praxis-agent 0.55.3 → 0.56.0

package/README.md

@@ -172,8 +172,9 @@ troubleshooting. Run `praxis --help` for the authoritative command surface.
   deterministic resize-aware URL/form elicitation rendering, and measured
   context budgets; print mode,
   structured JSON/JSONL, context compaction, tool loops, and bounded execution.
-- **Built-in tools** — read, write, edit, glob, search, shell, notebook, PDF,
-  image, web, scheduled prompts, workflows, and worktrees.
+- **Built-in tools** — read, write, edit, `ApplyPatch` for bounded ordered exact
+  multi-file replacements, glob, search, shell, notebook, PDF, image, web,
+  scheduled prompts, workflows, and worktrees.
 - **Shell lifecycle** — foreground Bash allows up to 10 minutes and carries a
   validated final working directory across calls in the same session without
   leaking state across sessions or overriding an explicit `/cd`.

package/dist/application/session-service.js

@@ -51,6 +51,7 @@ import { completeMeteredModelRequest } from './metered-model-completion.js';
 import { SessionMemoryController, SessionMemoryStateError, SessionMemoryStore, } from './session-memory.js';
 import { FilteredToolRegistry } from '../tools/filtered-tool-registry.js';
 import { DeferredToolCatalog } from '../tools/deferred-tool-catalog.js';
+import { parseApplyPatchInput } from '../tools/apply-patch.js';
 import { ClaudeCapabilityToolRegistry, resolveClaudeToolCapabilities, } from '../tools/claude-capabilities.js';
 import { generateToolUseSummary } from './tool-use-summary.js';
 import { ClaudeUserMessageToolRegistry, } from '../tools/claude-user-message.js';
@@ -88,6 +89,21 @@ function mainAgentToolNames(tools, agent) {
         .map(({ name }) => name)
         .filter((name) => (!requested || requested.has(name)) && !disallowed.has(name));
 }
+function mutationPaths(call) {
+    if (call.name === 'ApplyPatch')
+        return parseApplyPatchInput(call.input).map((edit) => edit.file_path);
+    if (call.name === 'Write' || call.name === 'Edit') {
+        return typeof call.input.file_path === 'string'
+            ? [call.input.file_path]
+            : [];
+    }
+    if (call.name === 'NotebookEdit') {
+        return typeof call.input.notebook_path === 'string'
+            ? [call.input.notebook_path]
+            : [];
+    }
+    return [];
+}
 function isSessionCandidateError(error) {
     return (error instanceof NativeTranscriptIndexCandidateError ||
         ['ENOENT', 'ENOTDIR', 'ELOOP'].includes(error.code ?? ''));
@@ -1168,6 +1184,7 @@ export class ClaudeSessionService {
             'Read',
             'LSP',
             'Edit',
+            'ApplyPatch',
             'Write',
             'NotebookEdit',
             'WebFetch',
@@ -2869,16 +2886,18 @@ export class ClaudeSessionService {
                         }),
                         prepare: (call, context) => interactiveMessageTools.prepare(call, context),
                         execute: async (call, context) => {
-                            const path = call.name === 'Write' || call.name === 'Edit'
-                                ? call.input.file_path
-                                : call.name === 'NotebookEdit'
-                                    ? call.input.notebook_path
-                                    : undefined;
-                            if (typeof path !== 'string') {
+                            const paths = mutationPaths(call);
+                            if (paths.length === 0) {
                                 return interactiveMessageTools.execute(call, context);
                             }
-                            if ((call.name === 'Write' || call.name === 'Edit') &&
-                                (await this.options.interactiveTools?.isPlanFile(sessionId, path))) {
+                            const historyPaths = call.name === 'Write' ||
+                                call.name === 'Edit' ||
+                                call.name === 'ApplyPatch'
+                                ? (await Promise.all(paths.map(async (path) => (await this.options.interactiveTools?.isPlanFile(sessionId, path))
+                                    ? null
+                                    : path))).filter((path) => path !== null)
+                                : paths;
+                            if (historyPaths.length === 0) {
                                 return interactiveMessageTools.execute(call, context);
                             }
                             const snapshotMessageId = currentPromptId ??
@@ -2888,21 +2907,31 @@ export class ClaudeSessionService {
                             if (!snapshotMessageId || !assistantMessageId) {
                                 throw new Error('Claude file history could not link tool call');
                             }
-                            const prepared = await fileHistory.prepareMutation(projectionSnapshot().entries, snapshotMessageId, path);
+                            const preparedMutations = [];
+                            try {
+                                for (const path of [...new Set(historyPaths)])
+                                    preparedMutations.push(await fileHistory.prepareMutation(projectionSnapshot().entries, snapshotMessageId, path));
+                            }
+                            catch (error) {
+                                await Promise.all(preparedMutations.map((mutation) => mutation.rollback()));
+                                throw error;
+                            }
                             let result;
                             try {
                                 result = await interactiveMessageTools.execute(call, context);
                             }
                             catch (error) {
-                                await prepared.rollback();
+                                await Promise.all(preparedMutations.map((mutation) => mutation.rollback()));
                                 throw error;
                             }
                             if (result.isError) {
-                                await prepared.rollback();
+                                await Promise.all(preparedMutations.map((mutation) => mutation.rollback()));
                                 return result;
                             }
-                            const entry = prepared.commit(assistantMessageId);
-                            if (entry) {
+                            const entries = preparedMutations
+                                .map((mutation) => mutation.commit(assistantMessageId))
+                                .filter((entry) => entry !== null);
+                            for (const entry of entries) {
                                 await persistence.commit({
                                     kind: 'messages',
                                     input: {
@@ -3105,7 +3134,9 @@ export class ClaudeSessionService {
                                 if (call.name === 'Read') {
                                     turnMemory.recordRead(path);
                                 }
-                                else if (call.name === 'Write' || call.name === 'Edit') {
+                                else if (call.name === 'Write' ||
+                                    call.name === 'Edit' ||
+                                    call.name === 'ApplyPatch') {
                                     projectMemoryMaintained = true;
                                 }
                             }
@@ -3117,6 +3148,14 @@ export class ClaudeSessionService {
                                     }
                                 }
                             }
+                            else if (call.name === 'ApplyPatch') {
+                                for (const accessedPath of toolResult.accessedPaths ?? []) {
+                                    const resolvedAccessedPath = resolve(this.activeCwd(), accessedPath);
+                                    if (isPathWithin(this.options.projectMemoryDirectory, resolvedAccessedPath)) {
+                                        projectMemoryMaintained = true;
+                                    }
+                                }
+                            }
                         }
                         if (toolResult.isError ||
                             call.name !== 'Read' ||

package/dist/application/subagent-service.js

@@ -299,6 +299,7 @@ const BACKGROUND_AGENT_TOOLS = new Set([
     'Glob',
     'Bash',
     'Edit',
+    'ApplyPatch',
     'Write',
     'NotebookEdit',
     'Skill',

package/dist/cli/interactive.js

@@ -1885,7 +1885,7 @@ export function InteractiveApp({ dataPlane = resolveDataPlane(), configRoot: sup
                 }
                 break;
             case 'tool-call':
-                if (['Edit', 'Write', 'NotebookEdit'].includes(event.call.name))
+                if (['Edit', 'Write', 'ApplyPatch', 'NotebookEdit'].includes(event.call.name))
                     turnMutatedFilesRef.current = true;
                 permissionCallsRef.current.set(event.call.id, event.call);
                 append({
@@ -4055,7 +4055,7 @@ export function InteractiveApp({ dataPlane = resolveDataPlane(), configRoot: sup
                 }
                 if (permission.kind === 'tool' &&
                     selected.action === 'allow-session-edits') {
-                    for (const rule of ['Write', 'Edit', 'NotebookEdit']) {
+                    for (const rule of ['Write', 'Edit', 'ApplyPatch', 'NotebookEdit']) {
                         if (!immediatePermissionRulesRef.current.includes(rule))
                             immediatePermissionRulesRef.current.push(rule);
                     }

package/dist/cli/process-signal.d.ts

@@ -0,0 +1,3 @@
+export declare const DIRECT_PROCESS_SIGINT: unique symbol;
+export declare function isDirectProcessSigint(signal: AbortSignal | undefined): boolean;
+//# sourceMappingURL=process-signal.d.ts.map

package/dist/cli/process-signal.js

@@ -0,0 +1,5 @@
+export const DIRECT_PROCESS_SIGINT = Symbol('praxis.direct-process-sigint');
+export function isDirectProcessSigint(signal) {
+    return signal?.aborted === true && signal.reason === DIRECT_PROCESS_SIGINT;
+}
+//# sourceMappingURL=process-signal.js.map

package/dist/cli/protocol.d.ts

@@ -323,6 +323,7 @@ export declare class StreamJsonOutput {
     private finishPartial;
     private finishPartialTail;
     private flushAssistant;
+    private flushPartialOnly;
     private finishTurn;
 }
 //# sourceMappingURL=protocol.d.ts.map

package/dist/cli/protocol.js

@@ -1929,9 +1929,16 @@ export class StreamJsonOutput {
                 event.state === 'completed' ||
                 event.state === 'cancelled' ||
                 event.state === 'failed') {
-                if (event.state !== 'failed' ||
-                    this.pendingFailureMessage === undefined)
+                const shouldFlush = event.state === 'cancelled'
+                    ? this.turnText.length > 0 ||
+                        this.turnThinking.length > 0 ||
+                        this.turnCalls.length > 0
+                    : event.state !== 'failed' ||
+                        this.pendingFailureMessage === undefined;
+                if (shouldFlush)
                     this.flushAssistant();
+                else if (event.state === 'cancelled')
+                    this.flushPartialOnly();
                 if (event.state === 'awaiting-permission')
                     this.writeSessionState('requires_action');
             }
@@ -2492,6 +2499,18 @@ export class StreamJsonOutput {
         });
         this.finishPartialTail();
     }
+    flushPartialOnly() {
+        if (!this.includePartialMessages ||
+            this.assistantFlushed ||
+            this.partialEvents.length === 0)
+            return;
+        this.assistantFlushed = true;
+        this.writePartialMessageStart();
+        for (const event of this.partialEvents)
+            this.write(event);
+        this.partialEvents = [];
+        this.pendingPartialStop = undefined;
+    }
     finishTurn() {
         this.flushAssistant();
         this.turnActive = false;

package/dist/cli-runtime.js

@@ -66,6 +66,7 @@ import { launchTmuxWorktree } from './platform/tmux-worktree.js';
 import { claudeSandboxRuntime } from './sandbox/claude-sandbox-runtime.js';
 import { nativeSandboxTempDirectory, loadClaudeSandboxSettings, } from './sandbox/claude-sandbox-settings.js';
 import { createErrorResult, createSuccessResult, isHeadlessCostCommand, matchHeadlessColorCommand, parseCliInvocation, projectProtocolTimings, readStreamJsonMessages, StreamJsonOutput, } from './cli/protocol.js';
+import { isDirectProcessSigint } from './cli/process-signal.js';
 import { executeProviderAuthCommand } from './cli/provider-auth-command.js';
 import { describeClaudePlugin, initClaudePlugin, installClaudePlugin, loadClaudePlugins, readPluginRegistry, setClaudePluginEnabled, uninstallClaudePlugin, updateClaudePlugin, validateClaudePlugin, } from './plugins/claude-plugin-runtime.js';
 import { addClaudeMarketplace, disableAllNativePlugins, installClaudeMarketplacePlugin, listClaudeMarketplaceAvailablePlugins, listNativePluginRecords, readClaudeKnownMarketplaces, removeClaudeMarketplace, setNativePluginEnabled, saveClaudePluginConfig, uninstallNativePlugin, updateClaudeMarketplace, updateNativePlugin, validateClaudeMarketplace, } from './plugins/claude-plugin-marketplace.js';
@@ -1795,7 +1796,7 @@ const createDefaultService = async ({ eventSink, requireProvider, hooksOnly = fa
         const filteredTools = new FilteredToolRegistry(extensionAndLspTools, {
             ...(cli.tools === undefined
                 ? simpleMode
-                    ? { tools: ['Bash', 'Edit', 'Read'] }
+                    ? { tools: ['Bash', 'Edit', 'ApplyPatch', 'Read'] }
                     : {}
                 : { tools: selectedBaseTools ?? [] }),
             disallowedTools: cli.disallowedTools,
@@ -6016,6 +6017,15 @@ export async function run(argv, io = consoleIO, dependencies = createDefaultDepe
     }
     catch (error) {
         if (isCancellation(error, signal)) {
+            if (isDirectProcessSigint(signal)) {
+                try {
+                    if (parseCliInvocation(argv).print)
+                        return 0;
+                }
+                catch {
+                    // Preserve the ordinary cancellation boundary when parsing fails.
+                }
+            }
             io.stderr('Praxis run cancelled.\n');
             return 130;
         }

package/dist/cli.js

@@ -2,6 +2,7 @@
 import { realpathSync } from 'node:fs';
 import { createRequire } from 'node:module';
 import { fileURLToPath, pathToFileURL } from 'node:url';
+import { DIRECT_PROCESS_SIGINT } from './cli/process-signal.js';
 export { parseContextEnvironment, parseProviderEnvironment, } from './providers/environment.js';
 const VERSION = createRequire(import.meta.url)('../package.json').version;
 export async function run(argv, io, dependencies, signal) {
@@ -36,14 +37,15 @@ function isDirectExecution(moduleUrl, argvPath) {
 }
 if (isDirectExecution(import.meta.url, process.argv[1])) {
     const controller = new AbortController();
+    const cancelWithSigint = () => controller.abort(DIRECT_PROCESS_SIGINT);
     const cancel = () => controller.abort();
-    process.on('SIGINT', cancel);
+    process.on('SIGINT', cancelWithSigint);
     process.on('SIGTERM', cancel);
     try {
         process.exitCode = await run(process.argv.slice(2), undefined, undefined, controller.signal);
     }
     finally {
-        process.removeListener('SIGINT', cancel);
+        process.removeListener('SIGINT', cancelWithSigint);
         process.removeListener('SIGTERM', cancel);
     }
 }

package/dist/evals/eval-contract.js

@@ -10,7 +10,15 @@ function toolName(rule) {
 }
 function gatedTool(rule) {
     const name = toolName(rule);
-    return (['Bash', 'Write', 'Edit', 'NotebookEdit', 'WebFetch', 'WebSearch'].includes(name) || name.startsWith('mcp__'));
+    return ([
+        'Bash',
+        'Write',
+        'Edit',
+        'ApplyPatch',
+        'NotebookEdit',
+        'WebFetch',
+        'WebSearch',
+    ].includes(name) || name.startsWith('mcp__'));
 }
 function grants(requested, allowed) {
     const name = toolName(requested);

package/dist/mcp/praxis-mcp-server.js

@@ -247,6 +247,7 @@ class PraxisMcpRuntime {
     sensitiveValues = sensitiveEnvironmentValues(process.env);
     toolRegistryPromise;
     closed = false;
+    messageHistory = [];
     constructor(options) {
         this.options = options;
         this.localTools = new LocalToolRegistry({
@@ -261,6 +262,7 @@ class PraxisMcpRuntime {
             'Bash',
             'Read',
             'Edit',
+            'ApplyPatch',
             'Write',
             'NotebookEdit',
             'Glob',
@@ -307,10 +309,20 @@ class PraxisMcpRuntime {
         const call = { id: randomUUID(), name, input };
         const context = {
             cwd: this.options.cwd,
+            messages: [...this.messageHistory],
             ...(signal ? { signal } : {}),
         };
         const prepared = await registry.prepare(call, context);
-        return registry.execute(prepared, context);
+        const result = await registry.execute(prepared, context);
+        if (name === 'Read' && !result.isError) {
+            this.messageHistory.push({ role: 'assistant', content: '', toolCalls: [prepared] }, {
+                role: 'tool',
+                toolCallId: prepared.id,
+                content: result.content,
+                isError: false,
+            });
+        }
+        return result;
     }
     async close() {
         if (this.closed)

package/dist/permissions/claude-permission-resolver.js

@@ -3,7 +3,8 @@ import { homedir } from 'node:os';
 import { realpath } from 'node:fs/promises';
 import { resolveProjectIdentity } from '../platform/project-identity.js';
 import { sanitizeProjectPath } from '../platform/project-path-key.js';
-import { annotateAutoModePermissionOutcome, annotatePermissionDecision, } from '../core/runtime.js';
+import { annotateAutoModePermissionOutcome, annotatePermissionDecision, autoModePermissionOutcome, permissionDecisionSource, } from '../core/runtime.js';
+import { parseApplyPatchInput } from '../tools/apply-patch.js';
 import { loadClaudeAutoModeConfig, } from './claude-auto-classifier.js';
 import { analyzeBashCommands, validateBashSemantics } from './bash-ast.js';
 import { shellPermissionMatchCandidates } from './bash-normalization.js';
@@ -30,6 +31,7 @@ const DEFAULT_BEHAVIOR = {
     Grep: 'allow',
     Write: 'ask',
     Edit: 'ask',
+    ApplyPatch: 'ask',
     NotebookEdit: 'ask',
     Glob: 'allow',
     LSP: 'allow',
@@ -50,6 +52,7 @@ const FILE_TOOLS = new Set([
     'Read',
     'Write',
     'Edit',
+    'ApplyPatch',
     'NotebookEdit',
     'Glob',
     'Grep',
@@ -206,6 +209,13 @@ function permissionTarget(call) {
             ? call.input.notebook_path
             : null;
     }
+    if (call.name === 'ApplyPatch') {
+        const edits = call.input.edits;
+        const first = Array.isArray(edits) ? edits[0] : undefined;
+        return isRecord(first) && typeof first.file_path === 'string'
+            ? first.file_path
+            : null;
+    }
     if (call.name === 'WebFetch') {
         return typeof call.input.url === 'string' ? call.input.url : null;
     }
@@ -217,7 +227,7 @@ function permissionTarget(call) {
 function matchesRule(rule, call, cwd, homeDirectory) {
     const toolMatches = rule.toolName === call.name ||
         (rule.toolName === 'Edit' &&
-            ['Edit', 'Write', 'NotebookEdit'].includes(call.name)) ||
+            ['Edit', 'Write', 'NotebookEdit', 'ApplyPatch'].includes(call.name)) ||
         (rule.toolName === 'Read' && ['Read', 'Glob', 'Grep'].includes(call.name));
     if (!toolMatches)
         return false;
@@ -400,6 +410,131 @@ export class ClaudePermissionResolver {
             ...call,
             input: { ...call.input, command: subcommand },
         });
+        if (call.name === 'ApplyPatch') {
+            const edits = parseApplyPatchInput(call.input);
+            const originalEdits = context?.originalCall?.name === 'ApplyPatch'
+                ? parseApplyPatchInput(context.originalCall.input)
+                : edits;
+            if (originalEdits.length !== edits.length) {
+                throw new Error('ApplyPatch original and canonical edits must match');
+            }
+            const targetInputs = edits.map((edit, index) => {
+                const originalEdit = originalEdits[index];
+                if (!originalEdit) {
+                    throw new Error('ApplyPatch original and canonical edits must match');
+                }
+                const targetCall = {
+                    ...call,
+                    name: 'Edit',
+                    input: { ...edit },
+                };
+                const applyView = {
+                    ...call,
+                    input: { edits: [{ ...edit }] },
+                };
+                const originalView = {
+                    ...call,
+                    input: { edits: [{ ...originalEdit }] },
+                };
+                const originalTargetCall = {
+                    ...targetCall,
+                    input: { ...originalEdit },
+                };
+                return {
+                    edit,
+                    originalEdit,
+                    targetCall,
+                    applyView,
+                    originalView,
+                    originalTargetCall,
+                };
+            });
+            const directDenied = targetInputs.flatMap(({ applyView, originalView, targetCall, originalTargetCall }) => effectiveRules('deny').filter((rule) => matchesRule(rule, applyView, cwd, this.homeDirectory) ||
+                matchesRule(rule, originalView, cwd, this.homeDirectory) ||
+                matchesRule(rule, targetCall, cwd, this.homeDirectory) ||
+                matchesRule(rule, originalTargetCall, cwd, this.homeDirectory)))[0];
+            if (directDenied) {
+                const suffix = directDenied.pattern === null ? '' : `(${directDenied.pattern})`;
+                return annotatePermissionDecision({
+                    behavior: 'deny',
+                    reason: `Denied by Claude permission rule ${directDenied.toolName}${suffix}`,
+                }, 'rule');
+            }
+            const targetDecisions = await Promise.all(targetInputs.map(async ({ originalEdit, targetCall, applyView, originalView }) => {
+                if (permissionMode === 'plan') {
+                    return annotatePermissionDecision({
+                        behavior: 'deny',
+                        reason: 'Cannot use ApplyPatch while in plan mode',
+                    }, 'mode');
+                }
+                const directAsked = effectiveRules('ask').find((rule) => matchesRule(rule, applyView, cwd, this.homeDirectory) ||
+                    matchesRule(rule, originalView, cwd, this.homeDirectory));
+                if (directAsked)
+                    return this.askDecision(targetCall, cwd, permissionMode, context, 'rule', undefined, true);
+                const directAllowed = effectiveRules('allow').find((rule) => matchesRule(rule, applyView, cwd, this.homeDirectory) ||
+                    matchesRule(rule, originalView, cwd, this.homeDirectory));
+                const resolved = await this.resolve(targetCall, context
+                    ? {
+                        ...context,
+                        originalCall: {
+                            ...call,
+                            input: { edits: [{ ...originalEdit }] },
+                        },
+                    }
+                    : { cwd, originalCall: originalView });
+                if (resolved.behavior === 'allow' &&
+                    permissionDecisionSource(resolved) === 'default' &&
+                    !directAllowed) {
+                    return this.askDecision(targetCall, cwd, permissionMode, context
+                        ? {
+                            ...context,
+                            originalCall: {
+                                ...call,
+                                input: { edits: [{ ...originalEdit }] },
+                            },
+                        }
+                        : { cwd, originalCall: originalView }, 'default', undefined, true);
+                }
+                if (directAllowed &&
+                    resolved.behavior === 'ask' &&
+                    resolved.reason !==
+                        'Path is outside allowed working directories' &&
+                    (permissionMode !== 'auto' || !this.shouldClassify(targetCall))) {
+                    return annotatePermissionDecision({ behavior: 'allow' }, 'rule');
+                }
+                return resolved;
+            }));
+            const deniedDecision = targetDecisions.find((decision) => decision.behavior === 'deny');
+            if (deniedDecision)
+                return deniedDecision;
+            const askedDecisions = targetDecisions.filter((decision) => decision.behavior === 'ask');
+            if (askedDecisions.length > 0) {
+                const first = askedDecisions[0];
+                if (!first)
+                    throw new Error('ApplyPatch permission decision is missing');
+                const suggestions = [
+                    ...new Map(askedDecisions
+                        .flatMap((decision) => decision.behavior === 'ask' ? (decision.suggestions ?? []) : [])
+                        .map((suggestion) => [JSON.stringify(suggestion), suggestion])).values(),
+                ];
+                const aggregate = {
+                    ...first,
+                    suggestions,
+                };
+                const source = permissionDecisionSource(first);
+                const annotated = source
+                    ? annotatePermissionDecision(aggregate, source)
+                    : aggregate;
+                const outcome = autoModePermissionOutcome(first);
+                return outcome
+                    ? annotateAutoModePermissionOutcome(annotated, outcome)
+                    : annotated;
+            }
+            const allowed = targetDecisions.find((decision) => decision.behavior === 'allow');
+            if (allowed)
+                return allowed;
+            throw new Error('ApplyPatch permission resolution produced no decision');
+        }
         const denied = matchingRule('deny') ??
             subcommands
                 .map((subcommand) => matchingRule('deny', subcommandCall(subcommand)))
@@ -414,6 +549,7 @@ export class ClaudePermissionResolver {
         if (permissionMode === 'plan' &&
             (call.name === 'Write' ||
                 call.name === 'Edit' ||
+                call.name === 'ApplyPatch' ||
                 call.name === 'NotebookEdit')) {
             return annotatePermissionDecision({
                 behavior: 'deny',
@@ -558,7 +694,7 @@ export class ClaudePermissionResolver {
                     absolutePath,
                 ]),
             ];
-            const write = ['Write', 'Edit', 'NotebookEdit'].includes(call.name);
+            const write = ['Write', 'Edit', 'ApplyPatch', 'NotebookEdit'].includes(call.name);
             const internalRoots = write
                 ? internalEditableRoots
                 : internalReadableRoots;
@@ -585,6 +721,7 @@ export class ClaudePermissionResolver {
         if (permissionMode === 'acceptEdits' &&
             (call.name === 'Write' ||
                 call.name === 'Edit' ||
+                call.name === 'ApplyPatch' ||
                 call.name === 'NotebookEdit')) {
             return annotatePermissionDecision({ behavior: 'allow' }, 'mode');
         }
@@ -651,7 +788,12 @@ export class ClaudePermissionResolver {
                             FILE_TOOLS.has(call.name) &&
                             permissionTarget(call)
                             ? {
-                                suggestions: filePermissionSuggestions(permissionTarget(call) ?? cwd, cwd, ['Write', 'Edit', 'NotebookEdit'].includes(call.name)
+                                suggestions: filePermissionSuggestions(permissionTarget(call) ?? cwd, cwd, [
+                                    'Write',
+                                    'Edit',
+                                    'ApplyPatch',
+                                    'NotebookEdit',
+                                ].includes(call.name)
                                     ? 'write'
                                     : 'read', (effectivePermissionMode(context?.permissionUpdates) ??
                                     permissionMode), false),
@@ -664,6 +806,7 @@ export class ClaudePermissionResolver {
             return true;
         if (call.name === 'Write' ||
             call.name === 'Edit' ||
+            call.name === 'ApplyPatch' ||
             call.name === 'NotebookEdit' ||
             call.name === 'WebFetch' ||
             call.name === 'WebSearch' ||

package/dist/platform/atomic-write.js

@@ -8,6 +8,8 @@ export async function writeFileAtomically(filePath, content, options = {}) {
         const handle = await open(temporary, 'wx', options.mode ?? 0o600);
         try {
             await handle.writeFile(content);
+            if (options.mode !== undefined)
+                await handle.chmod(options.mode);
             await handle.sync();
         }
         finally {

package/dist/tools/apply-patch.d.ts

@@ -0,0 +1,25 @@
+import type { ModelToolDefinition } from '../core/runtime.js';
+export declare const APPLY_PATCH_MAX_EDITS = 32;
+export declare const APPLY_PATCH_MAX_FILES = 8;
+export declare const APPLY_PATCH_MAX_INPUT_BYTES: number;
+export interface ApplyPatchEdit {
+    file_path: string;
+    old_string: string;
+    new_string: string;
+}
+export interface ApplyPatchPlanFile {
+    filePath: string;
+    before: string;
+    after: string;
+    linesAdded: number;
+    linesRemoved: number;
+}
+export interface ApplyPatchPlan {
+    files: readonly ApplyPatchPlanFile[];
+    linesAdded: number;
+    linesRemoved: number;
+}
+export declare const APPLY_PATCH_DEFINITION: ModelToolDefinition;
+export declare function parseApplyPatchInput(input: unknown): ApplyPatchEdit[];
+export declare function planApplyPatch(edits: readonly ApplyPatchEdit[], sources: ReadonlyMap<string, string>, maxFileBytes: number): ApplyPatchPlan;
+//# sourceMappingURL=apply-patch.d.ts.map

package/dist/tools/apply-patch.js

@@ -0,0 +1,128 @@
+import { countLineChanges } from './line-changes.js';
+export const APPLY_PATCH_MAX_EDITS = 32;
+export const APPLY_PATCH_MAX_FILES = 8;
+export const APPLY_PATCH_MAX_INPUT_BYTES = 256 * 1024;
+export const APPLY_PATCH_DEFINITION = {
+    name: 'ApplyPatch',
+    description: 'Applies a bounded batch of exact, unique string replacements to existing files.',
+    inputSchema: {
+        $schema: 'https://json-schema.org/draft/2020-12/schema',
+        type: 'object',
+        properties: {
+            edits: {
+                type: 'array',
+                minItems: 1,
+                maxItems: APPLY_PATCH_MAX_EDITS,
+                items: {
+                    type: 'object',
+                    properties: {
+                        file_path: { type: 'string', minLength: 1 },
+                        old_string: { type: 'string', minLength: 1 },
+                        new_string: { type: 'string' },
+                    },
+                    required: ['file_path', 'old_string', 'new_string'],
+                    additionalProperties: false,
+                },
+            },
+        },
+        required: ['edits'],
+        additionalProperties: false,
+    },
+};
+function objectInput(input, label) {
+    if (!input || typeof input !== 'object' || Array.isArray(input))
+        throw new Error(`${label} must be an object`);
+    return input;
+}
+function exactKeys(input, keys) {
+    const unexpected = Object.keys(input).find((key) => !keys.includes(key));
+    if (unexpected)
+        throw new Error(`Unexpected ApplyPatch field: ${unexpected}`);
+}
+function stringInput(input, key, nonEmpty = false) {
+    const value = input[key];
+    if (typeof value !== 'string' || (nonEmpty && value.length === 0))
+        throw new Error(`${key} must be ${nonEmpty ? 'a non-empty ' : 'a '}string`);
+    return value;
+}
+export function parseApplyPatchInput(input) {
+    let encoded;
+    try {
+        encoded = JSON.stringify(input);
+    }
+    catch {
+        throw new Error('ApplyPatch input must be JSON-serializable');
+    }
+    if (encoded === undefined)
+        throw new Error('ApplyPatch input must be JSON-serializable');
+    if (Buffer.byteLength(encoded, 'utf8') > APPLY_PATCH_MAX_INPUT_BYTES)
+        throw new Error('ApplyPatch input exceeds 256 KiB');
+    const object = objectInput(input, 'ApplyPatch input');
+    exactKeys(object, ['edits']);
+    const rawEdits = object.edits;
+    if (!Array.isArray(rawEdits) ||
+        rawEdits.length < 1 ||
+        rawEdits.length > APPLY_PATCH_MAX_EDITS)
+        throw new Error('ApplyPatch edits must contain 1 to 32 operations');
+    return rawEdits.map((raw, index) => {
+        const item = objectInput(raw, `ApplyPatch edits[${index}]`);
+        exactKeys(item, ['file_path', 'old_string', 'new_string']);
+        const edit = {
+            file_path: stringInput(item, 'file_path', true),
+            old_string: stringInput(item, 'old_string', true),
+            new_string: stringInput(item, 'new_string'),
+        };
+        if (edit.old_string === edit.new_string)
+            throw new Error('new_string must differ from old_string');
+        return edit;
+    });
+}
+export function planApplyPatch(edits, sources, maxFileBytes) {
+    if (edits.length < 1 || edits.length > APPLY_PATCH_MAX_EDITS)
+        throw new Error('ApplyPatch edits must contain 1 to 32 operations');
+    if (new Set(edits.map((edit) => edit.file_path)).size > APPLY_PATCH_MAX_FILES)
+        throw new Error('ApplyPatch may touch at most 8 files');
+    const snapshots = new Map();
+    for (const edit of edits) {
+        if (!edit.old_string)
+            throw new Error('old_string must be non-empty');
+        if (edit.old_string === edit.new_string)
+            throw new Error('new_string must differ from old_string');
+        if (!snapshots.has(edit.file_path)) {
+            const source = sources.get(edit.file_path);
+            if (source === undefined)
+                throw new Error(`ApplyPatch source is missing: ${edit.file_path}`);
+            snapshots.set(edit.file_path, source);
+        }
+    }
+    for (const edit of edits) {
+        const source = snapshots.get(edit.file_path);
+        if (source === undefined)
+            throw new Error(`ApplyPatch source is missing: ${edit.file_path}`);
+        const first = source.indexOf(edit.old_string);
+        if (first < 0)
+            throw new Error('old_string was not found');
+        const second = source.indexOf(edit.old_string, first + edit.old_string.length);
+        if (second >= 0)
+            throw new Error('old_string must match exactly once');
+        const after = source.slice(0, first) +
+            edit.new_string +
+            source.slice(first + edit.old_string.length);
+        if (Buffer.byteLength(after, 'utf8') > maxFileBytes)
+            throw new Error(`Edited content exceeds ${maxFileBytes} bytes`);
+        snapshots.set(edit.file_path, after);
+    }
+    const files = [...snapshots].map(([filePath, after]) => {
+        const before = sources.get(filePath);
+        if (before === undefined)
+            throw new Error(`ApplyPatch source is missing: ${filePath}`);
+        const changes = countLineChanges(before, after);
+        return { filePath, before, after, ...changes };
+    });
+    return {
+        files,
+        linesAdded: files.reduce((total, file) => total + file.linesAdded, 0),
+        linesRemoved: files.reduce((total, file) => total + file.linesRemoved, 0),
+    };
+}
+//# sourceMappingURL=apply-patch.js.map

package/dist/tools/claude-interactive-tools.js

@@ -1,6 +1,7 @@
 import { mkdir, readFile, realpath } from 'node:fs/promises';
 import { basename, dirname, join, resolve } from 'node:path';
 import { resolveToolSchedulingPolicy } from '../core/tool-scheduling-policy.js';
+import { parseApplyPatchInput } from './apply-patch.js';
 const ASK_USER_QUESTION = {
     name: 'AskUserQuestion',
     description: "Use this tool only when you are blocked on a decision that is genuinely the user's to make: one you cannot resolve from the request, the code, or sensible defaults. Users can always provide custom text. Use multiSelect for non-exclusive choices. In plan mode, use this tool to clarify requirements before ExitPlanMode; do not use it to request plan approval.",
@@ -354,6 +355,13 @@ Use AskUserQuestion for decisions that genuinely require the user. Write a compl
             typeof call.input.file_path === 'string') {
             return this.resolvePlanFile(state, call, context);
         }
+        if (state.mode === 'plan' && call.name === 'ApplyPatch') {
+            const edits = parseApplyPatchInput(call.input);
+            if ((await Promise.all(edits.map((edit) => this.isPlanFileForState(state, edit.file_path)))).every(Boolean)) {
+                return { behavior: 'allow' };
+            }
+            return this.resolver(state.mode).resolve(call, context);
+        }
         const decision = await this.resolver(this.planPermissionMode(sessionId)).resolve(call, context);
         return this.applyRetainedPrompts(state, call, decision);
     }

package/dist/tools/local-tools.d.ts

@@ -92,6 +92,7 @@ export declare class LocalToolRegistry implements ToolRegistry {
     private readPdf;
     private createPdfOutputDirectory;
     private write;
+    private applyPatch;
     private edit;
     private notebookEdit;
     private glob;

package/dist/tools/local-tools.js

@@ -12,6 +12,8 @@ import { countLineChanges } from './line-changes.js';
 import { editNotebook, formatNotebookForRead } from './notebook.js';
 import { openPdf } from './pdf.js';
 import { validateBashPathSafety } from '../permissions/bash-path-safety.js';
+import { APPLY_PATCH_DEFINITION, APPLY_PATCH_MAX_FILES, parseApplyPatchInput, planApplyPatch, } from './apply-patch.js';
+import { writeFileAtomically } from '../platform/atomic-write.js';
 import { protectedWritePathReason } from '../permissions/bypass-immune-paths.js';
 import { effectiveAdditionalDirectories, shellInputIsReadOnly, } from '../permissions/permission-updates.js';
 const REPORT_FINDINGS_DEFINITION = {
@@ -160,6 +162,7 @@ const TOOL_DEFINITIONS = [
             additionalProperties: false,
         },
     },
+    APPLY_PATCH_DEFINITION,
     {
         name: 'NotebookEdit',
         description: 'Replace, insert, or delete one cell in a Jupyter notebook after reading it.',
@@ -627,7 +630,15 @@ export class LocalToolRegistry {
             this.additionalReadDirectories.length === 0) {
             return definitions;
         }
-        return definitions.map((definition) => ['Read', 'Write', 'Edit', 'NotebookEdit', 'Glob', 'Grep'].includes(definition.name)
+        return definitions.map((definition) => [
+            'Read',
+            'Write',
+            'Edit',
+            'ApplyPatch',
+            'NotebookEdit',
+            'Glob',
+            'Grep',
+        ].includes(definition.name)
             ? {
                 ...definition,
                 description: `${definition.description}${this.additionalDirectories.length === 0
@@ -731,6 +742,26 @@ export class LocalToolRegistry {
                 this.mutationTargetExisted.set(prepared, targetExisted);
                 return prepared;
             }
+            case 'ApplyPatch': {
+                const edits = parseApplyPatchInput(call.input);
+                const preparedEdits = [];
+                for (const edit of edits) {
+                    const filePath = await this.filePath(edit.file_path, false, false, context);
+                    this.assertProtectedWritePath(filePath);
+                    if (!(await this.wasSuccessfullyRead(filePath, context.messages ?? [], context))) {
+                        throw new Error('<tool_use_error>File has not been read yet. Read it first before writing to it.</tool_use_error>');
+                    }
+                    preparedEdits.push({
+                        file_path: filePath,
+                        old_string: edit.old_string,
+                        new_string: edit.new_string,
+                    });
+                }
+                if (new Set(preparedEdits.map((edit) => edit.file_path)).size >
+                    APPLY_PATCH_MAX_FILES)
+                    throw new Error('ApplyPatch may touch at most 8 files');
+                return { ...call, input: { edits: preparedEdits } };
+            }
             case 'NotebookEdit': {
                 const requestedPath = stringInput(call.input, 'notebook_path');
                 if (!isAbsolute(requestedPath)) {
@@ -839,6 +870,8 @@ export class LocalToolRegistry {
                 return this.write(prepared, context, targetExisted);
             case 'Edit':
                 return this.edit(prepared, targetExisted);
+            case 'ApplyPatch':
+                return this.applyPatch(prepared, context);
             case 'NotebookEdit':
                 return this.notebookEdit(prepared);
             case 'Glob':
@@ -1222,6 +1255,74 @@ export class LocalToolRegistry {
             await handle.close();
         }
     }
+    async applyPatch(call, context) {
+        const edits = parseApplyPatchInput(call.input);
+        const sources = new Map();
+        const modes = new Map();
+        const identities = new Map();
+        const paths = [];
+        for (const edit of edits) {
+            const filePath = edit.file_path;
+            if (sources.has(filePath))
+                continue;
+            paths.push(filePath);
+            const handle = await open(filePath, constants.O_RDONLY | constants.O_NOFOLLOW);
+            try {
+                await this.assertStablePath(filePath);
+                const metadata = await handle.stat();
+                if (!metadata.isFile())
+                    throw new Error(`Not a file: ${filePath}`);
+                if (metadata.size > this.maxFileBytes)
+                    throw new Error(`File exceeds ${this.maxFileBytes} byte edit limit`);
+                sources.set(filePath, await handle.readFile('utf8'));
+                identities.set(filePath, { dev: metadata.dev, ino: metadata.ino });
+                modes.set(filePath, metadata.mode & 0o7777);
+            }
+            finally {
+                await handle.close();
+            }
+        }
+        const plan = planApplyPatch(edits, sources, this.maxFileBytes);
+        for (const file of plan.files) {
+            if (context.signal?.aborted)
+                throw abortError();
+            const mode = modes.get(file.filePath);
+            const committed = await writeFileAtomically(file.filePath, file.after, {
+                ...(mode === undefined ? {} : { mode }),
+                beforeCommit: async () => {
+                    let handle;
+                    try {
+                        handle = await open(file.filePath, constants.O_RDONLY | constants.O_NOFOLLOW);
+                        await this.assertStablePath(file.filePath);
+                        const metadata = await handle.stat();
+                        if (!metadata.isFile())
+                            return false;
+                        const identity = identities.get(file.filePath);
+                        if (!identity ||
+                            metadata.dev !== identity.dev ||
+                            metadata.ino !== identity.ino)
+                            return false;
+                        return (await handle.readFile('utf8')) === file.before;
+                    }
+                    catch {
+                        return false;
+                    }
+                    finally {
+                        await handle?.close();
+                    }
+                },
+            });
+            if (!committed)
+                throw new Error('Tool input changed after permission approval');
+        }
+        return {
+            content: `Applied ${edits.length} replacement(s) to ${paths.length} file(s)`,
+            isError: false,
+            linesAdded: plan.linesAdded,
+            linesRemoved: plan.linesRemoved,
+            accessedPaths: paths,
+        };
+    }
     async edit(call, preparedTargetExisted) {
         const filePath = stringInput(call.input, 'file_path');
         this.assertProtectedWritePath(filePath);

package/dist/tools/team-member-tools.js

@@ -5,8 +5,9 @@ import { analyzeBashStructure, normalizeBashWrapperArgv, } from '../permissions/
 import { validateBashPathSafety } from '../permissions/bash-path-safety.js';
 import { shellInputIsReadOnly } from '../permissions/permission-updates.js';
 import { isPathWithin } from '../platform/path-containment.js';
+import { parseApplyPatchInput } from './apply-patch.js';
 const READ_ONLY_TOOLS = new Set(['Read', 'Glob', 'Grep', 'Bash']);
-const WRITE_TOOLS = new Set([...READ_ONLY_TOOLS, 'Write', 'Edit']);
+const WRITE_TOOLS = new Set([...READ_ONLY_TOOLS, 'Write', 'Edit', 'ApplyPatch']);
 const SAFE_GIT_COMMANDS = new Set([
     'status',
     'diff',
@@ -88,6 +89,9 @@ function within(root, candidate) {
 function toolInputPaths(call) {
     if (call.name === 'Read' || call.name === 'Write' || call.name === 'Edit')
         return [call.input.file_path];
+    if (call.name === 'ApplyPatch') {
+        return parseApplyPatchInput(call.input).map((edit) => edit.file_path);
+    }
     if (call.name === 'Glob' || call.name === 'Grep')
         return call.input.path === undefined ? [] : [call.input.path];
     return [];

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "praxis-agent",
-  "version": "0.55.3",
+  "version": "0.56.0",
   "description": "Local-first, single-user general agent for the command line.",
   "license": "MIT",
   "author": "wuqisen",
@@ -62,7 +62,7 @@
     "verify:ci-coverage": "node scripts/verify-ci-coverage.mjs",
     "verify:fixture-contracts": "node scripts/verify-fixture-contracts.mjs",
     "test:fixtures": "node scripts/run-fixture-contracts.mjs",
-    "test:eval:baseline": "vitest run src/evals/coding-baseline.test.ts src/evals/project-eval-comparison.test.ts"
+    "test:eval:baseline": "vitest run src/evals/coding-baseline.test.ts src/evals/project-eval-comparison.test.ts src/evals/apply-patch-admission.test.ts"
   },
   "engines": {
     "node": ">=24"