leaving the changed target untouched.
+    await rename(target, quarantine);
+    let current;
+    try {
+        current = await readRegularFileSnapshotNoFollow(quarantine);
+    }
+    catch (error) {
+        await restoreMovedFile(quarantine, target);
+        throw error;
+    }
+    const owned = current.dev === plan.committed.dev && current.ino === plan.committed.ino && current.mode === plan.committed.mode && current.nlink === plan.committed.nlink && current.text === plan.after;
+    if (!owned) {
+        await restoreMovedFile(quarantine, target);
+        throw new FileChangedError(plan.path);
+    }
+    if (plan.type === "create") {
+        discardClaimedPath(quarantine, plan.committed);
+        await removeCreatedDirectories(plan.committed.createdDirs);
+        return;
+    }
+    if (plan.beforeMode === undefined) {
+        await restoreMovedFile(quarantine, target);
+        throw new Error(`missing preflight mode for ${plan.path}`);
+    }
+    try {
+        await atomicWriteText(target, plan.before, { expected: null, mode: plan.beforeMode });
+    }
+    catch (error) {
+        try {
+            await restoreMovedFile(quarantine, target);
+        }
+        catch (restoreError) {
+            throw new Error(`${error instanceof Error ? error.message : String(error)}; could not restore quarantine: ${restoreError?.message ?? String(restoreError)}`);
+        }
+        throw error;
+    }
+    discardClaimedPath(quarantine, plan.committed);
+}
+async function quarantineExpectedDelete(plan) {
+    if (!plan.beforeIdentity || !plan.beforePathIdentity || plan.beforeMode === undefined)
+        throw new Error(`missing preflight identity for ${plan.path}`);
+    if (!plan.writeBoundary)
+        throw new Error(`missing parent boundary for ${plan.path}`);
+    // Keep the initially moved path private until it has been verified. A directory watcher must not be able
+    // to mistake an unverified staging entry for the durable delete quarantine used by the commit/cleanup
+    // phases. Recording it immediately also lets the outer rollback recover (or accurately report) a failure
+    // that happens after rename but before verification completes.
+    const staging = join(dirname(plan.abs), `.hara-stage-delete-${process.pid}-${randomUUID()}.tmp`);
+    verifyAtomicWriteBoundary(plan.writeBoundary);
+    renameSync(plan.abs, staging);
+    plan.quarantine = staging;
+    const movedPath = await lstat(staging);
+    const samePath = movedPath.dev === plan.beforePathIdentity.dev && movedPath.ino === plan.beforePathIdentity.ino && (movedPath.mode & 0o777) === plan.beforePathIdentity.mode && movedPath.nlink === plan.beforePathIdentity.nlink;
+    const isExpectedLink = plan.beforeLinkTarget !== undefined;
+    const sameLink = movedPath.isSymbolicLink() === isExpectedLink && (!isExpectedLink || await readlink(staging) === plan.beforeLinkTarget);
+    if (!samePath || !sameLink)
+        throw new FileChangedError(plan.path);
+    const moved = isExpectedLink
+        ? await readRegularFileSnapshot(staging)
+        : await readRegularFileSnapshotNoFollow(staging);
+    if (moved.dev !== plan.beforeIdentity.dev || moved.ino !== plan.beforeIdentity.ino || moved.mode !== plan.beforeMode || moved.nlink !== plan.beforeIdentity.nlink || moved.text !== plan.before) {
+        throw new FileChangedError(plan.path);
+    }
+    const quarantine = join(dirname(plan.abs), `.hara-delete-${process.pid}-${randomUUID()}.tmp`);
+    verifyAtomicWriteBoundary(plan.writeBoundary);
+    renameSync(staging, quarantine);
+    plan.quarantine = quarantine;
+}
+/** Move a delete quarantine to a fresh name and verify that exact moved path before restore/cleanup. If a
+ * concurrent process replaced the known quarantine name, preserve the unexpected inode and fail closed. */
+async function claimDeleteQuarantine(plan, purpose) {
+    if (!plan.quarantine || !plan.beforePathIdentity || !plan.beforeIdentity || plan.beforeMode === undefined || !plan.writeBoundary) {
+        throw new Error(`missing delete quarantine identity for ${plan.path}`);
+    }
+    const claimed = join(dirname(plan.quarantine), `.hara-${purpose}-${process.pid}-${randomUUID()}.tmp`);
+    verifyAtomicWriteBoundary(plan.writeBoundary);
+    renameSync(plan.quarantine, claimed);
+    try {
+        const pathInfo = await lstat(claimed);
+        const expectedPath = plan.beforePathIdentity;
+        const expectedLink = plan.beforeLinkTarget !== undefined;
+        if (pathInfo.dev !== expectedPath.dev ||
+            pathInfo.ino !== expectedPath.ino ||
+            (pathInfo.mode & 0o777) !== expectedPath.mode ||
+            pathInfo.nlink !== expectedPath.nlink ||
+            pathInfo.isSymbolicLink() !== expectedLink ||
+            (expectedLink && await readlink(claimed) !== plan.beforeLinkTarget)) {
+            throw new FileChangedError(plan.path);
+        }
+        if (!expectedLink) {
+            const file = await readRegularFileSnapshotNoFollow(claimed);
+            if (file.dev !== plan.beforeIdentity.dev ||
+                file.ino !== plan.beforeIdentity.ino ||
+                file.mode !== plan.beforeMode ||
+                file.nlink !== plan.beforeIdentity.nlink ||
+                file.text !== plan.before) {
+                throw new FileChangedError(plan.path);
+            }
+        }
+        return claimed;
+    }
+    catch (error) {
+        try {
+            await restoreMovedFile(claimed, plan.quarantine);
+        }
+        catch (restoreError) {
+            throw new Error(`${error instanceof Error ? error.message : String(error)}; unexpected quarantine is preserved at ${claimed}: ${restoreError?.message ?? String(restoreError)}`);
+        }
+        throw error;
+    }
+}
 registerTool({
     name: "apply_patch",
     description: "Change SEVERAL files in one atomic step (all-or-nothing). `changes` is an array of " +
@@ -60,6 +211,9 @@ registerTool({
             if (typeof ch.path !== "string" || !ch.path)
                 return `Error: ${tag} is missing a path. Nothing written.`;
             const p = abs(ch.path);
+            const denied = sensitiveFileError(p, "patch");
+            if (denied)
+                return `Error: ${tag}: ${denied} Nothing written.`;
             if (plannedPaths.has(p))
                 return `Error: ${tag} repeats path ${ch.path}. Combine edits for one file into a single change. Nothing written.`;
             plannedPaths.add(p);
@@ -78,44 +232,70 @@ registerTool({
             }
             if (type === "delete") {
                 let before;
+                let pathInfo;
+                let beforeLinkTarget;
+                let writeBoundary;
                 try {
-                    before = await readFile(p, "utf8");
+                    writeBoundary = bindAtomicParentEntryPath(p, "patch");
+                    pathInfo = await lstat(writeBoundary.target);
+                    if (pathInfo.isSymbolicLink())
+                        beforeLinkTarget = await readlink(writeBoundary.target);
+                    const target = resolveVerifiedModelPath(writeBoundary.target, "patch");
+                    before = await readVerifiedRegularFileSnapshot(target, undefined, "patch");
                 }
-                catch {
-                    return `Error: ${tag} delete ${ch.path}: file not found. Nothing written.`;
+                catch (error) {
+                    return `Error: ${tag} delete ${ch.path}: ${error?.message ?? "file not found"}. Nothing written.`;
                 }
-                plans.push({ path: ch.path, abs: p, type, before, after: null, existed: true });
+                plans.push({
+                    path: ch.path,
+                    abs: writeBoundary.target,
+                    type,
+                    before: before.text,
+                    beforeMode: before.mode,
+                    beforeIdentity: { dev: before.dev, ino: before.ino, mode: before.mode, nlink: before.nlink },
+                    beforePathIdentity: { dev: pathInfo.dev, ino: pathInfo.ino, mode: pathInfo.mode & 0o777, nlink: pathInfo.nlink },
+                    beforeLinkTarget,
+                    writeBoundary,
+                    after: null,
+                    existed: true,
+                });
             }
             else if (type === "create") {
                 if (typeof ch.content !== "string")
                     return `Error: ${tag} create ${ch.path} needs \`content\`. Nothing written.`;
+                let writeBoundary;
                 try {
-                    await lstat(p);
+                    writeBoundary = bindAtomicWritePath(p, "patch");
+                    await lstat(writeBoundary.target);
                     return `Error: ${tag} create ${ch.path}: path already exists (use type:update to replace it). Nothing written.`;
                 }
                 catch (error) {
-                    if (error?.code !== "ENOENT")
+                    if (error?.code !== "ENOENT" || !writeBoundary)
                         return `Error: ${tag} create ${ch.path}: ${error?.message ?? String(error)}. Nothing written.`;
                 }
-                plans.push({ path: ch.path, abs: p, type, before: "", after: ch.content, existed: false });
+                if (!writeBoundary)
+                    return `Error: ${tag} create ${ch.path}: cannot bind a stable parent. Nothing written.`;
+                plans.push({ path: ch.path, abs: writeBoundary.target, type, before: "", after: ch.content, existed: false, writeBoundary });
             }
             else {
                 // update
                 let before;
+                let writeBoundary;
                 try {
-                    before = await readFile(p, "utf8");
+                    writeBoundary = bindAtomicWritePath(p, "patch");
+                    before = await readVerifiedRegularFileSnapshot(writeBoundary.target, undefined, "patch");
                 }
-                catch {
-                    return `Error: ${tag} update ${ch.path}: cannot read (use type:create for a new file). Nothing written.`;
+                catch (error) {
+                    return `Error: ${tag} update ${ch.path}: cannot read (${error?.message ?? "unknown error"}; use type:create for a new file). Nothing written.`;
                 }
                 if (typeof ch.content === "string" && !ch.edits) {
-                    plans.push({ path: ch.path, abs: p, type, before, after: ch.content, existed: true });
+                    plans.push({ path: ch.path, abs: writeBoundary.target, type, before: before.text, beforeMode: before.mode, beforeIdentity: { dev: before.dev, ino: before.ino, mode: before.mode, nlink: before.nlink }, after: ch.content, existed: true, writeBoundary });
                 }
                 else {
-                    const res = applyEdits(before, ch.edits ?? []);
+                    const res = applyEdits(before.text, ch.edits ?? []);
                     if ("error" in res)
                         return `Error: ${tag} ${ch.path} — ${res.error}. Nothing written.`;
-                    plans.push({ path: ch.path, abs: p, type, before, after: res.text, existed: true });
+                    plans.push({ path: ch.path, abs: writeBoundary.target, type, before: before.text, beforeMode: before.mode, beforeIdentity: { dev: before.dev, ino: before.ino, mode: before.mode, nlink: before.nlink }, after: res.text, existed: true, writeBoundary });
                 }
             }
         }
@@ -125,31 +305,41 @@ registerTool({
         try {
             for (const pl of plans) {
                 if (pl.type === "delete") {
-                    let current;
-                    try {
-                        current = await readFile(pl.abs, "utf8");
-                    }
-                    catch {
-                        throw new FileChangedError(pl.path);
-                    }
-                    if (current !== pl.before)
-                        throw new FileChangedError(pl.path);
-                    await unlink(pl.abs);
+                    // Atomic move-then-inspect: a replacement inode is moved aside and restored, never unlinked.
+                    // The expected inode remains quarantined until every other patch step has committed.
+                    await quarantineExpectedDelete(pl);
                 }
                 else {
-                    await atomicWriteText(pl.abs, pl.after, { expected: pl.existed ? pl.before : null });
+                    pl.committed = await atomicWriteText(pl.abs, pl.after, {
+                        expected: pl.existed ? pl.before : null,
+                        expectedIdentity: pl.existed ? pl.beforeIdentity : undefined,
+                        boundary: pl.writeBoundary,
+                    });
                 }
                 applied.push(pl);
             }
         }
         catch (e) {
             const rollbackFailures = [];
-            for (const pl of applied.reverse()) {
+            // A delete becomes a visible mutation at its first rename, before its verification can finish. Include
+            // that partially staged plan in rollback instead of claiming that an empty `applied` list means the
+            // tree was untouched.
+            const rollbackPlans = [...applied];
+            for (const pl of plans) {
+                if (pl.quarantine && !rollbackPlans.includes(pl))
+                    rollbackPlans.push(pl);
+            }
+            for (const pl of rollbackPlans.reverse()) {
                 try {
-                    if (pl.type === "create" && !pl.existed)
-                        await unlink(pl.abs); // remove a file we created
-                    else
-                        await atomicWriteText(pl.abs, pl.before); // restore an updated/deleted file's prior content
+                    if (pl.type === "delete") {
+                        if (!pl.quarantine)
+                            throw new Error(`missing delete quarantine for ${pl.path}`);
+                        const claimed = await claimDeleteQuarantine(pl, "restore");
+                        await restoreMovedFile(claimed, pl.abs);
+                    }
+                    else {
+                        await rollbackWrittenPlan(pl);
+                    }
                 }
                 catch (rollbackError) {
                     rollbackFailures.push(`${pl.path}: ${rollbackError?.message ?? String(rollbackError)}`);
@@ -160,13 +350,42 @@ registerTool({
             }
             return `Error: apply_patch failed writing a file (${e instanceof Error ? e.message : String(e)}) — rolled back, nothing left changed.`;
         }
+        // Deletes become final only after every commit step succeeds. Cleanup cannot affect visible paths;
+        // report a rare failure rather than rolling back after another quarantine may already be removed.
+        const cleanupFailures = [];
+        for (const pl of plans) {
+            for (const warning of pl.committed?.warnings ?? [])
+                cleanupFailures.push(`${pl.path}: ${warning}`);
+        }
+        for (const pl of plans) {
+            if (!pl.quarantine)
+                continue;
+            try {
+                const claimed = await claimDeleteQuarantine(pl, "cleanup");
+                if (!pl.beforePathIdentity)
+                    throw new Error(`missing delete path identity for ${pl.path}`);
+                discardClaimedPath(claimed, { ...pl.beforePathIdentity, linkTarget: pl.beforeLinkTarget });
+            }
+            catch (error) {
+                cleanupFailures.push(`${pl.path}: old entry cleanup was refused (${error?.message ?? String(error)})`);
+            }
+        }
         // All writes succeeded → now show diffs + record the undo snapshot.
         const summary = plans.map((pl) => {
             emitDiff(pl.path, pl.before, pl.type === "delete" ? "" : pl.after, ctx.ui);
             return pl.type === "delete" ? `deleted ${pl.path}` : `${pl.type === "create" ? "created" : "updated"} ${pl.path}`;
         });
-        recordEdit(plans.map((pl) => ({ path: pl.path, absPath: pl.abs, before: pl.existed ? pl.before : null })));
+        recordEdit(plans.map((pl) => ({
+            path: pl.path,
+            absPath: pl.abs,
+            before: pl.existed ? pl.before : null,
+            beforeMode: pl.beforeMode,
+            linkTarget: pl.type === "delete" ? pl.beforeLinkTarget : undefined,
+            removed: pl.type === "delete",
+            committed: pl.committed,
+            after: pl.after ?? undefined,
+        })));
         invalidateFileCandidates(ctx.cwd);
-        return `apply_patch: ${plans.length} file(s) — ${summary.join("; ")}.`;
+        return `apply_patch: ${plans.length} file(s) — ${summary.join("; ")}.` + (cleanupFailures.length ? ` Warning: ${cleanupFailures.join("; ")}` : "");
     },
 });