stitchkit 0.114.2 → 0.116.0

package/dist/{index-s47ac8zt.js → index-n5sv4z0w.js}

@@ -1,33 +1,36 @@
-import {
-  loadDarwinBinding
-} from "./index-2kbysk9s.js";
 import {
   NativeCommandError2
-} from "./index-84bf5spd.js";
+} from "./index-f6m4c545.js";
 import {
   CommandStopped,
   startNativeCommand
-} from "./index-7r4knwf8.js";
+} from "./index-dr3t5n1v.js";
+import {
+  scanContainedFiles
+} from "./index-6f49krb5.js";
+import {
+  writeContainedFile
+} from "./index-q968hy6y.js";
 import {
-  NumericFileHandle,
-  descriptorPath,
   listContainedDirectory,
   missingContainedDirectories,
+  misspelledContainedSegment,
+  UnapprovedContainedDirectoryError,
   openContainedParent,
   openContainedFile,
+  ContainedPathChangedError,
   assertContainedFileCurrent,
   assertContainedParentCurrent,
   containedEntryMetadata,
   openContainedParentFile,
-  readContainedUtf8Handle,
-  scanContainedFiles
-} from "./index-zrtrjkbf.js";
+  readContainedUtf8Handle
+} from "./index-arjmb6de.js";
 import {
   defineRuntimeTool2
 } from "./index-ega3yz4c.js";
 import {
-  stagingName
-} from "./index-j4zh647a.js";
+  errnoOf
+} from "./index-jj9228tt.js";
 import {
   AppError2,
   forbidden2,
@@ -250,7 +253,7 @@ async function recordAgentSandboxProbe2(input) {
 }
 
 // src/agent-runtime/coding-tools.ts
-import path5 from "node:path";
+import path4 from "node:path";
 import { z as z5 } from "zod";
 
 // src/agent-runtime/coding-tool-files.ts
@@ -278,7 +281,8 @@ function codingPathRefusal(code, message, path, options = {}) {
   });
 }
 function refuseMissingCodingPath(error, relative) {
-  const code = error?.code;
+  refuseChangedPath(error, relative);
+  const code = errnoOf(error);
   if (error instanceof Error && error.message.includes("is not a regular file")) {
     codingPathRefusal("BAD_REQUEST", "This path is not a regular file", relative, {
       hint: "Use list_directory to see what is here."
@@ -299,13 +303,55 @@ function refuseMissingCodingPath(error, relative) {
       hint: "Read or write the target directly, by its own workspace-relative path."
     });
   }
-  if (code === "EISDIR") {
+  if (code === "EISDIR" || code === "ENXIO" || code === "EOPNOTSUPP") {
     codingPathRefusal("BAD_REQUEST", "This path is not a regular file", relative, {
       hint: "Use list_directory to see what is here."
     });
   }
   throw error;
 }
+function refuseChangedPath(error, relative) {
+  if (error instanceof ContainedPathChangedError) {
+    codingPathRefusal("CONFLICT", "This path changed while it was being authorized", relative, {
+      hint: "Read it again and retry."
+    });
+  }
+}
+function refuseWriteConflict(error, relative, details = {}) {
+  refuseChangedPath(error, relative);
+  const code = errnoOf(error);
+  if (code === "ENOENT") {
+    codingPathRefusal("CONFLICT", "This path changed while it was being written", relative, {
+      details,
+      hint: "Read it again and retry."
+    });
+  }
+  if (code === "ENOTDIR") {
+    codingPathRefusal("CONFLICT", "A segment of this path is not a directory", relative, {
+      details,
+      hint: "Write under a different path, or remove the file blocking it."
+    });
+  }
+  if (code === "ELOOP") {
+    codingPathRefusal("FORBIDDEN", "This path is a symlink, which is not followed", relative, {
+      details,
+      hint: "Write to the target directly, by its own workspace-relative path."
+    });
+  }
+  if (code === "EISDIR") {
+    codingPathRefusal("CONFLICT", "This path is a directory", relative, {
+      details,
+      hint: "Write to a file path inside it, or choose another name."
+    });
+  }
+  if (code === "EEXIST") {
+    codingPathRefusal("CONFLICT", "This file already exists", relative, {
+      details,
+      hint: "Pass overwrite: true to replace it, or edit_file to change part of it."
+    });
+  }
+  throw error;
+}
 function refuseUnknownSpillReference(reference) {
   codingRefusal("SPILL_REFERENCE_UNKNOWN", `No spilled output is held under \`${reference}\``, {
     details: { reference },
@@ -343,6 +389,12 @@ function inputPath(root, requested, maxPathBytes) {
   return resolved;
 }
 function boundedCodingRelativePath(root, requested, maxPathBytes) {
+  if (requested.includes("\x00")) {
+    codingRefusal("BAD_REQUEST", "Path segments cannot contain a NUL byte", {
+      details: { path: requested },
+      hint: "Pass the exact workspace-relative entry name without NUL bytes."
+    });
+  }
   if (path.isAbsolute(requested))
     inputPath(root, requested, maxPathBytes);
   if (requested.includes("\\")) {
@@ -387,6 +439,14 @@ async function authorizeCodingPath(config, path2) {
   }
 }
 async function authorizeCodingPathChain(config, relative) {
+  if (relative !== ".") {
+    const misspelled = await misspelledContainedSegment(await realpath(config.root), relative);
+    if (misspelled !== undefined) {
+      codingPathRefusal("BAD_REQUEST", "This path differs from the name stored on disk", relative, {
+        hint: "Use list_directory to see the stored spelling."
+      });
+    }
+  }
   if (!config.authorizePath)
     return;
   const segments = relative === "." ? ["."] : relative.split("/");
@@ -462,86 +522,6 @@ function utf8AlignedStart(data, start, end) {
   return safe;
 }
 
-// src/agent-runtime/contained-write.ts
-import { fchmod, write as writeDescriptor } from "node:fs";
-import { rename, unlink, writeFile } from "node:fs/promises";
-import path2 from "node:path";
-async function writeDescriptorFully(descriptor, content) {
-  const bytes = Buffer.from(content);
-  let offset = 0;
-  while (offset < bytes.byteLength) {
-    const written = await new Promise((resolve, reject) => {
-      writeDescriptor(descriptor, bytes, offset, bytes.byteLength - offset, null, (error, bytesWritten) => error ? reject(error) : resolve(bytesWritten));
-    });
-    if (written === 0)
-      throw new Error("Contained file write made no progress");
-    offset += written;
-  }
-}
-async function chmodDescriptor(descriptor, mode) {
-  await new Promise((resolve, reject) => {
-    fchmod(descriptor, mode & 4095, (error) => error ? reject(error) : resolve());
-  });
-}
-async function createDarwinFile(parent, name, content, mode) {
-  const binding = loadDarwinBinding();
-  const descriptor = binding.createFileAt(parent.fd, name, mode & 4095);
-  let failed;
-  try {
-    await writeDescriptorFully(descriptor, content);
-    await chmodDescriptor(descriptor, mode);
-  } catch (error) {
-    failed = error;
-  } finally {
-    try {
-      await new NumericFileHandle(descriptor).close();
-    } catch (error) {
-      failed ??= error;
-    }
-  }
-  if (failed) {
-    binding.unlinkAt(parent.fd, name);
-    throw failed;
-  }
-}
-async function writeContainedFile(input) {
-  const mode = input.mode ?? 438;
-  if (!input.replace) {
-    if (process.platform === "darwin") {
-      await createDarwinFile(input.parent.handle, input.parent.basename, input.content, mode);
-      return;
-    }
-    await writeFile(path2.join(descriptorPath(input.parent.handle), input.parent.basename), input.content, { flag: "wx", mode });
-    return;
-  }
-  const temporary = stagingName();
-  if (process.platform === "darwin") {
-    const binding = loadDarwinBinding();
-    let created = false;
-    try {
-      await createDarwinFile(input.parent.handle, temporary, input.content, mode);
-      created = true;
-      binding.renameAt(input.parent.handle.fd, temporary, input.parent.basename);
-    } catch (error) {
-      if (created)
-        binding.unlinkAt(input.parent.handle.fd, temporary);
-      throw error;
-    }
-    return;
-  }
-  const directory = descriptorPath(input.parent.handle);
-  const temporaryPath = path2.join(directory, temporary);
-  try {
-    await writeFile(temporaryPath, input.content, { flag: "wx", mode });
-    await rename(temporaryPath, path2.join(directory, input.parent.basename));
-  } catch (error) {
-    await unlink(temporaryPath).catch(() => {
-      return;
-    });
-    throw error;
-  }
-}
-
 // src/agent-runtime/coding-tool-files.ts
 async function digestFile(handle, size) {
   const hash = createHash("sha256");
@@ -556,6 +536,17 @@ async function digestFile(handle, size) {
   }
   return hash.digest("hex");
 }
+async function openAuthorizedWriteParent(root, relative, createsDirectories) {
+  return openContainedParent(root, relative, { createDirectories: createsDirectories }).catch((error) => {
+    if (error instanceof UnapprovedContainedDirectoryError) {
+      codingPathRefusal("CONFLICT", "The directory creation plan changed during authorization", relative, {
+        details: { createsDirectories },
+        hint: "Retry the write so the host can authorize the current directories."
+      });
+    }
+    refuseWriteConflict(error, relative, { createsDirectories });
+  });
+}
 function createFileCodingTools(config, limits) {
   const read = defineRuntimeTool2({
     name: "read_file",
@@ -576,7 +567,7 @@ function createFileCodingTools(config, limits) {
       let sha256;
       try {
         await authorizeCodingTool(config, { operation: "read", path: relative });
-        await assertContainedFileCurrent(root, relative, handle);
+        await assertContainedFileCurrent(root, relative, handle).catch((error) => refuseMissingCodingPath(error, relative));
         const metadata = await handle.stat();
         if (!metadata.isFile()) {
           codingPathRefusal("BAD_REQUEST", "This path is not a regular file", relative, {
@@ -639,14 +630,7 @@ function createFileCodingTools(config, limits) {
           hint: "Write a smaller file, or split it."
         });
       }
-      const createsDirectories = await missingContainedDirectories(root, relative).catch((error) => {
-        if (error.code === "ENOTDIR") {
-          codingPathRefusal("CONFLICT", "A segment of this path is not a directory", relative, {
-            hint: "Write under a different path, or remove the file blocking it."
-          });
-        }
-        throw error;
-      });
+      const createsDirectories = await missingContainedDirectories(root, relative).catch((error) => refuseWriteConflict(error, relative));
       await authorizeCodingTool(config, {
         operation: "write",
         path: relative,
@@ -654,42 +638,39 @@ function createFileCodingTools(config, limits) {
         overwrite: input.overwrite,
         createsDirectories
       });
-      const parent = await openContainedParent(root, relative, { create: true }).catch((error) => {
-        const code = error.code;
-        if (code === "ENOTDIR" || error instanceof Error && error.message.includes("ancestor is not a directory")) {
-          codingPathRefusal("CONFLICT", "A segment of this path is not a directory", relative, {
-            details: { createsDirectories },
-            hint: "Write under a different path, or remove the file blocking it."
-          });
-        }
-        throw error;
-      });
-      try {
-        await assertContainedParentCurrent(root, relative, parent.handle);
-        const current = await containedEntryMetadata(parent);
-        if (input.overwrite) {
-          if (current?.isSymbolicLink()) {
-            codingPathRefusal("FORBIDDEN", "This path is a symlink", relative, {
-              hint: "Coding tools never write through symlinks; write to the target directly."
-            });
-          }
-          await writeContainedFile({
-            parent,
-            content: input.content,
-            replace: true,
-            ...current && { mode: current.mode }
-          });
-        } else {
-          if (current) {
-            codingPathRefusal("CONFLICT", "This file already exists", relative, {
-              hint: "Pass overwrite: true to replace it, or edit_file to change part of it."
-            });
+      await withCodingPathLock(`${root}:${relative}`, async () => {
+        const parent = await openAuthorizedWriteParent(root, relative, createsDirectories);
+        try {
+          await assertContainedParentCurrent(root, relative, parent.handle).catch((error) => refuseWriteConflict(error, relative));
+          const current = await containedEntryMetadata(parent);
+          if (input.overwrite) {
+            if (current?.isSymbolicLink()) {
+              codingPathRefusal("FORBIDDEN", "This path is a symlink", relative, {
+                hint: "Coding tools never write through symlinks; write to the target directly."
+              });
+            }
+            await writeContainedFile({
+              parent,
+              content: input.content,
+              replace: true,
+              ...current && { mode: current.mode }
+            }).catch((error) => refuseWriteConflict(error, relative));
+          } else {
+            if (current) {
+              codingPathRefusal("CONFLICT", "This file already exists", relative, {
+                hint: "Pass overwrite: true to replace it, or edit_file to change part of it."
+              });
+            }
+            await writeContainedFile({
+              parent,
+              content: input.content,
+              replace: false
+            }).catch((error) => refuseWriteConflict(error, relative));
           }
-          await writeContainedFile({ parent, content: input.content, replace: false });
+        } finally {
+          await parent.handle.close();
         }
-      } finally {
-        await parent.handle.close();
-      }
+      });
       return { path: relative, bytes, createdDirectories: createsDirectories };
     }
   });
@@ -698,7 +679,7 @@ function createFileCodingTools(config, limits) {
 
 // src/agent-runtime/coding-tool-listing.ts
 import { realpath as realpath3 } from "node:fs/promises";
-import path3 from "node:path";
+import path2 from "node:path";
 import { z as z3 } from "zod";
 var DEFAULT_EXCLUDED_DIRECTORIES = [
   ".git",
@@ -773,12 +754,7 @@ function createListingCodingTools(config, limits) {
       await authorizeCodingPathChain(config, relative);
       await authorizeCodingTool(config, { operation: "list", path: relative });
       const listing = await listContainedDirectory(root, relative, limits.maxListEntries, (candidate) => isCodingPathAuthorized(config, candidate)).catch((error) => {
-        if (error instanceof Error && error.message.includes("ancestor is not a directory")) {
-          codingPathRefusal("BAD_REQUEST", "This path is not a directory", relative, {
-            hint: "Pass a directory; use read_file for a file."
-          });
-        }
-        if (error.code === "ENOENT") {
+        if (errnoOf(error) === "ENOENT") {
           codingPathRefusal("NOT_FOUND", "This directory does not exist", relative, {
             hint: "List a parent directory to see what is there."
           });
@@ -794,7 +770,7 @@ function createListingCodingTools(config, limits) {
         truncated: listing.truncated,
         ...listing.denied.length > 0 && {
           denied: listing.denied.map((entry) => ({
-            path: relative === "." ? entry.name : path3.join(relative, entry.name),
+            path: relative === "." ? entry.name : path2.join(relative, entry.name),
             kind: entry.kind
           })),
           deniedTruncated: listing.deniedTruncated
@@ -832,10 +808,10 @@ function createListingCodingTools(config, limits) {
         maxDepth: limits.maxSearchDepth,
         maxFiles: limits.maxSearchFiles,
         symlinks: "skip",
-        excludeDirectory: (directory) => directory.split(path3.sep).some((segment) => excluded.has(segment)),
+        excludeDirectory: (directory) => directory.split(path2.sep).some((segment) => excluded.has(segment)),
         authorizePath: (candidate) => isCodingPathAuthorized(config, candidate)
       });
-      const prefix = relative === "." ? "" : `${relative}${path3.sep}`;
+      const prefix = relative === "." ? "" : `${relative}${path2.sep}`;
       const matched = scan.files.filter((file) => file.relative.startsWith(prefix)).map((file) => file.relative).filter((candidate) => matcher.test(candidate.slice(prefix.length))).sort();
       const paths = matched.slice(0, limits.maxSearchResults);
       const scopedDenied = scan.denied.filter((entry) => entry.relative.startsWith(prefix));
@@ -862,7 +838,7 @@ function createListingCodingTools(config, limits) {
 // src/agent-runtime/coding-tool-search-patch.ts
 import { createHash as createHash2 } from "node:crypto";
 import { realpath as realpath4 } from "node:fs/promises";
-import path4 from "node:path";
+import path3 from "node:path";
 import { z as z4 } from "zod";
 var SearchInputSchema = z4.object({
   query: z4.string().min(1),
@@ -943,7 +919,7 @@ async function searchFiles(config, limits, input) {
       readMaxBytes: limits.maxReadBytes,
       skipUnreadable: true
     },
-    excludeDirectory: (relative) => relative.split(path4.sep).some((segment) => excluded.has(segment)),
+    excludeDirectory: (relative) => relative.split(path3.sep).some((segment) => excluded.has(segment)),
     includeFile: (candidate) => {
       if (included && !included.test(candidate)) {
         rejectedByInclude += 1;
@@ -1019,8 +995,12 @@ async function editFile(config, limits, input) {
   const parent = await openContainedParent(root, relative).catch((error) => refuseMissingCodingPath(error, relative));
   try {
     return await withCodingPathLock(`${root}:${relative}`, async () => {
-      const handle = await openContainedParentFile(parent).catch((error) => refuseMissingCodingPath(error, relative));
-      const read = await readContainedUtf8Handle(handle, limits.maxWriteBytes).finally(() => handle.close());
+      const readCurrent = async () => {
+        const handle = await openContainedParentFile(parent).catch((error) => refuseMissingCodingPath(error, relative));
+        return readContainedUtf8Handle(handle, limits.maxWriteBytes).finally(() => handle.close());
+      };
+      await authorizeCodingTool(config, { operation: "read", path: relative });
+      const read = await readCurrent();
       const source = read.text;
       const baseSha256 = sha256(source);
       if (input.expectedSha256 !== undefined && baseSha256 !== input.expectedSha256) {
@@ -1064,14 +1044,20 @@ async function editFile(config, limits, input) {
         replacements,
         dryRun: input.dryRun
       });
-      await assertContainedParentCurrent(root, relative, parent.handle);
+      await assertContainedParentCurrent(root, relative, parent.handle).catch((error) => refuseWriteConflict(error, relative));
       if (!input.dryRun) {
+        if (sha256((await readCurrent()).text) !== baseSha256) {
+          conflict2("The file changed since it was read", {
+            message: "The file changed since it was read",
+            path: relative
+          });
+        }
         await writeContainedFile({
           parent,
           content: changed,
           replace: true,
           mode: read.mode
-        });
+        }).catch((error) => refuseWriteConflict(error, relative));
       }
       return {
         path: relative,
@@ -1383,10 +1369,10 @@ var AGENT_CODING_TOOL_NAMES = {
   writeFile: "write_file"
 };
 function createAgentCodingTools2(config) {
-  if (!path5.isAbsolute(config.root))
+  if (!path4.isAbsolute(config.root))
     throw new Error("Coding tool root must be absolute");
   for (const executable of Object.values(config.executables ?? {})) {
-    if (!path5.isAbsolute(executable)) {
+    if (!path4.isAbsolute(executable)) {
       throw new Error("Coding tool executables must be absolute paths");
     }
   }

package/dist/{index-bh2ht9y5.js → index-n8z3rvzw.js}

@@ -1,6 +1,9 @@
 import {
   loadDarwinBinding
 } from "./index-2kbysk9s.js";
+import {
+  errnoOf
+} from "./index-jj9228tt.js";
 import {
   isRecord
 } from "./index-9jfdm5tg.js";
@@ -126,7 +129,7 @@ async function observeProcessInstanceAt(pid, procRoot) {
       readlink(`${procRoot}/self/ns/pid`),
       readFile2(`${procRoot}/self/status`, "utf8"),
       readlink(`${procRoot}/self/ns/time`).catch((error) => {
-        if (error instanceof Error && "code" in error && error.code === "ENOENT")
+        if (errnoOf(error) === "ENOENT")
           return "";
         throw error;
       }),

package/dist/index-q968hy6y.js

@@ -0,0 +1,100 @@
+import {
+  loadDarwinBinding
+} from "./index-2kbysk9s.js";
+import {
+  descriptorPath,
+  NumericFileHandle
+} from "./index-arjmb6de.js";
+import {
+  stagingName
+} from "./index-tt30h7mr.js";
+
+// src/internal/contained-write.ts
+import { constants, fchmod, open as openDescriptor, write as writeDescriptor } from "node:fs";
+import { rename, unlink } from "node:fs/promises";
+import path from "node:path";
+function entryPath(directory, name) {
+  return path.join(descriptorPath(directory), name);
+}
+async function openExclusive(directory, name, mode) {
+  if (process.platform === "darwin") {
+    return loadDarwinBinding().createFileAt(directory.fd, name, mode);
+  }
+  return new Promise((resolve, reject) => {
+    openDescriptor(entryPath(directory, name), constants.O_WRONLY | constants.O_CREAT | constants.O_EXCL | constants.O_NOFOLLOW, mode, (error, descriptor) => error ? reject(error) : resolve(descriptor));
+  });
+}
+async function renameEntry(directory, source, target) {
+  if (process.platform === "darwin") {
+    loadDarwinBinding().renameAt(directory.fd, source, target);
+    return;
+  }
+  await rename(entryPath(directory, source), entryPath(directory, target));
+}
+async function discardEntry(directory, name) {
+  try {
+    if (process.platform === "darwin")
+      loadDarwinBinding().unlinkAt(directory.fd, name);
+    else
+      await unlink(entryPath(directory, name));
+  } catch {}
+}
+async function writeDescriptorFully(descriptor, content) {
+  const bytes = typeof content === "string" ? Buffer.from(content) : content;
+  let offset = 0;
+  while (offset < bytes.byteLength) {
+    const written = await new Promise((resolve, reject) => {
+      writeDescriptor(descriptor, bytes, offset, bytes.byteLength - offset, null, (error, bytesWritten) => error ? reject(error) : resolve(bytesWritten));
+    });
+    if (written === 0)
+      throw new Error("Contained file write made no progress");
+    offset += written;
+  }
+}
+async function applyMode(file, mode) {
+  if (((await file.stat()).mode & 511) === mode)
+    return;
+  await new Promise((resolve, reject) => {
+    fchmod(file.fd, mode, (error) => error ? reject(error) : resolve());
+  });
+}
+async function createFile(directory, name, content, mode) {
+  const descriptor = await openExclusive(directory, name, mode ?? 438);
+  const file = new NumericFileHandle(descriptor);
+  let failed;
+  try {
+    await writeDescriptorFully(descriptor, content);
+    if (mode !== undefined)
+      await applyMode(file, mode);
+  } catch (error) {
+    failed = error;
+  } finally {
+    try {
+      await file.close();
+    } catch (error) {
+      failed ??= error;
+    }
+  }
+  if (failed) {
+    await discardEntry(directory, name);
+    throw failed;
+  }
+}
+async function writeContainedFile(input) {
+  const { handle, basename } = input.parent;
+  const mode = input.mode === undefined ? undefined : input.mode & 511;
+  if (!input.replace) {
+    await createFile(handle, basename, input.content, mode);
+    return;
+  }
+  const temporary = stagingName();
+  await createFile(handle, temporary, input.content, mode);
+  try {
+    await renameEntry(handle, temporary, basename);
+  } catch (error) {
+    await discardEntry(handle, temporary);
+    throw error;
+  }
+}
+
+export { writeContainedFile };

package/dist/{index-j4zh647a.js → index-tt30h7mr.js}

@@ -1,3 +1,6 @@
+import {
+  errnoOf
+} from "./index-jj9228tt.js";
 import {
   assertPositiveSafeInteger
 } from "./index-0s4xebbg.js";
@@ -21,7 +24,7 @@ function isAtomicStagingName2(name) {
   return NAME.test(name);
 }
 function isMissing(error) {
-  return typeof error === "object" && error !== null && "code" in error && error.code === "ENOENT";
+  return errnoOf(error) === "ENOENT";
 }
 async function sweepAtomicStaging2(options) {
   const { directory, olderThanMs, signal } = options;