dsh-hashline-edit 0.2.2 → 0.3.0

package/src/mutation-engine/pipeline.ts

@@ -85,12 +85,16 @@ import { saveCutIntent, dropCutIntent } from "../undo-store.js";
 import { repairCutIntents } from "../cut-repair.js";
 import { withSortedMutationQueues } from "../mutation-queue.js";
 import { resolveTarget, writeAtomic, readBytes } from "../fs-write.js";
+import {
+  missingAncestorDirs,
+  pathKind,
+  pruneEmptyDirs,
+  removeFile,
+  renameFile,
+  assertPathWithinWorkspace,
+} from "../fs-lifecycle.js";
 import { toCwd } from "../paths.js";
-import type {
-  DesiredContent,
-  NormalizedEditItem,
-  NormalizedEditRequest,
-} from "../payload-contract.js";
+import type { DesiredContent, NormalizedEditItem, NormalizedEditRequest } from "./edit-request.js";
 import {
   batchAbortFor,
   batchAbortForMany,
@@ -99,7 +103,13 @@ import {
   wrapParseFailure,
 } from "../edit-response.js";
 import { DEFERRED_STORE_SYNC_WARNING } from "../constants.js";
-import type { PipelineOptions, ProcessedEditFile, ForeignCutRecord } from "./types.js";
+import type {
+  PipelineOptions,
+  ProcessedEditFile,
+  ForeignCutRecord,
+  MemberLifecycle,
+  TransactionRecoveryReport,
+} from "./types.js";
 import {
   loadEditFile,
   loadForeignServedView,
@@ -1308,6 +1318,108 @@ async function runCutTransaction(
  *   (those are reported and never committed).
  * @returns the batch outcome, anchored on the primary file.
  */
+function memberLifecycleOf(plan: ProcessedEditFile): MemberLifecycle {
+  return plan.lifecycle ?? { kind: "keep" };
+}
+
+function memberPostBytes(plan: ProcessedEditFile): Buffer {
+  return Buffer.from(plan.bom + restoreEndings(plan.result, plan.originalEnding), "utf-8");
+}
+
+/**
+ * Publish one already-validated member. This is the only place a lifecycle action reaches the
+ * filesystem: content writes keep using writeAtomic (one serializer); add/delete/move use the
+ * fs-lifecycle primitives that writeAtomic deliberately does not express.
+ */
+async function commitMember(
+  plan: ProcessedEditFile,
+  rawPreBytes: ReadonlyMap<string, Buffer>,
+  onPublished: (plan: ProcessedEditFile) => void,
+  workspaceRoot: string | undefined,
+  onAfterMoveRename?: (toAbsolutePath: string) => void | Promise<void>,
+): Promise<void> {
+  const lifecycle = memberLifecycleOf(plan);
+  switch (lifecycle.kind) {
+    case "keep":
+    case "add":
+      if (workspaceRoot !== undefined) {
+        await assertPathWithinWorkspace(workspaceRoot, plan.absolutePath);
+      }
+      await writeAtomic(plan.absolutePath, memberPostBytes(plan));
+      onPublished(plan);
+      return;
+    case "delete":
+      await removeFile(plan.absolutePath);
+      onPublished(plan);
+      return;
+    case "move": {
+      // WHY: rename first, then (only for an edited move) rewrite the destination. A pure move
+      // WHY: must stay a rename: re-serializing would launder the file's raw line endings.
+      await renameFile(
+        lifecycle.fromAbsolutePath,
+        lifecycle.toAbsolutePath,
+        undefined,
+        workspaceRoot,
+      );
+      // WHY: the rename is already a publication: a later content-write failure must roll this
+      // WHY: member back or the source disappears while the failure claims nothing changed.
+      onPublished(plan);
+      if (onAfterMoveRename !== undefined) await onAfterMoveRename(lifecycle.toAbsolutePath);
+      const post = memberPostBytes(plan);
+      // WHY: a pure rename must not re-serialize: the normalized text equals the baseline text,
+      // WHY: so the destination keeps the exact bytes the OS rename carried.
+      if (
+        plan.originalNormalized !== plan.result &&
+        !post.equals(rawPreBytes.get(plan.absolutePath)!)
+      ) {
+        await writeAtomic(lifecycle.toAbsolutePath, post);
+      }
+      return;
+    }
+  }
+}
+
+/**
+ * Restore one member that the commit had already published. A rollback is a BYTE restore, never
+ * a re-serialization: keep/delete write the captured pre-image buffer back; add removes what it
+ * created (and the empty directories it made); move renames back first, then restores the bytes.
+ */
+async function rollbackMember(
+  plan: ProcessedEditFile,
+  rawPreBytes: ReadonlyMap<string, Buffer>,
+  workspaceRoot: string | undefined,
+): Promise<void> {
+  const lifecycle = memberLifecycleOf(plan);
+  const pre = rawPreBytes.get(plan.absolutePath)!;
+  switch (lifecycle.kind) {
+    case "add":
+      if ((await pathKind(plan.absolutePath)) !== "absent") await removeFile(plan.absolutePath);
+      await pruneEmptyDirs(lifecycle.createdDirs);
+      return;
+    case "delete":
+      await writeAtomic(plan.absolutePath, pre);
+      return;
+    case "move": {
+      if ((await pathKind(lifecycle.toAbsolutePath)) !== "absent") {
+        await renameFile(
+          lifecycle.toAbsolutePath,
+          lifecycle.fromAbsolutePath,
+          undefined,
+          workspaceRoot,
+        );
+      }
+      // WHY: the rename carries the pre bytes for a pure move and for a failed content write; only
+      // WHY: rewrite when the destination really holds different bytes (a completed edit rolled back).
+      if (!(await readBytes(lifecycle.fromAbsolutePath)).equals(pre)) {
+        await writeAtomic(lifecycle.fromAbsolutePath, pre);
+      }
+      await pruneEmptyDirs(lifecycle.createdDirs);
+      return;
+    }
+    case "keep":
+      await writeAtomic(plan.absolutePath, pre);
+  }
+}
 async function runCorrelatedTransaction(
   writePlans: ProcessedEditFile[],
   sectionPlans: ProcessedEditFile[],
@@ -1327,18 +1439,60 @@ async function runCorrelatedTransaction(
   // WHY: (ticket-04b §11: after an abort EVERY file is byte-identical to its pre bytes).
   const rawPreBytes = new Map<string, Buffer>();
   for (const plan of writePlans) {
+    const lifecycle = plan.lifecycle;
+    if (lifecycle?.kind === "add") {
+      // WHY: an add has no pre-image by construction. A dry buffer keeps every consumer of the
+      // WHY: map total (rollback reads it, undo carries it as NULL through its lifecycle arm).
+      rawPreBytes.set(plan.absolutePath, Buffer.alloc(0));
+      plan.lifecycle = { ...lifecycle, createdDirs: await missingAncestorDirs(plan.absolutePath) };
+      continue;
+    }
+    if (lifecycle?.kind === "move") {
+      rawPreBytes.set(plan.absolutePath, await readBytes(lifecycle.fromAbsolutePath));
+      plan.lifecycle = {
+        ...lifecycle,
+        createdDirs: await missingAncestorDirs(lifecycle.toAbsolutePath),
+      };
+      continue;
+    }
     rawPreBytes.set(plan.absolutePath, await readBytes(plan.absolutePath));
   }
   const saved: { restore: () => Promise<void> }[] = [];
   for (const plan of writePlans) {
+    const lifecycle = plan.lifecycle;
+    const isAdd = lifecycle?.kind === "add";
+    const isDelete = lifecycle?.kind === "delete";
+    const isMove = lifecycle?.kind === "move";
+    const rawPost = Buffer.from(
+      plan.bom + restoreEndings(plan.result, plan.originalEnding),
+      "utf-8",
+    );
+    // WHY: a pure move carries the raw pre bytes to the destination; recording the canonical
+    // WHY: fold as its post image would make undo's byte oracle reject a legal mixed-ending file.
+    const storedRawPost =
+      isMove && plan.originalNormalized === plan.result
+        ? rawPreBytes.get(plan.absolutePath)!
+        : rawPost;
     const undo = await saveUndo(plan.absolutePath, {
-      content: plan.originalNormalized,
+      content: isAdd ? "" : plan.originalNormalized,
       bom: plan.bom,
       originalEnding: plan.originalEnding,
       hashes: plan.originalHashes,
-      resultContent: plan.result,
+      resultContent: isDelete ? "" : plan.result,
       transactionId: txnId,
-      rawPre: rawPreBytes.get(plan.absolutePath)!.toString("utf-8"),
+      rawPre: isAdd ? null : rawPreBytes.get(plan.absolutePath)!.toString("utf-8"),
+      ...(isMove
+        ? {
+            lifecycle: "move" as const,
+            fromPath: lifecycle.fromAbsolutePath,
+            toPath: lifecycle.toAbsolutePath,
+            rawPost: storedRawPost.toString("utf-8"),
+          }
+        : isAdd
+          ? { lifecycle: "add" as const, createdDirs: lifecycle.createdDirs }
+          : isDelete
+            ? { lifecycle: "delete" as const }
+            : { lifecycle: "edit" as const }),
     });
     if (!undo.persisted) {
       for (const prior of saved) await prior.restore();
@@ -1366,38 +1520,45 @@ async function runCorrelatedTransaction(
       await options.onBeforeFirstCutWrite();
     }
     abortIf(options?.signal);
-    await writeAtomic(
-      primary.absolutePath,
-      primary.bom + restoreEndings(primary.result, primary.originalEnding),
-    );
-    written.push(primary);
-    for (const plan of writePlans.slice(1)) {
-      if (options?.onCutBetweenWrites) {
+    for (let index = 0; index < writePlans.length; index++) {
+      const plan = writePlans[index]!;
+      if (index > 0 && options?.onCutBetweenWrites) {
         // WHY: test-only fault-injection seam (ticket-04b §3): fires INSIDE the two-rename
         // WHY: window, after the previous file's rename is durable.
         await options.onCutBetweenWrites(written[written.length - 1]!.absolutePath);
       }
       abortIf(options?.signal);
-      await writeAtomic(
-        plan.absolutePath,
-        plan.bom + restoreEndings(plan.result, plan.originalEnding),
+      const publish = (member: ProcessedEditFile): void => {
+        written.push(member);
+      };
+      await commitMember(
+        plan,
+        rawPreBytes,
+        publish,
+        options?.workspaceRoot,
+        options?.onAfterMoveRename,
       );
-      written.push(plan);
     }
   } catch (error) {
-    let rolledBack = true;
+    // WHY: the recovery report is the honest three-way split the contract requires: restored =
+    // WHY: proven back at its pre-image, remaining = rollback did not run / did not hold,
+    // WHY: uncertain = the rollback attempt itself threw (we cannot claim either state).
+    const report: TransactionRecoveryReport = { restored: [], remaining: [], uncertain: [] };
     for (const plan of written) {
       try {
-        await writeAtomic(plan.absolutePath, rawPreBytes.get(plan.absolutePath)!);
+        await rollbackMember(plan, rawPreBytes, options?.workspaceRoot);
+        report.restored.push(plan.path);
       } catch (rollbackError) {
-        rolledBack = false;
+        report.remaining.push(plan.path);
+        report.uncertain.push(plan.path);
         reportDiagnostic(
           "mutation-engine",
-          "Failed to roll back a cut-transaction file:",
+          "Failed to roll back a transaction member:",
           rollbackError,
         );
       }
     }
+    const rolledBack = report.remaining.length === 0;
     if (rolledBack) {
       for (const prior of saved) await prior.restore();
       try {
@@ -1411,8 +1572,8 @@ async function runCorrelatedTransaction(
       }
     }
     // WHY: a rollback that did not hold LEAVES the intent row and the transaction-tagged undo
-    // WHY: rows: next-run repair resolves to complete-the-cut or restore-both from the stored
-    // WHY: pre/post bytes (ADR-0028) — never a silent loss, never a fake atomicity claim.
+    // WHY: rows: next-run repair resolves to complete-the-transaction or restore-from-rows.
+    (error as Error & { recovery?: TransactionRecoveryReport }).recovery = report;
     throw error;
   }
 
@@ -1429,10 +1590,13 @@ async function runCorrelatedTransaction(
   // WHY: is REPORTED but never committed: its bytes did not move, so it owns no store write.
   const sections = [];
   for (const plan of sectionPlans) {
+    // WHY: a deleted file has no post-image to snapshot or serve; every other member commits its
+    // WHY: new anchors through the same finishCommittedFile the single-file edit uses.
+    const materializes = plan.appliedCount > 0 && memberLifecycleOf(plan).kind !== "delete";
     sections.push(
       toSection(
         plan,
-        plan.appliedCount > 0 ? await finishCommittedFile(plan, options, sessionKey) : undefined,
+        materializes ? await finishCommittedFile(plan, options, sessionKey) : undefined,
       ),
     );
   }
@@ -1817,3 +1981,10 @@ export async function execEdits(
 ): Promise<ProcessedEditFile> {
   return runMutations(request, cwd, options);
 }
+
+/**
+ * Visibility-only export of the correlated transaction for apply_patch's commit seam. The
+ * function body is the one the cut path already uses; apply_patch members carry an optional
+ * lifecycle action read by that body. No engine semantics change.
+ */
+export { runCorrelatedTransaction as commitTransaction };

package/src/mutation-engine/types.ts

@@ -8,13 +8,12 @@
 import type { LineEnding } from "../edit-diff.js";
 import type { ResolvedRange } from "../served-session/serve-render.js";
 import type { HashStore } from "../hash-store.js";
-import type { EditDetails, RMetrics } from "../edit-response.js";
-import type { DomainErrorCode, RangeCause } from "../domain-errors.js";
-import type { ServedRow } from "../domain-errors.js";
 
 // WHY: Re-export pipeline-facing options — validated once at admission (edit.ts),
 // WHY: trusted inside the engine. No `any`.
 export interface PipelineOptions {
+  /** Workspace root used to re-assert lifecycle path boundaries at commit time. */
+  workspaceRoot?: string;
   accessMode?: number;
   signal?: AbortSignal;
   store?: HashStore;
@@ -36,6 +35,22 @@ export interface PipelineOptions {
    * window cannot show that.
    */
   onBeforeFirstCutWrite?: () => void | Promise<void>;
+  /**
+   * TEST-ONLY mid-member fault seam: called after a move's rename is durable and before its
+   * destination content is rewritten, so the rollback of that in-flight member is exercised.
+   */
+  onAfterMoveRename?: (toAbsolutePath: string) => void | Promise<void>;
+}
+
+/**
+ * The honest outcome of a failed multi-member commit's rollback attempt. `restored` members are
+ * proven back at their pre-images; `remaining` members were not rolled back; `uncertain` members
+ * are those whose rollback attempt itself threw, so neither state can be claimed for them.
+ */
+export interface TransactionRecoveryReport {
+  restored: string[];
+  remaining: string[];
+  uncertain: string[];
 }
 
 /**
@@ -51,6 +66,24 @@ export interface ForeignCutRecord {
   spanTo: string;
 }
 
+/**
+ * The file-lifecycle action one transaction member carries.
+ *
+ * This is the engine-local vocabulary: apply_patch's plan IR maps onto it in
+ * `src/apply-patch/commit.ts` so the mutation engine never imports the apply-patch layer.
+ * Absent is an ordinary in-place edit.
+ */
+export type MemberLifecycle =
+  | { kind: "keep" }
+  | { kind: "add"; createdDirs: readonly string[] }
+  | { kind: "delete" }
+  | {
+      kind: "move";
+      fromAbsolutePath: string;
+      toAbsolutePath: string;
+      createdDirs: readonly string[];
+    };
+
 // WHY: Internal: the engine's view of one file's mutation outcome.
 // WHY: Mirrors `ProcessedEditFile` from the old pipeline — kept here as the engine's owned fact.
 export interface ProcessedEditFile {
@@ -96,60 +129,9 @@ export interface ProcessedEditFile {
    * correlated two-file transaction; the in-memory buffer itself never touches these files.
    */
   foreignCuts: ForeignCutRecord[];
-}
-
-// WHY: Discriminated success/failure for the deep seam.
-// WHY: Callers use exhaustive switch on `ok` — no `isError` flag checks,
-// WHY: no `any` threading.
-export interface MutationSuccess {
-  ok: true;
-  /** SAFETY: Normalized result content (LF). */
-  result: string;
-  /** SAFETY: Unified diff (hash-anchored) for model consumption. */
-  diff: string;
-  /** SAFETY: User-facing drift notice, if any (details only, not model content). */
-  drift: string | undefined;
-  /** SAFETY: Metrics for telemetry. */
-  metrics: RMetrics;
-  raw: ProcessedEditFile;
-  /** SAFETY: Full tool result (content + details) for pi's tool_result hook. */
-  toolResult: {
-    content: Array<{ type: "text"; text: string }>;
-    details: EditDetails;
-  };
-}
-
-export interface MutationFailure {
-  ok: false;
-  /**
-   * SAFETY: Machine code — a registry member (`DomainErrorCode`). `toFailure` validates every
-   * caught code through the envelope reader (`src/error-envelope.ts`): non-registry strings
-   * (errno pass-through included) route to `E_UNKNOWN`, so the union is honest.
-   */
-  code: DomainErrorCode;
-  /** SAFETY: Human message — model-facing signal when applicable. */
-  message: string;
-  /** SAFETY: Fresh served block for retry when available (reject-and-serve). */
-  servedBlock?: string;
-  servedRows?: ServedRow[];
   /**
-   * SAFETY: the RAW `E_BAD_PAYLOAD` message behind a rendered refusal, when the route is one, so
-   * SAFETY: the tool seam can name the invoking tool instead of falling back to the neutral
-   * SAFETY: wording. Present only for `code: "E_BAD_PAYLOAD"`.
+   * apply_patch lifecycle action for this member; absent is an ordinary edit. The correlated
+   * transaction reads it for pre-image capture, commit ordering, rollback and undo-row shape.
    */
-  payloadMessage?: string;
-  /** SAFETY: User-facing diagnosis, never a model remedy — a GLOSSARY.md glossary term. */
-  cause?: RangeCause;
-  details?: { code: DomainErrorCode; cause: RangeCause };
-}
-
-export type MutationResult = MutationSuccess | MutationFailure;
-
-// WHY: Narrowing helpers — keep call sites exhaustive.
-export function isMutationSuccess(r: MutationResult): r is MutationSuccess {
-  return r.ok === true;
-}
-
-export function isMutationFailure(r: MutationResult): r is MutationFailure {
-  return r.ok === false;
+  lifecycle?: MemberLifecycle;
 }

package/src/mutation-queue.ts

@@ -1,4 +1,4 @@
-import { withFileMutationQueue } from "@earendil-works/pi-coding-agent";
+import { withFileMutationQueue } from "./host-utils.js";
 
 /**
  * Enter pi's per-path mutation queues for SEVERAL paths in one deterministic, sorted nesting.

package/src/prompts.ts

@@ -1,16 +1,10 @@
 import { readFileSync } from "node:fs";
 import { HASH_LEN } from "./hashline/alphabet.js";
-import {
-  ANCHOR_EXAMPLE,
-  EDIT_DESCRIPTION,
-  EDIT_SNIPPET,
-  EDIT_GUIDELINES,
-} from "./payload-contract.js";
 
 /**
  * Resolve template variables in shipped prompt prose. Beyond caller-supplied replacements, the
- * anchor-width token and its example are ALWAYS resolved from the live HASH_LEN: the width is a
- * build-time setting (ADR-0020), so any prompt that quotes it must not hardcode a digit.
+ * anchor-width token is ALWAYS resolved from the live `HASH_LEN`: the width is a build-time setting
+ * (ADR-0020), so any prompt that quotes it must not hardcode a digit.
  */
 function applyReplacements(content: string, replacements?: Record<string, string>): string {
   let out = content;
@@ -19,36 +13,15 @@ function applyReplacements(content: string, replacements?: Record<string, string
       out = out.split(`{{${key}}}`).join(value);
     }
   }
-  return out
-    .split("{{HASH_LEN}}")
-    .join(String(HASH_LEN))
-    .split("{{ANCHOR_EXAMPLE}}")
-    .join(ANCHOR_EXAMPLE);
+  return out.split("{{HASH_LEN}}").join(String(HASH_LEN));
 }
 
-const EDIT_PROMPT_FILES = new Set([
-  "../prompts/edit.md",
-  "prompts/edit.md",
-  "../prompts/edit-snippet.md",
-  "prompts/edit-snippet.md",
-]);
-
-const EDIT_GUIDE_FILES = new Set(["../prompts/edit-guidelines.md", "prompts/edit-guidelines.md"]);
-
 export function loadP(relativePath: string, replacements?: Record<string, string>): string {
-  if (EDIT_PROMPT_FILES.has(relativePath)) {
-    const content = relativePath.includes("snippet") ? EDIT_SNIPPET : EDIT_DESCRIPTION;
-    return applyReplacements(content, replacements);
-  }
   const content = readFileSync(new URL(relativePath, import.meta.url), "utf-8").trim();
   return applyReplacements(content, replacements);
 }
 
 export function loadGuide(relativePath: string, replacements?: Record<string, string>): string[] {
-  if (EDIT_GUIDE_FILES.has(relativePath)) {
-    const guidelines = [...EDIT_GUIDELINES];
-    return guidelines.map((line) => applyReplacements(line, replacements));
-  }
   const content = readFileSync(new URL(relativePath, import.meta.url), "utf-8");
   return applyReplacements(content, replacements)
     .split("\n")

package/src/served-session/serve-render.ts

@@ -90,7 +90,7 @@ export function fmtServedRows(rows: ServedRow[], fileLines: string[]): string {
 
 // WHY: the one continuation a rejected edit offers (read-chrome): the `windows` offset, not a bare
 // WHY: `offset`, because `offset` alone no longer continues anything a page footer used to name.
-function paginationHint(nextOffset: number, more: number): string {
+export function paginationHint(nextOffset: number, more: number): string {
   return `[... ${more} more — use windows: [{ offset: ${nextOffset} }]]`;
 }
 
@@ -107,7 +107,7 @@ export function servedPositionsOf(served: (string | null)[], hash: string): numb
 // WHY: ---------------------------------------------------------------------------
 
 /** Builds the reject-and-serve served rows + rendered block for a current on-disk range. */
-function buildRangeServeBlock(
+export function buildRangeServeBlock(
   startLine: number,
   endLine: number,
   fileHashes: string[],

package/src/undo-store.ts

@@ -29,8 +29,25 @@ export interface UndoRecord {
    * `null` is a row from before this column, or an ordinary single-file edit.
    */
   rawPre?: string | null;
+  /**
+   * The lifecycle action this row reverses. Absent/null is an ordinary edit (back-compatible).
+   * add = the file did not exist before; delete = the file does not exist after; move = a pure
+   * rename with an optional content edit.
+   */
+  lifecycle?: UndoLifecycle | null;
+  /** Move: the absolute path the file had before the transaction. */
+  fromPath?: string | null;
+  /** Move: the absolute path the file has after the transaction. */
+  toPath?: string | null;
+  /** The RAW post-transaction text when the commit wrote non-canonical bytes (pure move). */
+  rawPost?: string | null;
+  /** Add: the directories the add created, outermost first, JSON-encoded in the column. */
+  createdDirs?: readonly string[] | null;
 }
 
+/** The lifecycle action one undo row reverses. */
+export type UndoLifecycle = "edit" | "add" | "delete" | "move";
+
 export type CutIntentDirection = "revert" | null;
 
 export interface CutIntent {
@@ -50,6 +67,11 @@ export interface UndoStmts {
     snapshotHash: string | null,
     transactionId: string | null,
     rawPre: string | null,
+    lifecycle: string | null,
+    fromPath: string | null,
+    toPath: string | null,
+    rawPost: string | null,
+    createdDirs: string | null,
     anchorGeneration: number,
     updatedAt: number,
   ) => void;
@@ -75,15 +97,15 @@ export function undoStmts(db: DatabaseSync): UndoStmts {
 
 function buildStmts(db: DatabaseSync): UndoStmts {
   const undoUpsertStmt = db.prepare(
-    "INSERT INTO file_undo (path, content, bom, ending, hashes, result_content, snapshot_hash, transaction_id, raw_pre, anchor_generation, updated_at) VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?) " +
-      "ON CONFLICT(path) DO UPDATE SET content = excluded.content, bom = excluded.bom, ending = excluded.ending, hashes = excluded.hashes, result_content = excluded.result_content, snapshot_hash = excluded.snapshot_hash, transaction_id = excluded.transaction_id, raw_pre = excluded.raw_pre, anchor_generation = excluded.anchor_generation, updated_at = excluded.updated_at",
+    "INSERT INTO file_undo (path, content, bom, ending, hashes, result_content, snapshot_hash, transaction_id, raw_pre, lifecycle, from_path, to_path, raw_post, created_dirs, anchor_generation, updated_at) VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?) " +
+      "ON CONFLICT(path) DO UPDATE SET content = excluded.content, bom = excluded.bom, ending = excluded.ending, hashes = excluded.hashes, result_content = excluded.result_content, snapshot_hash = excluded.snapshot_hash, transaction_id = excluded.transaction_id, raw_pre = excluded.raw_pre, lifecycle = excluded.lifecycle, from_path = excluded.from_path, to_path = excluded.to_path, raw_post = excluded.raw_post, created_dirs = excluded.created_dirs, anchor_generation = excluded.anchor_generation, updated_at = excluded.updated_at",
   );
   const undoGetStmt = db.prepare(
-    "SELECT content, bom, ending, hashes, result_content, snapshot_hash, transaction_id, raw_pre, anchor_generation FROM file_undo WHERE path = ?",
+    "SELECT content, bom, ending, hashes, result_content, snapshot_hash, transaction_id, raw_pre, lifecycle, from_path, to_path, raw_post, created_dirs, anchor_generation FROM file_undo WHERE path = ?",
   );
   const undoDelStmt = db.prepare("DELETE FROM file_undo WHERE path = ?");
   const undoGetTransactionStmt = db.prepare(
-    "SELECT path, content, bom, ending, hashes, result_content, snapshot_hash, transaction_id, raw_pre, anchor_generation FROM file_undo WHERE transaction_id = ? ORDER BY path",
+    "SELECT path, content, bom, ending, hashes, result_content, snapshot_hash, transaction_id, raw_pre, lifecycle, from_path, to_path, raw_post, created_dirs, anchor_generation FROM file_undo WHERE transaction_id = ? ORDER BY path",
   );
   const undoDelTransactionStmt = db.prepare("DELETE FROM file_undo WHERE transaction_id = ?");
   const intentUpsertStmt = db.prepare(
@@ -105,6 +127,11 @@ function buildStmts(db: DatabaseSync): UndoStmts {
       snapshotHash,
       transactionId,
       rawPre,
+      lifecycle,
+      fromPath,
+      toPath,
+      rawPost,
+      createdDirs,
       anchorGeneration,
       updatedAt,
     ) => {
@@ -119,6 +146,11 @@ function buildStmts(db: DatabaseSync): UndoStmts {
           snapshotHash,
           transactionId,
           rawPre,
+          lifecycle,
+          fromPath,
+          toPath,
+          rawPost,
+          createdDirs,
           anchorGeneration,
           updatedAt,
         );
@@ -164,12 +196,25 @@ onStoreOpen((db) => {
   ensureFileUndoSchema(db);
 });
 
+/** Parse the JSON-encoded created-directory list; a corrupt value degrades to an empty list. */
+function parseCreatedDirs(value: unknown): string[] | null {
+  if (typeof value !== "string" || value.length === 0) return null;
+  try {
+    const parsed: unknown = JSON.parse(value);
+    return Array.isArray(parsed) && parsed.every((entry) => typeof entry === "string")
+      ? (parsed as string[])
+      : null;
+  } catch {
+    return null;
+  }
+}
+
 function parseUndoRow(row: Record<string, unknown> | undefined): UndoRecord | undefined {
   if (!row) return undefined;
   try {
     const parsed = JSON.parse(row.hashes as string);
     if (!isValidHashList(parsed)) return undefined;
-    return {
+    const record: UndoRecord = {
       content: row.content as string,
       bom: row.bom as string,
       ending: row.ending as string,
@@ -180,6 +225,23 @@ function parseUndoRow(row: Record<string, unknown> | undefined): UndoRecord | un
       rawPre: (row.raw_pre as string | null) ?? null,
       anchorGeneration: (row.anchor_generation as number | null) ?? 0,
     };
+    // WHY: the lifecycle fields are additive; an ordinary row omits them entirely so its
+    // WHY: pre-extension shape stays byte-for-byte what existing consumers assert.
+    if (row.lifecycle !== null && row.lifecycle !== undefined) {
+      record.lifecycle = row.lifecycle as UndoLifecycle;
+    }
+    if (row.from_path !== null && row.from_path !== undefined) {
+      record.fromPath = row.from_path as string;
+    }
+    if (row.to_path !== null && row.to_path !== undefined) {
+      record.toPath = row.to_path as string;
+    }
+    if (row.raw_post !== null && row.raw_post !== undefined) {
+      record.rawPost = row.raw_post as string;
+    }
+    const createdDirs = parseCreatedDirs(row.created_dirs);
+    if (createdDirs !== null) record.createdDirs = createdDirs;
+    return record;
   } catch {
     return undefined;
   }
@@ -196,6 +258,13 @@ export function upsertUndo(store: HashStore, path: string, entry: UndoRecord): v
     entry.snapshotHash ?? null,
     entry.transactionId ?? null,
     entry.rawPre ?? null,
+    entry.lifecycle ?? null,
+    entry.fromPath ?? null,
+    entry.toPath ?? null,
+    entry.rawPost ?? null,
+    entry.createdDirs === null || entry.createdDirs === undefined
+      ? null
+      : JSON.stringify(entry.createdDirs),
     // WHY: ADR-0031 §4 (refuse, do not launder) — the stamp comes from the payload, never
     // WHY: hard-coded: a replay of a pre-generation row preserves its generation so the
     // WHY: restore gate re-derives, while a fresh write (absent generation) defaults current.

package/lib/types/dsh/tools/edit.d.ts

@@ -1,10 +0,0 @@
-import type { ToolDefinition } from "@deepseek-ai/dsh-tools";
-import type { ToolDependencies } from "../contracts.js";
-/** dsh tool name; the agent-layer registration shadows the preset's built-in `edit`. */
-export declare const EDIT_TOOL_NAME = "edit";
-/**
- * Build the dsh `edit` tool for one agent install.
- * @param deps - the host seams this tool may touch; `sandbox` advertises and resolves escalation.
- * @returns a registry-ready dsh tool definition named `edit`.
- */
-export declare function buildEditTool(deps: ToolDependencies): ToolDefinition;