klyro 1.0.0 → 1.0.2

package/dist/policy/path-guard.js

@@ -11,6 +11,7 @@
  */
 import * as path from 'node:path';
 import * as fs from 'node:fs/promises';
+import * as fsSync from 'node:fs';
 import { TOOL_ERROR_CODES } from '../tools/normalize.js';
 export class PathGuardError extends Error {
     code;
@@ -96,3 +97,48 @@ export async function resolveAndFollowSymlinks(cwd, requested) {
     }
     return { resolved: real };
 }
+/**
+ * Symlink-swap guard: refuse when the FINAL path itself is a symlink.
+ *
+ * File tools resolve symlinks up front, but a racing swap between that
+ * check and the final write/rename could redirect an open-with-O_TRUNC /
+ * O_CREAT (or rename) through a freshly-planted symlink. Calling this
+ * immediately before the final write/rename shrinks that window to ~0:
+ * `lstat` never follows the final component, so a swapped-in link is
+ * caught. (POSIX `rename(2)` onto a symlink replaces the LINK itself, so
+ * the vulnerable op is opening/truncating through the link — which this
+ * denies first.) Supported on POSIX and Windows (both implement lstat).
+ * Missing paths (ENOENT) are fine — a nonexistent path is not a symlink.
+ */
+export async function assertNotSymlink(p) {
+    let st;
+    try {
+        st = await fs.lstat(p);
+    }
+    catch (e) {
+        if (e?.code === 'ENOENT')
+            return;
+        throw e;
+    }
+    if (st.isSymbolicLink()) {
+        throw new PathGuardError(TOOL_ERROR_CODES.PATH_ESCAPE, `Refusing to write through symlink: ${p}`);
+    }
+}
+/**
+ * Open a file for writing without following a trailing symlink (POSIX).
+ *
+ * Uses O_WRONLY | O_CREAT | O_NOFOLLOW so the open itself fails (ELOOP)
+ * when the final component is a symlink, instead of truncating through
+ * it. On Windows there is no O_NOFOLLOW, so this falls back to a plain
+ * `'w'` open — symlink-swap protection there comes from
+ * `assertNotSymlink` (lstat) immediately before the write/rename instead.
+ */
+export function openNoFollowForWrite(dir, file) {
+    const target = path.resolve(dir, file);
+    if (process.platform === 'win32') {
+        // Windows fallback: no O_NOFOLLOW — plain open; see comment above.
+        return fsSync.openSync(target, 'w');
+    }
+    const flags = fsSync.constants.O_WRONLY | fsSync.constants.O_CREAT | fsSync.constants.O_NOFOLLOW;
+    return fsSync.openSync(target, flags, 0o666);
+}

package/dist/policy/secret-redactor.js

@@ -24,6 +24,10 @@ const PATTERNS = [
     { name: 'api-key', re: /(?:api[_-]?key|apikey)\s*[:=]\s*['"]?[A-Za-z0-9_\-]{16,}['"]?/gi },
     { name: 'password', re: /(?:password|passwd|pwd)\s*[:=]\s*['"]?[^\s'"]{4,}['"]?/gi },
     { name: 'secret-generic', re: /(?:secret|token)\s*[:=]\s*['"]?[A-Za-z0-9_\-+/=]{16,}['"]?/gi },
+    { name: 'discord-token', re: /mfa\.[\w-]{84}|[MN][A-Za-z\d]{23}\.[\w-]{6}\.[\w-]{27}/g },
+    { name: 'npm-token', re: /\bnpm_[A-Za-z0-9]{24,}/g },
+    { name: 'sendgrid-key', re: /\bSG\.[\w-]{22}\.[\w-]{43}/g },
+    { name: 'pypi-token', re: /\bpypi-[A-Za-z0-9_-]{30,}/g },
 ];
 const REPLACEMENT = '[REDACTED]';
 /** Redact a single string (or Buffer). */

package/dist/providers/model-info.d.ts

@@ -15,4 +15,27 @@ export interface ModelInfo {
 }
 export declare const MODEL_REGISTRY: Record<string, ModelInfo>;
 export declare function getModelInfo(id: string): ModelInfo;
+/**
+ * Single-source per-1K-token rate table, derived from MODEL_REGISTRY so
+ * prices live in exactly one place. Local/self-hosted entries are $0.
+ */
+export declare const MODEL_RATES_PER_1K: Record<string, {
+    input: number;
+    output: number;
+}>;
+/**
+ * Resolve per-1K rates for any model id. Exact registry hits win, then the
+ * local-model check ($0), then hosted-family fallbacks. Unknown models are
+ * $0 — never invent nonzero prices for models we don't recognize.
+ */
+export declare function ratesFor(modelId: string): {
+    input: number;
+    output: number;
+};
+/**
+ * True for Anthropic-family model ids (Claude). Used by the runtime's
+ * cache-aware cost math: only Anthropic bills cacheRead/cacheWrite, so
+ * other families keep ignoring those counters.
+ */
+export declare function isAnthropicModel(modelId: string): boolean;
 export declare function estimateCost(modelId: string, inputTokens: number, outputTokens: number): number;

package/dist/providers/model-info.js

@@ -12,7 +12,48 @@ export const MODEL_REGISTRY = {
 export function getModelInfo(id) {
     return MODEL_REGISTRY[id] ?? { id, contextWindow: 100000, maxOutput: 4096, inputPricePer1k: 0, outputPricePer1k: 0, capabilities: { tools: true } };
 }
+/**
+ * Single-source per-1K-token rate table, derived from MODEL_REGISTRY so
+ * prices live in exactly one place. Local/self-hosted entries are $0.
+ */
+export const MODEL_RATES_PER_1K = Object.fromEntries(Object.entries(MODEL_REGISTRY).map(([k, v]) => [k, { input: v.inputPricePer1k, output: v.outputPricePer1k }]));
+/** Hosted-family fallback rates for model ids not in the registry. */
+const FAMILY_RATES = [
+    { test: (m) => /o1/i.test(m), input: 0.015, output: 0.06 },
+    { test: (m) => /gpt-3\.5/i.test(m), input: 0.0005, output: 0.0015 },
+    { test: (m) => /gpt-4/i.test(m), input: 0.003, output: 0.015 },
+    { test: (m) => /claude|anthropic/i.test(m), input: 0.003, output: 0.015 },
+    { test: (m) => /gemini/i.test(m), input: 0.00075, output: 0.003 },
+];
+/** Local/self-hosted model ids are always priced at $0. */
+const LOCAL_MODEL_PATTERN = /local|ollama|llama|mistral|mixtral|qwen|gemma|phi-|vllm|llama\.cpp|^mock/i;
+/**
+ * Resolve per-1K rates for any model id. Exact registry hits win, then the
+ * local-model check ($0), then hosted-family fallbacks. Unknown models are
+ * $0 — never invent nonzero prices for models we don't recognize.
+ */
+export function ratesFor(modelId) {
+    const exact = MODEL_RATES_PER_1K[modelId];
+    if (exact)
+        return exact;
+    if (LOCAL_MODEL_PATTERN.test(modelId))
+        return { input: 0, output: 0 };
+    const fam = FAMILY_RATES.find((r) => r.test(modelId));
+    if (fam)
+        return { input: fam.input, output: fam.output };
+    return { input: 0, output: 0 };
+}
+/**
+ * True for Anthropic-family model ids (Claude). Used by the runtime's
+ * cache-aware cost math: only Anthropic bills cacheRead/cacheWrite, so
+ * other families keep ignoring those counters.
+ */
+export function isAnthropicModel(modelId) {
+    return /anthropic|claude/i.test(modelId);
+}
 export function estimateCost(modelId, inputTokens, outputTokens) {
-    const info = getModelInfo(modelId);
-    return (inputTokens / 1000) * info.inputPricePer1k + (outputTokens / 1000) * info.outputPricePer1k;
+    // Single source: delegate to ratesFor so registry, family fallbacks, and
+    // local-$0 rules live in exactly one place (no split-brain with getModelInfo).
+    const { input, output } = ratesFor(modelId);
+    return (inputTokens / 1000) * input + (outputTokens / 1000) * output;
 }

package/dist/repl.d.ts

@@ -6,4 +6,10 @@
  *
  * Type ':quit' (or Ctrl-C / Ctrl-D) to exit.
  */
+export interface Turn {
+    role: 'user' | 'assistant';
+    content: string;
+}
 export declare function repl(system: string): Promise<void>;
+/** Drop oldest turns to stay under the size cap. Keep user/assistant pairs together. */
+export declare function trimHistory(history: Turn[]): void;

package/dist/repl.js

@@ -10,6 +10,7 @@ import * as readline from 'node:readline/promises';
 import { stdin, exit } from 'node:process';
 import { streamToStdout, readBoundedText } from './chat.js';
 import { resolveProvider, providerHelp } from './providers.js';
+import { estimateTokens } from './context/tokenizer.js';
 /** Cap conversation history so we don't blow the model's context window. */
 const MAX_HISTORY_TURNS = 40;
 /** Approximate char budget for the user side of history. */
@@ -26,6 +27,8 @@ export async function repl(system) {
         exit(2);
     }
     const { baseURL, apiKey, model, source } = provider;
+    // Legacy REPL — prefer `klyro tui`; history truncation is approximate.
+    process.stderr.write('klyro: legacy REPL — prefer `klyro tui`; history truncation is approximate.\n');
     const history = [];
     // Adapt readline to the environment. On a TTY we let readline manage the
     // prompt and echo so the user sees their typing; on a pipe we suppress both
@@ -94,7 +97,7 @@ export async function repl(system) {
     }
 }
 /** Drop oldest turns to stay under the size cap. Keep user/assistant pairs together. */
-function trimHistory(history) {
+export function trimHistory(history) {
     // Keep even number of turns (pairs) when trimming for turn count
     while (history.length > MAX_HISTORY_TURNS) {
         // Drop oldest 2 (user+assistant) to preserve adjacency
@@ -106,21 +109,23 @@ function trimHistory(history) {
             history.shift();
         }
     }
-    let total = 0;
-    for (const t of history)
-        total += t.content.length;
-    while (total > MAX_HISTORY_CHARS && history.length > 2) {
+    // Token-budgeted trim (approximate): estimate over the joined history
+    // instead of raw chars so long-token text (CJK, code) trims correctly.
+    const budgetTokens = Math.ceil(MAX_HISTORY_CHARS / 4);
+    if (estimateTokens(history.map((t) => t.content).join('\n')) <= budgetTokens)
+        return;
+    while (history.length > 2) {
         // Drop oldest pair to avoid orphaning tool context
         const first = history[0];
         const second = history[1];
         if (!first)
             break;
-        total -= first.content.length;
         history.shift();
         if (second) {
-            total -= second.content.length;
             history.shift();
         }
+        if (estimateTokens(history.map((t) => t.content).join('\n')) <= budgetTokens)
+            break;
     }
 }
 /** Send the full history, stream the reply, return the assistant text. */

package/dist/tools/agent/spawn-agent.js

@@ -1,10 +1,10 @@
 /**
  * P1.1 — spawn_agent tool (6-10fix.md §5).
  *
- * Delegates to `AgentSpawnBridge.spawnAgent`, which runs the child to
- * completion (P0/P1 scope: blocking) and returns a compact ChildSummary —
- * never the child transcript. True background `task_wait` / `task_stop`
- * arrives in P2.
+ * Async: starts the child worker and returns IMMEDIATELY with
+ * `{ taskId, status: 'running', ... }` — never the child transcript.
+ * Await completion with `task_wait`, poll with `task_get` / `task_list`,
+ * merge the child's worktree with `task_apply`, or abort with `task_stop`.
  */
 import { z } from 'zod';
 import { defineTool } from '../types.js';
@@ -18,7 +18,7 @@ const InputSchema = z.object({
 });
 export const spawnAgentTool = defineTool({
     name: 'spawn_agent',
-    description: 'Spawn a child agent and return its compact summary { taskId, status, ... }. Child transcript stays separate; use task_get for status.',
+    description: 'Spawn a child agent asynchronously; returns immediately with { taskId, status: "running", ... }. Child transcript stays separate — await it with task_wait, poll with task_get, merge with task_apply, abort with task_stop.',
     inputSchema: InputSchema,
     permission: 'admin',
     isConcurrencySafe: false,

package/dist/tools/agent/task-apply.d.ts

@@ -0,0 +1,4 @@
+import type { ChildSummary } from '../../agent/orchestrator.js';
+export declare const taskApplyTool: import("../types.js").Tool<{
+    taskId: string;
+}, ChildSummary>;

package/dist/tools/agent/task-apply.js

@@ -0,0 +1,44 @@
+/**
+ * task_apply tool — merge a succeeded child's work into the parent tree.
+ *
+ * For worktree-isolated children this merges the `klyro/<taskId>` branch and
+ * emits `subtask.merged`; for shared-cwd children (whose edits already
+ * landed in the parent tree) it is the explicit acknowledgement step that
+ * emits `subtask.merged` and returns the summary. Non-succeeded tasks error
+ * with NOT_READY; conflicts error with MERGE_CONFLICT.
+ */
+import { z } from 'zod';
+import { defineTool } from '../types.js';
+import { toToolError } from '../normalize.js';
+const InputSchema = z.object({
+    taskId: z.string().min(1).describe('Succeeded task id to apply (e.g. task_1)'),
+});
+export const taskApplyTool = defineTool({
+    name: 'task_apply',
+    description: 'Merge a succeeded child task into the parent tree (emits subtask.merged). Errors with NOT_READY unless the task succeeded.',
+    inputSchema: InputSchema,
+    permission: 'admin',
+    isConcurrencySafe: false,
+    renderCall: (input) => `task_apply(${input.taskId})`,
+    execute: async (input, ctx) => {
+        try {
+            const bridge = ctx.agentBridge;
+            if (!bridge) {
+                return {
+                    ok: false,
+                    error: { code: 'NO_ORCHESTRATOR', message: 'task_apply requires an active orchestrator' },
+                };
+            }
+            if (!bridge.applyTask) {
+                return {
+                    ok: false,
+                    error: { code: 'UNSUPPORTED', message: 'task_apply is not supported by this orchestrator bridge' },
+                };
+            }
+            return await bridge.applyTask(input.taskId);
+        }
+        catch (err) {
+            return { ok: false, error: toToolError(err) };
+        }
+    },
+});

package/dist/tools/agent/task-stop.d.ts

@@ -0,0 +1,6 @@
+export declare const taskStopTool: import("../types.js").Tool<{
+    taskId: string;
+}, {
+    taskId: string;
+    status: import("../../agent/task-manager.js").TaskStatus;
+}>;

package/dist/tools/agent/task-stop.js

@@ -0,0 +1,39 @@
+/**
+ * task_stop tool — cancel a running child task via `taskManager.cancel`.
+ * Idempotent on terminal tasks (returns the current status).
+ */
+import { z } from 'zod';
+import { defineTool } from '../types.js';
+import { toToolError } from '../normalize.js';
+const InputSchema = z.object({
+    taskId: z.string().min(1).describe('Task id to stop (e.g. task_1)'),
+});
+export const taskStopTool = defineTool({
+    name: 'task_stop',
+    description: 'Cancel a running child-agent task. Returns { taskId, status }. Idempotent on terminal tasks.',
+    inputSchema: InputSchema,
+    permission: 'admin',
+    isConcurrencySafe: false,
+    renderCall: (input) => `task_stop(${input.taskId})`,
+    execute: async (input, ctx) => {
+        try {
+            const bridge = ctx.agentBridge;
+            if (!bridge) {
+                return {
+                    ok: false,
+                    error: { code: 'NO_ORCHESTRATOR', message: 'task_stop requires an active orchestrator' },
+                };
+            }
+            if (!bridge.cancelTask) {
+                return {
+                    ok: false,
+                    error: { code: 'UNSUPPORTED', message: 'task_stop is not supported by this orchestrator bridge' },
+                };
+            }
+            return bridge.cancelTask(input.taskId);
+        }
+        catch (err) {
+            return { ok: false, error: toToolError(err) };
+        }
+    },
+});

package/dist/tools/agent/task-wait.d.ts

@@ -0,0 +1,17 @@
+import type { ChildSummary } from '../../agent/orchestrator.js';
+import type { TaskStatus } from '../../agent/task-manager.js';
+export interface WaitTaskEntry {
+    taskId: string;
+    status: TaskStatus;
+    summary?: ChildSummary;
+    error?: {
+        code: string;
+        message: string;
+    };
+}
+export declare const taskWaitTool: import("../types.js").Tool<{
+    taskIds: string[];
+    timeoutMs?: number | undefined;
+}, {
+    tasks: import("../../agent/orchestrator.js").WaitedTask[];
+}>;

package/dist/tools/agent/task-wait.js

@@ -0,0 +1,79 @@
+/**
+ * task_wait tool — await one or more child tasks without cancelling them.
+ *
+ * Delegates to `AgentSpawnBridge.waitForTasks` when available, otherwise
+ * polls `getTask` until every id is terminal or `timeoutMs` elapses.
+ * Entries that do not settle in time come back with status `'running'` —
+ * the underlying task keeps running. Documented contract: waiting never
+ * cancels.
+ */
+import { z } from 'zod';
+import { defineTool } from '../types.js';
+import { toToolError } from '../normalize.js';
+const TERMINAL = new Set([
+    'succeeded',
+    'failed',
+    'cancelled',
+    'timed_out',
+    'blocked',
+]);
+const InputSchema = z.object({
+    taskIds: z.array(z.string().min(1)).min(1).describe('Task ids to await (e.g. ["task_1"])'),
+    timeoutMs: z.number().int().positive().optional().describe('Per-task wait timeout in ms (unset = wait indefinitely)'),
+});
+export const taskWaitTool = defineTool({
+    name: 'task_wait',
+    description: 'Await child-agent tasks until they settle. Entries that time out return status "running" — the task is NOT cancelled. Never cancels.',
+    inputSchema: InputSchema,
+    permission: 'read',
+    isConcurrencySafe: true,
+    renderCall: (input) => `task_wait(${input.taskIds.join(', ')})`,
+    execute: async (input, ctx) => {
+        try {
+            const bridge = ctx.agentBridge;
+            if (!bridge) {
+                return {
+                    ok: false,
+                    error: { code: 'NO_ORCHESTRATOR', message: 'task_wait requires an active orchestrator' },
+                };
+            }
+            if (bridge.waitForTasks) {
+                const r = await bridge.waitForTasks(input.taskIds, input.timeoutMs);
+                return { ok: true, value: r };
+            }
+            // Fallback for bridges without waitForTasks: poll getTask snapshots.
+            const deadline = input.timeoutMs !== undefined ? Date.now() + input.timeoutMs : undefined;
+            const tasks = [];
+            for (const taskId of input.taskIds) {
+                let snap = bridge.getTask(taskId);
+                if (!snap) {
+                    tasks.push({ taskId, status: 'failed', error: { code: 'NOT_FOUND', message: `Unknown task: ${taskId}` } });
+                    continue;
+                }
+                while (!TERMINAL.has(snap.status) && (deadline === undefined || Date.now() < deadline)) {
+                    await new Promise((r) => setTimeout(r, 10));
+                    const next = bridge.getTask(taskId);
+                    if (next)
+                        snap = next;
+                }
+                tasks.push({
+                    taskId,
+                    status: snap.status,
+                    summary: {
+                        taskId: snap.id,
+                        agentName: snap.agentName,
+                        status: snap.status,
+                        durationMs: snap.durationMs ?? 0,
+                        changedFiles: [],
+                        ...(snap.error ? { error: { code: snap.error.code, message: snap.error.message } } : {}),
+                    },
+                    ...(snap.error ? { error: { code: snap.error.code, message: snap.error.message } } : {}),
+                });
+            }
+            return { ok: true, value: { tasks } };
+        }
+        catch (err) {
+            return { ok: false, error: toToolError(err) };
+        }
+    },
+});

package/dist/tools/fs/apply-patch.js

@@ -20,9 +20,43 @@ import * as fs from 'node:fs/promises';
 import * as path from 'node:path';
 import { z } from 'zod';
 import { defineTool } from '../types.js';
-import { resolveAndFollowSymlinks } from '../../policy/path-guard.js';
+import { resolveAndFollowSymlinks, assertNotSymlink } from '../../policy/path-guard.js';
 import { safe } from '../normalize.js';
 import { wasRead } from './read-history.js';
+// Extension-anchored: matches test.ts, foo.test.ts, foo-test.ts, foo.spec.js,
+// __tests__ segments — but NOT latest.ts / attest.ts / contest-data.
+const TEST_BASENAME_RE = /(^|[._-])(test|spec)\.[^.]+$|\.test\.[^.]+$|\.spec\.[^.]+$|__(tests|snapshots)__/i;
+function repairGuardHit(targetPath, _content) {
+    const base = targetPath.split(/[\\/]/).pop() ?? targetPath;
+    // Basename alone decides. Patch CONTENT is never consulted for non-test
+    // paths (the old assert-skip regex over-blocked ordinary sources
+    // containing e.g. `it(` or `test(`), and stays unconsulted for test-like
+    // paths too since the basename already denies.
+    return TEST_BASENAME_RE.test(base);
+}
+async function allowedHit(cwd, resolved, allowed) {
+    if (!allowed)
+        return false;
+    // Canonicalize both sides (realpath) so lexical-vs-canonical spellings
+    // of the same directory (e.g. Windows 8.3 short names) compare equal.
+    const canon = async (p) => {
+        try {
+            return await fs.realpath(p);
+        }
+        catch {
+            return path.resolve(p);
+        }
+    };
+    const canonTarget = await canon(resolved);
+    for (const base of allowed) {
+        const absBase = path.isAbsolute(base) ? path.resolve(base) : path.resolve(cwd, base);
+        const canonBase = await canon(absBase);
+        const rel = path.relative(canonBase, canonTarget);
+        if (rel === '' || (!rel.startsWith('..') && !path.isAbsolute(rel)))
+            return false;
+    }
+    return true;
+}
 const InputSchema = z.object({
     patch: z.string().min(1).describe('Unified diff patch text'),
 });
@@ -116,6 +150,28 @@ async function guardWrite(cwd, relPath, resolved) {
         // missing file → creation path, no guard needed
     }
 }
+// TOCTOU shrink (mirrors write_file): re-resolve symlinks immediately
+// before the write and refuse if the target moved. Compares canonicalized
+// forms (not raw strings) to avoid false positives from
+// lexical-vs-canonical spellings (e.g. `sub/../a.txt`, short names).
+async function assertSameTarget(cwd, relPath, resolved) {
+    const { resolved: reResolved } = await resolveAndFollowSymlinks(cwd, relPath);
+    const canon = async (p) => {
+        try {
+            return await fs.realpath(p);
+        }
+        catch { /* missing file → try parent */ }
+        try {
+            return path.join(await fs.realpath(path.dirname(p)), path.basename(p));
+        }
+        catch {
+            return p;
+        }
+    };
+    if ((await canon(reResolved)) !== (await canon(resolved))) {
+        throw Object.assign(new Error(`Path target changed between check and write: ${relPath} (POLICY_DENIED)`), { code: 'POLICY_DENIED' });
+    }
+}
 export const applyPatchTool = defineTool({
     name: 'apply_patch',
     description: 'Apply a unified diff patch (Codex-style). Real hunk application with context matching; mismatches fail loudly.',
@@ -130,6 +186,13 @@ export const applyPatchTool = defineTool({
             for (const line of lines) {
                 if (line.startsWith('*** Begin Patch') || line.startsWith('*** End Patch'))
                     continue;
+                // Delete sections are NOT supported — reject loudly rather than
+                // mis-parsing the section as a write.
+                if (line.startsWith('*** Delete File:')) {
+                    throw Object.assign(new Error(`Delete sections not supported: ${line.trim()} (INVALID_PATCH)`), {
+                        code: 'INVALID_PATCH',
+                    });
+                }
                 if (line.startsWith('*** Update File:')) {
                     cur = { op: 'update', path: line.replace('*** Update File:', '').trim(), body: [] };
                     sections.push(cur);
@@ -150,7 +213,13 @@ export const applyPatchTool = defineTool({
             for (const sec of sections) {
                 if (!sec.path)
                     throw Object.assign(new Error('Patch section missing file path'), { code: 'INVALID_PATCH' });
+                if (ctx.repairGuard?.denyTestEdits && repairGuardHit(sec.path, sec.body.join('\n'))) {
+                    throw Object.assign(new Error('repair-guard: test edits denied (denyTestEdits)'), { code: 'POLICY_DENIED' });
+                }
                 const { resolved } = await resolveAndFollowSymlinks(ctx.cwd, sec.path);
+                if (await allowedHit(ctx.cwd, resolved, ctx.agentAllowedPaths)) {
+                    throw Object.assign(new Error(`agent path not allowed: ${resolved} (POLICY_DENIED)`), { code: 'POLICY_DENIED' });
+                }
                 const hunks = parseHunks(sec.body);
                 if (sec.op === 'add' || hunks.length === 0) {
                     // Creation path: content from + lines (legacy tolerant format).
@@ -171,7 +240,11 @@ export const applyPatchTool = defineTool({
                         .map((l) => l.slice(1))
                         .join('\n');
                     await guardWrite(ctx.cwd, sec.path, resolved);
+                    await assertSameTarget(ctx.cwd, sec.path, resolved);
                     await fs.mkdir(path.dirname(resolved), { recursive: true });
+                    // Symlink-swap guard: refuse if the final dest became a symlink
+                    // since the up-front resolve (lstat never follows the final link).
+                    await assertNotSymlink(resolved);
                     await fs.writeFile(resolved, content ? content + '\n' : '', 'utf-8');
                     patchedFiles.push(sec.path);
                     continue;
@@ -192,7 +265,10 @@ export const applyPatchTool = defineTool({
                 if (hasTrailingNewline && fileLines[fileLines.length - 1] === '')
                     fileLines.pop();
                 const next = applyHunks(sec.path, fileLines, hunks);
+                await assertSameTarget(ctx.cwd, sec.path, resolved);
                 await fs.mkdir(path.dirname(resolved), { recursive: true });
+                // Symlink-swap guard (mirrors the creation path above).
+                await assertNotSymlink(resolved);
                 await fs.writeFile(resolved, next.join('\n') + (hasTrailingNewline ? '\n' : ''), 'utf-8');
                 patchedFiles.push(sec.path);
             }