mixdog 0.9.87 → 0.9.89

package/src/runtime/agent/orchestrator/tools/patch/orchestrator.mjs

@@ -3,8 +3,8 @@
 // executePatchTool entry point + replay capture. Moved verbatim from
 // patch.mjs; control flow and output are unchanged.
 
-import { chmodSync, existsSync, readFileSync, readdirSync, writeFileSync, mkdirSync, rmSync, statSync } from 'node:fs';
-import { dirname as pathDirname, resolve as pathResolve, isAbsolute, join as pathJoin } from 'node:path';
+import { chmodSync, existsSync, statSync, readFileSync, readdirSync, writeFileSync, mkdirSync, rmSync } from 'node:fs';
+import { dirname as pathDirname, resolve as pathResolve, relative as pathRelative, isAbsolute, join as pathJoin } from 'node:path';
 import { parsePatch } from 'diff';
 import { getAbortSignalForSession } from '../../session/abort-lookup.mjs';
 import {
@@ -20,6 +20,7 @@ import { markCodeGraphDirtyPaths } from '../code-graph-state.mjs';
 import { prepareInput, isV4APatchInput, hasUnifiedBareV4AHunk, canFallbackCountedUnified, parseV4APatch, parseUnifiedBareV4APatch, parseUnifiedCountedAsV4APatch, isCompactedPlaceholderPatch, salvageV4AOpening } from './parsing.mjs';
 import {
   resolveBasePath,
+  resolveEntryPath,
   resolveV4AEntryPath,
   parsedEntryResolvedPath,
   isResolvedPathOutsideBase,
@@ -32,14 +33,13 @@ import {
 } from './paths.mjs';
 import { ensureNativePatchBinaryAvailable } from './native-server.mjs';
 import { assertPathReachable } from '../builtin/fs-reachability.mjs';
+import { resolveReadPathRedirect } from '../builtin/snapshot-store.mjs';
 import { dispatchNativePatch, dispatchJsPatchEntries } from './dispatch.mjs';
 import {
   planV4ARenameSections,
   applyV4ARenameSections,
   formatV4ARenameSuccessLines,
   convertV4ASectionsToUnifiedPatch,
-  convertUnifiedBareV4AToUnifiedPatch,
-  convertUnifiedCountedToUnifiedPatchViaV4A,
   isV4ARenameSection,
 } from './v4a-convert.mjs';
 
@@ -47,24 +47,80 @@ function isPatchErrorText(text) {
   return /^Error:/i.test(String(text ?? '').trimStart());
 }
 
+function patchPathKey(fullPath) {
+  const value = String(fullPath || '');
+  return process.platform === 'win32' ? value.toLowerCase() : value;
+}
+
+function redirectedPatchPath(requestedFullPath, readStateScope) {
+  // A newly-created exact requested path always wins over an older redirect.
+  if (!requestedFullPath || existsSync(requestedFullPath)) return requestedFullPath;
+  const redirected = resolveReadPathRedirect(requestedFullPath, readStateScope);
+  return redirected && existsSync(redirected) ? redirected : requestedFullPath;
+}
+
+function patchHeaderPathForResolved(basePath, fullPath) {
+  const rel = pathRelative(pathResolve(basePath), pathResolve(fullPath));
+  if (rel && !isAbsolute(rel) && !rel.split(/[\\/]+/).some((part) => part === '..')) {
+    return rel.replace(/\\/g, '/');
+  }
+  return fullPath;
+}
+
+function rewriteV4AReadRedirects(sections, basePath, readStateScope) {
+  return (sections || []).map((section) => {
+    if (!section || section.kind === 'add' || !section.path) return section;
+    const requested = resolveV4AEntryPath(basePath, section.path);
+    const redirected = redirectedPatchPath(requested, readStateScope);
+    if (patchPathKey(redirected) === patchPathKey(requested)) return section;
+    return { ...section, path: patchHeaderPathForResolved(basePath, redirected) };
+  });
+}
+
+function rewriteParsedReadRedirects(parsed, basePath, readStateScope) {
+  return (parsed || []).map((entry) => {
+    const kind = classifyEntry(entry);
+    if (kind === 'create' || !entry?.oldFileName) return entry;
+    const requested = resolveEntryPath(basePath, entry.oldFileName);
+    const redirected = redirectedPatchPath(requested, readStateScope);
+    if (patchPathKey(redirected) === patchPathKey(requested)) return entry;
+    const rewritten = {
+      ...entry,
+      oldFileName: patchHeaderPathForResolved(basePath, redirected),
+    };
+    if (kind === 'modify' && entry.newFileName) {
+      const newRequested = resolveEntryPath(basePath, entry.newFileName);
+      if (patchPathKey(newRequested) === patchPathKey(requested)) {
+        rewritten.newFileName = rewritten.oldFileName;
+      }
+    }
+    return rewritten;
+  });
+}
+
+// Pre-patch snapshot of every path this operation may touch: the bytes and
+// mode of each existing target, or an "absent" marker. Restoring them undoes
+// the whole batch. Hostile concurrent replacement of a path between capture
+// and restore is out of scope.
 function capturePatchRollbackState(paths) {
   return paths.map((fullPath) => {
-    if (!existsSync(fullPath)) return { fullPath, existed: false, content: null, mode: null };
-    const stat = statSync(fullPath);
+    let stat;
+    try {
+      stat = statSync(fullPath);
+    } catch (err) {
+      if (err?.code === 'ENOENT') return { fullPath, existed: false, content: null, mode: null };
+      throw new Error(`apply_patch: rollback snapshot target unreadable: ${normalizeOutputPath(fullPath)} (${err?.code || err?.message || String(err)})`);
+    }
     if (!stat.isFile()) throw new Error(`apply_patch: rollback snapshot target is not a regular file: ${normalizeOutputPath(fullPath)}`);
-    return {
-      fullPath,
-      existed: true,
-      content: readFileSync(fullPath),
-      mode: stat.mode,
-    };
+    return { fullPath, existed: true, content: readFileSync(fullPath), mode: stat.mode };
   });
 }
 
 function restorePatchRollbackState(snapshots, readStateScope) {
   const errors = [];
-  const paths = snapshots.map((snapshot) => snapshot.fullPath);
+  const paths = [];
   for (const snapshot of snapshots) {
+    const display = normalizeOutputPath(snapshot.fullPath);
     try {
       if (snapshot.existed) {
         mkdirSync(pathDirname(snapshot.fullPath), { recursive: true });
@@ -72,9 +128,12 @@ function restorePatchRollbackState(snapshots, readStateScope) {
         if (snapshot.mode != null) chmodSync(snapshot.fullPath, snapshot.mode);
       } else if (existsSync(snapshot.fullPath)) {
         rmSync(snapshot.fullPath, { force: true });
+      } else {
+        continue; // nothing written, nothing to undo
       }
+      paths.push(snapshot.fullPath);
     } catch (err) {
-      errors.push(`${normalizeOutputPath(snapshot.fullPath)} — ${err?.message || String(err)}`);
+      errors.push(`${display} — ${err?.message || String(err)}`);
     }
   }
   invalidateBuiltinResultCache(paths);
@@ -186,7 +245,11 @@ async function applyPatchSequence(patchStr, requestedFormat, basePath, ctx) {
   if (isV4APatchInput(patchStr, requestedFormat)) {
     let allSections;
     try {
-      allSections = parseV4APatch(patchStr);
+      allSections = rewriteV4AReadRedirects(
+        parseV4APatch(patchStr),
+        basePath,
+        readStateScope,
+      );
     } catch (err) {
       throw new Error(`apply_patch: V4A parse failed — ${err?.message || String(err)}`);
     }
@@ -197,7 +260,11 @@ async function applyPatchSequence(patchStr, requestedFormat, basePath, ctx) {
     // than converting the whole patch up front.
     let sections;
     try {
-      sections = parseUnifiedBareV4APatch(patchStr);
+      sections = rewriteV4AReadRedirects(
+        parseUnifiedBareV4APatch(patchStr),
+        basePath,
+        readStateScope,
+      );
     } catch (err) {
       throw new Error(`apply_patch: bare @@ parse failed — ${err?.message || String(err)}`);
     }
@@ -215,7 +282,11 @@ async function applyPatchSequence(patchStr, requestedFormat, basePath, ctx) {
       // V4A-style sections and defer per-section conversion — same ordered-stop
       // guarantee as the V4A path (no whole-patch up-front convert).
       try {
-        countedSections = parseUnifiedCountedAsV4APatch(patchStr);
+        countedSections = rewriteV4AReadRedirects(
+          parseUnifiedCountedAsV4APatch(patchStr),
+          basePath,
+          readStateScope,
+        );
       } catch (fallbackErr) {
         throw new Error(`apply_patch: parse failed — ${err?.message || String(err)}; V4A fallback failed — ${fallbackErr?.message || String(fallbackErr)}`);
       }
@@ -223,9 +294,17 @@ async function applyPatchSequence(patchStr, requestedFormat, basePath, ctx) {
     if (countedSections) {
       for (const section of countedSections) pushSectionUnit(section);
     } else {
+      parsed = rewriteParsedReadRedirects(parsed, basePath, readStateScope);
       for (const entry of parsed || []) {
         const kind = classifyEntry(entry);
         const headerName = kind === 'create' ? entry.newFileName : entry.oldFileName;
+        if (!headerName) {
+          throw new Error(
+            'apply_patch: a file section header could not be parsed (no target path) — the patch body is not a valid diff. '
+            + 'Each section must start with `*** Update File: <path>` / `*** Add File: <path>` / `*** Delete File: <path>` '
+            + '(V4A, wrapped in `*** Begin Patch` / `*** End Patch`), or a `--- a/<path>` + `+++ b/<path>` pair (unified).',
+          );
+        }
         units.push({
           displayPath: normalizeOutputPath(stripDiffPrefix(headerName || '')),
           fullPath: parsedEntryResolvedPath(entry, basePath),
@@ -247,6 +326,42 @@ async function applyPatchSequence(patchStr, requestedFormat, basePath, ctx) {
 
   return withBuiltinPathLocks(lockPaths, () =>
     withAdvisoryLocks(lockPaths, async () => {
+      // Most multi-file failures are stale context in a later, independent
+      // file. For unique targets, validate every section against current bytes
+      // before the first write. Same-target sequences retain the existing
+      // ordered conversion/rollback path because later sections may
+      // intentionally depend on earlier edits.
+      const preparedUnits = new Map();
+      const uniqueTargets = new Set(lockPaths.map(patchPathKey)).size === units.length;
+      if (!dryRun && rollbackOnFailure && uniqueTargets) {
+        for (let i = 0; i < units.length; i++) {
+          const unit = units[i];
+          if (abortSignal?.aborted) return 'Error: apply_patch aborted during preflight; no files were written';
+          let parsed;
+          try {
+            parsed = await unit.buildParsed();
+          } catch (err) {
+            return `Error: apply_patch preflight rejected section ${i + 1}/${units.length} (${unit.displayPath}); no files were written.\n${err?.message || String(err)}`;
+          }
+          if (!Array.isArray(parsed) || parsed.length === 0) {
+            preparedUnits.set(i, { parsed, wave: null });
+            continue;
+          }
+          let wave;
+          try {
+            const { entries, headerRewrites } = await preValidateNativeBatch(parsed, basePath);
+            wave = { parsed, entries, headerRewrites };
+          } catch (err) {
+            return `Error: apply_patch preflight rejected section ${i + 1}/${units.length} (${unit.displayPath}); no files were written.\n${err?.message || String(err)}`;
+          }
+          const checked = await applyParsedWave(wave, basePath, { ...waveOpts, dryRun: true });
+          if (checked.error) {
+            const detail = checked.error.replace(/^Error:\s*/, '');
+            return `Error: apply_patch preflight rejected section ${i + 1}/${units.length} (${unit.displayPath}); no files were written.\n${detail}`;
+          }
+          preparedUnits.set(i, { parsed, wave });
+        }
+      }
       let rollbackSnapshots = [];
       if (!dryRun && rollbackOnFailure) {
         try {
@@ -268,13 +383,15 @@ async function applyPatchSequence(patchStr, requestedFormat, basePath, ctx) {
           failedIndex = i;
           continue;
         }
-        let parsed;
-        try {
-          parsed = await unit.buildParsed();
-        } catch (err) {
-          failed = { displayPath: unit.displayPath, error: `Error: ${err?.message || String(err)}` };
-          failedIndex = i;
-          continue;
+        let parsed = preparedUnits.get(i)?.parsed;
+        if (!preparedUnits.has(i)) {
+          try {
+            parsed = await unit.buildParsed();
+          } catch (err) {
+            failed = { displayPath: unit.displayPath, error: `Error: ${err?.message || String(err)}` };
+            failedIndex = i;
+            continue;
+          }
         }
         if (!Array.isArray(parsed) || parsed.length === 0) {
           // Section produced no applicable hunks (all skipped / no-op). Nothing
@@ -282,14 +399,16 @@ async function applyPatchSequence(patchStr, requestedFormat, basePath, ctx) {
           applied.push({ displayPath: unit.displayPath, text: `(no changes) ${unit.displayPath}` });
           continue;
         }
-        let wave;
-        try {
-          const { entries, headerRewrites } = await preValidateNativeBatch(parsed, basePath);
-          wave = { parsed, entries, headerRewrites };
-        } catch (err) {
-          failed = { displayPath: unit.displayPath, error: `Error: ${err?.message || String(err)}` };
-          failedIndex = i;
-          continue;
+        let wave = preparedUnits.get(i)?.wave;
+        if (!wave) {
+          try {
+            const { entries, headerRewrites } = await preValidateNativeBatch(parsed, basePath);
+            wave = { parsed, entries, headerRewrites };
+          } catch (err) {
+            failed = { displayPath: unit.displayPath, error: `Error: ${err?.message || String(err)}` };
+            failedIndex = i;
+            continue;
+          }
         }
         const res = await applyParsedWave(wave, basePath, waveOpts);
         backend = res.backend;
@@ -473,7 +592,11 @@ async function apply_patch(args, cwd, options = {}) {
   let v4aRenamePlan = null;
   if (isV4APatchInput(patchStr, requestedFormat)) {
     try {
-      const allSections = parseV4APatch(patchStr);
+      const allSections = rewriteV4AReadRedirects(
+        parseV4APatch(patchStr),
+        basePath,
+        readStateScope,
+      );
       v4aRenamePlan = await planV4ARenameSections(allSections, basePath);
       inputPatchStr = await convertV4ASectionsToUnifiedPatch(v4aRenamePlan.remainingSections, basePath, v4aConvertOpts);
       if (v4aRenamePlan.renameSections.length > 0) {
@@ -486,7 +609,12 @@ async function apply_patch(args, cwd, options = {}) {
     }
   } else if (requestedFormat !== 'unified' && hasUnifiedBareV4AHunk(patchStr)) {
     try {
-      inputPatchStr = await convertUnifiedBareV4AToUnifiedPatch(patchStr, basePath, v4aConvertOpts);
+      const sections = rewriteV4AReadRedirects(
+        parseUnifiedBareV4APatch(patchStr),
+        basePath,
+        readStateScope,
+      );
+      inputPatchStr = await convertV4ASectionsToUnifiedPatch(sections, basePath, v4aConvertOpts);
     } catch (err) {
       throw new Error(`apply_patch: bare @@ parse failed — ${err?.message || String(err)}`);
     }
@@ -502,7 +630,12 @@ async function apply_patch(args, cwd, options = {}) {
       throw new Error(`apply_patch: parse failed — ${err?.message || String(err)}; prefer V4A envelope for multi-hunk edits (no @@ line counts)`);
     }
     try {
-      inputPatchStr = await convertUnifiedCountedToUnifiedPatchViaV4A(patchStr, basePath, v4aConvertOpts);
+      const sections = rewriteV4AReadRedirects(
+        parseUnifiedCountedAsV4APatch(patchStr),
+        basePath,
+        readStateScope,
+      );
+      inputPatchStr = await convertV4ASectionsToUnifiedPatch(sections, basePath, v4aConvertOpts);
       normalizedPatchStr = prepareInput(inputPatchStr);
       parsed = parsePatch(normalizedPatchStr);
       mutationPlan = {
@@ -514,6 +647,9 @@ async function apply_patch(args, cwd, options = {}) {
       throw new Error(`apply_patch: parse failed — ${err?.message || String(err)}; V4A fallback failed — ${fallbackErr?.message || String(fallbackErr)}`);
     }
   }
+  if (!v4aRenameOnly) {
+    parsed = rewriteParsedReadRedirects(parsed, basePath, readStateScope);
+  }
   if (!v4aRenameOnly && (!Array.isArray(parsed) || parsed.length === 0)) {
     return 'Error: patch contained no file sections';
   }
@@ -560,8 +696,7 @@ async function apply_patch(args, cwd, options = {}) {
     }),
   ];
 
-  return withBuiltinPathLocks(_lockPaths, () =>
-    withAdvisoryLocks(_lockPaths, async () => {
+  const runLegacyBulkBatch = async () => {
     let v4aRenameResults = [];
     if (v4aRenamePlan?.renameSections?.length) {
       v4aRenameResults = await applyV4ARenameSections(v4aRenamePlan.renameSections, basePath, v4aConvertOpts);
@@ -629,7 +764,44 @@ async function apply_patch(args, cwd, options = {}) {
       return wrapPatchMutationOutput(`${combined}\n${tail.join('\n')}`, mutationPlan, { backend });
     }
     return wrapPatchMutationOutput(combined, mutationPlan, { backend });
-  }));
+  };
+
+  return withBuiltinPathLocks(_lockPaths, () =>
+    withAdvisoryLocks(_lockPaths, async () => {
+      // Legacy bulk/atomic mode applies every wave in one shot, and a wave that
+      // mixes native (in-base) with JS (out-of-base) entries commits the native
+      // writes before the JS entries run. Snapshot every touched path up front
+      // and restore it whenever the batch fails — by returned Error text OR by
+      // a thrown error (V4A rename, persistence) — so mode:"atomic" really is
+      // all-or-nothing instead of leaving an earlier commit in place.
+      let rollbackSnapshots = [];
+      if (!dryRun) {
+        try {
+          rollbackSnapshots = capturePatchRollbackState(_lockPaths);
+        } catch (err) {
+          return `Error: ${err?.message || String(err)}`;
+        }
+      }
+      // Restoration errors are never swallowed: an incomplete rollback is
+      // reported verbatim so the caller never reads a false all-or-nothing.
+      const withRollback = (outcome) => {
+        const rollbackErrors = restorePatchRollbackState(rollbackSnapshots, readStateScope);
+        return rollbackErrors.length === 0
+          ? `${outcome}\n--- rolled back: every touched path was restored to its pre-patch state ---`
+          : [outcome, '--- rollback incomplete ---', ...rollbackErrors].join('\n');
+      };
+      let outcome;
+      try {
+        outcome = await runLegacyBulkBatch();
+      } catch (err) {
+        // A thrown failure (e.g. V4A rename) took the same path to disk as a
+        // returned one, so it takes the same path back out.
+        if (dryRun) throw err;
+        return withRollback(`Error: ${err?.message || String(err)}`);
+      }
+      if (dryRun || !isPatchErrorText(outcome)) return outcome;
+      return withRollback(outcome);
+    }));
 }
 
 export async function executePatchTool(name, args, cwd, options = {}) {

package/src/runtime/agent/orchestrator/tools/patch/paths.mjs

@@ -24,6 +24,16 @@ export function stripDiffPrefix(name) {
 }
 
 export function resolveEntryPath(basePath, rawName) {
+  // A parsed entry without a header path (jsdiff parses arbitrary non-diff
+  // text into a headerless entry) must fail as a patch-format error, not as a
+  // raw `The "path" argument must be of type string` TypeError from node:path.
+  if (rawName == null || rawName === '') {
+    throw new Error(
+      'apply_patch: a file section header could not be parsed (no target path) — the patch body is not a valid diff. '
+      + 'Each section must start with `*** Update File: <path>` / `*** Add File: <path>` / `*** Delete File: <path>` '
+      + '(V4A, wrapped in `*** Begin Patch` / `*** End Patch`), or a `--- a/<path>` + `+++ b/<path>` pair (unified).',
+    );
+  }
   const stripped = stripDiffPrefix(rawName);
   const norm = normalizeInputPath(stripped);
   return isAbsolute(norm) ? pathResolve(norm) : resolveAgainstCwd(norm, basePath);
@@ -156,6 +166,18 @@ function unifiedRange(start, lines) {
   return `${s},${n}`;
 }
 
+// jsdiff's parser normalizes the unified-diff "zero count" quirk by bumping the
+// start by one (`parse.js`: `if (hunk.oldLines === 0) hunk.oldStart += 1`), so a
+// re-render of a parsed hunk must undo it. Without this, an insert-only hunk
+// `@@ -N,0 @@` reaches the native engine as `-(N+1),0` and is anchored one line
+// too late — or rejected outright when N is already the last line (the engine
+// treats N as a 0-based "insert after line N" skip count, valid 0..=line_count).
+function unifiedRangeFromParsed(start, lines) {
+  const n = Math.max(0, Number(lines) || 0);
+  const s = Math.max(0, Number(start) || 0);
+  return unifiedRange(n === 0 ? Math.max(0, s - 1) : s, n);
+}
+
 export function renderParsedUnifiedPatch(parsed) {
   const out = [];
   for (const entry of parsed || []) {
@@ -163,7 +185,7 @@ export function renderParsedUnifiedPatch(parsed) {
     out.push(`+++ ${entry.newFileName || '/dev/null'}`);
     for (const hunk of entry.hunks || []) {
       const section = hunk.section ? ` ${hunk.section}` : '';
-      out.push(`@@ -${unifiedRange(hunk.oldStart, hunk.oldLines)} +${unifiedRange(hunk.newStart, hunk.newLines)} @@${section}`);
+      out.push(`@@ -${unifiedRangeFromParsed(hunk.oldStart, hunk.oldLines)} +${unifiedRangeFromParsed(hunk.newStart, hunk.newLines)} @@${section}`);
       for (const line of hunk.lines || []) out.push(line);
     }
   }

package/src/runtime/agent/orchestrator/tools/patch/v4a-convert.mjs

@@ -34,6 +34,7 @@ import {
   formatPatchSourceExcerpt,
   compactPatchPreviewLine,
   decodeValidUtf8OrNull,
+  assertSafeReplacementPlan,
 } from './matcher.mjs';
 
 function v4AHunkLineStats(hunk) {
@@ -154,6 +155,15 @@ function cloneTextLinesForPatch(sourceLines) {
   return lines;
 }
 
+// Codex parity (codex-rs/apply-patch/src/lib.rs compute_replacements): a chunk
+// with no old lines is a pure addition and is inserted at end-of-file — before
+// the trailing empty line when the file ends with a blank line — never at the
+// current anchor cursor.
+function eofInsertionIndex(sourceLines) {
+  const len = (sourceLines || []).length;
+  return len > 0 && sourceLines[len - 1] === '' ? len - 1 : len;
+}
+
 function resolveV4AHunkPosition(sourceLines, hunk, nextSearchLine, options = {}) {
   const stats = v4AHunkLineStats(hunk);
   if (stats.oldCount === 0 && stats.newCount === 0) return { skip: true };
@@ -170,7 +180,7 @@ function resolveV4AHunkPosition(sourceLines, hunk, nextSearchLine, options = {})
   let trimmedTrailing = 0;
   let trimmedTrailingNew = 0;
   if (stats.oldCount === 0) {
-    oldStartIdx = eof ? sourceLines.length : anchorLine;
+    oldStartIdx = eofInsertionIndex(sourceLines);
   } else {
     const searchFrom = Math.max(0, anchorLine - 1);
     oldStartIdx = findLineSequence(
@@ -180,20 +190,32 @@ function resolveV4AHunkPosition(sourceLines, hunk, nextSearchLine, options = {})
       searchFrom,
       { fuzzy, eof },
     );
-    if (eof && oldStartIdx < 0 && oldLinesPattern.length > 0 && oldLinesPattern[oldLinesPattern.length - 1] === '') {
+    // Codex parity (compute_replacements): when the first seek fails and the
+    // pattern's last line is the empty string that stands in for the region's
+    // terminating newline, retry without it. Codex runs this retry for EVERY
+    // chunk, not only `*** End of File` ones, so a hunk whose trailing blank
+    // context line sits at end-of-file resolves instead of reporting a context
+    // miss. When the retry empties the pattern (the old side was that single
+    // blank line) Codex's seek returns the cursor, i.e. the hunk becomes a
+    // zero-length insertion at the anchor cursor; `anchorLine` IS that cursor
+    // (Codex `line_index`), so use it directly instead of the seek's
+    // preferred-line fallback.
+    if (oldStartIdx < 0 && oldLinesPattern.length > 0 && oldLinesPattern[oldLinesPattern.length - 1] === '') {
       oldLinesPattern = oldLinesPattern.slice(0, -1);
       trimmedTrailing = 1;
       if (newLinesPattern.length > 0 && newLinesPattern[newLinesPattern.length - 1] === '') {
         newLinesPattern = newLinesPattern.slice(0, -1);
         trimmedTrailingNew = 1;
       }
-      oldStartIdx = findLineSequence(
-        sourceLines,
-        oldLinesPattern,
-        searchFrom,
-        searchFrom,
-        { fuzzy, eof },
-      );
+      oldStartIdx = oldLinesPattern.length === 0
+        ? anchorLine
+        : findLineSequence(
+          sourceLines,
+          oldLinesPattern,
+          searchFrom,
+          searchFrom,
+          { fuzzy, eof },
+        );
     }
   }
   // Escape-equivalence fallback (fuzzy, non-EOF only): accept a window where each old
@@ -229,7 +251,11 @@ function resolveV4AHunkPosition(sourceLines, hunk, nextSearchLine, options = {})
     oldStartIdx,
     matchLen,
     newLines: newLinesPattern,
-    nextSearchLine: oldStartIdx + Math.max(1, matchLen),
+    // Codex parity: a zero-length replacement never advances the cursor
+    // (compute_replacements `continue`s on the pure-addition branch), so a
+    // following hunk can still resolve against lines before the insertion
+    // point instead of being pushed past end-of-file.
+    nextSearchLine: matchLen === 0 ? Math.max(0, nextSearchLine || 0) : oldStartIdx + matchLen,
     trimmedTrailing,
     trimmedTrailingNew,
   };
@@ -251,6 +277,13 @@ export function applyV4AHunksToLines(sourceLines, hunks, options = {}) {
     });
     nextSearchLine = loc.nextSearchLine;
   }
+  // Codex parity (compute_replacements sorts by start index before
+  // apply_replacements walks them in reverse): descending application is only
+  // position-safe when the list is ordered by start index. Resolution order is
+  // normally already ascending; the sort is stable, so equal starts keep their
+  // resolution order.
+  replacements.sort((a, b) => a.oldStartIdx - b.oldStartIdx);
+  assertSafeReplacementPlan(replacements.map((rep) => ({ start: rep.oldStartIdx, oldLen: rep.oldLen })));
   for (const rep of replacements.reverse()) {
     lines.splice(rep.oldStartIdx, rep.oldLen, ...rep.newLines);
   }
@@ -628,6 +661,12 @@ export async function convertV4ASectionsToUnifiedPatch(sections, basePath, optio
       throw new Error(`V4A update target unreadable: ${section.path} (${err?.code || err?.message || String(err)}).`);
     }
     const sectionHunks = [];
+    // Resolved-position ordering for the emitted unified hunks: the unique-
+    // verbatim fallback in findLineSequence can resolve a later-listed hunk
+    // BEFORE an earlier one, and the native engine applies unified hunks with
+    // a forward-only cursor — emission must therefore be sorted by resolved
+    // start (stable on ties) instead of resolution order.
+    const sectionHunkEntries = [];
     const orderedHunks = orderV4AHunksByFilePosition(sourceLines, section.hunks, fuzzy);
     let nextSearchLine = 0;
     for (const hunk of orderedHunks) {
@@ -641,12 +680,7 @@ export async function convertV4ASectionsToUnifiedPatch(sections, basePath, optio
         if (rejectedHunks) rejectedHunks.push({ file: section.path, hunk, reason: msg });
         continue;
       }
-      const oldStart = stats.oldCount === 0 ? loc.oldStartIdx : loc.oldStartIdx + 1;
-      const newStart = oldStart;
       const tail = (hunk.anchors || []).filter(Boolean).join(' ');
-      const oldCount = stats.oldCount === 0 ? 0 : loc.matchLen;
-      const newCount = stats.newCount - (loc.trimmedTrailingNew || 0);
-      sectionHunks.push(`@@ -${oldStart},${oldCount} +${newStart},${newCount} @@${tail ? ` ${tail}` : ''}`);
       let dropOldAt = -1;
       let dropNewAt = -1;
       if (loc.trimmedTrailing) {
@@ -659,6 +693,13 @@ export async function convertV4ASectionsToUnifiedPatch(sections, basePath, optio
           if (dropOldAt >= 0 && (!loc.trimmedTrailingNew || dropNewAt >= 0)) break;
         }
       }
+      // Emit the body FIRST and derive the header counts from what was
+      // actually emitted: the trailing-newline sentinel drop can remove a line
+      // from one side only, so a header computed from the raw hunk stats can
+      // disagree with the body and make the emitted unified patch unparseable.
+      const bodyLines = [];
+      let emittedOld = 0;
+      let emittedNew = 0;
       let srcIdx = loc.oldStartIdx;
       const srcEnd = loc.oldStartIdx + loc.matchLen;
       for (let i = 0; i < hunk.lines.length; i++) {
@@ -666,20 +707,47 @@ export async function convertV4ASectionsToUnifiedPatch(sections, basePath, optio
         if (isV4AEndOfFileMarker(line)) continue;
         const prefix = line[0];
         if (prefix === ' ' || prefix === '-') {
-          if (i === dropOldAt || i === dropNewAt) continue;
+          if (i === dropOldAt) {
+            // The sentinel line leaves the OLD side. When it is a context line
+            // that the new side still keeps (Codex only trims the new slice
+            // when it ends with the sentinel), it survives as an addition.
+            if (prefix === ' ' && i !== dropNewAt) {
+              bodyLines.push(`+${line.slice(1)}`);
+              emittedNew++;
+            }
+            continue;
+          }
+          if (i === dropNewAt) continue;
           if (srcIdx < srcEnd && srcIdx < sourceLines.length) {
-            sectionHunks.push(prefix + sourceLines[srcIdx]);
+            bodyLines.push(prefix + sourceLines[srcIdx]);
           } else {
-            sectionHunks.push(line);
+            bodyLines.push(line);
           }
+          emittedOld++;
+          if (prefix === ' ') emittedNew++;
           srcIdx++;
         } else {
           if (i === dropNewAt) continue;
-          sectionHunks.push(line);
+          bodyLines.push(line);
+          emittedNew++;
         }
       }
+      // A zero-length old range is an insertion: its header start is the 0-based
+      // insertion index (`-N,0` inserts after source line N), while a real
+      // replacement starts at the 1-based first replaced line.
+      const oldStart = emittedOld === 0 ? loc.oldStartIdx : loc.oldStartIdx + 1;
+      sectionHunkEntries.push({
+        start: loc.oldStartIdx,
+        order: sectionHunkEntries.length,
+        lines: [
+          `@@ -${oldStart},${emittedOld} +${oldStart},${emittedNew} @@${tail ? ` ${tail}` : ''}`,
+          ...bodyLines,
+        ],
+      });
       nextSearchLine = loc.nextSearchLine;
     }
+    sectionHunkEntries.sort((a, b) => (a.start - b.start) || (a.order - b.order));
+    for (const entry of sectionHunkEntries) sectionHunks.push(...entry.lines);
     if (sectionHunks.length > 0) {
       out.push(`--- a/${displayPath}`);
       out.push(`+++ b/${displayPath}`);

package/src/runtime/agent/orchestrator/tools/patch-manifest.json

@@ -1,26 +1,26 @@
 {
-  "version": "0.7.21",
+  "version": "0.7.22",
   "_comment": "Rewritten by .github/workflows/patch-release.yml on each tagged release. assets maps platformKey (process.platform-process.arch, e.g. win32-x64, linux-x64, darwin-arm64) to { url, sha256 } of the mixdog-patch binary on the GitHub release. A local cargo build under native/mixdog-patch/target/release always takes precedence; otherwise the binary is fetched per this manifest into the data dir (apply is native-only — no JS apply engine).",
   "assets": {
     "darwin-arm64": {
-      "url": "https://github.com/tribgames/mixdog/releases/download/patch-v0.7.21/mixdog-patch-darwin-arm64",
-      "sha256": "f52db5c65ffdc28ace93a6dd54d7d1c8e76f3daba45a74e63676513fcee4b51b"
+      "url": "https://github.com/tribgames/mixdog/releases/download/patch-v0.7.22/mixdog-patch-darwin-arm64",
+      "sha256": "6990ee4442aa4f5ec4c07926b2f22e8fcbc17b668a1be005d71551bfcf61fc73"
     },
     "darwin-x64": {
-      "url": "https://github.com/tribgames/mixdog/releases/download/patch-v0.7.21/mixdog-patch-darwin-x64",
-      "sha256": "024bacaaead16a368fa4a2a148f66f3892ee03be78803c40dda9acd59f3dd2c1"
+      "url": "https://github.com/tribgames/mixdog/releases/download/patch-v0.7.22/mixdog-patch-darwin-x64",
+      "sha256": "0118298483df38af7e0463bede8412c2267c8df96b586ce98120c9139ad22977"
     },
     "linux-arm64": {
-      "url": "https://github.com/tribgames/mixdog/releases/download/patch-v0.7.21/mixdog-patch-linux-arm64",
-      "sha256": "c197931e005fb89211b60b66008bc0c3b42200393483e0ae4a251e2111a06d44"
+      "url": "https://github.com/tribgames/mixdog/releases/download/patch-v0.7.22/mixdog-patch-linux-arm64",
+      "sha256": "91330967bf089b943e6175f9ade45fbac2d4e6d4449c9ea28853c1acf0f472db"
     },
     "linux-x64": {
-      "url": "https://github.com/tribgames/mixdog/releases/download/patch-v0.7.21/mixdog-patch-linux-x64",
-      "sha256": "8d958f9315ec82a17fa2e21560630f66a4e55a8a56ad92d69ba9f3f5ff61c15c"
+      "url": "https://github.com/tribgames/mixdog/releases/download/patch-v0.7.22/mixdog-patch-linux-x64",
+      "sha256": "399e7c68a42f6e15fca28270ea3e216b8d34e48b53702bbefa2354cf0cc956f5"
     },
     "win32-x64": {
-      "url": "https://github.com/tribgames/mixdog/releases/download/patch-v0.7.21/mixdog-patch-win32-x64.exe",
-      "sha256": "cc927c7bc6f09ecae591c058d0053cd5bc65ee17c56c9bce6871487be1d2baa2"
+      "url": "https://github.com/tribgames/mixdog/releases/download/patch-v0.7.22/mixdog-patch-win32-x64.exe",
+      "sha256": "13e2373bceb6c6f9cafe7b815b5d20bffcb20414d8c9dfbb287dd7fd110a811e"
     }
   }
 }