This pull request lands the tool; switching the shipped defaults is a
separate pull request stacked on it. Every shipped `tool-fs` row states
`applyPatch: false`, the `fs-observation-policy` row stays mounted, the
write, edit, and apply_patch guidance names the policy, and every recorded
expectation outside the apply-patch scenarios returns to the master
baseline. The upgrade guide, the parity exception, and the optional
classification of the policy package move to the stacked change.
The SDK/Desktop parity check requires the `standard` tool sets to match, so
the base row enables apply_patch like the Web standard preset; the SDK PTC
overlay keeps that row while the Desktop PTC preset lists its own, which the
parity exceptions now record. fs-observation-policy, no longer mounted by
default, is classified as an optional product package.
Every headless, SDK, and ACP recording follows: sidecars and recorded headers
gain the apply_patch schema, the fixed-budget compaction scenarios pin
`applyPatch: false` so their recorded thresholds hold (model-switch-notice and
session-resume own their schema sidecars again), the parent presets that
borrow the default pin mirror the base row, and the pwsh and Python PTC pins
carry the schema and guidance.
Keeps the apply_patch toolview registration with master's file-menu inject,
takes master's shortened slot JSDoc, re-adds the seven filesystem type-equiv
manifest entries, regenerates the event matrix and client catalogs, moves the
fs-observation-policy upgrade guide under v0.2.2-alpha.2 with the matching
fs-patch version, and refreshes the two SDK scenarios master added for the
write and edit guidance change.
Evaluation on the shipped Web composition decided the defaults: the
`fs-observation-policy` row in dsh-base ships `disabled: true`, so write,
edit, and apply_patch mutate unconditionally in every profile; the Web
`standard` preset lists apply_patch; and the tool-fs `applyPatchGuard` switch
is gone, apply_patch always consulting the fs/* intent waterfalls like the
other mutating tools.
The write and edit guidance stops citing the policy as the default, and the
apply_patch guidance asks for enough hunk context instead of a prior read.
The two recordings that capture a policy refusal (fs-policy-reject and
apply-patch-rejected) re-enable the row through a per-scenario
runtime.cordis.yml; every other sidecar follows the prompt change, and the
Web standard-preset recordings gain the apply_patch schema. An upgrade guide
records the default change.
The guidance described only the commit phase ("stop at the first failure,
not rolled back"), so a model inferred that an invalid hunk would leave
earlier operations applied. The sentence now says the whole patch is checked
first and a rejected patch changes nothing before describing commit order.
`tool-fs.applyPatchGuard` selects the mutation guards of apply_patch:
`observation` consults the mounted observation policy per operation like
write and edit; `none`, the default, applies hunks unconditionally on
context match alone as the Codex tool does, keeps publishing fs/observed,
and replaces the read-first guidance with a context-matching reminder.
In 2,226 recorded DS-Bench and DeepSWE rollouts with the policy on, read-first
and stale-version refusals were 29–41% of apply_patch failures although hunk
context matching already rejects a divergent file. The recorded apply-patch
scenarios pin `observation`, under which they were captured.
Across 2,226 recorded DS-Bench and DeepSWE rollouts, 14% of apply_patch
calls arrived as {"input": ...} and were rejected for the missing `patch`
property: models trained on the Codex tool send its parameter name
unprompted. The schema now uses `input`; the executor request keeps its
internal `patch` field. Recorded apply-patch sessions, the schema sidecar,
and the catalogs follow.
Takes master's re-measured npm install-layout budget, which covers this
branch's graph, and regenerates the Cordis API, event matrix, client slot,
and tool catalogs on the merged tree.
The merged master raised the workspace version to 0.2.1-rc.3; the new
`@deepseek-ai/dsh-fs-patch` package follows it. The package adds one row and
its edges to the dual-release graph, so the install-layout budget records the
measured 316 package(s) x 2790 internal edge(s) = 881,640 unit(s).
Resolves the headless snapshot runner (keeps both the readonly-patch-directory
and cua-script-guidance workspace setups), regenerates the client slot and tool
catalogs with their pairing record, adds the apply_patch tool title to the five
locales master introduced, and refreshes the apply-patch system-prompt pin for
master's subagent guidance change.
`tool-fs.applyPatch` now defaults to false instead of deriving from
`write && edit`, so every shipped composition keeps the model request it
had before the tool existed. The `tool-fs` rows that enable `edit`
(dsh-base and the Web standard, ptc, and cordis presets) state
`applyPatch: false` explicitly; changing that one line adds the tool.
The apply-patch snapshot composition enables the switch, the tool catalog
mounts tool-fs with it on so the schema stays documented, and every other
recorded expectation returns to the master baseline.
Regenerate docs/module-graph for the fs-patch package, add apply_patch
to the shipped Web composition tool list, and refresh the Web
tool-schema, system-prompt, and collapse-timing pins that CI compares
against the default tool set.
Cover the symbolic-link preflight refusal through a provider lstat
double and the atomic-write parent failure through a regular-file
blocker, so Windows coverage no longer depends on POSIX-only tests.
The default per-image limit is 50 MiB and the default per-side limit is
65,535 pixels, but the admission summaries in the attachment subsystem
page and the attachment-local README still named 20 MiB and 8192 pixels.
The session-controller note on the /api/file byte limit and the tool-fs
note on read_image source caps also named the old 20 MiB maxImageBytes
default.
Drop the preflight sandbox fence. It derived writable roots in the local
process, so under the SSH provider it threw on remote additionalWritableRoots
and compared remote targets against local temp roots; write and edit never
fenced in the tool layer. The provider now refuses a denied operation at
commit, and a commit whose first operation failed without any change rejects
like a preflight refusal so the sandbox escalation path keeps its error code.
Classify FS_ABORTED as unknown: a cancelled remote request rejects while the
provider may still be writing, so no stat comparison can settle it. Document
that a cancelled call receives the registry's abort result like every tool.
Store no diff for creations, matching write, and bound the move source basis
by diffBasisMaxBytes so persisted metadata never holds whole files;
FsMoveOutcome.sourceBefore becomes nullable. Omit deletions from the call
preview and from result diffs without a basis instead of rendering them as
empty creations, and count distinct files in the preview title.
Reject a NUL byte beyond the read sampling window in preflight, name targets
by display path in atomic-write diagnostics, align the apply_patch guidance
with the edit wording and mention delete and move, read the stopped flag and
applied diffs tool-agnostically in the client models, skip the permission-bit
snapshot under root, list fs/delete-intent in the tool catalog, and refresh
the fs-patch description, group README, fs-sandbox summary, and ui-tool README.
A patch creates files like write and updates them like edit, so
applyPatch now defaults to `write && edit` instead of an independent
true. Compositions that disable both text mutation tools lose
apply_patch without naming it, and a user config override of the
tool-fs row cannot bring the tool back; the sdk-minimal and Web
minimal presets drop their explicit applyPatch: false. An explicit
value still overrides the derivation.
Align the fs-patch package version with the 0.2.1-rc.2 root, and add
apply_patch to the standard preset tool list, the subagent-inheritance
expected session, and the Python SDK dynamic-tools snapshot.
Restore files outside the patch feature to their merge-base state: the
invariant-check refactors across acp, session-controller, client,
compaction, agent-loop, agent, session-title, and subprocess, the cast
baseline edit, and the rescope-vendor skip list added during the merge.
Rename tool-fs.enableApplyPatch to applyPatch, matching the read, write,
and edit switches. Remove the unused collectMutationPaths export and the
unconsumed PatchHunk.contextLineIndices field, including its SSH schema
and fixtures. Report preflight refusals and syntax failures directly
instead of padding every phase with outcome, affectedPaths, and
cancelled fields. Add apply_patch to the shipped tool catalog test.
Fold the default-activation Agent Note into the apply_patch file-editing
note and delete it. Delete the guarded-filesystem-mutations upgrade
guide: every change is additive and all FileSystem subclasses live in
this repository. Trim defensive and reviewer-addressed sentences from
the package READMEs, subsystem docs, FileSystem JSDoc, and the Agent
Note, keeping the English and Chinese pairs aligned.
Directory entry names reach the same display-path helper, so expansion
moves to resolve and lstat. Replacing only the prefix keeps physical
parent traversal; ~\ expands only on Windows.
Refs #6548
sjw1231