praxis-agent 0.55.2 → 0.56.0

package/dist/cli-runtime.js

@@ -19,7 +19,7 @@ import { isSessionId } from './core/session.js';
 import { assertNativeDataPlane, resolveDataPlane, resolveDataPlaneRoot, resolveDataPlanePaths, } from './persistence/data-plane.js';
 import { loadNativeContextResources, loadNativeSettings, loadNativeSharedResources, } from './persistence/native-resources.js';
 import { resolveProjectIdentity } from './platform/project-identity.js';
-import { AgentRunCancelledError, } from './core/runtime.js';
+import { AgentRunCancelledError, ModelProviderError, } from './core/runtime.js';
 import { persistTuiPermissionUpdates } from './cli/tui/permission-settings.js';
 import { loadClaudeReleaseNotes } from './cli/tui/release-notes.js';
 import { canonicalClaudeCostModelName, formatCostSummary, } from './cli/tui/cost-summary.js';
@@ -65,7 +65,8 @@ import { WorkspaceContext } from './application/session-worktree.js';
 import { launchTmuxWorktree } from './platform/tmux-worktree.js';
 import { claudeSandboxRuntime } from './sandbox/claude-sandbox-runtime.js';
 import { nativeSandboxTempDirectory, loadClaudeSandboxSettings, } from './sandbox/claude-sandbox-settings.js';
-import { createErrorResult, createSuccessResult, isHeadlessCostCommand, matchHeadlessColorCommand, parseCliInvocation, readStreamJsonMessages, StreamJsonOutput, } from './cli/protocol.js';
+import { createErrorResult, createSuccessResult, isHeadlessCostCommand, matchHeadlessColorCommand, parseCliInvocation, projectProtocolTimings, readStreamJsonMessages, StreamJsonOutput, } from './cli/protocol.js';
+import { isDirectProcessSigint } from './cli/process-signal.js';
 import { executeProviderAuthCommand } from './cli/provider-auth-command.js';
 import { describeClaudePlugin, initClaudePlugin, installClaudePlugin, loadClaudePlugins, readPluginRegistry, setClaudePluginEnabled, uninstallClaudePlugin, updateClaudePlugin, validateClaudePlugin, } from './plugins/claude-plugin-runtime.js';
 import { addClaudeMarketplace, disableAllNativePlugins, installClaudeMarketplacePlugin, listClaudeMarketplaceAvailablePlugins, listNativePluginRecords, readClaudeKnownMarketplaces, removeClaudeMarketplace, setNativePluginEnabled, saveClaudePluginConfig, uninstallNativePlugin, updateClaudeMarketplace, updateNativePlugin, validateClaudeMarketplace, } from './plugins/claude-plugin-marketplace.js';
@@ -1795,7 +1796,7 @@ const createDefaultService = async ({ eventSink, requireProvider, hooksOnly = fa
         const filteredTools = new FilteredToolRegistry(extensionAndLspTools, {
             ...(cli.tools === undefined
                 ? simpleMode
-                    ? { tools: ['Bash', 'Edit', 'Read'] }
+                    ? { tools: ['Bash', 'Edit', 'ApplyPatch', 'Read'] }
                     : {}
                 : { tools: selectedBaseTools ?? [] }),
             disallowedTools: cli.disallowedTools,
@@ -5412,6 +5413,9 @@ async function execute(argv, io, dependencies, signal) {
     }
     let streamOutput;
     let jsonModelTurns = 0;
+    let jsonRequestAt;
+    let jsonOutputAt;
+    let jsonTerminalReason;
     const pendingEvents = [];
     let streamIterator;
     let firstStreamMessage;
@@ -5615,10 +5619,10 @@ async function execute(argv, io, dependencies, signal) {
             output.init();
             output.sink({ type: 'text-delta', delta: text });
             output.sink({ type: 'usage', usage: result.usage });
-            output.result(result, startedAt);
+            output.result(result, startedAt, { localCommand: true });
         }
         else if (outputFormat === 'json' || invocation.legacyJson) {
-            writeJson(io, createSuccessResult(result, info, startedAt, 0));
+            writeJson(io, createSuccessResult(result, info, startedAt, 0, { localCommand: true }));
         }
         else {
             io.stdout(`${text}\n`);
@@ -5663,6 +5667,20 @@ async function execute(argv, io, dependencies, signal) {
                 ? (event) => {
                     if (event.type === 'state' && event.state === 'awaiting-model') {
                         jsonModelTurns += 1;
+                        if (jsonRequestAt === undefined)
+                            jsonRequestAt = Date.now();
+                    }
+                    if (event.type === 'terminal') {
+                        jsonTerminalReason = event.reason;
+                    }
+                    if ((event.type === 'text-delta' ||
+                        event.type === 'thinking-start' ||
+                        event.type === 'thinking-delta' ||
+                        event.type === 'thinking-signature-delta' ||
+                        event.type === 'thinking-stop' ||
+                        event.type === 'tool-call') &&
+                        jsonOutputAt === undefined) {
+                        jsonOutputAt = Date.now();
                     }
                     if (event.type === 'warning') {
                         io.stderr(`Warning: ${redactSensitiveText(event.message, sensitiveEnvironmentValues(process.env))}\n`);
@@ -5816,8 +5834,12 @@ async function execute(argv, io, dependencies, signal) {
             currentTurnAbort = streamIterator ? turnAbort : undefined;
             const runSignal = streamIterator ? turnAbort.signal : signal;
             await ensureCostBaseline(activeSessionId);
+            jsonModelTurns = 0;
+            jsonRequestAt = undefined;
+            jsonOutputAt = undefined;
+            jsonTerminalReason = undefined;
             if (streamOutput) {
-                streamOutput.init();
+                streamOutput.init(startedAt);
                 if (isFirstTurn) {
                     for (const event of pendingEvents)
                         streamOutput.sink(event);
@@ -5902,10 +5924,20 @@ async function execute(argv, io, dependencies, signal) {
                     throw error;
                 }
                 const message = redactSensitiveText(error instanceof Error ? error.message : String(error), sensitiveEnvironmentValues(process.env));
+                const providerApiError = error instanceof ModelProviderError &&
+                    (error.status !== undefined || error.kind === 'api_error');
+                const errorContext = providerApiError
+                    ? {
+                        providerApiError: true,
+                        apiErrorStatus: error instanceof ModelProviderError
+                            ? (error.status ?? null)
+                            : null,
+                    }
+                    : {};
                 if (streamOutput)
-                    streamOutput.error(message, startedAt);
+                    streamOutput.error(message, startedAt, errorContext);
                 else if (outputFormat === 'json') {
-                    writeJson(io, createErrorResult(message, activeSessionId, startedAt, jsonModelTurns));
+                    writeJson(io, createErrorResult(message, activeSessionId, startedAt, jsonModelTurns, errorContext));
                 }
                 else {
                     if (currentTurnAbort === turnAbort)
@@ -5925,11 +5957,17 @@ async function execute(argv, io, dependencies, signal) {
                 if (localCommand) {
                     streamOutput.syntheticAssistant(result.text);
                 }
-                streamOutput.result(result, startedAt);
+                streamOutput.result(result, startedAt, { localCommand });
             }
             else if (outputFormat === 'json') {
                 const resultRuntimeInfo = service.runtimeInfo?.() ?? runtimeInfo;
-                writeJson(io, createSuccessResult(result, resultRuntimeInfo, startedAt, localCommand ? 0 : Math.max(1, jsonModelTurns)));
+                writeJson(io, createSuccessResult(result, resultRuntimeInfo, startedAt, localCommand ? 0 : Math.max(1, jsonModelTurns), {
+                    localCommand,
+                    ...(jsonTerminalReason === undefined
+                        ? {}
+                        : { stopReason: jsonTerminalReason }),
+                    ...projectProtocolTimings(startedAt, jsonRequestAt, jsonOutputAt),
+                }));
             }
             else if (outputFormat !== 'text')
                 writeJson(io, { type: 'result', ...result });
@@ -5979,6 +6017,15 @@ export async function run(argv, io = consoleIO, dependencies = createDefaultDepe
     }
     catch (error) {
         if (isCancellation(error, signal)) {
+            if (isDirectProcessSigint(signal)) {
+                try {
+                    if (parseCliInvocation(argv).print)
+                        return 0;
+                }
+                catch {
+                    // Preserve the ordinary cancellation boundary when parsing fails.
+                }
+            }
             io.stderr('Praxis run cancelled.\n');
             return 130;
         }

package/dist/cli.js

@@ -2,6 +2,7 @@
 import { realpathSync } from 'node:fs';
 import { createRequire } from 'node:module';
 import { fileURLToPath, pathToFileURL } from 'node:url';
+import { DIRECT_PROCESS_SIGINT } from './cli/process-signal.js';
 export { parseContextEnvironment, parseProviderEnvironment, } from './providers/environment.js';
 const VERSION = createRequire(import.meta.url)('../package.json').version;
 export async function run(argv, io, dependencies, signal) {
@@ -36,14 +37,15 @@ function isDirectExecution(moduleUrl, argvPath) {
 }
 if (isDirectExecution(import.meta.url, process.argv[1])) {
     const controller = new AbortController();
+    const cancelWithSigint = () => controller.abort(DIRECT_PROCESS_SIGINT);
     const cancel = () => controller.abort();
-    process.on('SIGINT', cancel);
+    process.on('SIGINT', cancelWithSigint);
     process.on('SIGTERM', cancel);
     try {
         process.exitCode = await run(process.argv.slice(2), undefined, undefined, controller.signal);
     }
     finally {
-        process.removeListener('SIGINT', cancel);
+        process.removeListener('SIGINT', cancelWithSigint);
         process.removeListener('SIGTERM', cancel);
     }
 }

package/dist/evals/eval-contract.js

@@ -10,7 +10,15 @@ function toolName(rule) {
 }
 function gatedTool(rule) {
     const name = toolName(rule);
-    return (['Bash', 'Write', 'Edit', 'NotebookEdit', 'WebFetch', 'WebSearch'].includes(name) || name.startsWith('mcp__'));
+    return ([
+        'Bash',
+        'Write',
+        'Edit',
+        'ApplyPatch',
+        'NotebookEdit',
+        'WebFetch',
+        'WebSearch',
+    ].includes(name) || name.startsWith('mcp__'));
 }
 function grants(requested, allowed) {
     const name = toolName(requested);

package/dist/mcp/praxis-mcp-server.js

@@ -247,6 +247,7 @@ class PraxisMcpRuntime {
     sensitiveValues = sensitiveEnvironmentValues(process.env);
     toolRegistryPromise;
     closed = false;
+    messageHistory = [];
     constructor(options) {
         this.options = options;
         this.localTools = new LocalToolRegistry({
@@ -261,6 +262,7 @@ class PraxisMcpRuntime {
             'Bash',
             'Read',
             'Edit',
+            'ApplyPatch',
             'Write',
             'NotebookEdit',
             'Glob',
@@ -307,10 +309,20 @@ class PraxisMcpRuntime {
         const call = { id: randomUUID(), name, input };
         const context = {
             cwd: this.options.cwd,
+            messages: [...this.messageHistory],
             ...(signal ? { signal } : {}),
         };
         const prepared = await registry.prepare(call, context);
-        return registry.execute(prepared, context);
+        const result = await registry.execute(prepared, context);
+        if (name === 'Read' && !result.isError) {
+            this.messageHistory.push({ role: 'assistant', content: '', toolCalls: [prepared] }, {
+                role: 'tool',
+                toolCallId: prepared.id,
+                content: result.content,
+                isError: false,
+            });
+        }
+        return result;
     }
     async close() {
         if (this.closed)

package/dist/permissions/claude-permission-resolver.js

@@ -3,7 +3,8 @@ import { homedir } from 'node:os';
 import { realpath } from 'node:fs/promises';
 import { resolveProjectIdentity } from '../platform/project-identity.js';
 import { sanitizeProjectPath } from '../platform/project-path-key.js';
-import { annotateAutoModePermissionOutcome, annotatePermissionDecision, } from '../core/runtime.js';
+import { annotateAutoModePermissionOutcome, annotatePermissionDecision, autoModePermissionOutcome, permissionDecisionSource, } from '../core/runtime.js';
+import { parseApplyPatchInput } from '../tools/apply-patch.js';
 import { loadClaudeAutoModeConfig, } from './claude-auto-classifier.js';
 import { analyzeBashCommands, validateBashSemantics } from './bash-ast.js';
 import { shellPermissionMatchCandidates } from './bash-normalization.js';
@@ -30,6 +31,7 @@ const DEFAULT_BEHAVIOR = {
     Grep: 'allow',
     Write: 'ask',
     Edit: 'ask',
+    ApplyPatch: 'ask',
     NotebookEdit: 'ask',
     Glob: 'allow',
     LSP: 'allow',
@@ -50,6 +52,7 @@ const FILE_TOOLS = new Set([
     'Read',
     'Write',
     'Edit',
+    'ApplyPatch',
     'NotebookEdit',
     'Glob',
     'Grep',
@@ -206,6 +209,13 @@ function permissionTarget(call) {
             ? call.input.notebook_path
             : null;
     }
+    if (call.name === 'ApplyPatch') {
+        const edits = call.input.edits;
+        const first = Array.isArray(edits) ? edits[0] : undefined;
+        return isRecord(first) && typeof first.file_path === 'string'
+            ? first.file_path
+            : null;
+    }
     if (call.name === 'WebFetch') {
         return typeof call.input.url === 'string' ? call.input.url : null;
     }
@@ -217,7 +227,7 @@ function permissionTarget(call) {
 function matchesRule(rule, call, cwd, homeDirectory) {
     const toolMatches = rule.toolName === call.name ||
         (rule.toolName === 'Edit' &&
-            ['Edit', 'Write', 'NotebookEdit'].includes(call.name)) ||
+            ['Edit', 'Write', 'NotebookEdit', 'ApplyPatch'].includes(call.name)) ||
         (rule.toolName === 'Read' && ['Read', 'Glob', 'Grep'].includes(call.name));
     if (!toolMatches)
         return false;
@@ -400,6 +410,131 @@ export class ClaudePermissionResolver {
             ...call,
             input: { ...call.input, command: subcommand },
         });
+        if (call.name === 'ApplyPatch') {
+            const edits = parseApplyPatchInput(call.input);
+            const originalEdits = context?.originalCall?.name === 'ApplyPatch'
+                ? parseApplyPatchInput(context.originalCall.input)
+                : edits;
+            if (originalEdits.length !== edits.length) {
+                throw new Error('ApplyPatch original and canonical edits must match');
+            }
+            const targetInputs = edits.map((edit, index) => {
+                const originalEdit = originalEdits[index];
+                if (!originalEdit) {
+                    throw new Error('ApplyPatch original and canonical edits must match');
+                }
+                const targetCall = {
+                    ...call,
+                    name: 'Edit',
+                    input: { ...edit },
+                };
+                const applyView = {
+                    ...call,
+                    input: { edits: [{ ...edit }] },
+                };
+                const originalView = {
+                    ...call,
+                    input: { edits: [{ ...originalEdit }] },
+                };
+                const originalTargetCall = {
+                    ...targetCall,
+                    input: { ...originalEdit },
+                };
+                return {
+                    edit,
+                    originalEdit,
+                    targetCall,
+                    applyView,
+                    originalView,
+                    originalTargetCall,
+                };
+            });
+            const directDenied = targetInputs.flatMap(({ applyView, originalView, targetCall, originalTargetCall }) => effectiveRules('deny').filter((rule) => matchesRule(rule, applyView, cwd, this.homeDirectory) ||
+                matchesRule(rule, originalView, cwd, this.homeDirectory) ||
+                matchesRule(rule, targetCall, cwd, this.homeDirectory) ||
+                matchesRule(rule, originalTargetCall, cwd, this.homeDirectory)))[0];
+            if (directDenied) {
+                const suffix = directDenied.pattern === null ? '' : `(${directDenied.pattern})`;
+                return annotatePermissionDecision({
+                    behavior: 'deny',
+                    reason: `Denied by Claude permission rule ${directDenied.toolName}${suffix}`,
+                }, 'rule');
+            }
+            const targetDecisions = await Promise.all(targetInputs.map(async ({ originalEdit, targetCall, applyView, originalView }) => {
+                if (permissionMode === 'plan') {
+                    return annotatePermissionDecision({
+                        behavior: 'deny',
+                        reason: 'Cannot use ApplyPatch while in plan mode',
+                    }, 'mode');
+                }
+                const directAsked = effectiveRules('ask').find((rule) => matchesRule(rule, applyView, cwd, this.homeDirectory) ||
+                    matchesRule(rule, originalView, cwd, this.homeDirectory));
+                if (directAsked)
+                    return this.askDecision(targetCall, cwd, permissionMode, context, 'rule', undefined, true);
+                const directAllowed = effectiveRules('allow').find((rule) => matchesRule(rule, applyView, cwd, this.homeDirectory) ||
+                    matchesRule(rule, originalView, cwd, this.homeDirectory));
+                const resolved = await this.resolve(targetCall, context
+                    ? {
+                        ...context,
+                        originalCall: {
+                            ...call,
+                            input: { edits: [{ ...originalEdit }] },
+                        },
+                    }
+                    : { cwd, originalCall: originalView });
+                if (resolved.behavior === 'allow' &&
+                    permissionDecisionSource(resolved) === 'default' &&
+                    !directAllowed) {
+                    return this.askDecision(targetCall, cwd, permissionMode, context
+                        ? {
+                            ...context,
+                            originalCall: {
+                                ...call,
+                                input: { edits: [{ ...originalEdit }] },
+                            },
+                        }
+                        : { cwd, originalCall: originalView }, 'default', undefined, true);
+                }
+                if (directAllowed &&
+                    resolved.behavior === 'ask' &&
+                    resolved.reason !==
+                        'Path is outside allowed working directories' &&
+                    (permissionMode !== 'auto' || !this.shouldClassify(targetCall))) {
+                    return annotatePermissionDecision({ behavior: 'allow' }, 'rule');
+                }
+                return resolved;
+            }));
+            const deniedDecision = targetDecisions.find((decision) => decision.behavior === 'deny');
+            if (deniedDecision)
+                return deniedDecision;
+            const askedDecisions = targetDecisions.filter((decision) => decision.behavior === 'ask');
+            if (askedDecisions.length > 0) {
+                const first = askedDecisions[0];
+                if (!first)
+                    throw new Error('ApplyPatch permission decision is missing');
+                const suggestions = [
+                    ...new Map(askedDecisions
+                        .flatMap((decision) => decision.behavior === 'ask' ? (decision.suggestions ?? []) : [])
+                        .map((suggestion) => [JSON.stringify(suggestion), suggestion])).values(),
+                ];
+                const aggregate = {
+                    ...first,
+                    suggestions,
+                };
+                const source = permissionDecisionSource(first);
+                const annotated = source
+                    ? annotatePermissionDecision(aggregate, source)
+                    : aggregate;
+                const outcome = autoModePermissionOutcome(first);
+                return outcome
+                    ? annotateAutoModePermissionOutcome(annotated, outcome)
+                    : annotated;
+            }
+            const allowed = targetDecisions.find((decision) => decision.behavior === 'allow');
+            if (allowed)
+                return allowed;
+            throw new Error('ApplyPatch permission resolution produced no decision');
+        }
         const denied = matchingRule('deny') ??
             subcommands
                 .map((subcommand) => matchingRule('deny', subcommandCall(subcommand)))
@@ -414,6 +549,7 @@ export class ClaudePermissionResolver {
         if (permissionMode === 'plan' &&
             (call.name === 'Write' ||
                 call.name === 'Edit' ||
+                call.name === 'ApplyPatch' ||
                 call.name === 'NotebookEdit')) {
             return annotatePermissionDecision({
                 behavior: 'deny',
@@ -558,7 +694,7 @@ export class ClaudePermissionResolver {
                     absolutePath,
                 ]),
             ];
-            const write = ['Write', 'Edit', 'NotebookEdit'].includes(call.name);
+            const write = ['Write', 'Edit', 'ApplyPatch', 'NotebookEdit'].includes(call.name);
             const internalRoots = write
                 ? internalEditableRoots
                 : internalReadableRoots;
@@ -585,6 +721,7 @@ export class ClaudePermissionResolver {
         if (permissionMode === 'acceptEdits' &&
             (call.name === 'Write' ||
                 call.name === 'Edit' ||
+                call.name === 'ApplyPatch' ||
                 call.name === 'NotebookEdit')) {
             return annotatePermissionDecision({ behavior: 'allow' }, 'mode');
         }
@@ -651,7 +788,12 @@ export class ClaudePermissionResolver {
                             FILE_TOOLS.has(call.name) &&
                             permissionTarget(call)
                             ? {
-                                suggestions: filePermissionSuggestions(permissionTarget(call) ?? cwd, cwd, ['Write', 'Edit', 'NotebookEdit'].includes(call.name)
+                                suggestions: filePermissionSuggestions(permissionTarget(call) ?? cwd, cwd, [
+                                    'Write',
+                                    'Edit',
+                                    'ApplyPatch',
+                                    'NotebookEdit',
+                                ].includes(call.name)
                                     ? 'write'
                                     : 'read', (effectivePermissionMode(context?.permissionUpdates) ??
                                     permissionMode), false),
@@ -664,6 +806,7 @@ export class ClaudePermissionResolver {
             return true;
         if (call.name === 'Write' ||
             call.name === 'Edit' ||
+            call.name === 'ApplyPatch' ||
             call.name === 'NotebookEdit' ||
             call.name === 'WebFetch' ||
             call.name === 'WebSearch' ||

package/dist/platform/atomic-write.js

@@ -8,6 +8,8 @@ export async function writeFileAtomically(filePath, content, options = {}) {
         const handle = await open(temporary, 'wx', options.mode ?? 0o600);
         try {
             await handle.writeFile(content);
+            if (options.mode !== undefined)
+                await handle.chmod(options.mode);
             await handle.sync();
         }
         finally {

package/dist/tools/apply-patch.d.ts

@@ -0,0 +1,25 @@
+import type { ModelToolDefinition } from '../core/runtime.js';
+export declare const APPLY_PATCH_MAX_EDITS = 32;
+export declare const APPLY_PATCH_MAX_FILES = 8;
+export declare const APPLY_PATCH_MAX_INPUT_BYTES: number;
+export interface ApplyPatchEdit {
+    file_path: string;
+    old_string: string;
+    new_string: string;
+}
+export interface ApplyPatchPlanFile {
+    filePath: string;
+    before: string;
+    after: string;
+    linesAdded: number;
+    linesRemoved: number;
+}
+export interface ApplyPatchPlan {
+    files: readonly ApplyPatchPlanFile[];
+    linesAdded: number;
+    linesRemoved: number;
+}
+export declare const APPLY_PATCH_DEFINITION: ModelToolDefinition;
+export declare function parseApplyPatchInput(input: unknown): ApplyPatchEdit[];
+export declare function planApplyPatch(edits: readonly ApplyPatchEdit[], sources: ReadonlyMap<string, string>, maxFileBytes: number): ApplyPatchPlan;
+//# sourceMappingURL=apply-patch.d.ts.map

package/dist/tools/apply-patch.js

@@ -0,0 +1,128 @@
+import { countLineChanges } from './line-changes.js';
+export const APPLY_PATCH_MAX_EDITS = 32;
+export const APPLY_PATCH_MAX_FILES = 8;
+export const APPLY_PATCH_MAX_INPUT_BYTES = 256 * 1024;
+export const APPLY_PATCH_DEFINITION = {
+    name: 'ApplyPatch',
+    description: 'Applies a bounded batch of exact, unique string replacements to existing files.',
+    inputSchema: {
+        $schema: 'https://json-schema.org/draft/2020-12/schema',
+        type: 'object',
+        properties: {
+            edits: {
+                type: 'array',
+                minItems: 1,
+                maxItems: APPLY_PATCH_MAX_EDITS,
+                items: {
+                    type: 'object',
+                    properties: {
+                        file_path: { type: 'string', minLength: 1 },
+                        old_string: { type: 'string', minLength: 1 },
+                        new_string: { type: 'string' },
+                    },
+                    required: ['file_path', 'old_string', 'new_string'],
+                    additionalProperties: false,
+                },
+            },
+        },
+        required: ['edits'],
+        additionalProperties: false,
+    },
+};
+function objectInput(input, label) {
+    if (!input || typeof input !== 'object' || Array.isArray(input))
+        throw new Error(`${label} must be an object`);
+    return input;
+}
+function exactKeys(input, keys) {
+    const unexpected = Object.keys(input).find((key) => !keys.includes(key));
+    if (unexpected)
+        throw new Error(`Unexpected ApplyPatch field: ${unexpected}`);
+}
+function stringInput(input, key, nonEmpty = false) {
+    const value = input[key];
+    if (typeof value !== 'string' || (nonEmpty && value.length === 0))
+        throw new Error(`${key} must be ${nonEmpty ? 'a non-empty ' : 'a '}string`);
+    return value;
+}
+export function parseApplyPatchInput(input) {
+    let encoded;
+    try {
+        encoded = JSON.stringify(input);
+    }
+    catch {
+        throw new Error('ApplyPatch input must be JSON-serializable');
+    }
+    if (encoded === undefined)
+        throw new Error('ApplyPatch input must be JSON-serializable');
+    if (Buffer.byteLength(encoded, 'utf8') > APPLY_PATCH_MAX_INPUT_BYTES)
+        throw new Error('ApplyPatch input exceeds 256 KiB');
+    const object = objectInput(input, 'ApplyPatch input');
+    exactKeys(object, ['edits']);
+    const rawEdits = object.edits;
+    if (!Array.isArray(rawEdits) ||
+        rawEdits.length < 1 ||
+        rawEdits.length > APPLY_PATCH_MAX_EDITS)
+        throw new Error('ApplyPatch edits must contain 1 to 32 operations');
+    return rawEdits.map((raw, index) => {
+        const item = objectInput(raw, `ApplyPatch edits[${index}]`);
+        exactKeys(item, ['file_path', 'old_string', 'new_string']);
+        const edit = {
+            file_path: stringInput(item, 'file_path', true),
+            old_string: stringInput(item, 'old_string', true),
+            new_string: stringInput(item, 'new_string'),
+        };
+        if (edit.old_string === edit.new_string)
+            throw new Error('new_string must differ from old_string');
+        return edit;
+    });
+}
+export function planApplyPatch(edits, sources, maxFileBytes) {
+    if (edits.length < 1 || edits.length > APPLY_PATCH_MAX_EDITS)
+        throw new Error('ApplyPatch edits must contain 1 to 32 operations');
+    if (new Set(edits.map((edit) => edit.file_path)).size > APPLY_PATCH_MAX_FILES)
+        throw new Error('ApplyPatch may touch at most 8 files');
+    const snapshots = new Map();
+    for (const edit of edits) {
+        if (!edit.old_string)
+            throw new Error('old_string must be non-empty');
+        if (edit.old_string === edit.new_string)
+            throw new Error('new_string must differ from old_string');
+        if (!snapshots.has(edit.file_path)) {
+            const source = sources.get(edit.file_path);
+            if (source === undefined)
+                throw new Error(`ApplyPatch source is missing: ${edit.file_path}`);
+            snapshots.set(edit.file_path, source);
+        }
+    }
+    for (const edit of edits) {
+        const source = snapshots.get(edit.file_path);
+        if (source === undefined)
+            throw new Error(`ApplyPatch source is missing: ${edit.file_path}`);
+        const first = source.indexOf(edit.old_string);
+        if (first < 0)
+            throw new Error('old_string was not found');
+        const second = source.indexOf(edit.old_string, first + edit.old_string.length);
+        if (second >= 0)
+            throw new Error('old_string must match exactly once');
+        const after = source.slice(0, first) +
+            edit.new_string +
+            source.slice(first + edit.old_string.length);
+        if (Buffer.byteLength(after, 'utf8') > maxFileBytes)
+            throw new Error(`Edited content exceeds ${maxFileBytes} bytes`);
+        snapshots.set(edit.file_path, after);
+    }
+    const files = [...snapshots].map(([filePath, after]) => {
+        const before = sources.get(filePath);
+        if (before === undefined)
+            throw new Error(`ApplyPatch source is missing: ${filePath}`);
+        const changes = countLineChanges(before, after);
+        return { filePath, before, after, ...changes };
+    });
+    return {
+        files,
+        linesAdded: files.reduce((total, file) => total + file.linesAdded, 0),
+        linesRemoved: files.reduce((total, file) => total + file.linesRemoved, 0),
+    };
+}
+//# sourceMappingURL=apply-patch.js.map

package/dist/tools/claude-interactive-tools.js

@@ -1,6 +1,7 @@
 import { mkdir, readFile, realpath } from 'node:fs/promises';
 import { basename, dirname, join, resolve } from 'node:path';
 import { resolveToolSchedulingPolicy } from '../core/tool-scheduling-policy.js';
+import { parseApplyPatchInput } from './apply-patch.js';
 const ASK_USER_QUESTION = {
     name: 'AskUserQuestion',
     description: "Use this tool only when you are blocked on a decision that is genuinely the user's to make: one you cannot resolve from the request, the code, or sensible defaults. Users can always provide custom text. Use multiSelect for non-exclusive choices. In plan mode, use this tool to clarify requirements before ExitPlanMode; do not use it to request plan approval.",
@@ -354,6 +355,13 @@ Use AskUserQuestion for decisions that genuinely require the user. Write a compl
             typeof call.input.file_path === 'string') {
             return this.resolvePlanFile(state, call, context);
         }
+        if (state.mode === 'plan' && call.name === 'ApplyPatch') {
+            const edits = parseApplyPatchInput(call.input);
+            if ((await Promise.all(edits.map((edit) => this.isPlanFileForState(state, edit.file_path)))).every(Boolean)) {
+                return { behavior: 'allow' };
+            }
+            return this.resolver(state.mode).resolve(call, context);
+        }
         const decision = await this.resolver(this.planPermissionMode(sessionId)).resolve(call, context);
         return this.applyRetainedPrompts(state, call, decision);
     }

package/dist/tools/local-tools.d.ts

@@ -92,6 +92,7 @@ export declare class LocalToolRegistry implements ToolRegistry {
     private readPdf;
     private createPdfOutputDirectory;
     private write;
+    private applyPatch;
     private edit;
     private notebookEdit;
     private glob;