open-agents-ai 0.187.554 → 0.187.555

package/dist/index.js

@@ -2877,6 +2877,43 @@ Annotated files:`);
   }
 });
 
+// packages/execution/dist/tools/edit-metadata.js
+import { createHash } from "node:crypto";
+function contentHash(content) {
+  return createHash("sha256").update(content, "utf8").digest("hex");
+}
+function normalizeExpectedHash(value2) {
+  if (typeof value2 !== "string")
+    return null;
+  const raw = value2.trim();
+  if (!raw)
+    return null;
+  const stripped = raw.replace(/^sha256:/i, "").toLowerCase();
+  return /^[a-f0-9]{64}$/.test(stripped) ? stripped : null;
+}
+function extractExpectedHash(args) {
+  return normalizeExpectedHash(args["expected_hash"] ?? args["expectedHash"] ?? args["before_hash"] ?? args["beforeHash"]);
+}
+function hashMismatchMessage(filePath, expectedHash, actualHash) {
+  return [
+    `Refusing to edit ${filePath}: expected_hash does not match current file content.`,
+    `expected_hash: ${expectedHash}`,
+    `current_hash:  ${actualHash}`,
+    `Re-read the file and rebuild the edit from the current content before retrying.`
+  ].join("\n");
+}
+function fileContextHeader(filePath, content, range) {
+  const totalLines = content.split("\n").length;
+  const hash = contentHash(content);
+  const shown = range && (range.offset !== void 0 || range.limit !== void 0) ? ` showing=${range.offset ?? 1}-${range.limit ? (range.offset ?? 1) + range.limit - 1 : "end"}` : "";
+  return `[FILE CONTEXT path=${filePath} sha256=${hash} lines=${totalLines}${shown}]`;
+}
+var init_edit_metadata = __esm({
+  "packages/execution/dist/tools/edit-metadata.js"() {
+    "use strict";
+  }
+});
+
 // packages/execution/dist/tools/file-read.js
 import { readFile } from "node:fs/promises";
 import { resolve as resolve2 } from "node:path";
@@ -2964,6 +3001,7 @@ var init_file_read = __esm({
   "packages/execution/dist/tools/file-read.js"() {
     "use strict";
     init_semantic_map();
+    init_edit_metadata();
     SIG_PATTERNS = [
       /^\s*(export\s+)?(async\s+)?function\s+\w+/,
       /^\s*(export\s+)?(abstract\s+)?class\s+\w+/,
@@ -3019,10 +3057,15 @@ var init_file_read = __esm({
             const startIdx = Math.max(0, (offset ?? 1) - 1);
             lines = lines.slice(startIdx, limit ? startIdx + limit : void 0);
             const numbered2 = lines.map((line, i2) => `${String(startIdx + i2 + 1).padStart(6)} | ${line}`).join("\n");
+            const hash = contentHash(content);
             return {
               success: true,
-              output: numbered2,
-              durationMs: performance.now() - start2
+              output: `${fileContextHeader(filePath, content, { offset, limit })}
+${numbered2}`,
+              durationMs: performance.now() - start2,
+              mutated: false,
+              mutatedFiles: [],
+              beforeHash: hash
             };
           }
           touchFile(this.workingDir, filePath);
@@ -3031,15 +3074,23 @@ var init_file_read = __esm({
             const notes2 = getFileNotes(this.workingDir, filePath);
             return {
               success: true,
-              output: buildStructuralPreview(lines, filePath, maxLines) + (notes2 ? "\n\n" + notes2 : ""),
-              durationMs: performance.now() - start2
+              output: `${fileContextHeader(filePath, content)}
+${buildStructuralPreview(lines, filePath, maxLines)}${notes2 ? "\n\n" + notes2 : ""}`,
+              durationMs: performance.now() - start2,
+              mutated: false,
+              mutatedFiles: [],
+              beforeHash: contentHash(content)
             };
           }
           const numbered = lines.map((line, i2) => `${String(i2 + 1).padStart(6)} | ${line}`).join("\n");
           return {
             success: true,
-            output: numbered,
-            durationMs: performance.now() - start2
+            output: `${fileContextHeader(filePath, content)}
+${numbered}`,
+            durationMs: performance.now() - start2,
+            mutated: false,
+            mutatedFiles: [],
+            beforeHash: contentHash(content)
           };
         } catch (error) {
           const errMsg = error instanceof Error ? error.message : String(error);
@@ -3223,6 +3274,7 @@ var init_file_write = __esm({
   "packages/execution/dist/tools/file-write.js"() {
     "use strict";
     init_change_log();
+    init_edit_metadata();
     FileWriteTool = class {
       name = "file_write";
       description = "Write content to a file, creating directories as needed";
@@ -3230,7 +3282,15 @@ var init_file_write = __esm({
         type: "object",
         properties: {
           path: { type: "string", description: "Absolute or relative file path" },
-          content: { type: "string", description: "File content to write" }
+          content: { type: "string", description: "File content to write" },
+          overwrite: {
+            type: "boolean",
+            description: "Required when overwriting an existing file with different content."
+          },
+          expected_hash: {
+            type: "string",
+            description: "SHA-256 hash from the most recent file_read. Required with overwrite=true for existing files."
+          }
         },
         required: ["path", "content"]
       };
@@ -3241,6 +3301,8 @@ var init_file_write = __esm({
       async execute(args) {
         const filePath = extractWritePath(args);
         const content = args["content"] ?? args["text"] ?? args["data"];
+        const overwrite = args["overwrite"] === true || args["overwriteExisting"] === true;
+        const expectedHash = extractExpectedHash(args);
         const start2 = performance.now();
         if (!filePath) {
           return {
@@ -3261,14 +3323,57 @@ var init_file_write = __esm({
         try {
           const fullPath = resolve3(this.workingDir, filePath);
           const isNew = !existsSync6(fullPath);
+          const newHash = contentHash(content);
           if (!isNew) {
             try {
               const existing = await readFile2(fullPath, "utf-8");
+              const beforeHash = contentHash(existing);
               if (existing === content) {
                 return {
                   success: true,
                   output: `[NO-OP — file ${filePath} already contains these exact bytes (${content.length}B). Skipped redundant write. If you intended to make a change, the content is identical to disk — you may be replaying an earlier plan. Update todo_write and proceed to the next pending task.]`,
-                  durationMs: performance.now() - start2
+                  durationMs: performance.now() - start2,
+                  mutated: false,
+                  mutatedFiles: [],
+                  noop: true,
+                  beforeHash,
+                  afterHash: beforeHash
+                };
+              }
+              if (!overwrite) {
+                return {
+                  success: false,
+                  output: "",
+                  error: `Refusing to overwrite existing file ${filePath} without overwrite=true. Use file_edit/file_patch for targeted changes, or re-read the file and call file_write with overwrite=true and expected_hash=${beforeHash}.`,
+                  durationMs: performance.now() - start2,
+                  mutated: false,
+                  mutatedFiles: [],
+                  beforeHash,
+                  afterHash: beforeHash
+                };
+              }
+              if (!expectedHash) {
+                return {
+                  success: false,
+                  output: "",
+                  error: `Refusing to overwrite existing file ${filePath} without expected_hash. Re-read the file first; file_read returns a sha256 header to pass as expected_hash.`,
+                  durationMs: performance.now() - start2,
+                  mutated: false,
+                  mutatedFiles: [],
+                  beforeHash,
+                  afterHash: beforeHash
+                };
+              }
+              if (expectedHash !== beforeHash) {
+                return {
+                  success: false,
+                  output: "",
+                  error: hashMismatchMessage(filePath, expectedHash, beforeHash),
+                  durationMs: performance.now() - start2,
+                  mutated: false,
+                  mutatedFiles: [],
+                  beforeHash,
+                  afterHash: beforeHash
                 };
               }
             } catch {
@@ -3284,8 +3389,13 @@ var init_file_write = __esm({
           });
           return {
             success: true,
-            output: `Written ${content.length} bytes to ${fullPath}`,
-            durationMs: performance.now() - start2
+            output: `${isNew ? "Created" : "Overwrote"} ${content.length} bytes at ${fullPath} (sha256 ${newHash})`,
+            durationMs: performance.now() - start2,
+            mutated: true,
+            mutatedFiles: [filePath],
+            noop: false,
+            beforeHash: isNew ? void 0 : expectedHash ?? void 0,
+            afterHash: newHash
           };
         } catch (error) {
           return {
@@ -4211,6 +4321,7 @@ var init_file_edit = __esm({
     "use strict";
     init_change_log();
     init_edit_snippet_finder();
+    init_edit_metadata();
     FileEditTool = class {
       name = "file_edit";
       description = "Make a precise edit to a file by replacing an exact string match. The old_string must be unique in the file unless replace_all is true. Use replace_all to rename variables or change repeated patterns throughout the file.";
@@ -4229,6 +4340,10 @@ var init_file_edit = __esm({
           replace_all: {
             type: "boolean",
             description: "Replace ALL occurrences instead of just the first. Use for variable renames, import path changes, etc. Default: false"
+          },
+          expected_hash: {
+            type: "string",
+            description: "Optional SHA-256 from the most recent file_read. If provided, edit is refused when the file changed."
           }
         },
         required: ["path", "old_string", "new_string"]
@@ -4242,6 +4357,7 @@ var init_file_edit = __esm({
         const oldString = args["old_string"] ?? args["oldString"] ?? args["search"] ?? args["find"];
         const newString = args["new_string"] ?? args["newString"] ?? args["replace"] ?? args["replacement"];
         const replaceAll = args["replace_all"] === true || args["replaceAll"] === true;
+        const expectedHash = extractExpectedHash(args);
         const start2 = performance.now();
         if (!filePath) {
           return {
@@ -4270,6 +4386,19 @@ var init_file_edit = __esm({
         try {
           const fullPath = resolve6(this.workingDir, filePath);
           const content = await readFile3(fullPath, "utf-8");
+          const beforeHash = contentHash(content);
+          if (expectedHash && expectedHash !== beforeHash) {
+            return {
+              success: false,
+              output: "",
+              error: hashMismatchMessage(filePath, expectedHash, beforeHash),
+              durationMs: performance.now() - start2,
+              mutated: false,
+              mutatedFiles: [],
+              beforeHash,
+              afterHash: beforeHash
+            };
+          }
           const occurrences = countOccurrences(content, oldString);
           if (occurrences === 0) {
             const snippet = findClosestSnippet(content, oldString, 5);
@@ -4289,7 +4418,11 @@ Use the EXACT current content above to construct a working old_string. Do not re
               success: false,
               output: "",
               error: errorMsg,
-              durationMs: performance.now() - start2
+              durationMs: performance.now() - start2,
+              mutated: false,
+              mutatedFiles: [],
+              beforeHash,
+              afterHash: beforeHash
             };
           }
           if (!replaceAll && occurrences > 1) {
@@ -4308,7 +4441,11 @@ ${s2.content}`;
 ${snippets}
 
 Add UNIQUE surrounding context (a function name, distinctive comment, or unique line above/below) to disambiguate. Or set replace_all=true if you want all ${occurrences} occurrences replaced identically.`,
-              durationMs: performance.now() - start2
+              durationMs: performance.now() - start2,
+              mutated: false,
+              mutatedFiles: [],
+              beforeHash,
+              afterHash: beforeHash
             };
           }
           let updated;
@@ -4322,19 +4459,40 @@ Add UNIQUE surrounding context (a function name, distinctive comment, or unique
             editedLines = [lineNumber];
             updated = content.slice(0, index) + newString + content.slice(index + oldString.length);
           }
+          const afterHash = contentHash(updated);
+          const diff = buildCompactDiff(oldString, newString);
+          if (afterHash === beforeHash) {
+            return {
+              success: true,
+              output: `[NO-OP — ${filePath} already matches the requested file_edit at ${editedLines.length === 1 ? `line ${editedLines[0]}` : `${editedLines.length} locations`}.]`,
+              durationMs: performance.now() - start2,
+              mutated: false,
+              mutatedFiles: [],
+              diff,
+              noop: true,
+              beforeHash,
+              afterHash
+            };
+          }
           await writeFile2(fullPath, updated, "utf-8");
           recordChange(this.workingDir, {
             tool: "file_edit",
             file: filePath,
             lineRange: editedLines.length > 0 ? [editedLines[0], editedLines[editedLines.length - 1]] : void 0,
             summary: replaceAll ? `Replaced ${editedLines.length} occurrences in ${filePath}` : `Edited ${filePath} at line ${editedLines[0]}`,
-            diff: buildCompactDiff(oldString, newString)
+            diff
           });
           const linesInfo = editedLines.length === 1 ? `line ${editedLines[0]}` : `${editedLines.length} locations (lines ${editedLines.join(", ")})`;
           return {
             success: true,
-            output: `Edited ${filePath} at ${linesInfo}`,
-            durationMs: performance.now() - start2
+            output: `Edited ${filePath} at ${linesInfo} (sha256 ${beforeHash} → ${afterHash})`,
+            durationMs: performance.now() - start2,
+            mutated: true,
+            mutatedFiles: [filePath],
+            diff,
+            noop: false,
+            beforeHash,
+            afterHash
           };
         } catch (error) {
           return {
@@ -4889,7 +5047,7 @@ var init_explore_tools = __esm({
       memory_write: "Store a fact in persistent memory",
       memory_search: "Search all memories by relevance",
       batch_edit: "Apply multiple file edits atomically",
-      file_patch: "Apply unified diff patches to files",
+      file_patch: "Apply version-checked line-range patches to files",
       git_info: "Get git status, branch, recent commits",
       codebase_map: "Generate overview of project structure",
       diagnostic: "Run project diagnostics (build, test, lint)",
@@ -5829,6 +5987,7 @@ var init_batch_edit = __esm({
     "use strict";
     init_change_log();
     init_edit_snippet_finder();
+    init_edit_metadata();
     BatchEditTool = class {
       name = "batch_edit";
       description = "Make multiple precise edits across one or more files in a single call. More efficient than calling file_edit repeatedly. Each edit replaces an exact string match with uniqueness validation. Edits are applied in order within each file. Set replace_all on individual edits for bulk renames.";
@@ -5856,6 +6015,10 @@ var init_batch_edit = __esm({
                 replace_all: {
                   type: "boolean",
                   description: "Replace all occurrences (for renames). Default: false"
+                },
+                expected_hash: {
+                  type: "string",
+                  description: "SHA-256 from the most recent file_read for this file. All edits for a file must use the same hash if provided."
                 }
               },
               required: ["path", "old_string", "new_string"]
@@ -5888,15 +6051,33 @@ var init_batch_edit = __esm({
             old_string: edit.old_string,
             new_string: edit.new_string,
             replace_all: edit.replace_all,
+            expected_hash: edit.expected_hash,
             relPath: edit.path
           });
         }
         const results = [];
         let successCount = 0;
         let failCount = 0;
+        const pendingWrites = [];
         for (const [fullPath, fileEdits] of byFile) {
           try {
             let content = await readFile7(fullPath, "utf-8");
+            const beforeHash = contentHash(content);
+            const expectedHashes = new Set(fileEdits.map((edit) => extractExpectedHash({ expected_hash: edit.expected_hash })).filter((h) => !!h));
+            if (expectedHashes.size > 1) {
+              results.push(`ERROR: ${fileEdits[0].relPath}: conflicting expected_hash values in one batch`);
+              failCount += fileEdits.length;
+              continue;
+            }
+            const expectedHash = expectedHashes.values().next().value;
+            if (expectedHash && expectedHash !== beforeHash) {
+              results.push(hashMismatchMessage(fileEdits[0].relPath, expectedHash, beforeHash));
+              failCount += fileEdits.length;
+              continue;
+            }
+            const originalContent = content;
+            let fileSuccessCount = 0;
+            let fileFailed = false;
             for (const edit of fileEdits) {
               const occurrences = countOccurrences2(content, edit.old_string);
               if (occurrences === 0) {
@@ -5911,7 +6092,8 @@ ${snippet.content}
                   results.push(`SKIP: old_string not found in ${edit.relPath} (file empty or binary)`);
                 }
                 failCount++;
-                continue;
+                fileFailed = true;
+                break;
               }
               if (!edit.replace_all && occurrences > 1) {
                 const offsets = findMatchOffsetsBatch(content, edit.old_string).slice(0, 4);
@@ -5924,7 +6106,8 @@ ${s2.content}`;
                 results.push(`AMBIGUOUS: old_string has ${occurrences} matches in ${edit.relPath}.${snippets}
   Add UNIQUE surrounding context, or use replace_all=true.`);
                 failCount++;
-                continue;
+                fileFailed = true;
+                break;
               }
               if (edit.replace_all) {
                 content = content.split(edit.old_string).join(edit.new_string);
@@ -5935,26 +6118,55 @@ ${s2.content}`;
                 content = content.slice(0, index) + edit.new_string + content.slice(index + edit.old_string.length);
                 results.push(`EDIT: ${edit.relPath} line ${lineNumber}`);
               }
-              successCount++;
+              fileSuccessCount++;
             }
-            await writeFile4(fullPath, content, "utf-8");
-            recordChange(this.workingDir, {
-              tool: "batch_edit",
-              file: fileEdits[0].relPath,
-              summary: `Batch: ${fileEdits.length} edit(s) in ${fileEdits[0].relPath}`
+            if (fileFailed) {
+              content = originalContent;
+              continue;
+            }
+            const afterHash = contentHash(content);
+            if (afterHash === beforeHash) {
+              results.push(`NO-OP: ${fileEdits[0].relPath} batch produced no disk changes`);
+              continue;
+            }
+            pendingWrites.push({
+              fullPath,
+              relPath: fileEdits[0].relPath,
+              content,
+              beforeHash,
+              afterHash,
+              editCount: fileSuccessCount
             });
+            successCount += fileSuccessCount;
           } catch (error) {
             results.push(`ERROR: ${fullPath}: ${error instanceof Error ? error.message : String(error)}`);
             failCount++;
           }
         }
-        const summary = `${successCount} edit(s) applied, ${failCount} failed across ${byFile.size} file(s)`;
+        if (failCount === 0) {
+          for (const write2 of pendingWrites) {
+            await writeFile4(write2.fullPath, write2.content, "utf-8");
+            recordChange(this.workingDir, {
+              tool: "batch_edit",
+              file: write2.relPath,
+              summary: `Batch: ${write2.editCount} edit(s) in ${write2.relPath}`
+            });
+          }
+        }
+        const appliedCount = failCount === 0 ? successCount : 0;
+        const summary = `${appliedCount} edit(s) applied, ${failCount} failed across ${byFile.size} file(s)` + (failCount > 0 ? " — atomic batch aborted; no files modified" : "");
         return {
           success: failCount === 0,
           output: `${summary}
 ${results.join("\n")}`,
           error: failCount > 0 ? `${failCount} edit(s) failed` : void 0,
-          durationMs: performance.now() - start2
+          durationMs: performance.now() - start2,
+          mutated: failCount === 0 && pendingWrites.length > 0,
+          mutatedFiles: failCount === 0 ? pendingWrites.map((w) => w.relPath) : [],
+          noop: failCount === 0 && pendingWrites.length === 0,
+          partial: false,
+          beforeHash: pendingWrites.length === 1 ? pendingWrites[0].beforeHash : void 0,
+          afterHash: pendingWrites.length === 1 ? pendingWrites[0].afterHash : void 0
         };
       }
     };
@@ -5969,6 +6181,7 @@ var init_file_patch = __esm({
   "packages/execution/dist/tools/file-patch.js"() {
     "use strict";
     init_change_log();
+    init_edit_metadata();
     FilePatchTool = class {
       name = "file_patch";
       description = "Edit specific line ranges in a file. More precise than string matching for large files. Modes: 'replace' replaces lines start_line..end_line with new_content, 'insert_before' inserts before start_line, 'insert_after' inserts after start_line, 'delete' removes lines start_line..end_line. Use dry_run to preview changes.";
@@ -5989,7 +6202,19 @@ var init_file_patch = __esm({
           },
           new_content: {
             type: "string",
-            description: "Replacement content (for replace mode) or content to insert (for insert modes). Not needed for delete mode."
+            description: "Replacement content (for replace mode) or content to insert (for insert modes). Required for replace and insert modes. Not needed for delete mode."
+          },
+          expected_hash: {
+            type: "string",
+            description: "SHA-256 from the most recent file_read. Required for insert modes and accepted for all modes."
+          },
+          expected_old_content: {
+            type: "string",
+            description: "Exact current content in start_line..end_line. Required for replace/delete unless expected_hash is provided."
+          },
+          allow_empty_content: {
+            type: "boolean",
+            description: "Set true only when an intentional blank replacement/insert is required."
           },
           mode: {
             type: "string",
@@ -6011,9 +6236,13 @@ var init_file_patch = __esm({
         const filePath = args["path"];
         const startLine = args["start_line"];
         const endLine = args["end_line"] ?? startLine;
-        const newContent = args["new_content"] ?? "";
         const mode = args["mode"] ?? "replace";
         const dryRun = args["dry_run"] === true;
+        const hasNewContent = typeof args["new_content"] === "string";
+        const newContent = hasNewContent ? args["new_content"] : "";
+        const expectedHash = extractExpectedHash(args);
+        const expectedOldContent = typeof args["expected_old_content"] === "string" ? args["expected_old_content"] : void 0;
+        const allowEmptyContent = args["allow_empty_content"] === true;
         const start2 = performance.now();
         try {
           if (!Number.isInteger(startLine) || startLine < 1) {
@@ -6034,8 +6263,21 @@ var init_file_patch = __esm({
           }
           const fullPath = resolve12(this.workingDir, filePath);
           const content = await readFile8(fullPath, "utf-8");
+          const beforeHash = contentHash(content);
           const lines = content.split("\n");
           const totalLines = lines.length;
+          if (expectedHash && expectedHash !== beforeHash) {
+            return {
+              success: false,
+              output: "",
+              error: hashMismatchMessage(filePath, expectedHash, beforeHash),
+              durationMs: performance.now() - start2,
+              mutated: false,
+              mutatedFiles: [],
+              beforeHash,
+              afterHash: beforeHash
+            };
+          }
           if (startLine > totalLines) {
             return {
               success: false,
@@ -6047,6 +6289,60 @@ var init_file_patch = __esm({
           const effectiveEnd = Math.min(endLine, totalLines);
           const startIdx = startLine - 1;
           const endIdx = effectiveEnd;
+          const oldTargetContent = lines.slice(startIdx, endIdx).join("\n");
+          if ((mode === "replace" || mode === "delete") && !expectedHash && expectedOldContent === void 0) {
+            return {
+              success: false,
+              output: "",
+              error: `file_patch ${mode} requires targeted context: pass expected_hash from file_read or expected_old_content copied exactly from lines ${startLine}-${effectiveEnd}.`,
+              durationMs: performance.now() - start2,
+              mutated: false,
+              mutatedFiles: [],
+              beforeHash,
+              afterHash: beforeHash
+            };
+          }
+          if ((mode === "insert_before" || mode === "insert_after") && !expectedHash) {
+            return {
+              success: false,
+              output: "",
+              error: `file_patch ${mode} requires expected_hash from the most recent file_read so line numbers are versioned.`,
+              durationMs: performance.now() - start2,
+              mutated: false,
+              mutatedFiles: [],
+              beforeHash,
+              afterHash: beforeHash
+            };
+          }
+          if (expectedOldContent !== void 0 && expectedOldContent !== oldTargetContent) {
+            return {
+              success: false,
+              output: "",
+              error: `Refusing to patch ${filePath}: expected_old_content does not match current lines ${startLine}-${effectiveEnd}.
+
+Current content:
+${oldTargetContent}
+
+Re-read the target range and retry with exact current content.`,
+              durationMs: performance.now() - start2,
+              mutated: false,
+              mutatedFiles: [],
+              beforeHash,
+              afterHash: beforeHash
+            };
+          }
+          if ((mode === "replace" || mode === "insert_before" || mode === "insert_after") && (!hasNewContent || newContent.length === 0 && !allowEmptyContent)) {
+            return {
+              success: false,
+              output: "",
+              error: `file_patch mode=${mode} requires non-empty new_content. Use mode="delete" for removal, or set allow_empty_content=true for an intentional blank edit.`,
+              durationMs: performance.now() - start2,
+              mutated: false,
+              mutatedFiles: [],
+              beforeHash,
+              afterHash: beforeHash
+            };
+          }
           const newLines = newContent.length > 0 ? newContent.split("\n") : [];
           let resultLines;
           let description;
@@ -6110,10 +6406,31 @@ ${newSection}`;
               output: `[DRY RUN] ${diff}
 
 File NOT modified. Remove dry_run to apply.`,
-              durationMs: performance.now() - start2
+              durationMs: performance.now() - start2,
+              mutated: false,
+              mutatedFiles: [],
+              diff,
+              dryRun: true,
+              beforeHash,
+              afterHash: beforeHash
+            };
+          }
+          const updatedContent = resultLines.join("\n");
+          const afterHash = contentHash(updatedContent);
+          if (afterHash === beforeHash) {
+            return {
+              success: true,
+              output: `[NO-OP — ${filePath}: ${description}; resulting content is identical to disk.]`,
+              durationMs: performance.now() - start2,
+              mutated: false,
+              mutatedFiles: [],
+              diff,
+              noop: true,
+              beforeHash,
+              afterHash
             };
           }
-          await writeFile5(fullPath, resultLines.join("\n"), "utf-8");
+          await writeFile5(fullPath, updatedContent, "utf-8");
           recordChange(this.workingDir, {
             tool: "file_patch",
             file: filePath,
@@ -6123,10 +6440,16 @@ File NOT modified. Remove dry_run to apply.`,
           });
           return {
             success: true,
-            output: `${filePath}: ${description} (${totalLines} → ${resultLines.length} total lines)
+            output: `${filePath}: ${description} (${totalLines} → ${resultLines.length} total lines, sha256 ${beforeHash} → ${afterHash})
 
 ${diff}`,
-            durationMs: performance.now() - start2
+            durationMs: performance.now() - start2,
+            mutated: true,
+            mutatedFiles: [filePath],
+            diff,
+            noop: false,
+            beforeHash,
+            afterHash
           };
         } catch (error) {
           return {
@@ -6706,7 +7029,7 @@ var init_git_info = __esm({
 });
 
 // packages/execution/dist/tools/jibberlink.js
-import { createCipheriv, createDecipheriv, createHash, randomBytes as randomBytes5 } from "node:crypto";
+import { createCipheriv, createDecipheriv, createHash as createHash2, randomBytes as randomBytes5 } from "node:crypto";
 function crc16(bytes) {
   let crc = 65535;
   for (let i2 = 0; i2 < bytes.length; i2++) {
@@ -6719,7 +7042,7 @@ function crc16(bytes) {
 }
 function deriveRoomKey(roomId, secret = "jibberlink-v1") {
   const material = `${secret}\0${roomId}`;
-  return createHash("sha256").update(material).digest();
+  return createHash2("sha256").update(material).digest();
 }
 function aesGcmEncrypt(key, plaintext) {
   if (key.length !== 32)
@@ -6805,7 +7128,7 @@ __export(nexus_exports, {
 import { readFile as readFile9, writeFile as writeFile6, mkdir as mkdir3, chmod, unlink, readdir as readdir2, open as fsOpen, copyFile as copyFile2 } from "node:fs/promises";
 import { existsSync as existsSync14, readFileSync as readFileSync12, watch as fsWatchLocal } from "node:fs";
 import { resolve as resolve13, join as join18 } from "node:path";
-import { randomBytes as randomBytes6, createCipheriv as createCipheriv2, createDecipheriv as createDecipheriv2, scryptSync, createHash as createHash2 } from "node:crypto";
+import { randomBytes as randomBytes6, createCipheriv as createCipheriv2, createDecipheriv as createDecipheriv2, scryptSync, createHash as createHash3 } from "node:crypto";
 import { execSync as execSync8, spawn as spawn2 } from "node:child_process";
 import { hostname, userInfo, homedir as homedir4 } from "node:os";
 function readBundledDependencySpec(packageName, fallback) {
@@ -12087,7 +12410,7 @@ process.on('SIGINT', () => process.emit('SIGTERM'));
       // =========================================================================
       async doConnect(args) {
         await this.ensureDir();
-        const currentScriptHash = createHash2("sha256").update(DAEMON_SCRIPT).digest("hex").slice(0, 16);
+        const currentScriptHash = createHash3("sha256").update(DAEMON_SCRIPT).digest("hex").slice(0, 16);
         const existingPid = this.getDaemonPid();
         if (existingPid) {
           let processAlive = false;
@@ -12693,7 +13016,7 @@ process.on('SIGINT', () => process.emit('SIGTERM'));
         } catch {
           const privKey = randomBytes6(32);
           privKeyHex = privKey.toString("hex");
-          address = "0x" + createHash2("sha256").update(privKey).digest("hex").slice(0, 40);
+          address = "0x" + createHash3("sha256").update(privKey).digest("hex").slice(0, 40);
           privKey.fill(0);
         }
         const salt = randomBytes6(32);
@@ -12755,7 +13078,7 @@ process.on('SIGINT', () => process.emit('SIGTERM'));
         } catch {
           const privKey = randomBytes6(32);
           privKeyHex = privKey.toString("hex");
-          address = "0x" + createHash2("sha256").update(privKey).digest("hex").slice(0, 40);
+          address = "0x" + createHash3("sha256").update(privKey).digest("hex").slice(0, 40);
           privKey.fill(0);
         }
         const salt = randomBytes6(32);
@@ -13278,7 +13601,7 @@ process.on('SIGINT', () => process.emit('SIGTERM'));
             }
           }
           const nonce = randomBytes6(16).toString("hex");
-          const hash = createHash2("sha256").update(`${modelName}:${nonce}:${Date.now()}`).digest("hex");
+          const hash = createHash3("sha256").update(`${modelName}:${nonce}:${Date.now()}`).digest("hex");
           const bar = (s2) => "█".repeat(Math.round(s2 / 5)) + "░".repeat(20 - Math.round(s2 / 5));
           const mem = vramMb > 24e3 ? 95 : vramMb > 16e3 ? 80 : vramMb > 8e3 ? 60 : vramMb > 0 ? 40 : 20;
           await this.ensureDir();
@@ -89943,7 +90266,7 @@ var require_auto = __commonJS({
 // ../node_modules/acme-client/src/client.js
 var require_client = __commonJS({
   "../node_modules/acme-client/src/client.js"(exports, module) {
-    var { createHash: createHash20 } = __require("crypto");
+    var { createHash: createHash21 } = __require("crypto");
     var { getPemBodyAsB64u } = require_crypto();
     var { log: log22 } = require_logger();
     var HttpClient = require_http();
@@ -90254,14 +90577,14 @@ var require_client = __commonJS({
        */
       async getChallengeKeyAuthorization(challenge) {
         const jwk = this.http.getJwk();
-        const keysum = createHash20("sha256").update(JSON.stringify(jwk));
+        const keysum = createHash21("sha256").update(JSON.stringify(jwk));
         const thumbprint = keysum.digest("base64url");
         const result = `${challenge.token}.${thumbprint}`;
         if (challenge.type === "http-01") {
           return result;
         }
         if (challenge.type === "dns-01") {
-          return createHash20("sha256").update(result).digest("base64url");
+          return createHash21("sha256").update(result).digest("base64url");
         }
         if (challenge.type === "tls-alpn-01") {
           return result;
@@ -232941,7 +233264,7 @@ var require_websocket2 = __commonJS({
     var http6 = __require("http");
     var net5 = __require("net");
     var tls2 = __require("tls");
-    var { randomBytes: randomBytes25, createHash: createHash20 } = __require("crypto");
+    var { randomBytes: randomBytes25, createHash: createHash21 } = __require("crypto");
     var { Duplex: Duplex3, Readable } = __require("stream");
     var { URL: URL3 } = __require("url");
     var PerMessageDeflate2 = require_permessage_deflate2();
@@ -233601,7 +233924,7 @@ var require_websocket2 = __commonJS({
           abortHandshake(websocket, socket, "Invalid Upgrade header");
           return;
         }
-        const digest3 = createHash20("sha1").update(key + GUID).digest("base64");
+        const digest3 = createHash21("sha1").update(key + GUID).digest("base64");
         if (res.headers["sec-websocket-accept"] !== digest3) {
           abortHandshake(websocket, socket, "Invalid Sec-WebSocket-Accept header");
           return;
@@ -233968,7 +234291,7 @@ var require_websocket_server = __commonJS({
     var EventEmitter13 = __require("events");
     var http6 = __require("http");
     var { Duplex: Duplex3 } = __require("stream");
-    var { createHash: createHash20 } = __require("crypto");
+    var { createHash: createHash21 } = __require("crypto");
     var extension2 = require_extension2();
     var PerMessageDeflate2 = require_permessage_deflate2();
     var subprotocol2 = require_subprotocol();
@@ -234269,7 +234592,7 @@ var require_websocket_server = __commonJS({
           );
         }
         if (this._state > RUNNING) return abortHandshake(socket, 503);
-        const digest3 = createHash20("sha1").update(key + GUID).digest("base64");
+        const digest3 = createHash21("sha1").update(key + GUID).digest("base64");
         const headers = [
           "HTTP/1.1 101 Switching Protocols",
           "Upgrade: websocket",
@@ -247076,13 +247399,13 @@ Justification: ${justification || "(none provided)"}`,
         }
         const snapshot = JSON.stringify(this.selfState, null, 2);
         try {
-          const { createHash: createHash20 } = await import("node:crypto");
+          const { createHash: createHash21 } = await import("node:crypto");
           const snapshotDir = join27(this.cwd, ".oa", "identity", "snapshots");
           await mkdir6(snapshotDir, { recursive: true });
           const version4 = this.selfState.version;
           const snapshotPath = join27(snapshotDir, `v${version4}.json`);
           await writeFile11(snapshotPath, snapshot, "utf8");
-          const hash = createHash20("sha256").update(snapshot).digest("hex");
+          const hash = createHash21("sha256").update(snapshot).digest("hex");
           await writeFile11(join27(this.cwd, ".oa", "identity", "latest-hash.txt"), hash, "utf8");
           let ipfsCid = "";
           try {
@@ -247215,8 +247538,8 @@ New: ${newNarrative.slice(0, 200)}...`,
       }
       // ── Helpers ──────────────────────────────────────────────────────────────
       createDefaultState() {
-        const { createHash: createHash20 } = __require("node:crypto");
-        const machineId = createHash20("sha256").update(this.cwd).digest("hex").slice(0, 12);
+        const { createHash: createHash21 } = __require("node:crypto");
+        const machineId = createHash21("sha256").update(this.cwd).digest("hex").slice(0, 12);
         return {
           self_id: `oa-${machineId}`,
           version: 1,
@@ -247298,9 +247621,9 @@ New: ${newNarrative.slice(0, 200)}...`,
         let cid;
         if (this.selfState.version > prevVersion) {
           try {
-            const { createHash: createHash20 } = await import("node:crypto");
+            const { createHash: createHash21 } = await import("node:crypto");
             const stateJson = JSON.stringify(this.selfState);
-            const hash = createHash20("sha256").update(stateJson).digest("hex").slice(0, 32);
+            const hash = createHash21("sha256").update(stateJson).digest("hex").slice(0, 32);
             const cidsPath = join27(this.cwd, ".oa", "identity", "cids.json");
             const cidsData = { latest: "", hash, version: this.selfState.version };
             try {
@@ -253007,7 +253330,7 @@ import { execSync as execSync22, exec as execCb, spawnSync as spawnSync2 } from
 import { readFile as readFile16, writeFile as writeFile17, mkdir as mkdir12 } from "node:fs/promises";
 import { resolve as resolve24, join as join41 } from "node:path";
 import { homedir as homedir10 } from "node:os";
-import { randomBytes as randomBytes11, createHash as createHash3 } from "node:crypto";
+import { randomBytes as randomBytes11, createHash as createHash4 } from "node:crypto";
 function isValidCron(expr) {
   const parts = expr.trim().split(/\s+/);
   if (parts.length !== 5)
@@ -253330,7 +253653,7 @@ var init_scheduler = __esm({
         }
         const scope = String(args["scope"] ?? "local");
         const fingerprint = `${resolve24(this.workingDir)}|${task}|${cronExpr}|${scope}`;
-        const id = `sched-${createHash3("sha1").update(fingerprint).digest("hex").slice(0, 8)}`;
+        const id = `sched-${createHash4("sha1").update(fingerprint).digest("hex").slice(0, 8)}`;
         const oneShot = Boolean(args["one_shot"]);
         const maxRuns = typeof args["max_runs"] === "number" ? args["max_runs"] : void 0;
         const newTask = {
@@ -256873,7 +257196,7 @@ var init_import_graph = __esm({
 import { createRequire as __createRequireGlob } from "node:module";
 import ignore from "ignore";
 import { readFile as readFile21, stat as stat4 } from "node:fs/promises";
-import { createHash as createHash4 } from "node:crypto";
+import { createHash as createHash5 } from "node:crypto";
 import { join as join49, relative as relative4, extname as extname8, basename as basename11 } from "node:path";
 var __requireGlob, glob2, DEFAULT_EXCLUDE, LANGUAGE_MAP, CodebaseIndexer;
 var init_codebase_indexer = __esm({
@@ -256941,7 +257264,7 @@ var init_codebase_indexer = __esm({
             if (fileStat.size > this.config.maxFileSize)
               continue;
             const content = await readFile21(fullPath);
-            const hash = createHash4("sha256").update(content).digest("hex");
+            const hash = createHash5("sha256").update(content).digest("hex");
             const ext = extname8(relativePath);
             indexed.push({
               path: fullPath,
@@ -501260,7 +501583,7 @@ var init_ts_morph_parser = __esm({
 
 // packages/indexer/dist/code-graph-db.js
 import { createRequire as createRequire2 } from "node:module";
-import { createHash as createHash5 } from "node:crypto";
+import { createHash as createHash6 } from "node:crypto";
 import { mkdirSync as mkdirSync12, readFileSync as readFileSync26 } from "node:fs";
 import { join as join50, dirname as dirname14, extname as extname9 } from "node:path";
 function loadDatabaseCtor() {
@@ -501332,7 +501655,7 @@ function extractFileImports(content, filePath) {
   return imports.map((p2) => p2.replace(/\.(js|ts|jsx|tsx|mjs|cjs)$/, ""));
 }
 function hashContent(content) {
-  return createHash5("sha1").update(content).digest("hex").slice(0, 16);
+  return createHash6("sha1").update(content).digest("hex").slice(0, 16);
 }
 function detectLanguage(filePath) {
   return EXT_TO_LANG[extname9(filePath)] ?? "unknown";
@@ -509952,7 +510275,7 @@ var init_environment_snapshot = __esm({
 import { execSync as execSync42 } from "node:child_process";
 import { existsSync as existsSync47, mkdirSync as mkdirSync24, writeFileSync as writeFileSync22, readFileSync as readFileSync39, readdirSync as readdirSync14, unlinkSync as unlinkSync11 } from "node:fs";
 import { join as join64, basename as basename12 } from "node:path";
-import { createHash as createHash6 } from "node:crypto";
+import { createHash as createHash7 } from "node:crypto";
 function isYouTubeUrl2(url) {
   return /(?:youtube\.com\/(?:watch|shorts|live|embed|v\/)|youtu\.be\/)/i.test(url);
 }
@@ -509980,7 +510303,7 @@ function ensureFfmpeg() {
 function imageHash(imagePath) {
   try {
     const data = readFileSync39(imagePath);
-    return createHash6("md5").update(data).digest("hex").slice(0, 12);
+    return createHash7("md5").update(data).digest("hex").slice(0, 12);
   } catch {
     return "unknown";
   }
@@ -514004,14 +514327,14 @@ var init_artifact_inspector = __esm({
 // packages/orchestrator/dist/lesson-bank.js
 import { existsSync as existsSync53, mkdirSync as mkdirSync27, appendFileSync as appendFileSync2, readFileSync as readFileSync44 } from "node:fs";
 import { join as join69, dirname as dirname19 } from "node:path";
-import { createHash as createHash7 } from "node:crypto";
+import { createHash as createHash8 } from "node:crypto";
 function tokenize2(text) {
   if (!text)
     return [];
   return text.toLowerCase().split(TOKENIZE_RE).filter((t2) => t2.length >= 3).slice(0, 80);
 }
 function shortHash(s2) {
-  return createHash7("sha256").update(s2).digest("hex").slice(0, 16);
+  return createHash8("sha256").update(s2).digest("hex").slice(0, 16);
 }
 function solicit(args) {
   const { taskGoal, stem, reflections, successOutputPreview } = args;
@@ -517476,7 +517799,7 @@ var init_pprRetrieval = __esm({
 import { join as join75 } from "node:path";
 import { mkdirSync as mkdirSync29, existsSync as existsSync59 } from "node:fs";
 import { randomUUID as randomUUID8 } from "node:crypto";
-import { createHash as createHash8 } from "node:crypto";
+import { createHash as createHash9 } from "node:crypto";
 function readEpisodeAffect2(metadata) {
   if (!metadata || typeof metadata !== "object")
     return null;
@@ -517682,7 +518005,7 @@ var init_episodeStore = __esm({
       insert(ep) {
         const id = randomUUID8();
         const now = Date.now();
-        const contentHash = createHash8("sha256").update(ep.content).digest("hex").slice(0, 16);
+        const contentHash2 = createHash9("sha256").update(ep.content).digest("hex").slice(0, 16);
         const modality = ep.modality ?? "text";
         const rawImportance = ep.importance ?? autoImportance(ep.toolName ?? null, modality, ep.content);
         const modulated = ep.emotionalState ? modulateImportance(sanitizeImportance(rawImportance), ep.emotionalState) : sanitizeImportance(rawImportance);
@@ -517691,13 +518014,13 @@ var init_episodeStore = __esm({
           return "";
         }
         const decayClass = ep.decayClass ?? autoDecayClass(ep.toolName ?? null, modality, ep.content);
-        const existing = this.db.prepare("SELECT id FROM episodes WHERE content_hash = ? AND session_id = ? LIMIT 1").get(contentHash, ep.sessionId ?? null);
+        const existing = this.db.prepare("SELECT id FROM episodes WHERE content_hash = ? AND session_id = ? LIMIT 1").get(contentHash2, ep.sessionId ?? null);
         if (existing)
           return existing.id;
         this.db.prepare(`
       INSERT INTO episodes (id, timestamp, session_id, task_id, turn_number, modality, tool_name, content, content_hash, metadata, importance, decay_class, strength)
       VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, 1.0)
-    `).run(id, now, ep.sessionId ?? null, ep.taskId ?? null, ep.turnNumber ?? null, modality, ep.toolName ?? null, ep.content, contentHash, ep.metadata ? JSON.stringify(ep.metadata) : null, importance, decayClass);
+    `).run(id, now, ep.sessionId ?? null, ep.taskId ?? null, ep.turnNumber ?? null, modality, ep.toolName ?? null, ep.content, contentHash2, ep.metadata ? JSON.stringify(ep.metadata) : null, importance, decayClass);
         if (this.graph) {
           try {
             const episode = this.get(id);
@@ -522251,7 +522574,7 @@ var init_memoryStageContext = __esm({
 });
 
 // packages/memory/dist/sessionGist.js
-import { createHash as createHash9 } from "node:crypto";
+import { createHash as createHash10 } from "node:crypto";
 function inferDomain(input) {
   const blob = [
     input.goal,
@@ -522276,7 +522599,7 @@ function inferDomain(input) {
   return ranked[0][0];
 }
 function computeGoalHash(goal) {
-  return createHash9("sha256").update(goal.trim().toLowerCase()).digest("hex").slice(0, 16);
+  return createHash10("sha256").update(goal.trim().toLowerCase()).digest("hex").slice(0, 16);
 }
 function clip(text, n2) {
   if (!text)
@@ -522487,12 +522810,12 @@ var init_toolOutcomes = __esm({
 });
 
 // packages/memory/dist/stagnationRecipes.js
-import { createHash as createHash10 } from "node:crypto";
+import { createHash as createHash11 } from "node:crypto";
 function fingerprintSignature(fp) {
   const normClusters = (fp.errorClusters ?? []).map((s2) => (s2 || "").toLowerCase().replace(/[0-9]+/g, "N").replace(/\s+/g, " ").trim()).filter(Boolean).sort();
   const tool = (fp.stuckTool ?? "").toLowerCase().trim();
   const blob = `tool=${tool};clusters=${normClusters.join("|")}`;
-  return createHash10("sha256").update(blob).digest("hex").slice(0, 16);
+  return createHash11("sha256").update(blob).digest("hex").slice(0, 16);
 }
 function crystallize(store2, input) {
   const sig = fingerprintSignature(input.fingerprint);
@@ -522549,7 +522872,7 @@ var init_stagnationRecipes = __esm({
 });
 
 // packages/memory/dist/codebaseMap.js
-import { createHash as createHash11, randomUUID as randomUUID12 } from "node:crypto";
+import { createHash as createHash12, randomUUID as randomUUID12 } from "node:crypto";
 function freshNodeId() {
   return randomUUID12();
 }
@@ -522563,7 +522886,7 @@ var init_codebaseMap = __esm({
       touchCount = /* @__PURE__ */ new Map();
       constructor(db, repoRoot, commitSha) {
         this.db = db;
-        this.repoFp = createHash11("sha256").update(`${repoRoot}::${commitSha ?? "no-commit"}`).digest("hex").slice(0, 16);
+        this.repoFp = createHash12("sha256").update(`${repoRoot}::${commitSha ?? "no-commit"}`).digest("hex").slice(0, 16);
         this.ensureSchema();
       }
       ensureSchema() {
@@ -522699,7 +523022,7 @@ var init_codebaseMap = __esm({
       }
       /** Stable composite id: `<kind>:<sha16(path)>` so insert ON CONFLICT works. */
       idFor(kind, path11) {
-        const h = createHash11("sha256").update(`${this.repoFp}:${kind}:${path11}`).digest("hex").slice(0, 24);
+        const h = createHash12("sha256").update(`${this.repoFp}:${kind}:${path11}`).digest("hex").slice(0, 24);
         return `${kind}-${h}`;
       }
     };
@@ -524758,7 +525081,7 @@ import { existsSync as existsSync66, readFileSync as readFileSync54, statSync as
 import { execSync as execSync45 } from "node:child_process";
 import { homedir as homedir22, platform as platform2, arch as arch2, totalmem as totalmem2, freemem as freemem2, hostname as hostname3 } from "node:os";
 import { join as join82 } from "node:path";
-import { createHash as createHash12 } from "node:crypto";
+import { createHash as createHash13 } from "node:crypto";
 function capturePreflightSnapshot(workingDir) {
   const warnings = [];
   const configFingerprints = {};
@@ -524925,7 +525248,7 @@ function expandPath(p2) {
   return p2;
 }
 function sha2563(s2) {
-  return createHash12("sha256").update(s2).digest("hex").slice(0, 16);
+  return createHash13("sha256").update(s2).digest("hex").slice(0, 16);
 }
 function freeDiskBytes(path11 = "/tmp") {
   try {
@@ -526876,14 +527199,14 @@ Your NEXT tool call MUST be EXACTLY ONE of:
   • file_write   — create a new file
   • file_edit    — modify an existing file (find/replace)
   • batch_edit   — multiple find/replace edits in one call
-  • file_patch   — apply a unified diff
+  • file_patch   — apply a version-checked line-range patch
 
 These are the ONLY four tools that count as creative edits. The following do NOT count and will NOT satisfy this directive:
   • todo_write    (only updates the todo list, not the filesystem)
   • memory_write  (writes to memory store, not the project)
   • list_directory / file_read / file_explore / grep_search / shell
 
-Pick the SMALLEST concrete deliverable from the spec — typically the project entry point or the file most other modules depend on. Write a stub or skeleton if the full implementation is too large; you can iterate later. Do NOT issue another read or todo update before producing the next file_write/file_edit/batch_edit/file_patch.`;
+Pick the SMALLEST concrete deliverable from the spec — typically the project entry point or the file most other modules depend on. Write a complete, version-checked slice that changes disk state; you can iterate later. Do NOT issue another read or todo update before producing the next file_write/file_edit/batch_edit/file_patch.`;
         messages2.push({ role: "system", content: reg61Msg });
         const _cyclePart = cycleLabel ? ` (${cycleLabel})` : "";
         this.emit({
@@ -526918,8 +527241,9 @@ Pick the SMALLEST concrete deliverable from the spec — typically the project e
         const _editTools = /* @__PURE__ */ new Set(["file_write", "file_edit", "batch_edit", "file_patch"]);
         if (!_editTools.has(tc.name))
           return null;
-        const _editPath = tc.arguments?.["path"] ?? "";
-        if (!_editPath || this._decomp2MainContextFiles.has(_editPath))
+        const _editPaths = this._extractToolTargetPaths(tc.name, tc.arguments);
+        const _editPath = _editPaths.find((p2) => !this._decomp2MainContextFiles.has(p2)) ?? "";
+        if (!_editPath)
           return null;
         const _filesList = [...this._decomp2MainContextFiles].slice(0, 8).map((p2) => `  • ${p2}`).join("\n");
         const _moreFiles = this._decomp2MainContextFiles.size > 8 ? `
@@ -526979,21 +527303,18 @@ Pick the SMALLEST concrete deliverable from the spec — typically the project e
       _trackDecomp2(tc, result, turn) {
         if (process.env["OA_DISABLE_DECOMP2"] === "1")
           return;
-        if (result && result.success !== false) {
-          const _editTools = /* @__PURE__ */ new Set(["file_write", "file_edit", "batch_edit", "file_patch"]);
-          if (_editTools.has(tc.name)) {
-            const _editPath = tc.arguments?.["path"] ?? "";
-            if (_editPath && typeof _editPath === "string") {
-              this._decomp2MainContextFiles.add(_editPath);
-              const DECOMP2_FILE_SPREAD_THRESHOLD = 5;
-              if (!this._decomp2GateActive && this._decomp2MainContextFiles.size >= DECOMP2_FILE_SPREAD_THRESHOLD && this._decomp2SubAgentCalls === 0) {
-                this._decomp2GateActive = true;
-                this.emit({
-                  type: "status",
-                  content: `DECOMP-2 NEW-FILE GATE ACTIVATED — ${this._decomp2MainContextFiles.size} distinct files edited in main context, 0 sub_agent calls; further edits to NEW files will be blocked until sub_agent is invoked`,
-                  timestamp: (/* @__PURE__ */ new Date()).toISOString()
-                });
-              }
+        if (this._isRealProjectMutation(tc.name, result)) {
+          const _editPaths = this._extractToolTargetPaths(tc.name, tc.arguments, result);
+          for (const _editPath of _editPaths) {
+            this._decomp2MainContextFiles.add(_editPath);
+            const DECOMP2_FILE_SPREAD_THRESHOLD = 5;
+            if (!this._decomp2GateActive && this._decomp2MainContextFiles.size >= DECOMP2_FILE_SPREAD_THRESHOLD && this._decomp2SubAgentCalls === 0) {
+              this._decomp2GateActive = true;
+              this.emit({
+                type: "status",
+                content: `DECOMP-2 NEW-FILE GATE ACTIVATED — ${this._decomp2MainContextFiles.size} distinct files edited in main context, 0 sub_agent calls; further edits to NEW files will be blocked until sub_agent is invoked`,
+                timestamp: (/* @__PURE__ */ new Date()).toISOString()
+              });
             }
           }
         }
@@ -527101,6 +527422,31 @@ Pick the SMALLEST concrete deliverable from the spec — typically the project e
           return null;
         }
       }
+      _isProjectEditTool(toolName) {
+        return toolName === "file_write" || toolName === "file_edit" || toolName === "batch_edit" || toolName === "file_patch";
+      }
+      _extractToolTargetPaths(toolName, args, result) {
+        const fromResult = Array.isArray(result?.mutatedFiles) ? result.mutatedFiles.filter((p3) => typeof p3 === "string" && p3.trim().length > 0) : [];
+        if (fromResult.length > 0)
+          return [...new Set(fromResult)];
+        if (toolName === "batch_edit" && Array.isArray(args?.["edits"])) {
+          const paths = args["edits"].map((edit) => edit && typeof edit === "object" ? edit["path"] : null).filter((p3) => typeof p3 === "string" && p3.trim().length > 0);
+          return [...new Set(paths)];
+        }
+        const p2 = args?.["path"] ?? args?.["file_path"] ?? args?.["file"] ?? args?.["filename"] ?? args?.["filepath"] ?? args?.["filePath"];
+        return typeof p2 === "string" && p2.trim().length > 0 ? [p2.trim()] : [];
+      }
+      _isRealProjectMutation(toolName, result) {
+        if (!this._isProjectEditTool(toolName))
+          return false;
+        if (!result || result.success === false)
+          return false;
+        if (typeof result.mutated === "boolean")
+          return result.mutated;
+        if (result.dryRun || result.noop || result.partial)
+          return false;
+        return true;
+      }
       /** Track the turn index of the last todo_write call so the reminder
        *  path can compute `turnsSinceLastTodoWrite` cheaply without walking
        *  the entire messages array. Reset on run(). */
@@ -527765,7 +528111,7 @@ ${body}`;
        * converging — particularly common when a build error names a specific
        * file the agent thinks needs more work.
        *
-       * Suggests targeted alternatives (file_edit/edit_block) and "good enough"
+           * Suggests targeted alternatives (file_edit/file_patch) and "good enough"
        * recognition. Returns null when no churn is happening.
        */
       _renderWriteChurnBlock(turn) {
@@ -527789,7 +528135,7 @@ ${body}`;
         for (const c9 of top) {
           lines.push(`  • ${c9.path} — ${c9.writes} writes (most recent ${c9.ageTurns} turn${c9.ageTurns === 1 ? "" : "s"} ago)`);
         }
-        lines.push("Refining the same file again and again rarely converges. If you have a specific change in mind, use file_edit or edit_block for targeted changes. If you're trying different approaches, read the file once with file_read to see current state, then decide. If the current version is reasonable but a downstream tool fails, the bug is probably in the OTHER file (importer, schema, dep) — not this one.");
+        lines.push("Refining the same file again and again rarely converges. If you have a specific change in mind, use file_edit or file_patch for targeted changes. If you're trying different approaches, read the file once with file_read to see current state, then decide. If the current version is reasonable but a downstream tool fails, the bug is probably in the OTHER file (importer, schema, dep) — not this one.");
         lines.push(`(turn ${turn} — this warning auto-clears when no path has ≥3 writes within 10 turns)`);
         return lines.join("\n");
       }
@@ -527810,6 +528156,10 @@ ${body}`;
           return false;
         if (/(^|[^&\d])(>|>>)\s*\S/.test(cmd))
           return false;
+        if (/(^|[^<])<\s*\S/.test(cmd))
+          return false;
+        if (/\bpatch\b/i.test(cmd))
+          return false;
         const MUTATE_BINS = [
           // POSIX file/process mutators
           "rm",
@@ -528013,8 +528363,6 @@ ${body}`;
           "unexpand",
           "diff",
           "cmp",
-          "patch",
-          // patch with -R or no-args could be mutating; --dry-run only is read
           "echo",
           "printf",
           "pwd",
@@ -528206,10 +528554,7 @@ ${body}`;
        */
       _renderTodoStateBlock(turn) {
         try {
-          const { readTodos: readTodos2 } = __require("@open-agents/execution");
-          const { getTodoSessionId: getTodoSessionId2 } = __require("@open-agents/execution");
-          const sessionId = getTodoSessionId2();
-          const todos = readTodos2(sessionId);
+          const todos = this.readSessionTodos();
           if (!todos || todos.length === 0)
             return null;
           const lines = ["[CURRENT TODO PLAN — already in your state, no need to call todo_write to see it]"];
@@ -529399,7 +529744,6 @@ If the hypothesis cannot be tested by a creative edit, ask the human via task_co
               content: `REG-58 NO-WRITE STAGNATION — ${gap} turns since last creative edit (turn ${this._lastFileWriteTurn})${_telSuffix58}`,
               timestamp: (/* @__PURE__ */ new Date()).toISOString()
             });
-            this._lastFileWriteTurn = turn;
           }
           const REG60_WINDOW_MS = 60 * 60 * 1e3;
           const REG60_MIN_WRITES = 3;
@@ -529626,8 +529970,11 @@ If this matches your current shape, try it before continuing.`
                 if (_readClass.has(c9.name)) {
                   _readCount++;
                 } else if (_mutationClass.has(c9.name)) {
-                  if (!_isStale)
+                  if (c9.mutated === true) {
                     _mutationCount++;
+                  } else if (c9.success === true && c9.mutated !== false && !_isStale) {
+                    _mutationCount++;
+                  }
                 } else if (c9.name === "shell") {
                   if (c9.success === true && !_isStale) {
                     _readCount++;
@@ -529801,6 +530148,14 @@ ${_staleSamples.join("\n")}` : ``,
               for (const c9 of _wtWindow) {
                 if (!_wtWriteClass.has(c9.name))
                   continue;
+                if (c9.mutated === false)
+                  continue;
+                if (Array.isArray(c9.mutatedFiles) && c9.mutatedFiles.length > 0) {
+                  for (const p2 of c9.mutatedFiles) {
+                    _wtFileCounts.set(p2, (_wtFileCounts.get(p2) ?? 0) + 1);
+                  }
+                  continue;
+                }
                 const _ak = c9.argsKey || "";
                 const _m = /(?:^|,)path=([^,]+)/.exec(_ak);
                 const _pk = _m ? _m[1].slice(0, 200) : _ak.slice(0, 200);
@@ -530428,8 +530783,8 @@ If you're stuck, try a completely different approach. Do NOT repeat what failed
               if (process.env["OA_DISABLE_ADAPTIVE_RETRIEVAL"] !== "1") {
                 const goalForSig = (this._taskState.goal || "").slice(0, 200);
                 const recentTools = this._toolSequence.slice(-5).join("|");
-                const { createHash: createHash20 } = await import("node:crypto");
-                const sig = createHash20("sha256").update(`${goalForSig}::${recentTools}`).digest("hex").slice(0, 16);
+                const { createHash: createHash21 } = await import("node:crypto");
+                const sig = createHash21("sha256").update(`${goalForSig}::${recentTools}`).digest("hex").slice(0, 16);
                 if (this._lastPprSig === sig && this._lastPprMemoryLines.length > 0) {
                   compacted.push({
                     role: "system",
@@ -531005,14 +531360,6 @@ ${memoryLines.join("\n")}`
                 "priority_delegate",
                 "background_run"
               ]);
-              if (REG61_EDIT_TOOLS.has(tc.name) && this._reg61PerpetualGateActive) {
-                this._reg61PerpetualGateActive = false;
-                this.emit({
-                  type: "status",
-                  content: `REG-61 GATE CLEARED — '${tc.name}' satisfied REG-61 directive at turn ${turn}`,
-                  timestamp: (/* @__PURE__ */ new Date()).toISOString()
-                });
-              }
               if (this._reg61PerpetualGateActive && !REG61_BYPASS_TOOLS.has(tc.name) && process.env["OA_DISABLE_REG61_COERCE"] !== "1") {
                 this.emit({
                   type: "tool_call",
@@ -531038,7 +531385,7 @@ ${memoryLines.join("\n")}`
                   ``,
                   `This is NOT random guessing — it's targeted hypothesis falsification. Reading the same files 5+ times has already proven uninformative; only a state change will move the system.`,
                   ``,
-                  `Issue EXACTLY ONE of: file_write / file_edit / batch_edit / file_patch on a single concrete change. The exact CHOICE of edit matters less than NOT continuing to re-read.`,
+                  `Issue EXACTLY ONE of: file_write / file_edit / batch_edit / file_patch on a single concrete change. The edit must actually change disk state; dry-runs and no-ops do not clear this directive.`,
                   ``,
                   `Allowed bypasses (will not be blocked but will not clear the directive either):`,
                   `  • web_search    — search the EXACT recurring error string`,
@@ -531055,14 +531402,14 @@ ${memoryLines.join("\n")}`
                   `  • file_write   — create a new file`,
                   `  • file_edit    — modify an existing file (find/replace)`,
                   `  • batch_edit   — multiple find/replace edits in one call`,
-                  `  • file_patch   — apply a unified diff`,
+                  `  • file_patch   — apply a version-checked line-range patch`,
                   ``,
                   `These tools are also allowed while the directive is active (will not be blocked, will not clear the gate):`,
                   `  • web_search    — for genuinely-unknown APIs / error strings`,
                   `  • task_complete — to exit if you cannot make any progress`,
                   `  • ask_user      — to escalate to human (if available)`,
                   ``,
-                  `Until you issue a creative edit, ALL of these will be BLOCKED again on every turn: file_read, file_explore, list_directory, grep_search, shell, todo_write, todo_read, memory_read, memory_write, etc. Pick the smallest concrete change that moves work forward — even a partial stub or a single-line edit counts.`
+                  `Until you issue a creative edit that actually changes disk, ALL of these will be BLOCKED again on every turn: file_read, file_explore, list_directory, grep_search, shell, todo_write, todo_read, memory_read, memory_write, etc. Pick the smallest concrete change that moves work forward.`
                 ].join("\n");
                 this.emit({
                   type: "tool_result",
@@ -531514,6 +531861,16 @@ Respond with EXACTLY this structure before your next tool call:
                   }
                 }
               }
+              const realFileMutation = this._isRealProjectMutation(tc.name, result);
+              const realMutationPaths = realFileMutation ? this._extractToolTargetPaths(tc.name, tc.arguments, result) : [];
+              if (realFileMutation && this._reg61PerpetualGateActive) {
+                this._reg61PerpetualGateActive = false;
+                this.emit({
+                  type: "status",
+                  content: `REG-61 GATE CLEARED — '${tc.name}' landed real file mutation at turn ${turn}`,
+                  timestamp: (/* @__PURE__ */ new Date()).toISOString()
+                });
+              }
               const updated = this._argCohorts.get(cohortKey) || { success: 0, failure: 0, lastOutcomeTurn: turn };
               if (result.success)
                 updated.success++;
@@ -531522,9 +531879,9 @@ Respond with EXACTLY this structure before your next tool call:
               updated.lastOutcomeTurn = turn;
               this._argCohorts.set(cohortKey, updated);
               try {
-                if (tc.name === "file_write" || tc.name === "file_edit" || tc.name === "edit_block" || tc.name === "batch_edit") {
-                  const p2 = String(tc.arguments?.["path"] ?? tc.arguments?.["file_path"] ?? tc.arguments?.["file"] ?? "");
-                  if (p2 && result.success) {
+                if (realFileMutation) {
+                  const paths = realMutationPaths.length > 0 ? realMutationPaths : this._extractToolTargetPaths(tc.name, tc.arguments, result);
+                  for (const p2 of paths) {
                     const prev = this._worldFacts.files.get(p2);
                     this._worldFacts.files.set(p2, {
                       exists: true,
@@ -531534,7 +531891,9 @@ Respond with EXACTLY this structure before your next tool call:
                       lastWriteTurn: turn,
                       writeCount: (prev?.writeCount ?? 0) + 1
                     });
-                    this._writesSinceLastTodoWrite++;
+                  }
+                  if (paths.length > 0) {
+                    this._writesSinceLastTodoWrite += paths.length;
                     if (this._writesSinceLastTodoWrite >= 6 && !this._progressGateActive) {
                       this._progressGateActive = true;
                       this.emit({
@@ -531907,12 +532266,17 @@ Respond with EXACTLY this structure before your next tool call:
                 const lastLog = toolCallLog[toolCallLog.length - 1];
                 if (lastLog) {
                   lastLog.success = false;
+                  lastLog.mutated = false;
+                  lastLog.mutatedFiles = [];
                   lastLog.outputPreview = errorText.slice(0, 100);
                 }
               } else if (result.success) {
                 const lastLog = toolCallLog[toolCallLog.length - 1];
-                if (lastLog)
+                if (lastLog) {
                   lastLog.success = true;
+                  lastLog.mutated = realFileMutation;
+                  lastLog.mutatedFiles = realMutationPaths;
+                }
                 if (tc.name === "shell") {
                   const _shellCmd = String(tc.arguments?.["command"] ?? tc.arguments?.["cmd"] ?? "");
                   const _typecheckOnly = /\b(--noEmit|--dry-run|--check\b|\bmypy\b|\bruff check\b|\bcargo check\b|\bstylelint --check\b|\bpylint\b(?!.*--exit-zero))\b/i.test(_shellCmd);
@@ -532013,16 +532377,16 @@ Respond with EXACTLY this structure before your next tool call:
                   } catch {
                   }
                 }
-                if (["file_write", "file_edit", "file_patch", "batch_edit"].includes(tc.name) && this._patchHistoryStore) {
+                if (realFileMutation && this._patchHistoryStore) {
                   try {
-                    const filePath2 = tc.arguments?.path || tc.arguments?.file_path;
-                    if (filePath2) {
+                    const patchFiles = realMutationPaths.length > 0 ? realMutationPaths : this._extractToolTargetPaths(tc.name, tc.arguments, result);
+                    for (const filePath2 of patchFiles) {
                       this._patchHistoryStore.insert({
                         taskId: this._sessionId,
                         sessionId: this._sessionId,
                         repoRoot: process.cwd(),
                         filePath: filePath2,
-                        diff: JSON.stringify(tc.arguments).slice(0, 1e3),
+                        diff: (result.diff ?? JSON.stringify(tc.arguments)).slice(0, 1e3),
                         status: "applied",
                         appliedAt: (/* @__PURE__ */ new Date()).toISOString(),
                         revertedAt: null,
@@ -532043,13 +532407,13 @@ Respond with EXACTLY this structure before your next tool call:
                   }
                 }
               }
-              const isFileMutation = ["file_write", "file_edit", "batch_edit", "file_patch"].includes(tc.name);
-              if (isFileMutation && result.success && dedupHitCount.size > 0) {
+              const isFileMutation = realFileMutation;
+              if (isFileMutation && dedupHitCount.size > 0) {
                 dedupHitCount.clear();
               }
-              if (isFileMutation && result.success) {
-                this._fileWritesSinceLastWorldState++;
-                this._fileWritesThisRun++;
+              if (isFileMutation) {
+                this._fileWritesSinceLastWorldState += Math.max(1, realMutationPaths.length);
+                this._fileWritesThisRun += Math.max(1, realMutationPaths.length);
               }
               if (result.success) {
                 this._recentFailures = this._recentFailures.filter((f2) => f2.fingerprint !== toolFingerprint);
@@ -532197,14 +532561,14 @@ Respond with EXACTLY this structure before your next tool call:
                 timestamp: (/* @__PURE__ */ new Date()).toISOString()
               });
               this._taskState.toolCallCount++;
-              if (result && result.success !== false) {
-                const creativeTools = ["file_write", "file_edit", "batch_edit", "file_patch"];
-                if (creativeTools.includes(tc.name)) {
-                  this._lastFileWriteTurn = turn;
+              if (realFileMutation) {
+                this._lastFileWriteTurn = turn;
+                const writeEvents = Math.max(1, realMutationPaths.length);
+                for (let i2 = 0; i2 < writeEvents; i2++) {
                   this._fileWriteTimestamps.push(Date.now());
-                  if (this._fileWriteTimestamps.length > 200) {
-                    this._fileWriteTimestamps.shift();
-                  }
+                }
+                while (this._fileWriteTimestamps.length > 200) {
+                  this._fileWriteTimestamps.shift();
                 }
               }
               this._trackDecomp2(tc, result, turn);
@@ -544333,7 +544697,7 @@ var require_websocket3 = __commonJS({
     var http6 = __require("http");
     var net5 = __require("net");
     var tls2 = __require("tls");
-    var { randomBytes: randomBytes25, createHash: createHash20 } = __require("crypto");
+    var { randomBytes: randomBytes25, createHash: createHash21 } = __require("crypto");
     var { Duplex: Duplex3, Readable } = __require("stream");
     var { URL: URL3 } = __require("url");
     var PerMessageDeflate2 = require_permessage_deflate3();
@@ -544993,7 +545357,7 @@ var require_websocket3 = __commonJS({
           abortHandshake(websocket, socket, "Invalid Upgrade header");
           return;
         }
-        const digest3 = createHash20("sha1").update(key + GUID).digest("base64");
+        const digest3 = createHash21("sha1").update(key + GUID).digest("base64");
         if (res.headers["sec-websocket-accept"] !== digest3) {
           abortHandshake(websocket, socket, "Invalid Sec-WebSocket-Accept header");
           return;
@@ -545360,7 +545724,7 @@ var require_websocket_server2 = __commonJS({
     var EventEmitter13 = __require("events");
     var http6 = __require("http");
     var { Duplex: Duplex3 } = __require("stream");
-    var { createHash: createHash20 } = __require("crypto");
+    var { createHash: createHash21 } = __require("crypto");
     var extension2 = require_extension3();
     var PerMessageDeflate2 = require_permessage_deflate3();
     var subprotocol2 = require_subprotocol2();
@@ -545661,7 +546025,7 @@ var require_websocket_server2 = __commonJS({
           );
         }
         if (this._state > RUNNING) return abortHandshake(socket, 503);
-        const digest3 = createHash20("sha1").update(key + GUID).digest("base64");
+        const digest3 = createHash21("sha1").update(key + GUID).digest("base64");
         const headers = [
           "HTTP/1.1 101 Switching Protocols",
           "Upgrade: websocket",
@@ -546721,7 +547085,7 @@ __export(oa_directory_exports, {
 import { existsSync as existsSync74, mkdirSync as mkdirSync42, readFileSync as readFileSync61, writeFileSync as writeFileSync38, readdirSync as readdirSync21, statSync as statSync25, unlinkSync as unlinkSync14, openSync as openSync2, closeSync as closeSync2, renameSync as renameSync3 } from "node:fs";
 import { join as join93, relative as relative8, basename as basename14, dirname as dirname27 } from "node:path";
 import { homedir as homedir26 } from "node:os";
-import { createHash as createHash13 } from "node:crypto";
+import { createHash as createHash14 } from "node:crypto";
 function findGitRoot(startDir) {
   let dir = startDir;
   const visited = /* @__PURE__ */ new Set();
@@ -547086,7 +547450,7 @@ function buildHandoffPrompt(repoRoot) {
   return lines.join("\n");
 }
 function computeDedupeHash(task, savedAt) {
-  return createHash13("sha256").update(`${task}|${savedAt}`).digest("hex").slice(0, 16);
+  return createHash14("sha256").update(`${task}|${savedAt}`).digest("hex").slice(0, 16);
 }
 function generateSessionId() {
   const timestamp = Date.now().toString(36);
@@ -575641,7 +576005,7 @@ var init_types = __esm({
 });
 
 // packages/cli/src/tui/p2p/secret-vault.ts
-import { createCipheriv as createCipheriv3, createDecipheriv as createDecipheriv3, randomBytes as randomBytes19, scryptSync as scryptSync2, createHash as createHash14 } from "node:crypto";
+import { createCipheriv as createCipheriv3, createDecipheriv as createDecipheriv3, randomBytes as randomBytes19, scryptSync as scryptSync2, createHash as createHash15 } from "node:crypto";
 import { readFileSync as readFileSync71, writeFileSync as writeFileSync46, existsSync as existsSync86, mkdirSync as mkdirSync50 } from "node:fs";
 import { dirname as dirname31 } from "node:path";
 var PLACEHOLDER_PREFIX, PLACEHOLDER_SUFFIX, CIPHER_ALGO, SALT_LEN, IV_LEN, KEY_LEN, SecretVault;
@@ -575886,7 +576250,7 @@ var init_secret_vault = __esm({
       /** Generate a deterministic fingerprint of vault contents (for sync verification) */
       fingerprint() {
         const names = Array.from(this.secrets.keys()).sort();
-        const hash = createHash14("sha256");
+        const hash = createHash15("sha256");
         for (const name10 of names) {
           hash.update(name10 + ":");
           hash.update(this.secrets.get(name10).value);
@@ -575901,7 +576265,7 @@ var init_secret_vault = __esm({
 // packages/cli/src/tui/p2p/peer-mesh.ts
 import { EventEmitter as EventEmitter7 } from "node:events";
 import { createServer as createServer5 } from "node:http";
-import { randomBytes as randomBytes20, createHash as createHash15, generateKeyPairSync } from "node:crypto";
+import { randomBytes as randomBytes20, createHash as createHash16, generateKeyPairSync } from "node:crypto";
 var PING_INTERVAL_MS, PEER_TIMEOUT_MS, GOSSIP_INTERVAL_MS, MAX_PEERS, PeerMesh;
 var init_peer_mesh = __esm({
   "packages/cli/src/tui/p2p/peer-mesh.ts"() {
@@ -575918,7 +576282,7 @@ var init_peer_mesh = __esm({
         const { publicKey: publicKey2, privateKey } = generateKeyPairSync("ed25519");
         this.publicKey = publicKey2.export({ type: "spki", format: "der" });
         this.privateKey = privateKey.export({ type: "pkcs8", format: "der" });
-        this.peerId = createHash15("sha256").update(this.publicKey).digest("base64url").slice(0, 22);
+        this.peerId = createHash16("sha256").update(this.publicKey).digest("base64url").slice(0, 22);
         this.capabilities = options2.capabilities;
         this.displayName = options2.displayName;
         this._authKey = options2.authKey ?? randomBytes20(24).toString("base64url");
@@ -585025,14 +585389,14 @@ var init_access_policy = __esm({
 });
 
 // packages/cli/src/api/project-preferences.ts
-import { createHash as createHash16 } from "node:crypto";
+import { createHash as createHash17 } from "node:crypto";
 import { existsSync as existsSync97, mkdirSync as mkdirSync59, readFileSync as readFileSync81, renameSync as renameSync7, writeFileSync as writeFileSync53, unlinkSync as unlinkSync22 } from "node:fs";
 import { homedir as homedir36 } from "node:os";
 import { join as join116, resolve as resolve36 } from "node:path";
 import { randomUUID as randomUUID15 } from "node:crypto";
 function projectKey(root) {
   const canonical = resolve36(root);
-  return createHash16("sha256").update(canonical).digest("hex").slice(0, 16);
+  return createHash17("sha256").update(canonical).digest("hex").slice(0, 16);
 }
 function projectDir(root) {
   return join116(PROJECTS_DIR, projectKey(root));
@@ -586210,7 +586574,7 @@ var init_disk_task_output = __esm({
 });
 
 // packages/cli/src/api/http.ts
-import { createHash as createHash17 } from "node:crypto";
+import { createHash as createHash18 } from "node:crypto";
 function problemDetails(opts) {
   const p2 = {
     type: opts.type ?? "about:blank",
@@ -586273,7 +586637,7 @@ function paginated(items, page2, total) {
 }
 function computeEtag(payload) {
   const json = typeof payload === "string" ? payload : JSON.stringify(payload);
-  const hash = createHash17("sha1").update(json).digest("hex").slice(0, 16);
+  const hash = createHash18("sha1").update(json).digest("hex").slice(0, 16);
   return `W/"${hash}"`;
 }
 function checkNotModified(req2, res, etag) {
@@ -600253,7 +600617,7 @@ import { homedir as homedir43 } from "node:os";
 import { spawn as spawn26, execSync as execSync57 } from "node:child_process";
 import { mkdirSync as mkdirSync67, writeFileSync as writeFileSync59, readFileSync as readFileSync89, readdirSync as readdirSync36, existsSync as existsSync108, watch as fsWatch3, renameSync as renameSync8, unlinkSync as unlinkSync24 } from "node:fs";
 import { randomBytes as randomBytes23, randomUUID as randomUUID16 } from "node:crypto";
-import { createHash as createHash19 } from "node:crypto";
+import { createHash as createHash20 } from "node:crypto";
 function getVersion3() {
   try {
     const thisDir = dirname36(fileURLToPath17(import.meta.url));
@@ -605894,7 +606258,7 @@ function listScheduledTasks() {
               const schedule = String(t2?.schedule || t2?.cron || t2?.when || "");
               const enabled2 = typeof t2?.enabled === "boolean" ? t2.enabled : true;
               const realId = typeof t2?.id === "string" && t2.id ? t2.id : null;
-              const fallbackId = createHash19("sha1").update(`${file}#${i2}`).digest("hex").slice(0, 16);
+              const fallbackId = createHash20("sha1").update(`${file}#${i2}`).digest("hex").slice(0, 16);
               const uid = realId || fallbackId;
               const key = `${uid}`;
               if (seen.has(key)) return;
@@ -606011,8 +606375,8 @@ function deleteScheduledById(id) {
     if (id) candidates.push(id);
     if (typeof entry?.id === "string" && entry.id && !candidates.includes(entry.id)) candidates.push(entry.id);
     try {
-      const { createHash: createHash20 } = require3("node:crypto");
-      const fallback = createHash20("sha1").update(`${target.file}#${target.index}`).digest("hex").slice(0, 16);
+      const { createHash: createHash21 } = require3("node:crypto");
+      const fallback = createHash21("sha1").update(`${target.file}#${target.index}`).digest("hex").slice(0, 16);
       if (!candidates.includes(fallback)) candidates.push(fallback);
     } catch {
     }
@@ -613679,13 +614043,13 @@ NEW TASK: ${fullInput}`;
       writeContent(() => renderError2(errMsg));
       if (failureStore) {
         try {
-          const { createHash: createHash20 } = await import("node:crypto");
+          const { createHash: createHash21 } = await import("node:crypto");
           failureStore.insert({
             taskId: "",
             sessionId: `${Date.now()}`,
             repoRoot,
             failureType: "runtime-error",
-            fingerprint: createHash20("sha256").update(errMsg.slice(0, 200)).digest("hex").slice(0, 16),
+            fingerprint: createHash21("sha256").update(errMsg.slice(0, 200)).digest("hex").slice(0, 16),
             filePath: null,
             errorMessage: errMsg.slice(0, 500),
             context: null,