@spotpatch/dev-server 0.1.2 → 0.3.0

package/dist/index.cjs

@@ -32,19 +32,25 @@ var index_exports = {};
 __export(index_exports, {
   DEFAULT_EXCLUDE: () => DEFAULT_EXCLUDE,
   DEFAULT_OPTIONS: () => DEFAULT_OPTIONS,
+  applyIntegrationPlan: () => applyIntegrationPlan,
   createAgentJobManager: () => createAgentJobManager,
+  createIntegrationFileChange: () => createIntegrationFileChange,
   createRuntimeAiConfig: () => createRuntimeAiConfig,
   createSession: () => createSession,
   createSourceRegistrationService: () => createSourceRegistrationService,
   createSourceRegistry: () => createSourceRegistry,
   createSpotPatchMiddleware: () => createSpotPatchMiddleware,
+  discoverProjectValidationCheck: () => discoverProjectValidationCheck,
+  integrationPathExists: () => integrationPathExists,
   isLoopbackHostname: () => isLoopbackHostname,
   parseSerializedSpotPatchOptions: () => parseSerializedSpotPatchOptions,
+  readIntegrationFile: () => readIntegrationFile,
   readJsonRequestBody: () => readJsonRequestBody,
   readRuntimeBootstrap: () => readRuntimeBootstrap,
   resolveCredentialEnvironment: () => resolveCredentialEnvironment,
   resolveEnvironmentAiConfiguration: () => resolveEnvironmentAiConfiguration,
   resolveOptions: () => resolveOptions,
+  resolveProjectOptions: () => resolveProjectOptions,
   resolveRuntimeBootstrapOptions: () => resolveRuntimeBootstrapOptions,
   serializeResolvedSpotPatchOptions: () => serializeResolvedSpotPatchOptions
 });
@@ -322,7 +328,8 @@ function createAgentJobManager(options) {
         transition(job, "completed", "No source changes were proposed.");
         return;
       }
-      if (options.ai.execution.applyMode === "auto" && preparedChange.autoApplyEligible) {
+      const shouldApplyDirectly = job.applyMode === "auto" && preparedChange.autoApplyEligible || job.applyMode === "trusted-auto" && job.trustedFastModeConsent;
+      if (shouldApplyDirectly) {
         try {
           await applyChange(job, preparedChange);
         } catch {
@@ -397,6 +404,13 @@ function createAgentJobManager(options) {
       if (closed) {
         throw new import_shared.SpotPatchError(import_shared.ERROR_CODES.AI_DISABLED);
       }
+      const configuredApplyMode = options.ai.execution.applyMode;
+      const requestedApplyMode = request.applyMode ?? (request.trustedFastModeConsent === true ? "trusted-auto" : configuredApplyMode);
+      const applyModeAllowed = configuredApplyMode === "trusted-auto" ? requestedApplyMode === "review" || requestedApplyMode === "trusted-auto" : requestedApplyMode === configuredApplyMode;
+      const trustedConsentMatches = requestedApplyMode === "trusted-auto" === (request.trustedFastModeConsent === true);
+      if (!applyModeAllowed || !trustedConsentMatches) {
+        throw new import_shared.SpotPatchError(import_shared.ERROR_CODES.INVALID_REQUEST);
+      }
       if (hasActiveJob()) {
         throw new import_shared.SpotPatchError(import_shared.ERROR_CODES.AGENT_BUSY);
       }
@@ -415,6 +429,7 @@ function createAgentJobManager(options) {
       const timestamp = dependencies.now();
       const job = {
         annotation: request.annotation,
+        applyMode: requestedApplyMode,
         controller: new AbortController(),
         createdAt: timestamp,
         credential: selection.credential,
@@ -430,6 +445,7 @@ function createAgentJobManager(options) {
         runPromise: void 0,
         sequence: 0,
         status: "queued",
+        trustedFastModeConsent: request.trustedFastModeConsent === true,
         updatedAt: timestamp,
         workingTreeMode: request.workingTreeMode
       };
@@ -585,6 +601,171 @@ function resolveEnvironmentAiConfiguration(environment) {
   });
 }
 
+// src/integration/file-plan.ts
+var import_node_crypto2 = require("crypto");
+var import_promises = require("fs/promises");
+var import_node_path = __toESM(require("path"), 1);
+function isMissingPathError(error) {
+  return typeof error === "object" && error !== null && "code" in error && error.code === "ENOENT";
+}
+function isPathWithin(root, target) {
+  const relative = import_node_path.default.relative(root, target);
+  return relative === "" || relative !== ".." && !relative.startsWith(`..${import_node_path.default.sep}`) && !import_node_path.default.isAbsolute(relative);
+}
+function relativePathWithin(root, target) {
+  const relative = import_node_path.default.relative(root, target);
+  if (relative.length === 0 || !isPathWithin(root, target)) {
+    throw new Error("SpotPatch init refuses to modify a path outside the app root.");
+  }
+  return relative.split(import_node_path.default.sep).join("/");
+}
+async function integrationPathExists(absolutePath) {
+  try {
+    await (0, import_promises.access)(absolutePath);
+    return true;
+  } catch {
+    return false;
+  }
+}
+async function readIntegrationFile(absolutePath) {
+  const metadata = await (0, import_promises.lstat)(absolutePath);
+  if (!metadata.isFile() || metadata.isSymbolicLink()) {
+    throw new Error(
+      `SpotPatch refuses to modify the non-regular file ${import_node_path.default.basename(absolutePath)}.`
+    );
+  }
+  return (0, import_promises.readFile)(absolutePath, "utf8");
+}
+function createIntegrationFileChange(appRoot, absolutePath, nextContent, previousContent) {
+  if (previousContent === nextContent) {
+    return void 0;
+  }
+  const root = import_node_path.default.resolve(appRoot);
+  const target = import_node_path.default.resolve(absolutePath);
+  return Object.freeze({
+    absolutePath: target,
+    nextContent,
+    ...previousContent === void 0 ? {} : { previousContent },
+    relativePath: relativePathWithin(root, target)
+  });
+}
+function temporaryPath(absolutePath, label) {
+  return import_node_path.default.join(
+    import_node_path.default.dirname(absolutePath),
+    `.${import_node_path.default.basename(absolutePath)}.spotpatch-${label}-${String(process.pid)}-${(0, import_node_crypto2.randomBytes)(8).toString("hex")}`
+  );
+}
+async function writeAtomic(absolutePath, content, mode) {
+  await (0, import_promises.mkdir)(import_node_path.default.dirname(absolutePath), { recursive: true });
+  const stagedPath = temporaryPath(absolutePath, "stage");
+  try {
+    await (0, import_promises.writeFile)(stagedPath, content, { encoding: "utf8", flag: "wx", mode });
+    await (0, import_promises.rename)(stagedPath, absolutePath);
+  } catch (error) {
+    await (0, import_promises.unlink)(stagedPath).catch(() => void 0);
+    throw error;
+  }
+}
+async function rollbackChange(change) {
+  const currentContent = await readIntegrationFile(change.absolutePath);
+  if (currentContent !== change.nextContent) {
+    throw new Error(
+      `SpotPatch init cannot restore ${change.relativePath} because it changed during initialization.`
+    );
+  }
+  if (change.previousContent === void 0) {
+    await (0, import_promises.unlink)(change.absolutePath);
+    return;
+  }
+  const mode = (await (0, import_promises.stat)(change.absolutePath)).mode & 511;
+  await writeAtomic(change.absolutePath, change.previousContent, mode);
+}
+async function assertSafeTarget(appRoot, realAppRoot, change) {
+  const target = import_node_path.default.resolve(change.absolutePath);
+  const relativePath = relativePathWithin(appRoot, target);
+  if (target !== change.absolutePath || relativePath !== change.relativePath || import_node_path.default.dirname(target) === target) {
+    throw new Error("SpotPatch init received an invalid integration file plan.");
+  }
+  let targetMetadata;
+  try {
+    targetMetadata = await (0, import_promises.lstat)(target);
+  } catch (error) {
+    if (!isMissingPathError(error)) {
+      throw error;
+    }
+  }
+  if (targetMetadata?.isSymbolicLink()) {
+    throw new Error(
+      `SpotPatch refuses to modify the symbolic link ${change.relativePath}.`
+    );
+  }
+  const containmentAnchor = await (0, import_promises.realpath)(
+    targetMetadata === void 0 ? import_node_path.default.dirname(target) : target
+  );
+  if (!isPathWithin(realAppRoot, containmentAnchor)) {
+    throw new Error("SpotPatch init refuses to modify a path outside the app root.");
+  }
+}
+async function assertCurrentBaseline(change) {
+  if (change.previousContent === void 0) {
+    try {
+      await (0, import_promises.lstat)(change.absolutePath);
+    } catch (error) {
+      if (isMissingPathError(error)) {
+        return;
+      }
+      throw error;
+    }
+    throw new Error(
+      `SpotPatch init cannot create ${change.relativePath} because it now exists.`
+    );
+  }
+  const currentContent = await readIntegrationFile(change.absolutePath);
+  if (currentContent !== change.previousContent) {
+    throw new Error(
+      `SpotPatch init cannot update ${change.relativePath} because it changed after the preview.`
+    );
+  }
+}
+async function applyIntegrationPlan(plan) {
+  if (plan.changes.length === 0) {
+    return;
+  }
+  const appRoot = import_node_path.default.resolve(plan.appRoot);
+  const realAppRoot = await (0, import_promises.realpath)(appRoot);
+  const targets = /* @__PURE__ */ new Set();
+  for (const change of plan.changes) {
+    if (targets.has(change.absolutePath)) {
+      throw new Error("SpotPatch init received duplicate integration file changes.");
+    }
+    targets.add(change.absolutePath);
+    await assertSafeTarget(appRoot, realAppRoot, change);
+    await assertCurrentBaseline(change);
+  }
+  const applied = [];
+  try {
+    for (const change of plan.changes) {
+      await assertCurrentBaseline(change);
+      const mode = change.previousContent === void 0 ? 384 : (await (0, import_promises.stat)(change.absolutePath)).mode & 511;
+      await writeAtomic(change.absolutePath, change.nextContent, mode);
+      applied.push(change);
+    }
+  } catch (error) {
+    const rollbackResults = await Promise.allSettled(
+      applied.reverse().map(rollbackChange)
+    );
+    if (rollbackResults.some((result) => result.status === "rejected")) {
+      throw new Error(
+        "SpotPatch init failed and could not completely restore the previous files.",
+        { cause: error }
+      );
+    }
+    throw new Error("SpotPatch init failed; all written files were restored.", {
+      cause: error
+    });
+  }
+}
+
 // src/options.ts
 var import_shared2 = require("@spotpatch/shared");
 var import_zod = require("zod");
@@ -662,7 +843,7 @@ var aiOptionsSchema = import_zod.z.strictObject({
   defaultProvider: import_zod.z.string(),
   execution: import_zod.z.strictObject({
     isolation: import_zod.z.literal("git-worktree").optional(),
-    applyMode: import_zod.z.enum(["review", "auto"]).optional(),
+    applyMode: import_zod.z.enum(import_shared2.AGENT_APPLY_MODES).optional(),
     checks: import_zod.z.record(import_zod.z.string(), agentCheckSchema).optional(),
     limits: agentLimitsSchema
   }).optional()
@@ -857,8 +1038,8 @@ function resolveAiOptions(options) {
   const limits = resolveLimits(validated.execution?.limits);
   const checks = resolveChecks(validated.execution?.checks, limits.checkTimeoutMs);
   const applyMode = validated.execution?.applyMode ?? "review";
-  if (applyMode === "auto" && !Object.values(checks).some((check) => check.required)) {
-    throw new RangeError("SpotPatch AI auto mode requires a required check.");
+  if (applyMode !== "review" && !Object.values(checks).some((check) => check.required)) {
+    throw new RangeError(`SpotPatch AI ${applyMode} mode requires a required check.`);
   }
   const providers = resolveProviders(validated.providers);
   if (!(validated.defaultProvider in providers)) {
@@ -910,6 +1091,9 @@ function assertPositiveBudget(budget) {
   }
 }
 function resolveOptions(options = {}, environmentAi) {
+  if (options.trustedFastMode !== void 0 && typeof options.trustedFastMode !== "boolean") {
+    throw new RangeError("SpotPatch trustedFastMode must be a boolean.");
+  }
   const budget = Object.freeze({
     ...DEFAULT_OPTIONS.budget,
     ...options.budget
@@ -949,17 +1133,179 @@ function resolveOptions(options = {}, environmentAi) {
   return Object.freeze(resolved);
 }
 
+// src/project-validation.ts
+var import_node_child_process = require("child_process");
+var import_promises2 = require("fs/promises");
+var import_node_module = require("module");
+var import_node_path2 = __toESM(require("path"), 1);
+var import_node_util = require("util");
+var execFileAsync = (0, import_node_util.promisify)(import_node_child_process.execFile);
+var TYPESCRIPT_CHECK_ID = "spotpatch-typecheck";
+var TYPESCRIPT_CHECK_LABEL = "TypeScript";
+function isRecord(value) {
+  return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+async function isRegularFile(absolutePath) {
+  try {
+    const metadata = await (0, import_promises2.lstat)(absolutePath);
+    return metadata.isFile() && !metadata.isSymbolicLink();
+  } catch {
+    return false;
+  }
+}
+async function readManifest(appRoot) {
+  const manifestPath = import_node_path2.default.join(appRoot, "package.json");
+  if (!await isRegularFile(manifestPath)) {
+    return void 0;
+  }
+  try {
+    const value = JSON.parse(await (0, import_promises2.readFile)(manifestPath, "utf8"));
+    return isRecord(value) ? value : void 0;
+  } catch {
+    return void 0;
+  }
+}
+function declaresTypeScript(manifest) {
+  return [
+    manifest.dependencies,
+    manifest.devDependencies,
+    manifest.peerDependencies
+  ].some(
+    (dependencies) => isRecord(dependencies) && typeof dependencies.typescript === "string"
+  );
+}
+async function findGitRoot(appRoot) {
+  try {
+    const result = await execFileAsync("git", ["rev-parse", "--show-toplevel"], {
+      cwd: appRoot,
+      encoding: "utf8",
+      timeout: 5e3,
+      windowsHide: true
+    });
+    const root = await (0, import_promises2.realpath)(result.stdout.trim());
+    const relative = import_node_path2.default.relative(root, appRoot);
+    if (relative === "" || !relative.startsWith(`..${import_node_path2.default.sep}`) && relative !== ".." && !import_node_path2.default.isAbsolute(relative)) {
+      return root;
+    }
+  } catch {
+    return void 0;
+  }
+  return void 0;
+}
+async function resolveTypeScriptCli(appRoot) {
+  const resolveFromApplication = (0, import_node_module.createRequire)(import_node_path2.default.join(appRoot, "package.json"));
+  try {
+    const packagePath = resolveFromApplication.resolve("typescript/package.json");
+    const cliPath = import_node_path2.default.join(import_node_path2.default.dirname(packagePath), "bin", "tsc");
+    await (0, import_promises2.access)(cliPath);
+    return await (0, import_promises2.realpath)(cliPath);
+  } catch {
+    return void 0;
+  }
+}
+function portableRelativePath(from, to) {
+  return import_node_path2.default.relative(from, to).split(import_node_path2.default.sep).join("/");
+}
+async function discoverProjectValidationCheck(options) {
+  const appRoot = await (0, import_promises2.realpath)(options.appRoot);
+  const tsconfigPath = import_node_path2.default.join(appRoot, "tsconfig.json");
+  const [manifest, projectRoot, hasTsconfig] = await Promise.all([
+    readManifest(appRoot),
+    findGitRoot(appRoot),
+    isRegularFile(tsconfigPath)
+  ]);
+  if (manifest === void 0 || projectRoot === void 0 || !hasTsconfig || !declaresTypeScript(manifest)) {
+    return void 0;
+  }
+  const cliPath = await resolveTypeScriptCli(appRoot);
+  if (cliPath === void 0) {
+    return void 0;
+  }
+  const projectPath = portableRelativePath(projectRoot, tsconfigPath);
+  if (projectPath.length === 0 || projectPath.startsWith("../")) {
+    return void 0;
+  }
+  return Object.freeze({
+    id: TYPESCRIPT_CHECK_ID,
+    label: TYPESCRIPT_CHECK_LABEL,
+    command: process.execPath,
+    args: Object.freeze([
+      cliPath,
+      "--noEmit",
+      "--pretty",
+      "false",
+      "--project",
+      projectPath
+    ]),
+    required: true,
+    timeoutMs: options.timeoutMs
+  });
+}
+
+// src/project-options.ts
+function hasRequiredCheck(ai) {
+  return Object.values(ai.execution.checks).some((check) => check.required);
+}
+function availableCheckId(checks, preferred) {
+  if (checks[preferred] === void 0) {
+    return preferred;
+  }
+  let suffix = 2;
+  while (checks[`${preferred}-${String(suffix)}`] !== void 0) {
+    suffix += 1;
+  }
+  return `${preferred}-${String(suffix)}`;
+}
+async function resolveProjectOptions(input) {
+  const userOptions = input.options ?? {};
+  const resolved = resolveOptions(userOptions, input.environmentAi);
+  if (!userOptions.trustedFastMode || resolved.ai === false) {
+    return resolved;
+  }
+  if (resolved.ai.execution.applyMode === "auto") {
+    throw new RangeError(
+      "SpotPatch trustedFastMode cannot be combined with applyMode auto."
+    );
+  }
+  let checks = resolved.ai.execution.checks;
+  if (!hasRequiredCheck(resolved.ai)) {
+    const discovered = await discoverProjectValidationCheck({
+      appRoot: input.appRoot,
+      timeoutMs: resolved.ai.execution.limits.checkTimeoutMs
+    });
+    if (discovered === void 0) {
+      throw new RangeError(
+        "SpotPatch trustedFastMode requires a configured required check or a local TypeScript project with tsconfig.json."
+      );
+    }
+    const id = availableCheckId(checks, discovered.id);
+    checks = Object.freeze({
+      ...checks,
+      [id]: Object.freeze({ ...discovered, id })
+    });
+  }
+  const ai = Object.freeze({
+    ...resolved.ai,
+    execution: Object.freeze({
+      ...resolved.ai.execution,
+      applyMode: "trusted-auto",
+      checks
+    })
+  });
+  return Object.freeze({ ...resolved, ai });
+}
+
 // src/registry/source-registry.ts
-var import_node_path = __toESM(require("path"), 1);
+var import_node_path3 = __toESM(require("path"), 1);
 
 // src/registry/source-id.ts
-var import_node_crypto2 = require("crypto");
+var import_node_crypto3 = require("crypto");
 var SOURCE_ID_BYTES = 8;
-var createRandomSourceId = () => (0, import_node_crypto2.randomBytes)(SOURCE_ID_BYTES).toString("base64url");
+var createRandomSourceId = () => (0, import_node_crypto3.randomBytes)(SOURCE_ID_BYTES).toString("base64url");
 
 // src/registry/source-registry.ts
 function normalizeAbsolutePath(absolutePath) {
-  return import_node_path.default.normalize(import_node_path.default.resolve(absolutePath));
+  return import_node_path3.default.normalize(import_node_path3.default.resolve(absolutePath));
 }
 function createSourceRegistry(options = {}) {
   const createId = options.createId ?? createRandomSourceId;
@@ -997,13 +1343,13 @@ var import_shared10 = require("@spotpatch/shared");
 var import_shared7 = require("@spotpatch/shared");
 
 // src/server/agent-request.ts
-var import_promises3 = require("fs/promises");
-var import_node_path4 = __toESM(require("path"), 1);
+var import_promises5 = require("fs/promises");
+var import_node_path6 = __toESM(require("path"), 1);
 var import_shared5 = require("@spotpatch/shared");
 
 // src/server/source-context.ts
-var import_promises2 = require("fs/promises");
-var import_node_path3 = __toESM(require("path"), 1);
+var import_promises4 = require("fs/promises");
+var import_node_path5 = __toESM(require("path"), 1);
 var import_shared4 = require("@spotpatch/shared");
 
 // src/server/extract-code-context.ts
@@ -1233,8 +1579,8 @@ function extractCodeContext(options) {
 }
 
 // src/server/source-file.ts
-var import_promises = require("fs/promises");
-var import_node_path2 = __toESM(require("path"), 1);
+var import_promises3 = require("fs/promises");
+var import_node_path4 = __toESM(require("path"), 1);
 var import_shared3 = require("@spotpatch/shared");
 
 // src/server/constants.ts
@@ -1252,8 +1598,8 @@ async function assertInsideRoot(root, candidate) {
   let realCandidate;
   try {
     [realRoot, realCandidate] = await Promise.all([
-      (0, import_promises.realpath)(root),
-      (0, import_promises.realpath)(candidate)
+      (0, import_promises3.realpath)(root),
+      (0, import_promises3.realpath)(candidate)
     ]);
   } catch (error) {
     if (isMissingFileError(error)) {
@@ -1263,8 +1609,8 @@ async function assertInsideRoot(root, candidate) {
     }
     throw error;
   }
-  const relative = import_node_path2.default.relative(realRoot, realCandidate);
-  const outside = relative.startsWith(`..${import_node_path2.default.sep}`) || relative === ".." || import_node_path2.default.isAbsolute(relative);
+  const relative = import_node_path4.default.relative(realRoot, realCandidate);
+  const outside = relative.startsWith(`..${import_node_path4.default.sep}`) || relative === ".." || import_node_path4.default.isAbsolute(relative);
   if (outside) {
     throw new import_shared3.SpotPatchError(import_shared3.ERROR_CODES.SOURCE_OUTSIDE_ROOT);
   }
@@ -1276,12 +1622,12 @@ async function resolveSourceFile(options) {
     throw new import_shared3.SpotPatchError(import_shared3.ERROR_CODES.SOURCE_NOT_FOUND);
   }
   const sourcePath = await assertInsideRoot(options.root, registeredPath);
-  if (!ALLOWED_EXTENSIONS.has(import_node_path2.default.extname(sourcePath).toLowerCase())) {
+  if (!ALLOWED_EXTENSIONS.has(import_node_path4.default.extname(sourcePath).toLowerCase())) {
     throw new import_shared3.SpotPatchError(import_shared3.ERROR_CODES.SOURCE_NOT_FOUND);
   }
   let sourceStat;
   try {
-    sourceStat = await (0, import_promises.stat)(sourcePath);
+    sourceStat = await (0, import_promises3.stat)(sourcePath);
   } catch (error) {
     if (isMissingFileError(error)) {
       throw new import_shared3.SpotPatchError(import_shared3.ERROR_CODES.SOURCE_NOT_FOUND, void 0, {
@@ -1301,7 +1647,7 @@ async function resolveSourceFile(options) {
 
 // src/server/source-context.ts
 function toDisplayPath(root, sourcePath) {
-  return import_node_path3.default.relative(root, sourcePath).split(import_node_path3.default.sep).join("/");
+  return import_node_path5.default.relative(root, sourcePath).split(import_node_path5.default.sep).join("/");
 }
 async function readSourceContext(options) {
   const sourcePath = await resolveSourceFile({
@@ -1311,7 +1657,7 @@ async function readSourceContext(options) {
   });
   let source;
   try {
-    source = await (0, import_promises2.readFile)(sourcePath, "utf8");
+    source = await (0, import_promises4.readFile)(sourcePath, "utf8");
   } catch (error) {
     if (error instanceof Error && "code" in error && (error.code === "ENOENT" || error.code === "ENOTDIR")) {
       throw new import_shared4.SpotPatchError(import_shared4.ERROR_CODES.SOURCE_NOT_FOUND, void 0, {
@@ -1324,11 +1670,11 @@ async function readSourceContext(options) {
   if (options.request.line > lines.length) {
     throw new import_shared4.SpotPatchError(import_shared4.ERROR_CODES.INVALID_REQUEST);
   }
-  const extension = import_node_path3.default.extname(sourcePath).toLowerCase();
+  const extension = import_node_path5.default.extname(sourcePath).toLowerCase();
   return extractCodeContext({
     source,
     sourcePath,
-    relativePath: toDisplayPath(await (0, import_promises2.realpath)(options.root), sourcePath),
+    relativePath: toDisplayPath(await (0, import_promises4.realpath)(options.root), sourcePath),
     language: extension === ".tsx" ? "tsx" : "jsx",
     line: options.request.line,
     column: options.request.column,
@@ -1364,7 +1710,7 @@ async function authorizeSourceRef(source, registry, root) {
     registry,
     root
   });
-  const relativePath = import_node_path4.default.relative(await (0, import_promises3.realpath)(root), sourcePath).split(import_node_path4.default.sep).join("/");
+  const relativePath = import_node_path6.default.relative(await (0, import_promises5.realpath)(root), sourcePath).split(import_node_path6.default.sep).join("/");
   if (source.relativePath !== void 0 && source.relativePath !== relativePath) {
     throw new import_shared5.SpotPatchError(import_shared5.ERROR_CODES.INVALID_REQUEST);
   }
@@ -1469,9 +1815,11 @@ async function authorizeAgentJobRequest(input) {
   });
   return Object.freeze({
     annotation,
+    ...input.request.applyMode === void 0 ? {} : { applyMode: input.request.applyMode },
     providerProfileId: input.request.providerProfileId,
     modelProfileId: input.request.modelProfileId,
     providerDataConsent: true,
+    ...input.request.trustedFastModeConsent === true ? { trustedFastModeConsent: true } : {},
     workingTreeMode: input.request.workingTreeMode
   });
 }
@@ -1534,21 +1882,21 @@ var EVENT_STREAM_END_STATUSES = /* @__PURE__ */ new Set([
   "reverted",
   "failed"
 ]);
-function matchAgentRequestPath(path6) {
-  if (path6 === import_shared7.SPOTPATCH_ENDPOINTS.agentCapability) {
+function matchAgentRequestPath(path8) {
+  if (path8 === import_shared7.SPOTPATCH_ENDPOINTS.agentCapability) {
     return Object.freeze({ kind: "capability" });
   }
-  if (path6 === import_shared7.SPOTPATCH_ENDPOINTS.agentWorkspaceHealth) {
+  if (path8 === import_shared7.SPOTPATCH_ENDPOINTS.agentWorkspaceHealth) {
     return Object.freeze({ kind: "workspace-health" });
   }
-  if (path6 === import_shared7.SPOTPATCH_ENDPOINTS.agentJobs) {
+  if (path8 === import_shared7.SPOTPATCH_ENDPOINTS.agentJobs) {
     return Object.freeze({ kind: "create-job" });
   }
   const prefix = `${import_shared7.SPOTPATCH_ENDPOINTS.agentJobs}/`;
-  if (!path6.startsWith(prefix)) {
+  if (!path8.startsWith(prefix)) {
     return void 0;
   }
-  const segments = path6.slice(prefix.length).split("/");
+  const segments = path8.slice(prefix.length).split("/");
   const jobId = segments[0];
   const action = segments[1];
   if (segments.length !== 2 || jobId === void 0 || !AGENT_JOB_ID_PATTERN.test(jobId) || action === void 0 || !AGENT_JOB_ACTIONS.has(action)) {
@@ -1718,7 +2066,7 @@ async function handleAgentRequest(request, response, options, route, writeSucces
 }
 
 // src/server/editor.ts
-var import_node_child_process = require("child_process");
+var import_node_child_process2 = require("child_process");
 var import_launch_editor = __toESM(require("launch-editor"), 1);
 var EDITOR_STARTUP_GRACE_MS = 300;
 function normalizedEditorEnvironment(environment) {
@@ -1745,7 +2093,7 @@ function editorCommand(editor) {
 var DEFAULT_DEPENDENCIES2 = Object.freeze({
   environment: process.env,
   fallbackLauncher: import_launch_editor.default,
-  processSpawner: (command, arguments_, options) => (0, import_node_child_process.spawn)(command, [...arguments_], options),
+  processSpawner: (command, arguments_, options) => (0, import_node_child_process2.spawn)(command, [...arguments_], options),
   startupGraceMs: EDITOR_STARTUP_GRACE_MS
 });
 function createEditorLauncher(dependencies = DEFAULT_DEPENDENCIES2) {
@@ -1803,7 +2151,7 @@ function createEditorLauncher(dependencies = DEFAULT_DEPENDENCIES2) {
 var launchConfiguredEditor = createEditorLauncher();
 
 // src/server/request-security.ts
-var import_node_crypto3 = require("crypto");
+var import_node_crypto4 = require("crypto");
 var import_node_net = require("net");
 var import_shared8 = require("@spotpatch/shared");
 function getSingleHeader(request, name) {
@@ -1816,7 +2164,7 @@ function tokensMatch(actual, expected) {
   }
   const actualBytes = Buffer.from(actual);
   const expectedBytes = Buffer.from(expected);
-  return actualBytes.byteLength === expectedBytes.byteLength && (0, import_node_crypto3.timingSafeEqual)(actualBytes, expectedBytes);
+  return actualBytes.byteLength === expectedBytes.byteLength && (0, import_node_crypto4.timingSafeEqual)(actualBytes, expectedBytes);
 }
 function isLoopbackHostname(hostname) {
   const normalized = hostname.toLowerCase().replace(/^\[|\]$/g, "");
@@ -2071,14 +2419,14 @@ async function handleOpenEditor(request, options) {
 function createSpotPatchMiddleware(options) {
   const bootstrap = options.bootstrap === void 0 ? void 0 : resolveRuntimeBootstrapOptions(options.bootstrap);
   return (request, response, next) => {
-    const path6 = requestPath(request);
-    const agentRoute = matchAgentRequestPath(path6);
-    if (path6 !== import_shared10.SPOTPATCH_ENDPOINTS.sourceContext && path6 !== import_shared10.SPOTPATCH_ENDPOINTS.openEditor && agentRoute === void 0 && !path6.startsWith(`${import_shared10.SPOTPATCH_API_BASE}/`)) {
+    const path8 = requestPath(request);
+    const agentRoute = matchAgentRequestPath(path8);
+    if (path8 !== import_shared10.SPOTPATCH_ENDPOINTS.sourceContext && path8 !== import_shared10.SPOTPATCH_ENDPOINTS.openEditor && agentRoute === void 0 && !path8.startsWith(`${import_shared10.SPOTPATCH_API_BASE}/`)) {
       next();
       return;
     }
     const handle = async () => {
-      if (path6 === import_shared10.SPOTPATCH_ENDPOINTS.bootstrap && bootstrap !== void 0) {
+      if (path8 === import_shared10.SPOTPATCH_ENDPOINTS.bootstrap && bootstrap !== void 0) {
         const data = await readRuntimeBootstrap(
           request,
           bootstrap
@@ -2090,7 +2438,7 @@ function createSpotPatchMiddleware(options) {
         allowLan: options.options.allowLan,
         sessionToken: options.session.token
       });
-      if (path6 === import_shared10.SPOTPATCH_ENDPOINTS.sourceContext) {
+      if (path8 === import_shared10.SPOTPATCH_ENDPOINTS.sourceContext) {
         if (request.method !== "POST") {
           throw new import_shared10.SpotPatchError(import_shared10.ERROR_CODES.INVALID_REQUEST);
         }
@@ -2098,7 +2446,7 @@ function createSpotPatchMiddleware(options) {
         writeJson(response, 200, { ok: true, data });
         return;
       }
-      if (path6 === import_shared10.SPOTPATCH_ENDPOINTS.openEditor) {
+      if (path8 === import_shared10.SPOTPATCH_ENDPOINTS.openEditor) {
         if (request.method !== "POST") {
           throw new import_shared10.SpotPatchError(import_shared10.ERROR_CODES.INVALID_REQUEST);
         }
@@ -2126,9 +2474,9 @@ function createSpotPatchMiddleware(options) {
 }
 
 // src/server/source-registration.ts
-var import_node_crypto4 = require("crypto");
-var import_promises4 = require("fs/promises");
-var import_node_path5 = __toESM(require("path"), 1);
+var import_node_crypto5 = require("crypto");
+var import_promises6 = require("fs/promises");
+var import_node_path7 = __toESM(require("path"), 1);
 var import_compiler = require("@spotpatch/compiler");
 var import_zod2 = require("zod");
 var REGISTRATION_BODY_LIMIT_BYTES = 4096;
@@ -2149,14 +2497,14 @@ function identitiesMatch(actual, expected) {
   }
   const actualBytes = Buffer.from(actual);
   const expectedBytes = Buffer.from(expected);
-  return actualBytes.byteLength === expectedBytes.byteLength && (0, import_node_crypto4.timingSafeEqual)(actualBytes, expectedBytes);
+  return actualBytes.byteLength === expectedBytes.byteLength && (0, import_node_crypto5.timingSafeEqual)(actualBytes, expectedBytes);
 }
 function isWithinRoot(root, candidate) {
-  const relative = import_node_path5.default.relative(root, candidate);
-  return relative === "" || !relative.startsWith(`..${import_node_path5.default.sep}`) && relative !== ".." && !import_node_path5.default.isAbsolute(relative);
+  const relative = import_node_path7.default.relative(root, candidate);
+  return relative === "" || !relative.startsWith(`..${import_node_path7.default.sep}`) && relative !== ".." && !import_node_path7.default.isAbsolute(relative);
 }
 function hasForbiddenSegment(root, candidate) {
-  return import_node_path5.default.relative(root, candidate).split(import_node_path5.default.sep).some((segment) => FORBIDDEN_SOURCE_SEGMENTS.has(segment));
+  return import_node_path7.default.relative(root, candidate).split(import_node_path7.default.sep).some((segment) => FORBIDDEN_SOURCE_SEGMENTS.has(segment));
 }
 function writeJson2(response, statusCode, payload) {
   const body = JSON.stringify(payload);
@@ -2178,15 +2526,15 @@ function requestComesFromLoopbackWorker(request) {
   }
 }
 async function resolveAuthorizedSource(root, requestedPath, shouldTransform) {
-  if (!import_node_path5.default.isAbsolute(requestedPath) || requestedPath.includes("\0")) {
+  if (!import_node_path7.default.isAbsolute(requestedPath) || requestedPath.includes("\0")) {
     return void 0;
   }
   try {
-    const sourceStat = await (0, import_promises4.lstat)(requestedPath);
+    const sourceStat = await (0, import_promises6.lstat)(requestedPath);
     if (!sourceStat.isFile() || sourceStat.isSymbolicLink()) {
       return void 0;
     }
-    const resolvedPath = await (0, import_promises4.realpath)(requestedPath);
+    const resolvedPath = await (0, import_promises6.realpath)(requestedPath);
     if (!isWithinRoot(root, resolvedPath) || hasForbiddenSegment(root, resolvedPath) || !shouldTransform(resolvedPath)) {
       return void 0;
     }
@@ -2199,7 +2547,7 @@ async function createSourceRegistrationService(input) {
   if (!REGISTRATION_IDENTITY_PATTERN.test(input.internalSecret) || !REGISTRATION_IDENTITY_PATTERN.test(input.registryEpoch)) {
     throw new TypeError("The source registration identity is invalid.");
   }
-  const root = await (0, import_promises4.realpath)(input.root);
+  const root = await (0, import_promises6.realpath)(input.root);
   const sourceFilter = (0, import_compiler.createSourceFilter)(root, input.options);
   const handler = (request, response) => {
     const handle = async () => {
@@ -2244,11 +2592,11 @@ async function createSourceRegistrationService(input) {
 }
 
 // src/session/session.ts
-var import_node_crypto5 = require("crypto");
+var import_node_crypto6 = require("crypto");
 function createSession() {
   return Object.freeze({
-    id: (0, import_node_crypto5.randomBytes)(16).toString("base64url"),
-    token: (0, import_node_crypto5.randomBytes)(16).toString("base64url")
+    id: (0, import_node_crypto6.randomBytes)(16).toString("base64url"),
+    token: (0, import_node_crypto6.randomBytes)(16).toString("base64url")
   });
 }
 
@@ -2276,7 +2624,7 @@ var BUDGET_KEYS = Object.freeze([
   "maxComponentDepth"
 ]);
 var REGEXP_FLAGS_PATTERN = /^(?!.*(.).*\1)[dgimsuvy]*$/u;
-function isRecord(value) {
+function isRecord2(value) {
   return typeof value === "object" && value !== null && !Array.isArray(value);
 }
 function hasExactKeys(value, keys) {
@@ -2361,7 +2709,7 @@ function parseFilterList(value) {
   }
   return Object.freeze(
     value.map((entry) => {
-      if (!isRecord(entry)) {
+      if (!isRecord2(entry)) {
         throw new TypeError("The SpotPatch filter transport is invalid.");
       }
       if (entry.kind === "string" && hasExactKeys(entry, ["kind", "value"]) && typeof entry.value === "string" && entry.value.length > 0 && entry.value.length <= 1024 && !entry.value.includes("\0")) {
@@ -2379,7 +2727,7 @@ function parseFilterList(value) {
   );
 }
 function parseBudget(value) {
-  if (!isRecord(value) || !hasExactKeys(value, BUDGET_KEYS)) {
+  if (!isRecord2(value) || !hasExactKeys(value, BUDGET_KEYS)) {
     throw new TypeError("The SpotPatch budget transport is invalid.");
   }
   const budget = Object.fromEntries(
@@ -2388,10 +2736,10 @@ function parseBudget(value) {
   return Object.freeze(budget);
 }
 function parseSerializedSpotPatchOptions(value) {
-  if (!isRecord(value) || !hasExactKeys(value, OPTION_KEYS)) {
+  if (!isRecord2(value) || !hasExactKeys(value, OPTION_KEYS)) {
     throw new TypeError("The SpotPatch options transport is invalid.");
   }
-  if (typeof value.enabled !== "boolean" || typeof value.redact !== "boolean" || typeof value.allowLan !== "boolean" || typeof value.debug !== "boolean" || typeof value.shortcut !== "string" || typeof value.maxTargets !== "number" || typeof value.editor !== "string" || typeof value.locale !== "string" || value.ai !== false && !isRecord(value.ai)) {
+  if (typeof value.enabled !== "boolean" || typeof value.redact !== "boolean" || typeof value.allowLan !== "boolean" || typeof value.debug !== "boolean" || typeof value.shortcut !== "string" || typeof value.maxTargets !== "number" || typeof value.editor !== "string" || typeof value.locale !== "string" || value.ai !== false && !isRecord2(value.ai)) {
     throw new TypeError("The SpotPatch options transport is invalid.");
   }
   try {
@@ -2419,19 +2767,25 @@ function parseSerializedSpotPatchOptions(value) {
 0 && (module.exports = {
   DEFAULT_EXCLUDE,
   DEFAULT_OPTIONS,
+  applyIntegrationPlan,
   createAgentJobManager,
+  createIntegrationFileChange,
   createRuntimeAiConfig,
   createSession,
   createSourceRegistrationService,
   createSourceRegistry,
   createSpotPatchMiddleware,
+  discoverProjectValidationCheck,
+  integrationPathExists,
   isLoopbackHostname,
   parseSerializedSpotPatchOptions,
+  readIntegrationFile,
   readJsonRequestBody,
   readRuntimeBootstrap,
   resolveCredentialEnvironment,
   resolveEnvironmentAiConfiguration,
   resolveOptions,
+  resolveProjectOptions,
   resolveRuntimeBootstrapOptions,
   serializeResolvedSpotPatchOptions
 });