@oscharko-dev/keiko 0.1.6 → 0.1.7

package/dist/tools/exec.js

@@ -1,327 +1,5 @@
-// Command execution — the spawn boundary. Deny-by-default allowlist is checked BEFORE any
-// spawn; the child runs with a clean name-allowlisted env, no shell, and a resolved-in-workspace
-// cwd. Timeout and abort both kill the process group (SIGTERM→SIGKILL after the grace period).
-// stdout/stderr are byte-capped and redacted before they leave this layer (ADR-0006 D3/D5).
-//
-// node:child_process is imported ONLY for the default SpawnFn adapter; all decision logic lives
-// in sandbox.ts (pure). Tests inject a fake SpawnFn for the allowlist/timeout/cancel paths and a
-// real `node`-spawn for the env-isolation / no-shell / real-cancellation integration cases.
-import { spawn as nodeSpawn } from "node:child_process";
-import { accessSync, constants, mkdtempSync, realpathSync, rmSync } from "node:fs";
-import { tmpdir } from "node:os";
-import { delimiter, join, resolve as resolvePath } from "node:path";
-import { redact } from "../gateway/redaction.js";
-import { isDenied } from "../workspace/ignore.js";
-import { isWithinWorkspace, resolveWithinWorkspace } from "../workspace/paths.js";
-import { containedRealPathInfo } from "../workspace/realpath.js";
-import { nodeWorkspaceFs } from "../workspace/fs.js";
-import { PathDeniedError } from "../workspace/errors.js";
-import { CommandCancelledError, CommandDeniedError, CommandTimeoutError } from "./errors.js";
-import { buildSandboxEnv, collectSensitiveEnvValues, isCommandAllowed } from "./sandbox.js";
-export const nodeSpawnFn = (command, args, options) => nodeSpawn(command, [...args], options);
-export const nodeHomeProvider = {
-    make: () => mkdtempSync(join(tmpdir(), "keiko-home-")),
-    cleanup: (dir) => {
-        // Best-effort: a leftover temp dir is not worth failing or rejecting the command over.
-        rmSync(dir, { recursive: true, force: true });
-    },
-};
-const POSIX = process.platform !== "win32";
-// Kills the whole process group on POSIX (negative pid) so orphaned grandchildren die too;
-// on Windows, best-effort child.kill() (a tree-kill needs a dependency we cannot add).
-function killGroup(child, sig) {
-    const pid = child.pid;
-    if (pid === undefined) {
-        return;
-    }
-    try {
-        if (POSIX) {
-            process.kill(-pid, sig);
-        }
-        else {
-            child.kill(sig);
-        }
-    }
-    catch {
-        // The child already exited; nothing to signal. Swallowing here keeps termination idempotent.
-    }
-}
-const TRUNCATED_OUTPUT_MARKER = "[TRUNCATED OUTPUT REDACTED]";
-function hasPathSeparator(value) {
-    return value.includes("/") || value.includes("\\");
-}
-function hasNul(value) {
-    return value.includes("\u0000");
-}
-function realRoot(fs, root) {
-    try {
-        return fs.realPath(root);
-    }
-    catch {
-        return root;
-    }
-}
-function assertBareExecutable(command) {
-    if (command.length === 0 || hasNul(command) || hasPathSeparator(command)) {
-        throw new CommandDeniedError("executable must be a bare PATH-resolved name", command);
-    }
-}
-function pathEntries(processEnv) {
-    const pathValue = processEnv.PATH ?? "";
-    return pathValue.length === 0 ? [] : pathValue.split(delimiter).filter(Boolean);
-}
-function executableExtensions(processEnv) {
-    if (process.platform !== "win32") {
-        return [""];
-    }
-    return (processEnv.PATHEXT ?? ".EXE;.CMD;.BAT;.COM")
-        .split(";")
-        .filter((value) => value.length > 0);
-}
-function candidateExecutable(command, rawEntry, ext) {
-    const candidate = resolvePath(resolvePath(rawEntry), command + ext);
-    try {
-        accessSync(candidate, constants.X_OK);
-        return { path: candidate, real: realpathSync(candidate) };
-    }
-    catch {
-        return undefined;
-    }
-}
-function assertExecutableOutsideWorkspace(command, lexicalWorkspaceRoot, realWorkspaceRoot, candidate) {
-    if (isWithinWorkspace(lexicalWorkspaceRoot, candidate.path) ||
-        isWithinWorkspace(realWorkspaceRoot, candidate.real)) {
-        throw new CommandDeniedError(`executable resolves inside workspace: ${command}`, command);
-    }
-}
-function defaultResolveExecutable(command, deps) {
-    assertBareExecutable(command);
-    const fs = deps.fs ?? nodeWorkspaceFs;
-    const lexicalWorkspaceRoot = deps.workspace.root;
-    const realWorkspaceRoot = realRoot(fs, lexicalWorkspaceRoot);
-    for (const rawEntry of pathEntries(deps.processEnv)) {
-        for (const ext of executableExtensions(deps.processEnv)) {
-            const candidate = candidateExecutable(command, rawEntry, ext);
-            if (candidate === undefined) {
-                continue;
-            }
-            assertExecutableOutsideWorkspace(command, lexicalWorkspaceRoot, realWorkspaceRoot, candidate);
-            return candidate.real;
-        }
-    }
-    throw new CommandDeniedError(`executable not found on PATH: ${command}`, command);
-}
-function appendCapped(buffers, sink, chunk, max) {
-    if (buffers.truncated) {
-        return false;
-    }
-    const remaining = max - buffers.total;
-    if (chunk.length <= remaining) {
-        sink.push(chunk);
-        buffers.total += chunk.length;
-        return false;
-    }
-    if (remaining > 0) {
-        sink.push(chunk.subarray(0, remaining));
-        buffers.total = max;
-    }
-    buffers.truncated = true;
-    return true; // signals the caller to kill the child (flood protection)
-}
-// Resolves the validated cwd. Lexical containment first, then symlink containment via realpath
-// (S-H1): a cwd that is a symlink escaping the root or resolving into an always-denied path must
-// not become the spawn cwd. Both cases surface as workspace path errors, which the host maps to a
-// tool error — the command never spawns.
-function resolveCwd(deps, cwd) {
-    const lexical = resolveWithinWorkspace(deps.workspace.root, cwd ?? ".");
-    const fs = deps.fs ?? nodeWorkspaceFs;
-    const rel = lexical.slice(deps.workspace.root.length).replace(/^[/\\]/, "");
-    if (isDenied(rel === "" ? (cwd ?? ".") : rel)) {
-        throw new PathDeniedError("path matches an always-on deny pattern", cwd ?? ".");
-    }
-    const info = containedRealPathInfo(fs, deps.workspace.root, lexical);
-    if (isDenied(info.realRelative)) {
-        throw new PathDeniedError("path matches an always-on deny pattern", cwd ?? ".");
-    }
-    return lexical;
-}
-function buildResult(input, buffers, state, exitCode, termSignal, deps, startedAt) {
-    const secrets = collectSensitiveEnvValues(deps.processEnv, deps.policy.envAllowlist);
-    if (buffers.truncated) {
-        return {
-            command: input.command,
-            args: input.args,
-            exitCode,
-            signal: termSignal,
-            stdout: TRUNCATED_OUTPUT_MARKER,
-            stderr: TRUNCATED_OUTPUT_MARKER,
-            durationMs: deps.now() - startedAt,
-            timedOut: state.timedOut,
-            truncated: true,
-        };
-    }
-    return {
-        command: input.command,
-        args: input.args,
-        exitCode,
-        signal: termSignal,
-        stdout: redact(Buffer.concat(buffers.out).toString("utf8"), secrets),
-        stderr: redact(Buffer.concat(buffers.err).toString("utf8"), secrets),
-        durationMs: deps.now() - startedAt,
-        timedOut: state.timedOut,
-        truncated: buffers.truncated,
-    };
-}
-function cleanup(state, signal) {
-    if (state.timer !== undefined) {
-        clearTimeout(state.timer);
-    }
-    if (state.graceTimer !== undefined) {
-        clearTimeout(state.graceTimer);
-    }
-    if (state.onAbort !== undefined) {
-        signal.removeEventListener("abort", state.onAbort);
-    }
-    // Remove the ephemeral HOME exactly once, on whichever settle path fires first (C5).
-    if (!state.homeCleaned && state.home !== undefined && state.homeDir !== undefined) {
-        state.homeCleaned = true;
-        state.home.cleanup(state.homeDir);
-    }
-}
-// Escalates from SIGTERM to SIGKILL after the grace period so a child ignoring SIGTERM is still
-// guaranteed to terminate within terminationGraceMs of the trigger.
-function terminate(child, policy, state) {
-    killGroup(child, "SIGTERM");
-    state.graceTimer = setTimeout(() => {
-        killGroup(child, "SIGKILL");
-    }, policy.terminationGraceMs);
-    state.graceTimer.unref();
-}
-function wireStreams(child, buffers, policy, state) {
-    const onData = (sink) => (chunk) => {
-        if (appendCapped(buffers, sink, chunk, policy.maxOutputBytes)) {
-            terminate(child, policy, state); // output flood → kill
-        }
-    };
-    child.stdout?.on("data", onData(buffers.out));
-    child.stderr?.on("data", onData(buffers.err));
-}
-function settleOnClose(ctx, resolve, reject) {
-    ctx.child.on("close", (code, signalName) => {
-        if (ctx.state.settled) {
-            return;
-        }
-        ctx.state.settled = true;
-        cleanup(ctx.state, ctx.input.signal);
-        if (ctx.state.timedOut) {
-            reject(new CommandTimeoutError("command timed out", timeoutOf(ctx)));
-            return;
-        }
-        if (ctx.input.signal.aborted) {
-            reject(new CommandCancelledError("command cancelled"));
-            return;
-        }
-        resolve(buildResult(ctx.input, ctx.buffers, ctx.state, code, signalName, ctx.deps, ctx.startedAt));
-    });
-    ctx.child.on("error", (error) => {
-        if (ctx.state.settled) {
-            return;
-        }
-        ctx.state.settled = true;
-        cleanup(ctx.state, ctx.input.signal);
-        reject(error);
-    });
-}
-function timeoutOf(ctx) {
-    return ctx.input.timeoutMs ?? ctx.deps.policy.defaultTimeoutMs;
-}
-function armTimersAndAbort(ctx) {
-    const ms = timeoutOf(ctx);
-    ctx.state.timer = setTimeout(() => {
-        ctx.state.timedOut = true;
-        terminate(ctx.child, ctx.deps.policy, ctx.state);
-    }, ms);
-    ctx.state.timer.unref();
-    const onAbort = () => {
-        terminate(ctx.child, ctx.deps.policy, ctx.state);
-    };
-    ctx.state.onAbort = onAbort;
-    if (ctx.input.signal.aborted) {
-        onAbort();
-    }
-    else {
-        ctx.input.signal.addEventListener("abort", onAbort, { once: true });
-    }
-}
-function asError(error, fallback) {
-    return error instanceof Error ? error : new Error(fallback);
-}
-function validateRunCommandInput(input, deps) {
-    if (!Array.isArray(deps.policy.envAllowlist) || deps.policy.envAllowlist.length === 0) {
-        throw new CommandDeniedError("sandbox envAllowlist must be a non-empty array", input.command);
-    }
-    const decision = isCommandAllowed(deps.commandRules, input.command, input.args);
-    if (!decision.allowed) {
-        throw new CommandDeniedError(decision.reason ?? "command denied", input.command);
-    }
-}
-function resolveExecutable(input, deps) {
-    const resolver = deps.resolveExecutable ?? defaultResolveExecutable;
-    return resolver(input.command, {
-        workspace: deps.workspace,
-        processEnv: deps.processEnv,
-        fs: deps.fs,
-    });
-}
-function createRunState(home, homeDir) {
-    return {
-        settled: false,
-        timedOut: false,
-        timer: undefined,
-        graceTimer: undefined,
-        onAbort: undefined,
-        home,
-        homeDir,
-        homeCleaned: false,
-    };
-}
-function spawnChild(input, deps, executable, cwd, env, state) {
-    try {
-        return deps.spawn(executable, input.args, { cwd, env, shell: false, detached: POSIX });
-    }
-    catch (error) {
-        cleanup(state, input.signal);
-        throw asError(error, "spawn failed");
-    }
-}
-function runSpawnedChild(ctx) {
-    return new Promise((resolve, reject) => {
-        wireStreams(ctx.child, ctx.buffers, ctx.deps.policy, ctx.state);
-        settleOnClose(ctx, resolve, reject);
-        armTimersAndAbort(ctx);
-    });
-}
-// Runs an allowlisted command. Rejects with CommandDeniedError (before spawn) for a denied
-// command or a workspace-escaping cwd (PathEscapeError), CommandTimeoutError on timeout, and
-// CommandCancelledError on abort; otherwise resolves a redacted, byte-capped CommandResult. All
-// failure paths are Promise rejections — the function never throws synchronously.
-export function runCommand(input, deps) {
-    try {
-        validateRunCommandInput(input, deps);
-        const executable = resolveExecutable(input, deps);
-        const cwd = resolveCwd(deps, input.cwd);
-        const env = buildSandboxEnv(deps.processEnv, deps.policy.envAllowlist);
-        const home = deps.home ?? nodeHomeProvider;
-        const homeDir = home.make();
-        env.HOME = homeDir;
-        env.USERPROFILE = homeDir;
-        const state = createRunState(home, homeDir);
-        const child = spawnChild(input, deps, executable, cwd, env, state);
-        const buffers = { out: [], err: [], total: 0, truncated: false };
-        const ctx = { child, input, deps, buffers, state, startedAt: deps.now() };
-        return runSpawnedChild(ctx);
-    }
-    catch (error) {
-        return Promise.reject(asError(error, "command execution failed"));
-    }
-}
+// Re-export shim: command execution boundary lives in @oscharko-dev/keiko-tools
+// (issue #162, ADR-0019). All existing import sites (`from "../tools/exec.js"`) keep resolving
+// unchanged via this barrel.
+export { nodeHomeProvider, nodeSpawnFn } from "@oscharko-dev/keiko-tools/internal/exec";
+export { runCommand, } from "@oscharko-dev/keiko-tools";

package/dist/tools/index.d.ts

@@ -1,11 +1,13 @@
-export type { CommandResult, CommandRule, CommandRunInput, NetworkPolicy, PatchApplyResult, PatchChangeKind, PatchConflict, PatchFileChange, PatchHunk, PatchLimits, PatchRejection, PatchRejectionCode, PatchValidation, SandboxPolicy, ToolHostConfig, ToolHostConfigInput, } from "./types.js";
-export { DEFAULT_COMMAND_RULES, DEFAULT_ENV_ALLOWLIST, DEFAULT_PATCH_LIMITS, DEFAULT_SANDBOX_POLICY, DEFAULT_TOOL_HOST_CONFIG, resolveToolHostConfig, } from "./types.js";
-export { CommandCancelledError, CommandDeniedError, CommandTimeoutError, OutputLimitError, PatchApplyDisabledError, PatchApplyError, PatchValidationError, TOOL_CODES, ToolArgumentError, ToolError, UnknownToolError, type ToolCode, } from "./errors.js";
-export { buildSandboxEnv, collectSensitiveEnvValues, isCommandAllowed, type CommandDecision, } from "./sandbox.js";
-export { nodeWorkspaceWriter, type WorkspaceWriter } from "./writer.js";
-export { nodeSpawnFn, runCommand, type RunCommandDeps, type RunCommandInput, type ExecutableResolver, type ExecutableResolverDeps, type SpawnFn, type SpawnOptions, } from "./exec.js";
-export { applyPatch, renderDryRun, validatePatch, type ApplyDeps, type ValidateDeps, } from "./patch.js";
-export { normalizeUnifiedDiffHunks } from "./patch-normalize.js";
-export { parseUnifiedDiff, type ParsedPatch } from "./patch-parse.js";
-export { TOOL_DEFINITIONS } from "./schemas.js";
-export { WorkspaceToolHost } from "./registry.js";
+export type { CommandResult, CommandRule, CommandRunInput, NetworkPolicy, PatchApplyResult, PatchChangeKind, PatchConflict, PatchFileChange, PatchHunk, PatchLimits, PatchRejection, PatchRejectionCode, PatchValidation, SandboxPolicy, ToolHostConfig, ToolHostConfigInput, } from "@oscharko-dev/keiko-tools";
+export { DEFAULT_COMMAND_RULES, DEFAULT_ENV_ALLOWLIST, DEFAULT_PATCH_LIMITS, DEFAULT_SANDBOX_POLICY, DEFAULT_TOOL_HOST_CONFIG, resolveToolHostConfig, } from "@oscharko-dev/keiko-tools";
+export { CommandCancelledError, CommandDeniedError, CommandTimeoutError, OutputLimitError, PatchApplyDisabledError, PatchApplyError, PatchValidationError, TOOL_CODES, ToolArgumentError, ToolError, UnknownToolError, type ToolCode, } from "@oscharko-dev/keiko-tools";
+export { buildSandboxEnv, collectSensitiveEnvValues, isCommandAllowed, type CommandDecision, } from "@oscharko-dev/keiko-tools";
+export { nodeWorkspaceWriter } from "@oscharko-dev/keiko-tools/internal/writer";
+export type { WorkspaceWriter } from "@oscharko-dev/keiko-tools";
+export { nodeSpawnFn } from "@oscharko-dev/keiko-tools/internal/exec";
+export { runCommand, type RunCommandDeps, type RunCommandInput, type ExecutableResolver, type ExecutableResolverDeps, type SpawnFn, type SpawnOptions, } from "@oscharko-dev/keiko-tools";
+export { applyPatch, renderDryRun, validatePatch, type ApplyDeps, type ValidateDeps, } from "@oscharko-dev/keiko-tools";
+export { normalizeUnifiedDiffHunks } from "@oscharko-dev/keiko-tools";
+export { parseUnifiedDiff, type ParsedPatch } from "@oscharko-dev/keiko-tools";
+export { TOOL_DEFINITIONS } from "@oscharko-dev/keiko-tools";
+export { WorkspaceToolHost } from "@oscharko-dev/keiko-tools";

package/dist/tools/index.js

@@ -1,14 +1,21 @@
-// Public barrel for the safe tool-execution layer (ADR-0006). The tool host is the trust
-// boundary between model output and developer repositories: deny-by-default command allowlist,
-// env-isolated no-shell spawn, and a fail-closed, atomic patch workflow. Explicit named
-// re-exports, `type` keyword for type-only, double quotes, `.js`.
-export { DEFAULT_COMMAND_RULES, DEFAULT_ENV_ALLOWLIST, DEFAULT_PATCH_LIMITS, DEFAULT_SANDBOX_POLICY, DEFAULT_TOOL_HOST_CONFIG, resolveToolHostConfig, } from "./types.js";
-export { CommandCancelledError, CommandDeniedError, CommandTimeoutError, OutputLimitError, PatchApplyDisabledError, PatchApplyError, PatchValidationError, TOOL_CODES, ToolArgumentError, ToolError, UnknownToolError, } from "./errors.js";
-export { buildSandboxEnv, collectSensitiveEnvValues, isCommandAllowed, } from "./sandbox.js";
-export { nodeWorkspaceWriter } from "./writer.js";
-export { nodeSpawnFn, runCommand, } from "./exec.js";
-export { applyPatch, renderDryRun, validatePatch, } from "./patch.js";
-export { normalizeUnifiedDiffHunks } from "./patch-normalize.js";
-export { parseUnifiedDiff } from "./patch-parse.js";
-export { TOOL_DEFINITIONS } from "./schemas.js";
-export { WorkspaceToolHost } from "./registry.js";
+// Re-export shim: the safe tool-execution layer lives in @oscharko-dev/keiko-tools
+// (issue #162, ADR-0019). All existing import sites (`from "../tools/index.js"`) keep
+// resolving unchanged via this barrel.
+//
+// Explicitly enumerated to match the PRE-MOVE surface of `src/tools/index.ts`. Browser CDP
+// symbols (CdpClient, validators, BrowserToolError, BrowserSessionManager, etc.) are
+// deliberately ABSENT from this barrel — they were only ever accessible via
+// `src/tools/browser/index.ts` before the extraction, and the legacy shim there preserves
+// that surface. Mirrors the workspace shim asymmetry pattern (`nodeWorkspaceFs` not exposed
+// on the legacy workspace barrel) so a future SDK-leak test can pin this invariant.
+export { DEFAULT_COMMAND_RULES, DEFAULT_ENV_ALLOWLIST, DEFAULT_PATCH_LIMITS, DEFAULT_SANDBOX_POLICY, DEFAULT_TOOL_HOST_CONFIG, resolveToolHostConfig, } from "@oscharko-dev/keiko-tools";
+export { CommandCancelledError, CommandDeniedError, CommandTimeoutError, OutputLimitError, PatchApplyDisabledError, PatchApplyError, PatchValidationError, TOOL_CODES, ToolArgumentError, ToolError, UnknownToolError, } from "@oscharko-dev/keiko-tools";
+export { buildSandboxEnv, collectSensitiveEnvValues, isCommandAllowed, } from "@oscharko-dev/keiko-tools";
+export { nodeWorkspaceWriter } from "@oscharko-dev/keiko-tools/internal/writer";
+export { nodeSpawnFn } from "@oscharko-dev/keiko-tools/internal/exec";
+export { runCommand, } from "@oscharko-dev/keiko-tools";
+export { applyPatch, renderDryRun, validatePatch, } from "@oscharko-dev/keiko-tools";
+export { normalizeUnifiedDiffHunks } from "@oscharko-dev/keiko-tools";
+export { parseUnifiedDiff } from "@oscharko-dev/keiko-tools";
+export { TOOL_DEFINITIONS } from "@oscharko-dev/keiko-tools";
+export { WorkspaceToolHost } from "@oscharko-dev/keiko-tools";

package/dist/tools/patch-content.d.ts

@@ -1,10 +1 @@
-import type { PatchFileChange } from "./types.js";
-export interface HunkConflict {
-    readonly hunkIndex: number;
-    readonly reason: string;
-}
-export interface ApplyOutcome {
-    readonly content: string | null;
-    readonly conflicts: readonly HunkConflict[];
-}
-export declare function computeFileContent(change: PatchFileChange, current: string | undefined): ApplyOutcome;
+export { computeFileContent, type ApplyOutcome, type HunkConflict, } from "@oscharko-dev/keiko-tools";

package/dist/tools/patch-content.js

@@ -1,126 +1,4 @@
-// PURE hunk application against in-memory file content. Given the current file lines and a
-// file's hunks, it verifies the pre-image (context and removed lines must match the current
-// content at the hunk location) and produces the post-image. A mismatch yields a conflict
-// rather than a silent corruption — the apply phase refuses to write when any conflict exists.
-// Splits file content into lines WITHOUT a trailing empty element for a final newline, so line
-// indexing matches unified-diff 1-based line numbers. An empty file is zero lines.
-function toLines(content) {
-    if (content === "") {
-        return [];
-    }
-    const lines = content.split("\n");
-    if (lines.at(-1) === "") {
-        lines.pop();
-    }
-    return lines;
-}
-function joinLines(lines) {
-    return lines.length === 0 ? "" : `${lines.join("\n")}\n`;
-}
-// Applies a single hunk starting at `cursor` (0-based index into the original lines). Returns the
-// produced output lines, the count of original lines consumed, and a conflict reason on mismatch.
-function applyHunk(original, hunk, cursor) {
-    const out = [];
-    let pos = cursor;
-    for (const raw of hunk.lines) {
-        const marker = raw.charAt(0);
-        const text = raw.slice(1);
-        if (marker === "+") {
-            out.push(text);
-            continue;
-        }
-        // context (" ") and removal ("-") must both match the current line at pos.
-        if (original[pos] !== text) {
-            return {
-                outLines: [],
-                consumed: 0,
-                conflict: `context mismatch at original line ${String(pos + 1)}`,
-            };
-        }
-        if (marker === " ") {
-            out.push(text);
-        }
-        pos += 1;
-    }
-    return { outLines: out, consumed: pos - cursor, conflict: undefined };
-}
-// Applies all hunks of a modify in order. Hunks are anchored by their stated oldStart (1-based);
-// lines between hunks are copied verbatim. Returns the new content or the collected conflicts.
-function applyModify(original, hunks) {
-    const out = [];
-    const conflicts = [];
-    let cursor = 0;
-    hunks.forEach((hunk, index) => {
-        const anchor = Math.max(hunk.oldStart - 1, 0);
-        if (anchor < cursor) {
-            conflicts.push({ hunkIndex: index, reason: "overlapping or out-of-order hunk" });
-            return;
-        }
-        // Copy verbatim the unchanged lines between the previous cursor and this hunk's anchor.
-        out.push(...original.slice(cursor, Math.min(anchor, original.length)));
-        cursor = anchor;
-        const result = applyHunk(original, hunk, cursor);
-        if (result.conflict !== undefined) {
-            conflicts.push({ hunkIndex: index, reason: result.conflict });
-            return;
-        }
-        out.push(...result.outLines);
-        cursor += result.consumed;
-    });
-    // Copy any remaining original lines after the last applied hunk.
-    out.push(...original.slice(cursor));
-    return conflicts.length > 0
-        ? { content: null, conflicts }
-        : { content: joinLines(out), conflicts: [] };
-}
-// Verifies a delete's pre-image against the current content (C2). A delete hunk lists the lines to
-// remove (`-`) and surrounding context (` `); their concatenation must equal the current file, or
-// the diff is stale/fabricated and we MUST NOT delete a mismatched file. A hunk-free delete (no
-// pre-image to check) is accepted as-is. `+` lines are not expected in a delete and are ignored.
-function verifyDeletePreImage(change, current) {
-    const preImage = [];
-    for (const hunk of change.hunks) {
-        for (const raw of hunk.lines) {
-            const marker = raw.charAt(0);
-            if (marker === " " || marker === "-") {
-                preImage.push(raw.slice(1));
-            }
-        }
-    }
-    if (preImage.length === 0) {
-        return { content: null, conflicts: [] };
-    }
-    const matches = joinLines(preImage) === current || preImage.join("\n") === current;
-    return matches
-        ? { content: null, conflicts: [] }
-        : {
-            content: null,
-            conflicts: [{ hunkIndex: 0, reason: "delete pre-image does not match current content" }],
-        };
-}
-// Computes the post-image for one file change against its current content (undefined = absent).
-export function computeFileContent(change, current) {
-    if (change.kind === "create") {
-        if (current !== undefined) {
-            return {
-                content: null,
-                conflicts: [{ hunkIndex: 0, reason: "create target already exists" }],
-            };
-        }
-        const added = change.hunks.flatMap((h) => h.lines.filter((l) => l.startsWith("+")).map((l) => l.slice(1)));
-        return { content: joinLines(added), conflicts: [] };
-    }
-    if (change.kind === "delete") {
-        if (current === undefined) {
-            return {
-                content: null,
-                conflicts: [{ hunkIndex: 0, reason: "delete target does not exist" }],
-            };
-        }
-        return verifyDeletePreImage(change, current);
-    }
-    if (current === undefined) {
-        return { content: null, conflicts: [{ hunkIndex: 0, reason: "modify target does not exist" }] };
-    }
-    return applyModify(toLines(current), change.hunks);
-}
+// Re-export shim: patch-content helpers live in @oscharko-dev/keiko-tools (issue #162, ADR-0019).
+// All existing import sites (`from "../tools/patch-content.js"`) keep resolving unchanged via this
+// barrel.
+export { computeFileContent, } from "@oscharko-dev/keiko-tools";

package/dist/tools/patch-normalize.d.ts

@@ -1 +1 @@
-export declare function normalizeUnifiedDiffHunks(diff: string): string;
+export { normalizeUnifiedDiffHunks } from "@oscharko-dev/keiko-tools";

package/dist/tools/patch-normalize.js

@@ -1,79 +1,4 @@
-// Best-effort normalization for common LLM unified-diff shorthand. This module rewrites hunk headers
-// from the hunk body markers (" ", "+", "-") and repairs blank context lines that models often emit
-// as an empty line instead of a single-space diff line. It does not invent paths; the normal
-// validate/apply path still performs path containment, deny-list checks, and conflict checks.
-const HUNK_HEADER = /^@@ -(\d+)(?:,\d+)? \+(\d+)(?:,\d+)? @@(.*)$/;
-function isBodyLine(line) {
-    const marker = line.charAt(0);
-    return marker === " " || marker === "+" || marker === "-";
-}
-function isFileHeaderPair(lines, index) {
-    return lines[index]?.startsWith("--- ") === true && lines[index + 1]?.startsWith("+++ ") === true;
-}
-function hunkEnd(lines, start) {
-    let index = start;
-    while (index < lines.length) {
-        const line = lines[index] ?? "";
-        if (line.startsWith("@@") || isFileHeaderPair(lines, index)) {
-            break;
-        }
-        index += 1;
-    }
-    return index;
-}
-function countOldLines(lines) {
-    return lines.filter((line) => line.startsWith(" ") || line.startsWith("-")).length;
-}
-function countNewLines(lines) {
-    return lines.filter((line) => line.startsWith(" ") || line.startsWith("+")).length;
-}
-function parseStarts(line) {
-    const match = HUNK_HEADER.exec(line);
-    if (match === null) {
-        return line.trim() === "@@" ? { oldStart: 0, newStart: 1, suffix: "" } : undefined;
-    }
-    return {
-        oldStart: Number(match[1]),
-        newStart: Number(match[2]),
-        suffix: match[3] ?? "",
-    };
-}
-function formatRange(start, count) {
-    return `${String(start)},${String(count)}`;
-}
-function normalizeHunkHeader(header, body) {
-    const starts = parseStarts(header);
-    if (starts === undefined) {
-        return header;
-    }
-    const { oldStart, newStart, suffix } = starts;
-    return `@@ -${formatRange(oldStart, countOldLines(body))} +${formatRange(newStart, countNewLines(body))} @@${suffix}`;
-}
-function hasBodyLineBefore(lines, index) {
-    return lines.slice(0, index).some(isBodyLine);
-}
-function hasBodyLineAfter(lines, index) {
-    return lines.slice(index + 1).some(isBodyLine);
-}
-function normalizeBlankContextLines(lines) {
-    return lines.map((line, index) => line === "" && hasBodyLineBefore(lines, index) && hasBodyLineAfter(lines, index) ? " " : line);
-}
-export function normalizeUnifiedDiffHunks(diff) {
-    const lines = diff.split("\n");
-    const out = [];
-    let index = 0;
-    while (index < lines.length) {
-        const line = lines[index] ?? "";
-        if (!line.startsWith("@@")) {
-            out.push(line);
-            index += 1;
-            continue;
-        }
-        const end = hunkEnd(lines, index + 1);
-        const normalizedLines = normalizeBlankContextLines(lines.slice(index + 1, end));
-        const body = normalizedLines.filter(isBodyLine);
-        out.push(normalizeHunkHeader(line, body), ...normalizedLines);
-        index = end;
-    }
-    return out.join("\n");
-}
+// Re-export shim: unified-diff normalization lives in @oscharko-dev/keiko-tools (issue #162,
+// ADR-0019). All existing import sites (`from "../tools/patch-normalize.js"`) keep resolving
+// unchanged via this barrel.
+export { normalizeUnifiedDiffHunks } from "@oscharko-dev/keiko-tools";

package/dist/tools/patch-parse.d.ts

@@ -1,8 +1 @@
-import type { PatchFileChange } from "./types.js";
-export interface ParsedPatch {
-    readonly files: readonly PatchFileChange[];
-}
-export declare class PatchParseError extends Error {
-    constructor(message: string);
-}
-export declare function parseUnifiedDiff(diff: string): ParsedPatch;
+export { parseUnifiedDiff, PatchParseError, type ParsedPatch } from "@oscharko-dev/keiko-tools";