stitchkit 0.94.0 → 0.94.1

package/dist/{index-kj2wbeta.js → index-het2he5g.js}

@@ -1,16 +1,18 @@
 import {
+  NumericFileHandle,
   assertContainedFileCurrent,
   assertContainedParentCurrent,
   containedEntryMetadata,
+  descriptorPath,
   listContainedDirectory,
+  loadDarwinBinding,
   missingContainedDirectories,
   openContainedFile,
   openContainedParent,
   openContainedParentFile,
   readContainedUtf8Handle,
-  scanContainedFiles,
-  writeContainedFile
-} from "./index-bn2cjajt.js";
+  scanContainedFiles
+} from "./index-px2gm2jp.js";
 import {
   codingPathRefusal,
   codingRefusal,
@@ -20,7 +22,7 @@ import {
 } from "./index-qmy6zq75.js";
 import {
   defineRuntimeTool
-} from "./index-v38qyerb.js";
+} from "./index-xw3s75nj.js";
 import {
   conflict,
   forbidden
@@ -170,7 +172,7 @@ function resolveCodingToolLimits(input) {
 }
 
 // src/agent-runtime/coding-tools.ts
-import path4 from "node:path";
+import path5 from "node:path";
 import { z as z4 } from "zod";
 
 // src/agent-runtime/coding-tool-files.ts
@@ -328,6 +330,86 @@ function utf8AlignedStart(data, start, end) {
   return safe;
 }
 
+// src/agent-runtime/contained-write.ts
+import { fchmod, write as writeDescriptor } from "node:fs";
+import { rename, unlink, writeFile } from "node:fs/promises";
+import path2 from "node:path";
+async function writeDescriptorFully(descriptor, content) {
+  const bytes = Buffer.from(content);
+  let offset = 0;
+  while (offset < bytes.byteLength) {
+    const written = await new Promise((resolve, reject) => {
+      writeDescriptor(descriptor, bytes, offset, bytes.byteLength - offset, null, (error, bytesWritten) => error ? reject(error) : resolve(bytesWritten));
+    });
+    if (written === 0)
+      throw new Error("Contained file write made no progress");
+    offset += written;
+  }
+}
+async function chmodDescriptor(descriptor, mode) {
+  await new Promise((resolve, reject) => {
+    fchmod(descriptor, mode & 4095, (error) => error ? reject(error) : resolve());
+  });
+}
+async function createDarwinFile(parent, name, content, mode) {
+  const binding = loadDarwinBinding();
+  const descriptor = binding.createFileAt(parent.fd, name, mode & 4095);
+  let failed;
+  try {
+    await writeDescriptorFully(descriptor, content);
+    await chmodDescriptor(descriptor, mode);
+  } catch (error) {
+    failed = error;
+  } finally {
+    try {
+      await new NumericFileHandle(descriptor).close();
+    } catch (error) {
+      failed ??= error;
+    }
+  }
+  if (failed) {
+    binding.unlinkAt(parent.fd, name);
+    throw failed;
+  }
+}
+async function writeContainedFile(input) {
+  const mode = input.mode ?? 438;
+  if (!input.replace) {
+    if (process.platform === "darwin") {
+      await createDarwinFile(input.parent.handle, input.parent.basename, input.content, mode);
+      return;
+    }
+    await writeFile(path2.join(descriptorPath(input.parent.handle), input.parent.basename), input.content, { flag: "wx", mode });
+    return;
+  }
+  const temporary = `.${input.parent.basename}.${process.pid}.${crypto.randomUUID()}.tmp`;
+  if (process.platform === "darwin") {
+    const binding = loadDarwinBinding();
+    let created = false;
+    try {
+      await createDarwinFile(input.parent.handle, temporary, input.content, mode);
+      created = true;
+      binding.renameAt(input.parent.handle.fd, temporary, input.parent.basename);
+    } catch (error) {
+      if (created)
+        binding.unlinkAt(input.parent.handle.fd, temporary);
+      throw error;
+    }
+    return;
+  }
+  const directory = descriptorPath(input.parent.handle);
+  const temporaryPath = path2.join(directory, temporary);
+  try {
+    await writeFile(temporaryPath, input.content, { flag: "wx", mode });
+    await rename(temporaryPath, path2.join(directory, input.parent.basename));
+  } catch (error) {
+    await unlink(temporaryPath).catch(() => {
+      return;
+    });
+    throw error;
+  }
+}
+
 // src/agent-runtime/coding-tool-files.ts
 async function digestFile(handle, size) {
   const hash = createHash("sha256");
@@ -484,7 +566,7 @@ function createFileCodingTools(config, limits) {
 
 // src/agent-runtime/coding-tool-listing.ts
 import { realpath as realpath3 } from "node:fs/promises";
-import path2 from "node:path";
+import path3 from "node:path";
 import { z as z2 } from "zod";
 var DEFAULT_EXCLUDED_DIRECTORIES = [
   ".git",
@@ -580,7 +662,7 @@ function createListingCodingTools(config, limits) {
         truncated: listing.truncated,
         ...listing.denied.length > 0 && {
           denied: listing.denied.map((entry) => ({
-            path: relative === "." ? entry.name : path2.join(relative, entry.name),
+            path: relative === "." ? entry.name : path3.join(relative, entry.name),
             kind: entry.kind
           })),
           deniedTruncated: listing.deniedTruncated
@@ -618,10 +700,10 @@ function createListingCodingTools(config, limits) {
         maxDepth: limits.maxSearchDepth,
         maxFiles: limits.maxSearchFiles,
         symlinks: "skip",
-        excludeDirectory: (directory) => directory.split(path2.sep).some((segment) => excluded.has(segment)),
+        excludeDirectory: (directory) => directory.split(path3.sep).some((segment) => excluded.has(segment)),
         authorizePath: (candidate) => isCodingPathAuthorized(config, candidate)
       });
-      const prefix = relative === "." ? "" : `${relative}${path2.sep}`;
+      const prefix = relative === "." ? "" : `${relative}${path3.sep}`;
       const matched = scan.files.filter((file) => file.relative.startsWith(prefix)).map((file) => file.relative).filter((candidate) => matcher.test(candidate.slice(prefix.length))).sort();
       const paths = matched.slice(0, limits.maxSearchResults);
       const scopedDenied = scan.denied.filter((entry) => entry.relative.startsWith(prefix));
@@ -648,7 +730,7 @@ function createListingCodingTools(config, limits) {
 // src/agent-runtime/coding-tool-search-patch.ts
 import { createHash as createHash2 } from "node:crypto";
 import { realpath as realpath4 } from "node:fs/promises";
-import path3 from "node:path";
+import path4 from "node:path";
 import { z as z3 } from "zod";
 var SearchInputSchema = z3.object({
   query: z3.string().min(1),
@@ -709,6 +791,168 @@ var EditOutputSchema = z3.object({
 function sha256(value) {
   return createHash2("sha256").update(value).digest("hex");
 }
+async function searchFiles(config, limits, input) {
+  await authorizeCodingTool(config, {
+    operation: "search",
+    query: input.query,
+    mode: input.mode
+  });
+  const root = await realpath4(config.root);
+  await authorizeCodingPath(config, ".");
+  const excluded = new Set(config.search?.excludeDirectories ?? DEFAULT_EXCLUDED_DIRECTORIES);
+  const included = input.include ? compileWorkspaceGlob(input.include) : null;
+  let rejectedByInclude = 0;
+  const scan = await scanContainedFiles({
+    root,
+    maxDepth: limits.maxSearchDepth,
+    maxFiles: limits.maxSearchFiles,
+    symlinks: "skip",
+    ...input.mode === "content" && {
+      readMaxBytes: limits.maxReadBytes,
+      skipUnreadable: true
+    },
+    excludeDirectory: (relative) => relative.split(path4.sep).some((segment) => excluded.has(segment)),
+    includeFile: (candidate) => {
+      if (included && !included.test(candidate)) {
+        rejectedByInclude += 1;
+        return false;
+      }
+      return true;
+    },
+    authorizePath: (candidate) => isCodingPathAuthorized(config, candidate)
+  });
+  const matcher = input.regex ? compileSearchRegex(input.query) : null;
+  const hit = (line) => {
+    if (line.length > MAX_SEARCHED_LINE_BYTES)
+      return false;
+    if (matcher) {
+      matcher.lastIndex = 0;
+      return matcher.test(line);
+    }
+    return line.includes(input.query);
+  };
+  const matches = [];
+  let truncated = false;
+  for (const file of scan.files) {
+    if (input.mode === "path") {
+      if (hit(file.relative))
+        matches.push({ path: file.relative });
+    } else {
+      const text = file.content?.text;
+      if (text === undefined)
+        continue;
+      const lines = text.split(`
+`);
+      for (let index = 0;index < lines.length; index += 1) {
+        const line = lines[index];
+        if (line === undefined || !hit(line))
+          continue;
+        matches.push({
+          path: file.relative,
+          line: index + 1,
+          text: line,
+          ...input.context > 0 && {
+            before: lines.slice(Math.max(0, index - input.context), index),
+            after: lines.slice(index + 1, index + 1 + input.context)
+          }
+        });
+        if (matches.length >= limits.maxSearchResults)
+          break;
+      }
+    }
+    if (matches.length >= limits.maxSearchResults) {
+      truncated = true;
+      break;
+    }
+  }
+  return {
+    matches,
+    truncated: truncated || scan.truncated,
+    scannedFiles: scan.files.length,
+    skippedDirectories: scan.skippedDirectories,
+    skippedSymlinks: scan.skippedSymlinks,
+    ...scan.denied.length > 0 && {
+      denied: scan.denied.slice(0, limits.maxSearchResults).map(({ relative, kind }) => ({ path: relative, kind })),
+      deniedTruncated: scan.deniedTruncated || scan.denied.length > limits.maxSearchResults
+    },
+    ...input.include && scan.files.length === 0 && rejectedByInclude > 0 && {
+      hint: `The anchored include pattern \`${input.include}\` rejected all ${rejectedByInclude} ${rejectedByInclude === 1 ? "file" : "files"} the scan reached. \`*\` does not cross \`/\`; use a pattern such as \`**/*.ts\` for matching files in subdirectories.`
+    }
+  };
+}
+async function editFile(config, limits, input) {
+  const root = await realpath4(config.root);
+  const relative = boundedCodingRelativePath(root, input.path, limits.maxPathBytes);
+  await authorizeCodingPathChain(config, relative);
+  const parent = await openContainedParent(root, relative).catch((error) => refuseMissingCodingPath(error, relative));
+  try {
+    return await withCodingPathLock(`${root}:${relative}`, async () => {
+      const handle = await openContainedParentFile(parent).catch((error) => refuseMissingCodingPath(error, relative));
+      const read = await readContainedUtf8Handle(handle, limits.maxWriteBytes).finally(() => handle.close());
+      const source = read.text;
+      const baseSha256 = sha256(source);
+      if (input.expectedSha256 !== undefined && baseSha256 !== input.expectedSha256) {
+        conflict("The file changed since it was read", {
+          message: "The file changed since it was read",
+          path: relative,
+          expectedSha256: input.expectedSha256,
+          actualSha256: baseSha256
+        });
+      }
+      const count = textOccurrences(source, input.oldText);
+      if (count === 0) {
+        codingPathRefusal("NOT_FOUND", "oldText does not appear in this file", relative, {
+          details: { occurrences: 0 },
+          hint: "Read the file and copy the snippet exactly, including indentation."
+        });
+      }
+      if (!input.replaceAll && count !== 1) {
+        codingPathRefusal("CONFLICT", `oldText appears ${count} times, so the edit is ambiguous`, relative, {
+          details: { occurrences: count },
+          hint: "Lengthen the snippet until it is unique, or pass replaceAll: true."
+        });
+      }
+      const replacements = input.replaceAll ? count : 1;
+      const changed = input.replaceAll ? source.replaceAll(input.oldText, input.newText) : source.replace(input.oldText, () => input.newText);
+      const bytes = Buffer.byteLength(changed);
+      const resultSha256 = sha256(changed);
+      if (bytes > limits.maxWriteBytes) {
+        codingPathRefusal("BAD_REQUEST", `The result would be ${bytes} bytes, over the ${limits.maxWriteBytes}-byte limit`, relative, {
+          details: { bytes, maxWriteBytes: limits.maxWriteBytes },
+          hint: "Make a smaller edit, or split the file."
+        });
+      }
+      await authorizeCodingTool(config, {
+        operation: "edit",
+        path: relative,
+        baseSha256,
+        resultSha256,
+        resultBytes: bytes,
+        replacements,
+        dryRun: input.dryRun
+      });
+      await assertContainedParentCurrent(root, relative, parent.handle);
+      if (!input.dryRun) {
+        await writeContainedFile({
+          parent,
+          content: changed,
+          replace: true,
+          mode: read.mode
+        });
+      }
+      return {
+        path: relative,
+        baseSha256,
+        sha256: resultSha256,
+        replacements,
+        bytes,
+        applied: !input.dryRun
+      };
+    });
+  } finally {
+    await parent.handle.close();
+  }
+}
 function createSearchAndPatchCodingTools(config, limits) {
   const search = defineRuntimeTool({
     name: "search_files",
@@ -717,95 +961,7 @@ function createSearchAndPatchCodingTools(config, limits) {
     input: SearchInputSchema,
     output: SearchOutputSchema,
     transports: ["AGENT"],
-    handler: async ({ input }) => {
-      await authorizeCodingTool(config, {
-        operation: "search",
-        query: input.query,
-        mode: input.mode
-      });
-      const root = await realpath4(config.root);
-      await authorizeCodingPath(config, ".");
-      const excluded = new Set(config.search?.excludeDirectories ?? DEFAULT_EXCLUDED_DIRECTORIES);
-      const included = input.include ? compileWorkspaceGlob(input.include) : null;
-      let rejectedByInclude = 0;
-      const scan = await scanContainedFiles({
-        root,
-        maxDepth: limits.maxSearchDepth,
-        maxFiles: limits.maxSearchFiles,
-        symlinks: "skip",
-        ...input.mode === "content" && {
-          readMaxBytes: limits.maxReadBytes,
-          skipUnreadable: true
-        },
-        excludeDirectory: (relative) => relative.split(path3.sep).some((segment) => excluded.has(segment)),
-        includeFile: (candidate) => {
-          if (included && !included.test(candidate)) {
-            rejectedByInclude += 1;
-            return false;
-          }
-          return true;
-        },
-        authorizePath: (candidate) => isCodingPathAuthorized(config, candidate)
-      });
-      const matcher = input.regex ? compileSearchRegex(input.query) : null;
-      const hit = (line) => {
-        if (line.length > MAX_SEARCHED_LINE_BYTES)
-          return false;
-        if (matcher) {
-          matcher.lastIndex = 0;
-          return matcher.test(line);
-        }
-        return line.includes(input.query);
-      };
-      const matches = [];
-      let truncated = false;
-      for (const file of scan.files) {
-        if (input.mode === "path") {
-          if (hit(file.relative))
-            matches.push({ path: file.relative });
-        } else {
-          const text = file.content?.text;
-          if (text === undefined)
-            continue;
-          const lines = text.split(`
-`);
-          for (let index = 0;index < lines.length; index += 1) {
-            const line = lines[index];
-            if (line === undefined || !hit(line))
-              continue;
-            matches.push({
-              path: file.relative,
-              line: index + 1,
-              text: line,
-              ...input.context > 0 && {
-                before: lines.slice(Math.max(0, index - input.context), index),
-                after: lines.slice(index + 1, index + 1 + input.context)
-              }
-            });
-            if (matches.length >= limits.maxSearchResults)
-              break;
-          }
-        }
-        if (matches.length >= limits.maxSearchResults) {
-          truncated = true;
-          break;
-        }
-      }
-      return {
-        matches,
-        truncated: truncated || scan.truncated,
-        scannedFiles: scan.files.length,
-        skippedDirectories: scan.skippedDirectories,
-        skippedSymlinks: scan.skippedSymlinks,
-        ...scan.denied.length > 0 && {
-          denied: scan.denied.slice(0, limits.maxSearchResults).map(({ relative, kind }) => ({ path: relative, kind })),
-          deniedTruncated: scan.deniedTruncated || scan.denied.length > limits.maxSearchResults
-        },
-        ...input.include && scan.files.length === 0 && rejectedByInclude > 0 && {
-          hint: `The anchored include pattern \`${input.include}\` rejected all ${rejectedByInclude} ${rejectedByInclude === 1 ? "file" : "files"} the scan reached. \`*\` does not cross \`/\`; use a pattern such as \`**/*.ts\` for matching files in subdirectories.`
-        }
-      };
-    }
+    handler: ({ input }) => searchFiles(config, limits, input)
   });
   const edit = defineRuntimeTool({
     name: "edit_file",
@@ -814,79 +970,7 @@ function createSearchAndPatchCodingTools(config, limits) {
     input: EditInputSchema,
     output: EditOutputSchema,
     transports: ["AGENT"],
-    handler: async ({ input }) => {
-      const root = await realpath4(config.root);
-      const relative = boundedCodingRelativePath(root, input.path, limits.maxPathBytes);
-      await authorizeCodingPathChain(config, relative);
-      const parent = await openContainedParent(root, relative).catch((error) => refuseMissingCodingPath(error, relative));
-      try {
-        return await withCodingPathLock(`${root}:${relative}`, async () => {
-          const handle = await openContainedParentFile(parent).catch((error) => refuseMissingCodingPath(error, relative));
-          const read = await readContainedUtf8Handle(handle, limits.maxWriteBytes).finally(() => handle.close());
-          const source = read.text;
-          const baseSha256 = sha256(source);
-          if (input.expectedSha256 !== undefined && baseSha256 !== input.expectedSha256) {
-            conflict("The file changed since it was read", {
-              message: "The file changed since it was read",
-              path: relative,
-              expectedSha256: input.expectedSha256,
-              actualSha256: baseSha256
-            });
-          }
-          const count = textOccurrences(source, input.oldText);
-          if (count === 0) {
-            codingPathRefusal("NOT_FOUND", "oldText does not appear in this file", relative, {
-              details: { occurrences: 0 },
-              hint: "Read the file and copy the snippet exactly, including indentation."
-            });
-          }
-          if (!input.replaceAll && count !== 1) {
-            codingPathRefusal("CONFLICT", `oldText appears ${count} times, so the edit is ambiguous`, relative, {
-              details: { occurrences: count },
-              hint: "Lengthen the snippet until it is unique, or pass replaceAll: true."
-            });
-          }
-          const replacements = input.replaceAll ? count : 1;
-          const changed = input.replaceAll ? source.replaceAll(input.oldText, input.newText) : source.replace(input.oldText, () => input.newText);
-          const bytes = Buffer.byteLength(changed);
-          const resultSha256 = sha256(changed);
-          if (bytes > limits.maxWriteBytes) {
-            codingPathRefusal("BAD_REQUEST", `The result would be ${bytes} bytes, over the ${limits.maxWriteBytes}-byte limit`, relative, {
-              details: { bytes, maxWriteBytes: limits.maxWriteBytes },
-              hint: "Make a smaller edit, or split the file."
-            });
-          }
-          await authorizeCodingTool(config, {
-            operation: "edit",
-            path: relative,
-            baseSha256,
-            resultSha256,
-            resultBytes: bytes,
-            replacements,
-            dryRun: input.dryRun
-          });
-          await assertContainedParentCurrent(root, relative, parent.handle);
-          if (!input.dryRun) {
-            await writeContainedFile({
-              parent,
-              content: changed,
-              replace: true,
-              mode: read.mode
-            });
-          }
-          return {
-            path: relative,
-            baseSha256,
-            sha256: resultSha256,
-            replacements,
-            bytes,
-            applied: !input.dryRun
-          };
-        });
-      } finally {
-        await parent.handle.close();
-      }
-    }
+    handler: ({ input }) => editFile(config, limits, input)
   });
   return [search, edit];
 }
@@ -896,30 +980,30 @@ import { realpath as realpath5, stat } from "node:fs/promises";
 
 // src/agent-runtime/coding-shell-process.ts
 import { spawn } from "node:child_process";
-async function runCodingShell(input) {
-  const preview = (data, budget) => {
-    if (data.byteLength <= budget) {
-      return { data, headBytes: data.byteLength, tailBytes: 0, omittedBytes: 0 };
-    }
-    const headEnd = utf8AlignedEnd(data, 0, Math.ceil(budget / 2));
-    const tailStart = Math.max(headEnd, utf8AlignedStart(data, data.byteLength - Math.floor(budget / 2), data.byteLength));
-    const tailBytes = data.byteLength - tailStart;
-    return {
-      data: Buffer.concat([data.subarray(0, headEnd), data.subarray(tailStart)]),
-      headBytes: headEnd,
-      tailBytes,
-      omittedBytes: data.byteLength - headEnd - tailBytes
-    };
+function preview(data, budget) {
+  if (data.byteLength <= budget) {
+    return { data, headBytes: data.byteLength, tailBytes: 0, omittedBytes: 0 };
+  }
+  const headEnd = utf8AlignedEnd(data, 0, Math.ceil(budget / 2));
+  const tailStart = Math.max(headEnd, utf8AlignedStart(data, data.byteLength - Math.floor(budget / 2), data.byteLength));
+  const tailBytes = data.byteLength - tailStart;
+  return {
+    data: Buffer.concat([data.subarray(0, headEnd), data.subarray(tailStart)]),
+    headBytes: headEnd,
+    tailBytes,
+    omittedBytes: data.byteLength - headEnd - tailBytes
   };
-  const retainedPreview = (data) => {
-    const end = utf8AlignedEnd(data, 0, data.byteLength);
-    return {
-      data: data.subarray(0, end),
-      headBytes: end,
-      tailBytes: 0,
-      omittedBytes: data.byteLength - end
-    };
+}
+function retainedPreview(data) {
+  const end = utf8AlignedEnd(data, 0, data.byteLength);
+  return {
+    data: data.subarray(0, end),
+    headBytes: end,
+    tailBytes: 0,
+    omittedBytes: data.byteLength - end
   };
+}
+async function runCodingShell(input) {
   const stdoutHeader = Buffer.from(`--- stdout ---
 `);
   const stderrHeader = Buffer.from(`
@@ -1192,10 +1276,10 @@ var AGENT_CODING_TOOL_NAMES = {
   writeFile: "write_file"
 };
 function createAgentCodingTools(config) {
-  if (!path4.isAbsolute(config.root))
+  if (!path5.isAbsolute(config.root))
     throw new Error("Coding tool root must be absolute");
   for (const executable of Object.values(config.executables ?? {})) {
-    if (!path4.isAbsolute(executable)) {
+    if (!path5.isAbsolute(executable)) {
       throw new Error("Coding tool executables must be absolute paths");
     }
   }

package/dist/{index-vcvkq30w.js → index-hmp4800j.js}

@@ -1,12 +1,12 @@
 import {
   contractToolMountable
-} from "./index-2cr1cqhn.js";
+} from "./index-khtgb21r.js";
 import {
   runtimeToolMountable
-} from "./index-v38qyerb.js";
+} from "./index-xw3s75nj.js";
 import {
   projectToolSurface
-} from "./index-dydjcp8z.js";
+} from "./index-np4m8hd3.js";
 
 // src/tools/surface.ts
 function collectToolSurface({