Evaluation on the shipped Web composition decided the defaults: the
`fs-observation-policy` row in dsh-base ships `disabled: true`, so write,
edit, and apply_patch mutate unconditionally in every profile; the Web
`standard` preset lists apply_patch; and the tool-fs `applyPatchGuard` switch
is gone, apply_patch always consulting the fs/* intent waterfalls like the
other mutating tools.
The write and edit guidance stops citing the policy as the default, and the
apply_patch guidance asks for enough hunk context instead of a prior read.
The two recordings that capture a policy refusal (fs-policy-reject and
apply-patch-rejected) re-enable the row through a per-scenario
runtime.cordis.yml; every other sidecar follows the prompt change, and the
Web standard-preset recordings gain the apply_patch schema. An upgrade guide
records the default change.
`tool-fs.applyPatchGuard` selects the mutation guards of apply_patch:
`observation` consults the mounted observation policy per operation like
write and edit; `none`, the default, applies hunks unconditionally on
context match alone as the Codex tool does, keeps publishing fs/observed,
and replaces the read-first guidance with a context-matching reminder.
In 2,226 recorded DS-Bench and DeepSWE rollouts with the policy on, read-first
and stale-version refusals were 29–41% of apply_patch failures although hunk
context matching already rejects a divergent file. The recorded apply-patch
scenarios pin `observation`, under which they were captured.
`tool-fs.applyPatch` now defaults to false instead of deriving from
`write && edit`, so every shipped composition keeps the model request it
had before the tool existed. The `tool-fs` rows that enable `edit`
(dsh-base and the Web standard, ptc, and cordis presets) state
`applyPatch: false` explicitly; changing that one line adds the tool.
The apply-patch snapshot composition enables the switch, the tool catalog
mounts tool-fs with it on so the schema stays documented, and every other
recorded expectation returns to the master baseline.
Regenerate docs/module-graph for the fs-patch package, add apply_patch
to the shipped Web composition tool list, and refresh the Web
tool-schema, system-prompt, and collapse-timing pins that CI compares
against the default tool set.
Cover the symbolic-link preflight refusal through a provider lstat
double and the atomic-write parent failure through a regular-file
blocker, so Windows coverage no longer depends on POSIX-only tests.
Drop the preflight sandbox fence. It derived writable roots in the local
process, so under the SSH provider it threw on remote additionalWritableRoots
and compared remote targets against local temp roots; write and edit never
fenced in the tool layer. The provider now refuses a denied operation at
commit, and a commit whose first operation failed without any change rejects
like a preflight refusal so the sandbox escalation path keeps its error code.
Classify FS_ABORTED as unknown: a cancelled remote request rejects while the
provider may still be writing, so no stat comparison can settle it. Document
that a cancelled call receives the registry's abort result like every tool.
Store no diff for creations, matching write, and bound the move source basis
by diffBasisMaxBytes so persisted metadata never holds whole files;
FsMoveOutcome.sourceBefore becomes nullable. Omit deletions from the call
preview and from result diffs without a basis instead of rendering them as
empty creations, and count distinct files in the preview title.
Reject a NUL byte beyond the read sampling window in preflight, name targets
by display path in atomic-write diagnostics, align the apply_patch guidance
with the edit wording and mention delete and move, read the stopped flag and
applied diffs tool-agnostically in the client models, skip the permission-bit
snapshot under root, list fs/delete-intent in the tool catalog, and refresh
the fs-patch description, group README, fs-sandbox summary, and ui-tool README.
Restore files outside the patch feature to their merge-base state: the
invariant-check refactors across acp, session-controller, client,
compaction, agent-loop, agent, session-title, and subprocess, the cast
baseline edit, and the rescope-vendor skip list added during the merge.
Rename tool-fs.enableApplyPatch to applyPatch, matching the read, write,
and edit switches. Remove the unused collectMutationPaths export and the
unconsumed PatchHunk.contextLineIndices field, including its SSH schema
and fixtures. Report preflight refusals and syntax failures directly
instead of padding every phase with outcome, affectedPaths, and
cancelled fields. Add apply_patch to the shipped tool catalog test.
Fold the default-activation Agent Note into the apply_patch file-editing
note and delete it. Delete the guarded-filesystem-mutations upgrade
guide: every change is additive and all FileSystem subclasses live in
this repository. Trim defensive and reviewer-addressed sentences from
the package READMEs, subsystem docs, FileSystem JSDoc, and the Agent
Note, keeping the English and Chinese pairs aligned.
Regenerate config/tool/module/event catalogs, Cordis API and client slot catalogs; re-record reviewed bilingual hashes instead of merging generated bytes.
Accept deleted filesystem invariant companions. Master has no replacement event-invariant registration; keep delete-intent in typed events, policy guards, and behavior tests.
Adopt master workspace-changes intent waterfalls and tool-execution recorder association, add a prepended delete-intent listener that delegates before capture, remove argument parsing and the fs-patch dependency, and retain the real-tool Review matrix.
Keep master filesystem mutation-result metadata and tool switches alongside opt-in apply_patch. Await current-directory resolution in plan and no-follow preflight; store patch diffs as processPath. Adapt native/PTC fixtures to the supported modes.
Preserve client patch diffs and stopped states with master partial arguments and absolute navigation. Use master's rewritten ProviderEditor, including its remaining repeated model validation.
Regenerate the lockfile with pnpm install and align the new fs-patch package version. Clean retired package build outputs. Update exact rescope exceptions for verified preset and event identifiers from master; old package names remain rejected.
sjw1231