@semalt-ai/code 1.19.0 → 1.20.1

package/test/exec-diff.test.js

@@ -0,0 +1,268 @@
+'use strict';
+
+// Execution-time file-edit diffs.
+//
+// The fix moves file-edit diff rendering OUT of the permission modal and INTO
+// the execution-result path, so the diff renders for EVERY edit regardless of
+// approval state (manual-approved, auto-approved) or entry mode (fresh /
+// --resume / /history / /chats). These tests pin the three layers of that fix:
+//
+//   1. lib/ui/diff.js renderDiff — the changed-line cap (head+tail + notice for
+//      a large edit; full render for a small edit or a series of small edits).
+//   2. lib/ui/diff.js buildExecutionDiff — the once-per-edit decision: renders
+//      when a payload is present, returns null on error / no payload (a loaded
+//      history turn carries none, so past turns are NOT replayed) / no-op edit.
+//   3. The mutating executors (write/append/edit_file/replace_in_file) attach
+//      the before/after payload UNCONDITIONALLY — not gated by the permission
+//      modal — which is what makes an auto-approved edit show its diff.
+//
+// Home-based paths are redirected into a temp dir BEFORE any lib module loads,
+// matching test/readonly-tools.test.js.
+
+const os = require('node:os');
+const fs = require('node:fs');
+const path = require('node:path');
+
+const TMP_HOME = fs.mkdtempSync(path.join(os.tmpdir(), 'semalt-diff-home-'));
+const PREV_HOME = process.env.HOME;
+const PREV_USERPROFILE = process.env.USERPROFILE;
+process.env.HOME = TMP_HOME;
+process.env.USERPROFILE = TMP_HOME;
+
+const { test, before, after } = require('node:test');
+const assert = require('node:assert');
+
+const ui = require('../lib/ui');
+const { renderDiff, buildExecutionDiff } = require('../lib/ui/diff');
+const { summarizeToolResult } = require('../lib/ui/format');
+const { createPermissionManager } = require('../lib/permissions');
+const { createToolExecutor } = require('../lib/tools');
+const { DEFAULT_CONFIG } = require('../lib/constants');
+
+// renderDiff styles with ANSI only when stdout.isTTY; under `node --test` it is
+// false, so output is already plain. stripAnsi defends against a TTY harness.
+const stripAnsi = (s) => String(s).replace(/\x1b\[[0-9;]*m/g, '');
+
+function mkExec({ config = {}, pmOpts = {} } = {}) {
+  const pm = createPermissionManager(ui, pmOpts);
+  return createToolExecutor(pm, ui, () => ({
+    max_file_size_kb: 512,
+    command_timeout_ms: 30000,
+    max_output_lines: 50,
+    ...config,
+  }));
+}
+
+let CWD;
+let PREV_CWD;
+
+before(() => {
+  PREV_CWD = process.cwd();
+  CWD = fs.mkdtempSync(path.join(os.tmpdir(), 'semalt-diff-cwd-'));
+  process.chdir(CWD);
+});
+
+after(() => {
+  process.chdir(PREV_CWD);
+  if (PREV_HOME === undefined) delete process.env.HOME; else process.env.HOME = PREV_HOME;
+  if (PREV_USERPROFILE === undefined) delete process.env.USERPROFILE; else process.env.USERPROFILE = PREV_USERPROFILE;
+});
+
+const tmpFile = (name, content) => {
+  const p = path.join(CWD, name);
+  fs.writeFileSync(p, content);
+  return p;
+};
+
+// ── 1. renderDiff cap ───────────────────────────────────────────────────────
+
+test('renderDiff: small edit renders fully with no truncation notice', () => {
+  const out = stripAnsi(renderDiff('a\nb\nc', 'a\nB\nc', 'f.txt', { maxLines: 50 }));
+  assert.match(out, /B/, 'the changed line is shown');
+  assert.doesNotMatch(out, /more changed lines/, 'no cap notice for a small edit');
+});
+
+test('renderDiff: edit exceeding diff_max_lines renders head+tail + notice', () => {
+  const before = Array.from({ length: 100 }, (_, i) => `old ${i}`).join('\n');
+  const after = Array.from({ length: 100 }, (_, i) => `new ${i}`).join('\n');
+  const out = stripAnsi(renderDiff(before, after, 'big.txt', { maxLines: 10 }));
+  // 100 removed + 100 added = 200 changed lines, capped at 10 (head 6 + tail 4).
+  assert.match(out, /…\s*190 more changed lines \(200 total\)/, 'notice reports elided + total changed lines');
+  // Head shows the first removed line; tail shows the last added line.
+  assert.match(out, /old 0/, 'head of the diff is present');
+  assert.match(out, /new 99/, 'tail of the diff is present');
+  // Bounded: head(6) + notice + tail(4) = 11 lines, far below the input.
+  assert.ok(out.split('\n').length <= 14, 'capped output is bounded');
+});
+
+test('renderDiff: a series of small edits each render fully (no spurious truncation)', () => {
+  for (let i = 0; i < 5; i++) {
+    const before = `line one\nline two\nline three`;
+    const after = `line one\nline two CHANGED ${i}\nline three`;
+    const out = stripAnsi(renderDiff(before, after, `s${i}.txt`, { maxLines: 50 }));
+    assert.match(out, new RegExp(`CHANGED ${i}`), `edit ${i} renders its change`);
+    assert.doesNotMatch(out, /more changed lines/, `edit ${i} is not truncated`);
+  }
+});
+
+test('renderDiff: a large NEW file is also capped on changed (added) lines', () => {
+  const after = Array.from({ length: 80 }, (_, i) => `gen ${i}`).join('\n');
+  const out = stripAnsi(renderDiff('', after, 'new.txt', { maxLines: 10 }));
+  assert.match(out, /more changed lines \(80 total\)/, 'new-file additions count as changed lines');
+});
+
+// ── 1b. D3 (Output Refactor Phase 2): the diff body no longer repeats the path ─
+// The result line above the diff already states the file path (the descriptor's
+// `target`). The diff body therefore drops its redundant path header — the path
+// is stated once, on the result line. The @@ hunk ranges and the (new file)
+// marker remain; only the bare path-header line is gone.
+
+test('D3: an existing-file diff body does NOT restate the file path', () => {
+  const out = stripAnsi(renderDiff('a\nb\nc', 'a\nB\nc', 'unique/path/to/file.js', { maxLines: 50 }));
+  assert.doesNotMatch(out, /unique\/path\/to\/file\.js/, 'the path is not repeated in the diff body');
+  assert.match(out, /B/, 'the changed line is still shown');
+  assert.match(out, /@@/, 'the hunk range header remains');
+});
+
+test('D3: the capped diff body also omits the redundant path header', () => {
+  const before = Array.from({ length: 100 }, (_, i) => `old ${i}`).join('\n');
+  const after = Array.from({ length: 100 }, (_, i) => `new ${i}`).join('\n');
+  const out = stripAnsi(renderDiff(before, after, 'capped/unique-path.txt', { maxLines: 10 }));
+  assert.doesNotMatch(out, /capped\/unique-path\.txt/, 'no path header on the capped path');
+  // The cap notice + head + tail are unchanged.
+  assert.match(out, /…\s*190 more changed lines \(200 total\)/);
+  assert.match(out, /old 0/, 'head of the diff is present');
+  assert.match(out, /new 99/, 'tail of the diff is present');
+});
+
+test('D3: a new-file diff keeps its @@ (new file) marker but not a path header', () => {
+  const out = stripAnsi(renderDiff('', 'one\ntwo\nthree', 'brand/new-file.js', { maxLines: 50 }));
+  assert.doesNotMatch(out, /brand\/new-file\.js/, 'no path header for a new file');
+  assert.match(out, /\(new file\)/, 'the new-file hunk marker remains');
+  assert.match(out, /@@ -0,0 \+1,3 @@/, 'the new-file hunk range remains');
+});
+
+// ── 2. buildExecutionDiff (the once-per-edit decision) ───────────────────────
+
+test('buildExecutionDiff: renders the diff when a payload is present', () => {
+  const out = buildExecutionDiff({ diff: { before: 'a\nb', after: 'a\nB', path: 'f.txt' }, maxLines: 50 });
+  assert.ok(out, 'a diff string is produced');
+  assert.match(stripAnsi(out), /B/);
+});
+
+test('buildExecutionDiff: returns null on a failed edit (no diff under an error)', () => {
+  const out = buildExecutionDiff({ diff: { before: 'a', after: 'b', path: 'f' }, error: { message: 'boom' }, maxLines: 50 });
+  assert.strictEqual(out, null);
+});
+
+test('buildExecutionDiff: returns null with no payload — loaded turns are not replayed', () => {
+  // A loaded-history tool result reaches the UI without a before/after payload
+  // (diffs are never persisted), so nothing replays for past turns.
+  assert.strictEqual(buildExecutionDiff({ diff: null, maxLines: 50 }), null);
+  assert.strictEqual(buildExecutionDiff({ maxLines: 50 }), null);
+  assert.strictEqual(buildExecutionDiff({ diff: { before: 'a' }, maxLines: 50 }), null);
+});
+
+test('buildExecutionDiff: returns null for a no-op edit (before === after)', () => {
+  assert.strictEqual(buildExecutionDiff({ diff: { before: 'x\ny', after: 'x\ny', path: 'f' }, maxLines: 50 }), null);
+});
+
+test('buildExecutionDiff: honors diff_max_lines for the cap', () => {
+  const before = Array.from({ length: 60 }, (_, i) => `o${i}`).join('\n');
+  const after = Array.from({ length: 60 }, (_, i) => `n${i}`).join('\n');
+  const out = stripAnsi(buildExecutionDiff({ diff: { before, after, path: 'p' }, maxLines: 8 }));
+  assert.match(out, /more changed lines \(120 total\)/);
+});
+
+// ── 3. Executors attach the before/after payload unconditionally ─────────────
+// The payload is produced by the executor itself, NOT by the permission modal —
+// so it is present whether the call was manual-approved, auto-approved, or run
+// in any entry mode. (The agent loop forwards it to onToolEnd, which renders it
+// exactly once — the modal no longer carries the full diff.)
+
+test('write (new file): payload captures empty before → full content after', async () => {
+  const exec = mkExec();
+  const f = path.join(CWD, 'created.txt');
+  const r = await exec.agentExecFile('write', f, 'hello\nworld');
+  assert.strictEqual(r.status, 'ok');
+  assert.strictEqual(r._diffBefore, '');
+  assert.strictEqual(r._diffAfter, 'hello\nworld');
+});
+
+test('write (existing file): payload captures prior content as before', async () => {
+  const exec = mkExec();
+  const f = tmpFile('over.txt', 'old text');
+  const r = await exec.agentExecFile('write', f, 'new text');
+  assert.strictEqual(r._diffBefore, 'old text');
+  assert.strictEqual(r._diffAfter, 'new text');
+});
+
+test('append: payload after is prior + appended content', async () => {
+  const exec = mkExec();
+  const f = tmpFile('log.txt', 'line1\n');
+  const r = await exec.agentExecFile('append', f, 'line2\n');
+  assert.strictEqual(r._diffBefore, 'line1\n');
+  assert.strictEqual(r._diffAfter, 'line1\nline2\n');
+});
+
+test('edit_file (single line): payload reflects the one-line swap', async () => {
+  const exec = mkExec();
+  const f = tmpFile('e.txt', 'a\nb\nc');
+  const r = await exec.agentExecFile('edit_file', f, 2, 'B');
+  assert.strictEqual(r._diffBefore, 'a\nb\nc');
+  assert.strictEqual(r._diffAfter, 'a\nB\nc');
+});
+
+test('edit_file (line range): payload reflects the block replacement', async () => {
+  const exec = mkExec();
+  const f = tmpFile('r.txt', 'a\nb\nc\nd');
+  const r = await exec.agentExecFile('edit_file', f, 2, 'X\nY\nZ', 3);
+  assert.strictEqual(r._diffBefore, 'a\nb\nc\nd');
+  assert.strictEqual(r._diffAfter, 'a\nX\nY\nZ\nd');
+});
+
+test('replace_in_file: payload captures before/after of the replacement', async () => {
+  const exec = mkExec();
+  const f = tmpFile('rep.txt', 'foo bar foo');
+  const r = await exec.agentExecFile('replace_in_file', f, 'bar', 'baz', '');
+  assert.strictEqual(r._diffBefore, 'foo bar foo');
+  assert.strictEqual(r._diffAfter, 'foo baz foo');
+});
+
+test('a failed edit attaches NO payload (out-of-range line)', async () => {
+  const exec = mkExec();
+  const f = tmpFile('oor.txt', 'one\ntwo');
+  const r = await exec.agentExecFile('edit_file', f, 99, 'X');
+  assert.ok(r.error, 'the edit failed');
+  assert.strictEqual(r._diffBefore, undefined, 'no diff payload on a failed edit');
+});
+
+// End-to-end through buildExecutionDiff: the executor payload renders a real diff
+// for an auto-approve-style call (no modal involved in this harness at all).
+test('parity: an executor payload renders a diff with no modal in the loop', async () => {
+  const exec = mkExec();
+  const f = tmpFile('parity.txt', 'keep\nold\nkeep');
+  const r = await exec.agentExecFile('edit_file', f, 2, 'new');
+  const out = stripAnsi(buildExecutionDiff({
+    diff: { before: r._diffBefore, after: r._diffAfter, path: f },
+    maxLines: DEFAULT_CONFIG.diff_max_lines,
+  }));
+  assert.match(out, /new/, 'the new content shows in the rendered diff');
+  assert.match(out, /old/, 'the removed content shows in the rendered diff');
+});
+
+// ── 4. No replay: loaded history collapses to summaries, not diffs ───────────
+
+test('loaded-history file results summarize to a one-liner (never a diff)', () => {
+  // displayLoadedMessages renders stored tool results through summarizeToolResult.
+  // A persisted write result is a short "Wrote …" line — there is no diff to replay.
+  const summary = summarizeToolResult('Wrote 42 bytes to /tmp/x.txt');
+  assert.strictEqual(summary, 'Wrote 42 bytes to /tmp/x.txt');
+  assert.doesNotMatch(summary, /more changed lines/);
+});
+
+// ── config default ───────────────────────────────────────────────────────────
+
+test('diff_max_lines has a sane default', () => {
+  assert.strictEqual(DEFAULT_CONFIG.diff_max_lines, 50);
+});

package/test/executors.test.js

@@ -186,6 +186,63 @@ test('edit_file out-of-range line returns an error', async () => {
   assert.ok(r.error && /out of range/i.test(r.error));
 });
 
+// Part 2: line-range edit_file (regex-free block replacement) ----------------
+
+test('edit_file replaces a contiguous line range with multi-line content', async () => {
+  await ef('write', 'range.txt', 'l1\nl2\nl3\nl4\nl5');
+  const r = await ef('edit_file', 'range.txt', 2, 'A\nB\nC', 4);
+  assert.strictEqual(r.status, 'ok');
+  assert.strictEqual(r.line, 2);
+  assert.strictEqual(r.end_line, 4);
+  assert.strictEqual(read('range.txt'), 'l1\nA\nB\nC\nl5', 'lines 2-4 replaced wholesale');
+});
+
+test('edit_file line-range collapses several lines into one', async () => {
+  await ef('write', 'range2.txt', 'keep\nx\ny\nz\nkeep2');
+  const r = await ef('edit_file', 'range2.txt', 2, 'ONE', 4);
+  assert.strictEqual(r.status, 'ok');
+  assert.strictEqual(read('range2.txt'), 'keep\nONE\nkeep2');
+});
+
+test('edit_file line-range out of range returns an error (no mutation)', async () => {
+  await ef('write', 'range3.txt', 'a\nb\nc');
+  const r = await ef('edit_file', 'range3.txt', 2, 'X', 99);
+  assert.ok(r.error && /out of range/i.test(r.error));
+  assert.strictEqual(read('range3.txt'), 'a\nb\nc');
+});
+
+test('edit_file rejects an inverted range (end before start)', async () => {
+  await ef('write', 'range4.txt', 'a\nb\nc\nd');
+  const r = await ef('edit_file', 'range4.txt', 3, 'X', 2);
+  assert.ok(r.error && /out of range/i.test(r.error));
+  assert.strictEqual(read('range4.txt'), 'a\nb\nc\nd');
+});
+
+test('edit_file single-line (no end_line) is unchanged (paired no-regression)', async () => {
+  await ef('write', 'single.txt', 'l1\nl2\nl3');
+  const r = await ef('edit_file', 'single.txt', 2, 'REPLACED');
+  assert.strictEqual(r.status, 'ok');
+  assert.strictEqual(r.line, 2);
+  assert.strictEqual(r.end_line, undefined, 'no end_line reported for a single-line edit');
+  assert.strictEqual(read('single.txt'), 'l1\nREPLACED\nl3');
+});
+
+test('edit_file round-trip: read a file, then replace an exact line range by number', async () => {
+  // Mirrors the intended large-edit workflow: read_file (a numbered slice tells
+  // the agent the 1-based line numbers), then edit_file with line..end_line.
+  const src = ['def race(self):', '    speed = 0', '    # broken', '    pass', 'done()'].join('\n');
+  await ef('write', 'cligames.py', src);
+  const rd = await ef('read', 'cligames.py', null, null, true);
+  const lines = rd.content.split('\n');
+  // Locate the broken body (lines 2..4, 1-based) the way an agent would from numbers.
+  const start = lines.findIndex((l) => l.includes('speed = 0')) + 1;
+  const end = lines.findIndex((l) => l.includes('pass')) + 1;
+  assert.deepStrictEqual([start, end], [2, 4]);
+  const r = await ef('edit_file', 'cligames.py', start, '    speed = 10\n    move()', end);
+  assert.strictEqual(r.status, 'ok');
+  assert.strictEqual(read('cligames.py'), 'def race(self):\n    speed = 10\n    move()\ndone()');
+});
+
 test('search_in_file returns matching lines with 1-based numbers', async () => {
   await ef('write', 's.txt', 'alpha\nbeta\ngamma beta');
   const r = await ef('search_in_file', 's.txt', 'beta');
@@ -200,34 +257,214 @@ test('search_in_file refuses a protected secret path', async () => {
   assert.ok(r.error && /secrets|credentials/i.test(r.error));
 });
 
-test('replace_in_file with explicit "g" flag replaces all and reports the count', async () => {
+test('replace_in_file with replace_all replaces all occurrences and reports the count', async () => {
+  // Literal is now the default; replacing more than one occurrence requires the
+  // explicit replace_all flag (positional arg 6) — without it the >1-match guard
+  // would refuse (see the ambiguity test below).
   await ef('write', 'repg.txt', 'a a a');
-  const r = await ef('replace_in_file', 'repg.txt', 'a', 'b', 'g');
+  const r = await ef('replace_in_file', 'repg.txt', 'a', 'b', '', false, true);
   assert.strictEqual(r.status, 'ok');
   assert.strictEqual(r.count, 3);
   assert.strictEqual(read('repg.txt'), 'b b b');
 });
 
-test('replace_in_file without "g" flag replaces only the first match and reports count 1', async () => {
-  // Fixed in Task 1.4c (was a count bug pinned in 1.4b): the replacement
-  // semantics are unchanged — without "g", only the first occurrence is replaced
-  // — but the returned count now reflects the replacements ACTUALLY performed
-  // (1) instead of the always-global match total (3).
+test('replace_in_file REFUSES an ambiguous (>1) match when replace_all is not set, file unchanged', async () => {
+  // Was: silently replaced only the FIRST of three (wrong-span corruption risk).
+  // Now: the uniqueness guard refuses and names the count, file untouched.
   await ef('write', 'rep.txt', 'a a a');
   const r = await ef('replace_in_file', 'rep.txt', 'a', 'b', '');
-  assert.strictEqual(r.status, 'ok');
-  assert.strictEqual(read('rep.txt'), 'b a a', 'only the first occurrence is replaced (semantics unchanged)');
-  assert.strictEqual(r.count, 1, 'count equals the actual number of replacements');
+  assert.ok(r.error && /found 3 matches/i.test(r.error), `expected ambiguity error, got ${JSON.stringify(r)}`);
+  assert.ok(/replace_all/i.test(r.error));
+  assert.strictEqual(read('rep.txt'), 'a a a', 'file must be unchanged on refusal');
 });
 
-test('replace_in_file reports count 0 when there is no match (no file change)', async () => {
+test('replace_in_file REFUSES when there is no match (count 0 is an error, file unchanged)', async () => {
+  // Was: returned {status:'ok', count:0} — masking a no-op as success. Now errors.
   await ef('write', 'rep0.txt', 'xyz');
   const r = await ef('replace_in_file', 'rep0.txt', 'q', 'b', '');
-  assert.strictEqual(r.status, 'ok');
-  assert.strictEqual(r.count, 0);
+  assert.ok(r.error && /not found/i.test(r.error), `expected not-found error, got ${JSON.stringify(r)}`);
   assert.strictEqual(read('rep0.txt'), 'xyz');
 });
 
+// ---------------------------------------------------------------------------
+// replace_in_file: LITERAL-by-default + uniqueness guard (Claude Code Edit model)
+// Literal is the DEFAULT for ALL searches — a block with ( ) { } . [ ] is matched
+// byte-for-byte, never as a regex (so "Nothing to repeat" can't happen on real
+// code). Regex is opt-in via regex:true and keeps the ReDoS guard. The match must
+// be UNIQUE: 0 → error, >1 → error unless replace_all. These tests are PAIRED:
+// the now-allowed literals and the still-blocked regex bombs share one mechanism.
+
+test('replace_in_file: a ~5,000-char literal block on a 40 KB file is allowed and replaces correctly (the reported bug)', async () => {
+  // A plain block, NO regex metacharacters — only words, spaces, newlines.
+  const block = Array.from({ length: 250 }, (_, i) => `line number ${i} of the copied block`).join('\n');
+  assert.ok(block.length >= 5000, `block is ${block.length} chars`);
+  const filler = ('x'.repeat(79) + '\n').repeat(500); // ~40 KB of surrounding file
+  await ef('write', 'big-literal.txt', filler + block + '\n' + filler);
+  const r = await ef('replace_in_file', 'big-literal.txt', block, 'REPLACED_BLOCK', '');
+  assert.strictEqual(r.status, 'ok', `expected ok, got ${JSON.stringify(r)}`);
+  assert.strictEqual(r.count, 1);
+  assert.ok(read('big-literal.txt').includes('REPLACED_BLOCK'));
+  assert.ok(!read('big-literal.txt').includes('line number 0 of the copied block'));
+});
+
+test('replace_in_file: a ~1,500-char literal block is allowed (default literal, no flag needed)', async () => {
+  const block = Array.from({ length: 60 }, (_, i) => `const value_${i} = compute(${i});`).join('\n');
+  // contains ( ) ; — matched verbatim by default (no regex, no literal flag needed)
+  assert.ok(block.length >= 1500, `block is ${block.length} chars`);
+  await ef('write', 'mid-literal.txt', 'header\n' + block + '\nfooter');
+  const r = await ef('replace_in_file', 'mid-literal.txt', block, 'X', '');
+  assert.strictEqual(r.status, 'ok');
+  assert.strictEqual(r.count, 1);
+  assert.strictEqual(read('mid-literal.txt'), 'header\nX\nfooter');
+});
+
+test('replace_in_file: dangerous regexes stay BLOCKED with regex:true (ReDoS protection intact)', async () => {
+  await ef('write', 'redos.txt', 'aaaaaaaaaaaaaaaaaaaa,');
+  for (const bomb of ['(a+)+$', '(.*,)*']) {
+    const r = await ef('replace_in_file', 'redos.txt', bomb, 'x', 'g', true);
+    assert.ok(r.error && /backtracking/i.test(r.error), `${bomb} must be rejected, got ${JSON.stringify(r)}`);
+  }
+});
+
+test('replace_in_file: a ~2,000-char metacharacter-heavy regex stays BLOCKED with regex:true', async () => {
+  // Heavy with active metacharacters → regex path → length cap rejects it.
+  const heavy = 'a.*b+c?'.repeat(300); // ~2,100 chars, full of . * + ?
+  assert.ok(heavy.length >= 2000, `heavy is ${heavy.length} chars`);
+  await ef('write', 'heavy.txt', 'abc');
+  const r = await ef('replace_in_file', 'heavy.txt', heavy, 'x', 'g', true);
+  assert.ok(r.error && /exceeds 1000 chars/i.test(r.error), `expected length rejection, got ${JSON.stringify(r)}`);
+});
+
+test('replace_in_file: a metacharacter-heavy string is matched LITERALLY by default (no length bound, no ReDoS check)', async () => {
+  // Same string that is length-rejected as a regex is matched VERBATIM by default
+  // — literal cannot backtrack, so its length is irrelevant. This is the trap the
+  // old auto-detect created: it routed this to the regex path and rejected it.
+  const heavy = 'a.*b+c?'.repeat(300);
+  await ef('write', 'litheavy.txt', 'head\n' + heavy + '\ntail');
+  const r = await ef('replace_in_file', 'litheavy.txt', heavy, 'Z', '');
+  assert.strictEqual(r.status, 'ok', `default-literal must match verbatim: ${JSON.stringify(r).slice(0, 160)}`);
+  assert.strictEqual(r.count, 1);
+  assert.strictEqual(read('litheavy.txt'), 'head\nZ\ntail');
+});
+
+test('replace_in_file: a literal block containing regex-special chars (parens) is matched literally, not as a group', async () => {
+  // foo(x) as a REGEX would match "foox" capturing x — never the literal text.
+  // By default (literal) it must match the verbatim "foo(x)".
+  await ef('write', 'parens.txt', 'before foo(x) after');
+  const r = await ef('replace_in_file', 'parens.txt', 'foo(x)', 'bar(y)', '');
+  assert.strictEqual(r.status, 'ok');
+  assert.strictEqual(r.count, 1);
+  assert.strictEqual(read('parens.txt'), 'before bar(y) after');
+});
+
+test('replace_in_file: default-literal with brackets/quantifier chars replaces a copied code line verbatim', async () => {
+  const line = 'arr[i] = items.map(x => x * 2);';
+  await ef('write', 'code.txt', 'a\n' + line + '\nb');
+  const r = await ef('replace_in_file', 'code.txt', line, 'arr[i] = items;', '');
+  assert.strictEqual(r.status, 'ok');
+  assert.strictEqual(r.count, 1);
+  assert.strictEqual(read('code.txt'), 'a\narr[i] = items;\nb');
+});
+
+test('replace_in_file: regex mode works (back-references) only when regex:true is set', async () => {
+  // Single group, so it does NOT trip the nested-quantifier guard. $1 honored.
+  await ef('write', 'rx.txt', 'key=value');
+  const r = await ef('replace_in_file', 'rx.txt', '(value)', '[$1]', '', true);
+  assert.strictEqual(r.status, 'ok');
+  assert.strictEqual(read('rx.txt'), 'key=[value]');
+});
+
+// ---------------------------------------------------------------------------
+// replace_in_file: focused new tests for the literal-default + uniqueness guard
+// (Claude Code Edit model — change set for this task).
+
+test('replace_in_file (a): a literal block with ( ) { } . [ ] is matched VERBATIM (no "Nothing to repeat")', async () => {
+  const block = 'if (a[i].fn({x: 1}) && (b||c)) { return *p; }';
+  await ef('write', 'meta.js', 'top\n' + block + '\nbottom');
+  const r = await ef('replace_in_file', 'meta.js', block, 'noop();', '');
+  assert.ok(!r.error, `must not error on metacharacters: ${JSON.stringify(r)}`);
+  assert.strictEqual(r.status, 'ok');
+  assert.strictEqual(r.count, 1);
+  assert.strictEqual(read('meta.js'), 'top\nnoop();\nbottom');
+});
+
+test('replace_in_file (b): search not found → ERROR, file unchanged', async () => {
+  await ef('write', 'nf.txt', 'hello world');
+  const r = await ef('replace_in_file', 'nf.txt', 'goodbye', 'x', '');
+  assert.ok(r.error && /not found/i.test(r.error));
+  assert.strictEqual(read('nf.txt'), 'hello world');
+});
+
+test('replace_in_file (c): 2+ matches without replace_all → ERROR naming the count, file unchanged', async () => {
+  await ef('write', 'amb.txt', 'foo\nbar\nfoo\nbaz\nfoo');
+  const r = await ef('replace_in_file', 'amb.txt', 'foo', 'qux', '');
+  assert.ok(r.error && /found 3 matches/i.test(r.error), `got ${JSON.stringify(r)}`);
+  assert.ok(/line/i.test(r.error), 'error should surface match line numbers for disambiguation');
+  assert.strictEqual(read('amb.txt'), 'foo\nbar\nfoo\nbaz\nfoo');
+});
+
+test('replace_in_file (d): unique match → replaced, honest count 1', async () => {
+  await ef('write', 'uniq.txt', 'alpha\nbeta\ngamma');
+  const r = await ef('replace_in_file', 'uniq.txt', 'beta', 'BETA', '');
+  assert.strictEqual(r.status, 'ok');
+  assert.strictEqual(r.count, 1);
+  assert.strictEqual(read('uniq.txt'), 'alpha\nBETA\ngamma');
+});
+
+test('replace_in_file (e): replace_all:true with N matches → all replaced, honest count N', async () => {
+  await ef('write', 'all.txt', 'x x x x');
+  const r = await ef('replace_in_file', 'all.txt', 'x', 'y', '', false, true);
+  assert.strictEqual(r.status, 'ok');
+  assert.strictEqual(r.count, 4);
+  assert.strictEqual(read('all.txt'), 'y y y y');
+});
+
+test('replace_in_file (f): regex:true with a real regex works and the ReDoS guard is still active', async () => {
+  await ef('write', 'rxf.txt', 'id=42; id=7;');
+  const ok = await ef('replace_in_file', 'rxf.txt', 'id=\\d+', 'id=0', '', true, true);
+  assert.strictEqual(ok.status, 'ok');
+  assert.strictEqual(ok.count, 2);
+  assert.strictEqual(read('rxf.txt'), 'id=0; id=0;');
+  // ReDoS guard still fires in regex mode
+  await ef('write', 'rxbomb.txt', 'aaaaaaaaaa!');
+  const bomb = await ef('replace_in_file', 'rxbomb.txt', '(a+)+$', 'x', 'g', true);
+  assert.ok(bomb.error && /backtracking/i.test(bomb.error));
+});
+
+test('replace_in_file (g): the original multi-line corruption repro now errors instead of silently corrupting', async () => {
+  // The reported "newBullet duplication": a block that appears more than once
+  // used to silently replace only the first span (wrong-span corruption). Now the
+  // uniqueness guard refuses; adding context makes it unique and it replaces.
+  const dup = '  const newBullet = makeBullet();\n  list.push(newBullet);';
+  await ef('write', 'bullets.js', 'function a() {\n' + dup + '\n}\nfunction b() {\n' + dup + '\n}\n');
+  const ambiguous = await ef('replace_in_file', 'bullets.js', dup, '  // removed', '');
+  assert.ok(ambiguous.error && /found 2 matches/i.test(ambiguous.error), `should refuse, got ${JSON.stringify(ambiguous)}`);
+  assert.ok(read('bullets.js').split(dup).length - 1 === 2, 'file unchanged — both copies intact');
+  // Disambiguate with surrounding context → unique → replaces correctly.
+  const unique = await ef('replace_in_file', 'bullets.js', 'function b() {\n' + dup + '\n}', 'function b() {}', '');
+  assert.strictEqual(unique.status, 'ok');
+  assert.strictEqual(unique.count, 1);
+  assert.ok(read('bullets.js').includes('function a() {\n' + dup), 'function a copy preserved');
+});
+
+test('replace_in_file (h): post-replace verification warns when the search string still remains', async () => {
+  // Replacement CONTAINS the search string → after replacing, it still appears.
+  await ef('write', 'warn.txt', 'value');
+  const r = await ef('replace_in_file', 'warn.txt', 'value', '[value]', '');
+  assert.strictEqual(r.status, 'ok');
+  assert.strictEqual(r.count, 1);
+  assert.ok(r.warning && /still appears/i.test(r.warning), `expected warning, got ${JSON.stringify(r)}`);
+  assert.strictEqual(read('warn.txt'), '[value]');
+});
+
+test('search_in_file: a long literal pattern is no longer rejected for length', async () => {
+  const block = 'token '.repeat(400).trimEnd(); // 2,399 chars, no metacharacters
+  await ef('write', 'searchbig.txt', 'noise\n' + block + '\nnoise');
+  const r = await ef('search_in_file', 'searchbig.txt', block);
+  assert.ok(!r.error, `expected matches, got ${JSON.stringify(r).slice(0, 120)}`);
+  assert.deepStrictEqual(r.matches, [{ line: 2, content: block }]);
+});
+
 test('search_files finds files by glob', async () => {
   await ef('write', 'find/x.ts', '1');
   await ef('write', 'find/y.js', '2');

package/test/extract-tool-calls.test.js

@@ -60,8 +60,9 @@ const ATTR_TAG_CASES = [
   { name: 'move_file',        tmpl: (q) => `<move_file src=${q}a${q} dst=${q}b${q}/>`,                 expected: [['move_file', 'a', 'b']] },
   { name: 'copy_file',        tmpl: (q) => `<copy_file src=${q}a${q} dst=${q}b${q}/>`,                 expected: [['copy_file', 'a', 'b']] },
   { name: 'edit_file',        tmpl: (q) => `<edit_file path=${q}a.js${q} line=${q}42${q}>x = 1</edit_file>`, expected: [['edit_file', 'a.js', 42, 'x = 1']] },
+  { name: 'edit_file range',  tmpl: (q) => `<edit_file path=${q}a.js${q} line=${q}10${q} end_line=${q}12${q}>block</edit_file>`, expected: [['edit_file', 'a.js', 10, 'block', 12]] },
   { name: 'search_in_file',   tmpl: (q) => `<search_in_file path=${q}a.js${q}>TODO</search_in_file>`,  expected: [['search_in_file', 'a.js', 'TODO']] },
-  { name: 'replace_in_file',  tmpl: (q) => `<replace_in_file path=${q}a.js${q} search=${q}old${q} replace=${q}new${q}>g</replace_in_file>`, expected: [['replace_in_file', 'a.js', 'old', 'new', 'g']] },
+  { name: 'replace_in_file',  tmpl: (q) => `<replace_in_file path=${q}a.js${q} search=${q}old${q} replace=${q}new${q}>g</replace_in_file>`, expected: [['replace_in_file', 'a.js', 'old', 'new', 'g', false, false]] },
   { name: 'upload',           tmpl: (q) => `<upload path=${q}a.bin${q}>QUJD</upload>`,                 expected: [['upload', 'a.bin', 'QUJD']] },
   { name: 'http_get attr',    tmpl: (q) => `<http_get url=${q}http://x/api${q}/>`,                     expected: [['http_get', 'http://x/api', {}]] },
   { name: 'ask_user',         tmpl: (q) => `<ask_user question=${q}Which lang?${q}/>`,                 expected: [['ask_user', 'Which lang?']] },
@@ -138,6 +139,36 @@ test('fenced shell block: each non-comment line becomes a shell call', () => {
   assert.deepStrictEqual(extractToolCalls(fx.SHELL_FENCE), [['shell', 'echo hi'], ['shell', 'ls -la']]);
 });
 
+// ---------------------------------------------------------------------------
+// skipTextHeuristics (P1, native-rail safety). The bare-code-fence pass is the
+// ONLY text heuristic that infers commands from untagged prose; on the native
+// rail it must be skipped so an illustrative ```bash block in a final answer is
+// never executed. EXPLICIT tool tags are unaffected — they run on both rails.
+// ---------------------------------------------------------------------------
+
+test('skipTextHeuristics: the bare ```bash fence is NOT extracted (native-rail guard)', () => {
+  // Same fixture the XML rail extracts above — with the flag, zero calls.
+  assert.deepStrictEqual(extractToolCalls(fx.SHELL_FENCE, { skipTextHeuristics: true }), []);
+  // A realistic illustrative block (the incident shape) yields nothing.
+  const prose = 'Here is an example you could run:\n```bash\nsu nobody\necho $TOKEN\n```\nThat would do it.';
+  assert.deepStrictEqual(extractToolCalls(prose, { skipTextHeuristics: true }), []);
+});
+
+test('skipTextHeuristics: EXPLICIT tool tags STILL extract (category A unaffected)', () => {
+  // <shell>/<exec> and every wrapper/registered tag are deliberate dispatch, so
+  // the flag leaves them intact — the native rail dispatches tools this way too.
+  assert.deepStrictEqual(extractToolCalls('<shell>echo HI</shell>', { skipTextHeuristics: true }), [['shell', 'echo HI']]);
+  assert.deepStrictEqual(extractToolCalls('<read_file>a.txt</read_file>', { skipTextHeuristics: true }), [['read', 'a.txt', null, null, false]]);
+  assert.deepStrictEqual(extractToolCalls(fx.MINIMAX_WRAPPER, { skipTextHeuristics: true }), [['write', 'a.json', '{"k":1}']]);
+});
+
+test('skipTextHeuristics OFF (XML rail): bare fence extraction is byte-identical to default', () => {
+  // Regression guard for the rail we keep: omitting the flag (XML rail) parses
+  // the fence exactly as before — same as the no-options characterization above.
+  assert.deepStrictEqual(extractToolCalls(fx.SHELL_FENCE, {}), [['shell', 'echo hi'], ['shell', 'ls -la']]);
+  assert.deepStrictEqual(extractToolCalls(fx.SHELL_FENCE, { skipTextHeuristics: false }), [['shell', 'echo hi'], ['shell', 'ls -la']]);
+});
+
 // ---------------------------------------------------------------------------
 // Multiple calls, ordering, nesting, equivalence.
 // ---------------------------------------------------------------------------
@@ -265,8 +296,10 @@ const MAP_CASES = [
   ['copy_file',      { src: 'a', dst: 'b' },                        ['copy_file', 'a', 'b']],
   ['file_stat',      { path: 'a' },                                 ['file_stat', 'a']],
   ['search_in_file', { path: 'a', pattern: 'p' },                   ['search_in_file', 'a', 'p']],
-  ['replace_in_file', { path: 'a', search: 'o', replace: 'n' },     ['replace_in_file', 'a', 'o', 'n', '']],
-  ['replace_in_file', { path: 'a', search: 'o', replace: 'n', flags: 'g' }, ['replace_in_file', 'a', 'o', 'n', 'g']],
+  ['replace_in_file', { path: 'a', search: 'o', replace: 'n' },     ['replace_in_file', 'a', 'o', 'n', '', false, false]],
+  ['replace_in_file', { path: 'a', search: 'o', replace: 'n', flags: 'g' }, ['replace_in_file', 'a', 'o', 'n', 'g', false, false]],
+  ['replace_in_file', { path: 'a', search: 'o', replace: 'n', regex: true }, ['replace_in_file', 'a', 'o', 'n', '', true, false]],
+  ['replace_in_file', { path: 'a', search: 'o', replace: 'n', replace_all: true }, ['replace_in_file', 'a', 'o', 'n', '', false, true]],
   ['get_env',        { name: 'X' },                                 ['get_env', 'X']],
   ['set_env',        { name: 'X', value: 'v' },                     ['set_env', 'X', 'v']],
   ['set_env',        { name: 'X' },                                 ['set_env', 'X', '']],
@@ -295,6 +328,7 @@ test('mapInvokeToCall: more missing-required-param guards return null', () => {
 
 test('mapInvokeToCall: edit_file coerces line to int', () => {
   assert.deepStrictEqual(mapInvokeToCall('edit_file', { path: 'a', line: '7', content: 'x' }), ['edit_file', 'a', 7, 'x']);
+  assert.deepStrictEqual(mapInvokeToCall('edit_file', { path: 'a', line: '7', content: 'x', end_line: '9' }), ['edit_file', 'a', 7, 'x', 9]);
 });
 
 // ---------------------------------------------------------------------------