pi-codex-tools 0.1.0 → 0.1.2

package/CHANGELOG.md

@@ -6,6 +6,22 @@ This project follows the spirit of [Keep a Changelog](https://keepachangelog.com
 
 ## [Unreleased]
 
+## [0.1.2] - 2026-08-06
+
+### Added
+
+- Stream `apply_patch` progress in the TUI: while a patch is generated the tool now shows a live diff glimpse of the content being written plus a running `+added -removed` tally (and a capped per-file roster for multi-file patches), reusing Pi's shared diff rendering. Moves render the source → destination transition, and the preview is byte/file bounded for responsiveness. Execution behavior is unchanged.
+
+## [0.1.1] - 2026-08-04
+
+### Fixed
+
+- Guard `apply_patch` execution when the active model does not advertise grammar-tool support.
+- Require the Pi runtime grammar-tool contract and fail closed on unsupported filesystem platforms.
+- Preflight repeated file hunks sequentially without rejecting valid Codex patches.
+- Respect `enableInstallTelemetry: false` even when `PI_TELEMETRY` is enabled.
+- Document credential-containing target reads, telemetry controls, runtime requirements, and line-oriented compatibility.
+
 ## [0.1.0] - 2026-08-03
 
 ### Added

package/README.md

@@ -6,9 +6,10 @@ Give grammar-capable OpenAI/Codex models the Codex `apply_patch` tool in Pi with
 
 - **Raw `apply_patch`** — sends Codex's Lark grammar as an OpenAI custom tool, so patches are not JSON-wrapped.
 - **Capability-based activation** — requires `openai-codex-responses` or `openai-responses` plus `model.compat.supportsOpenAIGrammarTools === true`; model names alone are never enough.
-- **Safe local mutation** — patches are limited to 1 MiB, target files to 64 MiB, stay under Pi's current working directory, reject symlink escapes, use descriptor-anchored no-follow operations on Linux/macOS, fail closed elsewhere, preflight all hunks, and serialize writes with Pi's mutation queue.
+- **Safe local mutation** — patches are limited to 1 MiB, target files to 64 MiB, stay under Pi's current working directory, reject symlink escapes, use descriptor-anchored no-follow operations on Linux, fail closed elsewhere, preflight all hunks, and serialize writes with Pi's mutation queue.
 - **Model switching** — supported models replace Pi's `edit` and `write` tools with `apply_patch`; other active tools are preserved. Switching back restores only the file tools that were active before the switch.
 - **Sequential patch calls** — the extension marks patch execution sequential and disables provider-side parallel tool calls when the patch tool is active.
+- **Streaming progress** — while a patch is generated, the TUI shows a live, color-coded glimpse of the content being written (new-file content, or `+`/`-` lines for updates) plus a running `+added -removed` tally and a per-file roster for multi-file patches. It reuses Pi's shared diff rendering and mirrors the built-in `write`/`edit` previews; patch execution is unchanged.
 
 ## Installation
 
@@ -24,7 +25,7 @@ pi -e /path/to/pi-mono/packages/pi-codex-tools
 
 ## Scope decisions
 
-The current Codex source does not define separate `read_file` or `write_file` tools: file inspection is normally done through shell commands and file mutation through `apply_patch`. This package keeps Pi's bounded `read` and `bash` tools, and uses `apply_patch` in place of Pi's `edit` and `write` tools for supported models. Because Pi does not provide Codex's OS-level filesystem sandbox, `apply_patch` runs only on Linux/macOS and fails closed on unsupported platforms.
+The current Codex source does not define separate `read_file` or `write_file` tools: file inspection is normally done through shell commands and file mutation through `apply_patch`. This package keeps Pi's bounded `read` and `bash` tools, and uses `apply_patch` in place of Pi's `edit` and `write` tools for supported models. Because Pi does not provide Codex's OS-level filesystem sandbox, `apply_patch` runs only on Linux and fails closed on unsupported platforms. It also requires a Pi model runtime that advertises `compat.supportsOpenAIGrammarTools`; older runtimes leave the tool inactive.
 
 | Codex surface | Decision |
 | --- | --- |
@@ -48,6 +49,8 @@ These choices are based on the Codex tool specifications in `codex-rs/core/src/t
 
 These behaviors intentionally match Codex `apply_patch`.
 
+The provider contract is runtime-specific: use Pi 0.83.0 or newer for OpenAI grammar-tool support. For a manual smoke test, start Pi with this extension and a model that advertises `supportsOpenAIGrammarTools`, then verify that a file change appears as an `apply_patch` call and not as `edit`, `write`, or `bash`.
+
 ## Development
 
 ```bash
@@ -56,7 +59,7 @@ npm test -w packages/pi-codex-tools
 npm run -w packages/pi-codex-tools pack:dry-run
 ```
 
-Install/update telemetry can be disabled with `PI_OFFLINE=1` or `PI_TELEMETRY=0`.
+Install/update telemetry is disabled in CI and can be disabled with `PI_OFFLINE=1`, `PI_TELEMETRY=0` or `PI_TELEMETRY=false`, or Pi's `enableInstallTelemetry: false` setting. See [SECURITY.md](./SECURITY.md).
 
 ## License
 

package/SECURITY.md

@@ -19,8 +19,8 @@ Report privately through [GitHub Security Advisories](https://github.com/jvm/pi-
 
 Pi extensions execute with the same permissions as the local user running Pi. Review installed extensions and only install packages from sources you trust.
 
-`apply_patch` does not access the network or credentials. It validates paths beneath the current working directory, rejects symlink paths and symlinked parents, limits patch input to 1 MiB and target-file reads to 64 MiB, preflights file changes before writing, and uses root-anchored descriptor-based no-follow operations on Linux/macOS. It fails closed on unsupported platforms because Pi does not provide Codex's OS-level filesystem sandbox. A failure during a multi-file write can still leave earlier files changed; callers should use version control and review the resulting diff.
+`apply_patch` does not access the network or credential APIs. It can read credential-containing files when a patch targets them. It validates paths beneath the current working directory, rejects symlink paths and symlinked parents, limits patch input to 1 MiB and target-file reads to 64 MiB, preflights file changes before writing, and uses root-anchored descriptor-based no-follow operations on Linux. It fails closed on unsupported platforms because Pi does not provide Codex's OS-level filesystem sandbox. A failure during a multi-file write can still leave earlier files changed; callers should use version control and review the resulting diff.
 
 The package reads the current provider/model capability flags only to select tools. It does not log prompts, patches, file contents, credentials, auth headers, or provider responses.
 
-Install/update telemetry is best effort and can be disabled with `PI_OFFLINE=1`, `PI_TELEMETRY=0`, CI detection, or Pi's `enableInstallTelemetry: false` setting. It sends only package/version and runtime metadata through `@mocito/install-telemetry`.
+Install/update telemetry is best effort and can be disabled with `PI_OFFLINE=1`, `PI_TELEMETRY=0`, `PI_TELEMETRY=false`, CI detection, or Pi's `enableInstallTelemetry: false` setting. Through `@mocito/install-telemetry`, it sends the package name and version as HTTPS URL query parameters and adds `process.platform`, the runtime name/version, and `process.arch` to the `User-Agent`. These fields are not intended to identify a host, user, repository, or path; no prompts, patches, file contents, credentials, auth headers, or provider responses are sent.

package/extensions/index.ts

@@ -1,8 +1,22 @@
+import { Container, Text } from "@earendil-works/pi-tui";
+import type { Component } from "@earendil-works/pi-tui";
 import type { ExtensionAPI, ExtensionContext } from "@earendil-works/pi-coding-agent";
 import { reportInstallTelemetry } from "../src/install-telemetry.js";
 import { applyPatch, APPLY_PATCH_GRAMMAR, MAX_PATCH_BYTES } from "../src/apply-patch.js";
 import { createFreeformInputSchema, createOpenAILarkSampling, type OpenAIGrammarSampling } from "../src/grammar.js";
 import { supportsOpenAIGrammarTools } from "../src/model-support.js";
+import { formatApplyPatchCallText, formatApplyPatchResultText } from "../src/patch-preview.js";
+
+class ApplyPatchCallComponent extends Text {
+  cache?: { key: string; text: string };
+  constructor() {
+    super("", 0, 0);
+  }
+}
+
+function readPatchArg(args: unknown): string {
+  return typeof (args as { patch?: unknown })?.patch === "string" ? (args as { patch: string }).patch : "";
+}
 
 const APPLY_PATCH = "apply_patch";
 const EDIT = "edit";
@@ -35,7 +49,35 @@ export default function piCodexTools(pi: ExtensionAPI): void {
     parameters: APPLY_PATCH_PARAMETERS,
     constrainedSampling: createOpenAILarkSampling(APPLY_PATCH_GRAMMAR),
     executionMode: "sequential",
+    renderCall(args, theme, context) {
+      const component =
+        context.lastComponent instanceof ApplyPatchCallComponent ? context.lastComponent : new ApplyPatchCallComponent();
+      const rawPatch = readPatchArg(args);
+      const key = `${context.expanded ? "1" : "0"}:${rawPatch}`;
+      if (!component.cache || component.cache.key !== key) {
+        component.cache = {
+          key,
+          text: formatApplyPatchCallText(rawPatch, theme, { expanded: context.expanded }),
+        };
+      }
+      component.setText(component.cache.text);
+      return component as Component;
+    },
+    renderResult(result, _options, theme, context) {
+      const text = formatApplyPatchResultText(result, theme, context.isError);
+      if (!text) {
+        const component = (context.lastComponent ?? new Container()) as Container;
+        component.clear();
+        return component as Component;
+      }
+      const component = context.lastComponent instanceof Text ? context.lastComponent : new Text("", 0, 0);
+      component.setText(text);
+      return component as Component;
+    },
     async execute(_toolCallId, rawParams, signal, _onUpdate, ctx) {
+      if (!supportsOpenAIGrammarTools(ctx.model)) {
+        throw new Error("apply_patch is only available for OpenAI models that advertise grammar-tool support.");
+      }
       const patch = (rawParams as { patch?: unknown }).patch;
       if (typeof patch !== "string") throw new Error("apply_patch requires raw patch text.");
       const result = await applyPatch(patch, { cwd: ctx.cwd, signal });

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "pi-codex-tools",
-  "version": "0.1.0",
+  "version": "0.1.2",
   "description": "Codex-compatible apply_patch tooling for Pi's grammar-capable OpenAI models.",
   "type": "module",
   "license": "Apache-2.0",
@@ -52,14 +52,16 @@
   "peerDependencies": {
     "@earendil-works/pi-ai": "*",
     "@earendil-works/pi-coding-agent": "*",
+    "@earendil-works/pi-tui": "*",
     "typebox": "*"
   },
   "devDependencies": {
-    "@earendil-works/pi-ai": "^0.80.10",
-    "@earendil-works/pi-coding-agent": "^0.80.10",
-    "@types/node": "^26.1.1",
+    "@earendil-works/pi-ai": "^0.82.1",
+    "@earendil-works/pi-coding-agent": "^0.82.1",
+    "@earendil-works/pi-tui": "^0.82.1",
+    "@types/node": "^26.1.2",
     "tsx": "^4.23.1",
-    "typebox": "^1.3.6",
+    "typebox": "^1.3.8",
     "typescript": "^7.0.2"
   },
   "publishConfig": {

package/src/apply-patch.ts

@@ -10,7 +10,7 @@ export const MAX_PATCH_HUNKS = 1_000;
 export const MAX_TARGET_FILE_BYTES = 64 * 1024 * 1024;
 
 const O_NOFOLLOW = constants.O_NOFOLLOW ?? 0;
-const SECURE_FD_DIRECTORY = process.platform === "linux" ? "/proc/self/fd" : process.platform === "darwin" ? "/dev/fd" : undefined;
+const SECURE_FD_DIRECTORY = process.platform === "linux" ? "/proc/self/fd" : undefined;
 const SECURE_FILESYSTEM_SUPPORTED = SECURE_FD_DIRECTORY !== undefined && O_NOFOLLOW !== 0;
 const SECURE_DIRECTORY_FLAGS = constants.O_RDONLY | O_NOFOLLOW | (constants.O_DIRECTORY ?? 0) | (constants.O_NONBLOCK ?? 0);
 const SECURE_READ_FLAGS = constants.O_RDONLY | O_NOFOLLOW | (constants.O_NONBLOCK ?? 0);
@@ -225,6 +225,7 @@ type PlannedOperation =
   | { kind: "update"; path: string; displayPath: string; moveTo?: string; moveDisplayPath?: string; chunkGroups: UpdateChunk[][]; content: string };
 
 type SafePath = { absolute: string; exists: boolean; isDirectory: boolean; isFile: boolean };
+type VirtualFile = Omit<SafePath, "absolute"> & { content?: string };
 
 export async function applyPatch(input: string, options: ApplyPatchOptions): Promise<ApplyPatchResult> {
   requireSecureFilesystem();
@@ -271,77 +272,108 @@ export async function applyPatch(input: string, options: ApplyPatchOptions): Pro
 
 async function planOperations(hunks: ApplyPatchHunk[], root: string, rootHandle: FileHandle, signal?: AbortSignal): Promise<PlannedOperation[]> {
   const operations: PlannedOperation[] = [];
-  const byPath = new Map<string, PlannedOperation>();
-  const occupied = new Set<string>();
+  const virtualFiles = new Map<string, VirtualFile>();
+
+  const getVirtualFile = async (rawPath: string): Promise<{ absolute: string; file: VirtualFile }> => {
+    const absolute = resolvePatchPath(rawPath, root);
+    const existing = virtualFiles.get(absolute);
+    if (existing) return { absolute, file: existing };
+    const safe = await safePath(rawPath, root, signal);
+    const file: VirtualFile = {
+      exists: safe.exists,
+      isDirectory: safe.isDirectory,
+      isFile: safe.isFile,
+    };
+    virtualFiles.set(absolute, file);
+    return { absolute, file };
+  };
+
+  const getVirtualContent = async (absolute: string, file: VirtualFile): Promise<string> => {
+    if (!file.exists || !file.isFile) throw new Error(`Cannot read non-file '${absolute}'.`);
+    if (file.content === undefined) file.content = await readSecureFile(rootHandle, root, absolute, signal);
+    return file.content;
+  };
 
   for (const hunk of hunks) {
     throwIfAborted(signal);
-    const source = await safePath(hunk.path, root, signal);
-    if (occupied.has(source.absolute) && !(hunk.kind === "update" && byPath.get(source.absolute)?.kind === "update")) {
-      throw new Error(`Patch addresses '${hunk.path}' more than once.`);
-    }
+    const source = await getVirtualFile(hunk.path);
 
     if (hunk.kind === "add") {
-      if (source.isDirectory || (source.exists && !source.isFile)) throw new Error(`Cannot add file over non-file '${hunk.path}'.`);
-      const operation: PlannedOperation = { kind: "add", path: source.absolute, displayPath: displayPath(root, source.absolute, hunk.path), content: hunk.content };
-      operations.push(operation);
-      byPath.set(source.absolute, operation);
-      occupied.add(source.absolute);
+      if (source.file.isDirectory || (source.file.exists && !source.file.isFile)) {
+        throw new Error(`Cannot add file over non-file '${hunk.path}'.`);
+      }
+      source.file.exists = true;
+      source.file.isDirectory = false;
+      source.file.isFile = true;
+      source.file.content = hunk.content;
+      operations.push({
+        kind: "add",
+        path: source.absolute,
+        displayPath: displayPath(root, source.absolute, hunk.path),
+        content: hunk.content,
+      });
       continue;
     }
 
     if (hunk.kind === "delete") {
-      if (!source.exists) throw new Error(`Cannot delete missing file '${hunk.path}'.`);
-      if (source.isDirectory || !source.isFile) throw new Error(`Cannot delete non-file '${hunk.path}'.`);
-      const operation: PlannedOperation = { kind: "delete", path: source.absolute, displayPath: displayPath(root, source.absolute, hunk.path) };
-      operations.push(operation);
-      byPath.set(source.absolute, operation);
-      occupied.add(source.absolute);
+      if (!source.file.exists) throw new Error(`Cannot delete missing file '${hunk.path}'.`);
+      if (source.file.isDirectory || !source.file.isFile) throw new Error(`Cannot delete non-file '${hunk.path}'.`);
+      operations.push({ kind: "delete", path: source.absolute, displayPath: displayPath(root, source.absolute, hunk.path) });
+      source.file.exists = false;
+      source.file.content = undefined;
       continue;
     }
 
-    if (!source.exists) throw new Error(`Cannot update missing file '${hunk.path}'.`);
-    if (source.isDirectory || !source.isFile) throw new Error(`Cannot update non-file '${hunk.path}'.`);
-    const original = await readSecureFile(rootHandle, root, source.absolute, signal);
-    const moveTo = hunk.moveTo ? (await safePath(hunk.moveTo, root, signal)).absolute : undefined;
+    if (!source.file.exists) throw new Error(`Cannot update missing file '${hunk.path}'.`);
+    if (source.file.isDirectory || !source.file.isFile) throw new Error(`Cannot update non-file '${hunk.path}'.`);
+    const original = await getVirtualContent(source.absolute, source.file);
+    const moveTo = hunk.moveTo ? resolvePatchPath(hunk.moveTo, root) : undefined;
     if (moveTo === source.absolute) throw new Error(`Cannot move '${hunk.path}' onto itself.`);
+
+    let destination: { absolute: string; file: VirtualFile } | undefined;
     if (moveTo) {
-      const destination = await safePath(hunk.moveTo!, root, signal);
-      if (destination.isDirectory || (destination.exists && !destination.isFile)) throw new Error(`Cannot move file over non-file '${hunk.moveTo}'.`);
-      if (occupied.has(moveTo)) throw new Error(`Patch addresses move destination '${hunk.moveTo}' more than once.`);
-      occupied.add(moveTo);
+      destination = await getVirtualFile(hunk.moveTo!);
+      if (destination.file.isDirectory || (destination.file.exists && !destination.file.isFile)) {
+        throw new Error(`Cannot move file over non-file '${hunk.moveTo}'.`);
+      }
     }
 
-    const existing = byPath.get(source.absolute);
-    if (existing?.kind === "update") {
-      if (existing.moveTo || moveTo) throw new Error(`A file can only be moved once in a patch: '${hunk.path}'.`);
-      existing.chunkGroups.push(hunk.chunks);
-      existing.content = existing.chunkGroups.reduce(
-        (content, chunks) => applyUpdateContent(content, chunks, hunk.path),
-        original,
-      );
+    const content = applyUpdateContent(original, hunk.chunks, hunk.path);
+    if (destination) {
+      operations.push({
+        kind: "update",
+        path: source.absolute,
+        displayPath: displayPath(root, source.absolute, hunk.path),
+        moveTo: moveTo!,
+        moveDisplayPath: displayPath(root, moveTo!, hunk.moveTo!),
+        chunkGroups: [[...hunk.chunks]],
+        content,
+      });
+      source.file.exists = false;
+      source.file.content = undefined;
+      destination.file.exists = true;
+      destination.file.isDirectory = false;
+      destination.file.isFile = true;
+      destination.file.content = content;
       continue;
     }
 
-    const operation: PlannedOperation = {
-      kind: "update",
-      path: source.absolute,
-      displayPath: displayPath(root, source.absolute, hunk.path),
-      moveTo,
-      moveDisplayPath: moveTo ? displayPath(root, moveTo, hunk.moveTo!) : undefined,
-      chunkGroups: [[...hunk.chunks]],
-      content: applyUpdateContent(original, hunk.chunks, hunk.path),
-    };
-    operations.push(operation);
-    byPath.set(source.absolute, operation);
-    occupied.add(source.absolute);
-  }
-
-  for (const operation of operations) {
-    if (operation.kind === "update" && operation.moveTo && byPath.has(operation.moveTo)) {
-      throw new Error(`Move destination '${operation.moveDisplayPath}' is also changed by this patch.`);
+    const previous = operations.at(-1);
+    if (previous?.kind === "update" && previous.path === source.absolute && !previous.moveTo) {
+      previous.content = content;
+      previous.chunkGroups.push([...hunk.chunks]);
+    } else {
+      operations.push({
+        kind: "update",
+        path: source.absolute,
+        displayPath: displayPath(root, source.absolute, hunk.path),
+        chunkGroups: [[...hunk.chunks]],
+        content,
+      });
     }
+    source.file.content = content;
   }
+
   return operations;
 }
 

package/src/install-telemetry.ts

@@ -44,14 +44,15 @@ function isPresentEnvFlag(value: string | undefined): boolean {
   return normalized !== "0" && normalized !== "false" && normalized !== "no";
 }
 
-function isInstallTelemetryEnabled(): boolean {
-  if (isTruthyEnvFlag(process.env.CI)) return false;
-  if (CI_ENVIRONMENT_VARIABLES.some((name) => isPresentEnvFlag(process.env[name]))) return false;
-  if (isTruthyEnvFlag(process.env.PI_OFFLINE)) return false;
-  if (process.env.PI_TELEMETRY !== undefined) return isTruthyEnvFlag(process.env.PI_TELEMETRY);
+export function isInstallTelemetryEnabled(env: NodeJS.ProcessEnv = process.env, settingsPath = join(getAgentDir(), "settings.json")): boolean {
+  if (isTruthyEnvFlag(env.CI)) return false;
+  if (CI_ENVIRONMENT_VARIABLES.some((name) => isPresentEnvFlag(env[name]))) return false;
+  if (isTruthyEnvFlag(env.PI_OFFLINE)) return false;
 
-  const settings = readJsonFile(join(getAgentDir(), "settings.json")) as SettingsDocument;
-  return settings.enableInstallTelemetry !== false;
+  const settings = readJsonFile(settingsPath) as SettingsDocument;
+  if (settings.enableInstallTelemetry === false) return false;
+  if (env.PI_TELEMETRY !== undefined) return isTruthyEnvFlag(env.PI_TELEMETRY);
+  return true;
 }
 
 function getPackageVersion(): string {

package/src/patch-preview.ts

@@ -0,0 +1,265 @@
+// Streaming preview rendering for the apply_patch tool.
+//
+// The strict parser in apply-patch.ts rejects incomplete input, but the patch arrives as a
+// growing prefix while the model generates it. This module scans that partial text tolerantly
+// (it never throws) to drive a live, write-style glimpse of the content plus a running
+// added/removed tally. It reuses Pi's shared `renderDiff` primitive for +/- coloring, so the
+// preview stays consistent with the built-in `edit` tool's diff preview.
+import { keyHint, type Theme } from "@earendil-works/pi-coding-agent";
+
+const FILE_ADD = "*** Add File: ";
+const FILE_DELETE = "*** Delete File: ";
+const FILE_UPDATE = "*** Update File: ";
+const MOVE_TO = "*** Move to: ";
+const END_OF_FILE = "*** End of File";
+const BEGIN_PATCH = "*** Begin Patch";
+const END_PATCH = "*** End Patch";
+
+/**
+ * Preview bounds. The patch itself is capped at apply time (1 MiB / 1000 hunks), but the TUI
+ * re-renders on every streaming token, so the preview scanner bails earlier to keep the UI
+ * responsive and its retained output bounded (see AGENTS.md: "bound tool output").
+ */
+const PREVIEW_LINES_COLLAPSED = 10;
+const PREVIEW_LINES_EXPANDED = 500;
+const MAX_PREVIEW_BYTES = 256 * 1024;
+const MAX_PREVIEW_FILES = 500;
+/** Cap a single rendered glimpse line so minified/generated content cannot flood the TUI. */
+const PREVIEW_LINE_CHARS = 200;
+
+export type PatchLineType = "add" | "del" | "ctx";
+
+export interface PatchPreviewLine {
+  type: PatchLineType;
+  text: string;
+}
+
+export interface PatchPreviewFile {
+  kind: "add" | "update" | "delete";
+  path: string;
+  /** Destination for an update that carries `*** Move to:`; execution writes this path and deletes `path`. */
+  moveTo?: string;
+  /** Diff lines for the file. Empty for deletes (the patch carries no content for them). */
+  lines: PatchPreviewLine[];
+}
+
+export interface PatchPreview {
+  files: PatchPreviewFile[];
+  totalAdded: number;
+  totalRemoved: number;
+  /** True when the preview stopped early because the patch exceeded a preview bound. */
+  truncated: boolean;
+}
+
+/**
+ * Tolerantly scan a (possibly incomplete) apply_patch body into a preview.
+ *
+ * The grammar is line-oriented, so a partial buffer is always a prefix of valid lines. We walk
+ * every line and accumulate per-file diff lines and running counts; malformed/unknown lines are
+ * ignored rather than thrown on. Each call re-scans the current buffer from scratch, so there is
+ * no accumulation drift across streaming deltas.
+ */
+export function scanPatchPreview(input: string): PatchPreview {
+  // Bound per-render work: cap the bytes we split and walk so a large patch (up to 1 MiB at apply
+  // time) cannot make streaming re-renders quadratic. Anything past the cap is reported truncated.
+  const capped = input.length > MAX_PREVIEW_BYTES + 1 ? input.slice(0, MAX_PREVIEW_BYTES + 1) : input;
+  const lines = capped.split("\n");
+
+  const filesByPath = new Map<string, PatchPreviewFile>();
+  const files: PatchPreviewFile[] = []; // first-seen order
+  let totalAdded = 0;
+  let totalRemoved = 0;
+  let current: PatchPreviewFile | undefined;
+  let truncated = input.length > capped.length;
+
+  for (const raw of lines) {
+    const line = raw.replace(/\r$/, "");
+    // The terminator ends the patch; trailing text must not change totals or the active file.
+    if (line === END_PATCH) break;
+    if (line === "" || line === BEGIN_PATCH || line === END_OF_FILE) continue;
+
+    if (line.startsWith(MOVE_TO)) {
+      // A move renames the current update's file; preserve the destination so the preview can
+      // show the source -> destination transition (execution deletes source, writes destination).
+      if (current) current.moveTo = line.slice(MOVE_TO.length).trim();
+      continue;
+    }
+
+    if (line.startsWith(FILE_ADD) || line.startsWith(FILE_DELETE) || line.startsWith(FILE_UPDATE)) {
+      const kind: PatchPreviewFile["kind"] = line.startsWith(FILE_ADD)
+        ? "add"
+        : line.startsWith(FILE_DELETE)
+          ? "delete"
+          : "update";
+      const prefix = kind === "add" ? FILE_ADD : kind === "delete" ? FILE_DELETE : FILE_UPDATE;
+      const path = line.slice(prefix.length);
+      const existing = filesByPath.get(path);
+      if (existing) {
+        // Execution coalesces multiple hunks for the same path; the preview must too, otherwise
+        // the roster shows duplicate rows and an inflated file count.
+        current = existing;
+        continue;
+      }
+      if (files.length >= MAX_PREVIEW_FILES) {
+        truncated = true;
+        break;
+      }
+      current = { kind, path, lines: [] };
+      filesByPath.set(path, current);
+      files.push(current);
+      continue;
+    }
+
+    // Lines before the first file header (or inside a delete) carry no preview content.
+    if (!current || current.kind === "delete") continue;
+
+    if (line === "@@" || line.startsWith("@@ ")) continue; // chunk context marker
+
+    if (line.startsWith("+")) {
+      current.lines.push({ type: "add", text: line.slice(1) });
+      totalAdded++;
+    } else if (line.startsWith("-")) {
+      current.lines.push({ type: "del", text: line.slice(1) });
+      totalRemoved++;
+    } else {
+      // Context line (" text") or a bare "" inside a chunk.
+      current.lines.push({ type: "ctx", text: line.startsWith(" ") ? line.slice(1) : line });
+    }
+  }
+
+  return { files, totalAdded, totalRemoved, truncated };
+}
+
+function fileStatusMark(file: PatchPreviewFile): string {
+  switch (file.kind) {
+    case "add":
+      return "A";
+    case "delete":
+      return "D";
+    default:
+      return "M";
+  }
+}
+
+function fileCountsLabel(file: PatchPreviewFile, theme: Theme): string {
+  if (file.kind === "delete") return "";
+  const added = theme.fg("toolDiffAdded", `+${countLines(file, "add")}`);
+  const removed = file.kind === "update" ? ` ${theme.fg("toolDiffRemoved", `-${countLines(file, "del")}`)}` : "";
+  return `${added}${removed}`;
+}
+
+function fileMarkLabel(file: PatchPreviewFile, theme: Theme): string {
+  const mark = file.kind === "add" ? "toolDiffAdded" : file.kind === "delete" ? "toolDiffRemoved" : "warning";
+  return theme.fg(mark, fileStatusMark(file));
+}
+
+function filePathLabel(file: PatchPreviewFile, theme: Theme): string {
+  const path = theme.fg("accent", truncatePath(file.path));
+  return file.moveTo ? `${path} ${theme.fg("muted", "->")} ${theme.fg("accent", truncatePath(file.moveTo))}` : path;
+}
+
+function formatFileRosterLine(file: PatchPreviewFile, theme: Theme): string {
+  const counts = fileCountsLabel(file, theme);
+  return `${fileMarkLabel(file, theme)} ${filePathLabel(file, theme)}${counts ? ` ${counts}` : ""}`;
+}
+
+function countLines(file: PatchPreviewFile, type: PatchLineType): number {
+  let n = 0;
+  for (const line of file.lines) if (line.type === type) n++;
+  return n;
+}
+
+/**
+ * Render one glimpse line directly. apply_patch has no real line numbers (only `@@` anchors), so
+ * we color +/- lines without fabricating numbers, and cap each line's width.
+ */
+function renderGlimpseLine(line: PatchPreviewLine, theme: Theme): string {
+  const sign = line.type === "add" ? "+" : line.type === "del" ? "-" : " ";
+  const body = line.text.length > PREVIEW_LINE_CHARS ? `${line.text.slice(0, PREVIEW_LINE_CHARS)}…` : line.text;
+  const styled = `${sign}${body}`;
+  if (line.type === "add") return theme.fg("toolDiffAdded", styled);
+  if (line.type === "del") return theme.fg("toolDiffRemoved", styled);
+  return theme.fg("toolDiffContext", styled);
+}
+
+function focusFile(files: PatchPreviewFile[]): PatchPreviewFile | undefined {
+  // Prefer the most recent file that has visible content to glimpse; fall back to the last file.
+  for (let index = files.length - 1; index >= 0; index--) {
+    const file = files[index];
+    if (file.kind !== "delete" && file.lines.length > 0) return file;
+  }
+  return files.at(-1);
+}
+
+/** Cap a rendered path: keep the tail (filename/extension) since that is the meaningful part. */
+function truncatePath(path: string): string {
+  return path.length > PREVIEW_LINE_CHARS ? `…${path.slice(path.length - PREVIEW_LINE_CHARS + 1)}` : path;
+}
+
+/** Format the live apply_patch tool-call text (streaming glimpse + tally). */
+export function formatApplyPatchCallText(rawPatch: string, theme: Theme, options: { expanded: boolean }): string {
+  const preview = scanPatchPreview(rawPatch);
+  const title = theme.fg("toolTitle", theme.bold("apply_patch"));
+  if (preview.files.length === 0) return title;
+
+  let text: string;
+  if (preview.files.length === 1) {
+    // Single file: lead with the status mark + path (like the built-in `write` tool, with the
+    // file's A/M/D status so a delete is distinguishable from an empty in-progress update).
+    const file = preview.files[0];
+    const counts = fileCountsLabel(file, theme);
+    text = `${title} ${fileMarkLabel(file, theme)} ${filePathLabel(file, theme)}${counts ? ` ${counts}` : ""}`;
+  } else {
+    const tally = `${theme.fg("toolDiffAdded", `+${preview.totalAdded}`)} ${theme.fg("toolDiffRemoved", `-${preview.totalRemoved}`)} ${theme.fg("muted", `· ${preview.files.length} files`)}`;
+    // Cap the collapsed roster so a multi-hundred-file patch cannot re-render hundreds of lines
+    // every token; expansion reveals the rest (up to the preview file cap).
+    const maxRoster = options.expanded ? preview.files.length : PREVIEW_LINES_COLLAPSED;
+    const visible = preview.files.slice(0, maxRoster);
+    let roster = visible.map((file) => formatFileRosterLine(file, theme)).join("\n");
+    const hidden = preview.files.length - visible.length;
+    if (hidden > 0) roster += `\n${theme.fg("muted", `… ${hidden} more files`)}`;
+    text = `${title}  ${tally}\n${roster}`;
+  }
+
+  const focus = focusFile(preview.files);
+  if (focus && focus.kind !== "delete" && focus.lines.length > 0) {
+    // Even expanded, cap rendered output so a huge file cannot stall the terminal.
+    const maxLines = options.expanded ? PREVIEW_LINES_EXPANDED : PREVIEW_LINES_COLLAPSED;
+    const visible = focus.lines.slice(0, maxLines);
+    const remaining = focus.lines.length - maxLines;
+    let body = visible.map((line) => renderGlimpseLine(line, theme)).join("\n");
+    if (remaining > 0) {
+      body += theme.fg(
+        "muted",
+        `\n... (${remaining} more lines, ${focus.lines.length} total, ${keyHint("app.tools.expand", "to expand")})`,
+      );
+    }
+    // In multi-file previews the focused file may be hidden behind the capped roster, so label the
+    // glimpse with its own row (the single-file header already carries the path).
+    const label = preview.files.length > 1 ? `${formatFileRosterLine(focus, theme)}\n` : "";
+    text += `\n\n${label}${body}`;
+  }
+
+  if (preview.truncated) {
+    text += `\n${theme.fg("muted", "(large patch; preview truncated)")}`;
+  }
+  return text;
+}
+
+/**
+ * Format the apply_patch tool-result text. On success the streaming glimpse already conveys the
+ * change, so nothing is added (mirrors the built-in `write` tool). On error the message is shown.
+ */
+export function formatApplyPatchResultText(
+  result: { content: Array<{ type: string; text?: string }> },
+  theme: Theme,
+  isError: boolean,
+): string | undefined {
+  if (!isError) return undefined;
+  const output = result.content
+    .filter((part) => part.type === "text")
+    .map((part) => part.text ?? "")
+    .join("\n")
+    .trim();
+  return output ? theme.fg("error", output) : undefined;
+}