Add apply_patch for atomic multi-file edits

One envelope carrying Add, Update, Move, and Delete file markers, validated in full before anything is written: a failure on the fourth file leaves the first three untouched. Permission rules match every path a patch touches, and the write guard and secret checks cover it alongside the other write tools.

Ultraworked with [Sisyphus](https://github.com/code-yeongyu/oh-my-openagent)

Co-authored-by: Sisyphus <clio-agent@sisyphuslabs.ai>

src/permission.ts

@@ -68,6 +68,18 @@ export function subjectOf(tool: string, input: unknown): string | undefined {
     case 'list_dir':
     case 'git_blame':
       return str('path');
+    case 'web_fetch':
+      return str('url');
+    case 'apply_patch': {
+      // Every path the patch touches, so denying `src/generated/*` catches a patch
+      // that includes one alongside files it may edit.
+      const patch = str('patch');
+      if (!patch) return undefined;
+      const paths = [...patch.matchAll(/^\*\*\* (?:Add|Update|Delete) File: (.+)$/gm)].map((m) => m[1]!.trim());
+      const moves = [...patch.matchAll(/^\*\*\* Move to: (.+)$/gm)].map((m) => m[1]!.trim());
+      const all = [...paths, ...moves];
+      return all.length > 0 ? all.join(' ') : undefined;
+    }
     case 'read_many_files': {
       // A batch read is gated on the paths it asks for, so one bad path in
       // twenty is enough to trigger a rule.
@@ -97,11 +109,14 @@ export function subjectOf(tool: string, input: unknown): string | undefined {
 }
 
 /**
- * A read_many_files subject is several paths at once, so a rule has to match if
- * it matches any of them: denying `*.env` must catch a batch that includes one.
+ * A subject that is several strings at once is matched if a rule matches any of
+ * them: denying `*.env` must catch a batch read that includes one, and denying
+ * `src/generated/*` must catch a patch that touches one among five files.
  */
+const MULTI = new Set(['read_many_files', 'apply_patch']);
+
 const subjectsFor = (tool: string, subject: string): string[] =>
-  tool === 'read_many_files' ? subject.split(' ') : [subject];
+  MULTI.has(tool) ? subject.split(' ') : [subject];
 
 export type Resolved = { decision: Decision; pattern: string | undefined };
 
@@ -154,7 +169,9 @@ export const DEFAULT_PERMISSIONS: PermissionConfig = {
   write_file: 'ask',
   edit_file: 'ask',
   multi_edit: 'ask',
+  apply_patch: 'ask',
   bash: 'ask',
+  web_fetch: 'ask',
 };
 
 /** Session, plugin, and read-only tools that never gate. */

src/plugins-builtin.ts

@@ -66,9 +66,116 @@ export const timePlugin: Plugin = {
   },
 };
 
-export const BUILTIN_PLUGINS: Plugin[] = [guardPlugin, bellPlugin, timePlugin];
+/**
+ * Paths that hold credentials.
+ *
+ * The permission defaults already refuse to *read* these. This refuses to write
+ * them, which is a different failure: a model asked to "add the API key to the env
+ * file" will do exactly that, and a secret committed by an agent is a secret to
+ * rotate. The user writes their own credentials.
+ */
+const SECRET_PATHS: { re: RegExp; why: string }[] = [
+  // `.env.example` holds placeholders by convention and is the one such file a
+  // model legitimately writes, so it is excluded here rather than by a later rule.
+  { re: /(^|[\\/])\.env(?!\.example$)(\.|$)/i, why: 'an env file' },
+  { re: /\.(pem|key|p12|pfx|jks|keystore)$/i, why: 'a key or certificate' },
+  { re: /(^|[\\/])(id_rsa|id_ed25519|id_ecdsa|id_dsa)(\.pub)?$/i, why: 'an SSH key' },
+  { re: /(^|[\\/])\.(npmrc|pypirc|netrc|pgpass)$/i, why: 'a registry or database credential file' },
+  { re: /(^|[\\/])(credentials|secrets?)\.(json|ya?ml|toml|ini)$/i, why: 'a credentials file' },
+  { re: /(^|[\\/])\.aws[\\/]/i, why: 'an AWS credential directory' },
+  { re: /(^|[\\/])\.ssh[\\/]/i, why: 'an SSH directory' },
+  { re: /(^|[\\/])\.gnupg[\\/]/i, why: 'a GPG directory' },
+];
 
-/** Enabled unless the config turns them off. bell is opt-in; a bell per turn is intrusive. */
-export const DEFAULT_ENABLED = ['guard', 'time'];
+/** Every path a write tool might carry, including a patch's markers. */
+function writtenPaths(toolName: string, input: unknown): string[] {
+  const o = (input ?? {}) as Record<string, unknown>;
 
-export { DESTRUCTIVE };
+  if (toolName === 'apply_patch') {
+    const patch = typeof o['patch'] === 'string' ? o['patch'] : '';
+    return [
+      ...[...patch.matchAll(/^\*\*\* (?:Add|Update|Delete) File: (.+)$/gm)].map((m) => m[1]!.trim()),
+      ...[...patch.matchAll(/^\*\*\* Move to: (.+)$/gm)].map((m) => m[1]!.trim()),
+    ];
+  }
+
+  return typeof o['path'] === 'string' ? [o['path']] : [];
+}
+
+export const secretsPlugin: Plugin = {
+  name: 'secrets',
+  description: 'refuses to write credential files',
+  appendix:
+    'The secrets plugin refuses writes to env files, keys, and credential stores. If one needs a value, tell the ' +
+    'user which file and which key, and let them write it themselves. Do not work around the refusal by writing ' +
+    'the same content somewhere else.',
+  beforeToolCall: ({ toolName, input }) => {
+    if (!['write_file', 'edit_file', 'multi_edit', 'apply_patch'].includes(toolName)) return undefined;
+
+    for (const path of writtenPaths(toolName, input)) {
+      for (const { re, why } of SECRET_PATHS) {
+        if (re.test(path)) {
+          return `refusing to write ${path} (${why}). Tell the user what to put there and let them write it.`;
+        }
+      }
+    }
+    return undefined;
+  },
+};
+
+const FORMATTERS: { file: string; script: string; command: string[] }[] = [
+  { file: 'package.json', script: 'format', command: ['bun', 'run', 'format'] },
+  { file: 'Cargo.toml', script: '', command: ['cargo', 'fmt'] },
+  { file: 'go.mod', script: '', command: ['gofmt', '-w', '.'] },
+];
+
+/**
+ * Runs the project's own formatter once a turn ends, if it has one.
+ *
+ * Off by default. It is useful — a diff without formatting noise reviews faster —
+ * but it writes to files after the approvals for that turn are over, which is a
+ * boundary worth crossing only on purpose.
+ *
+ * It runs the script the project already defines rather than shipping opinions
+ * about style. No `package.json` `format` script means nothing happens.
+ */
+export const formatPlugin: Plugin = {
+  name: 'format',
+  description: "runs the project's own formatter after each turn",
+  afterTurn: async () => {
+    for (const { file, script, command } of FORMATTERS) {
+      const manifest = Bun.file(file);
+      if (!(await manifest.exists())) continue;
+
+      if (script) {
+        try {
+          const pkg = (await manifest.json()) as { scripts?: Record<string, string> };
+          if (!pkg.scripts?.[script]) continue;
+        } catch {
+          continue;
+        }
+      }
+
+      try {
+        const proc = Bun.spawn(command, { stdout: 'ignore', stderr: 'ignore', timeout: 60_000 });
+        await proc.exited;
+      } catch {
+        // A missing binary is not worth interrupting the turn over.
+      }
+      return;
+    }
+  },
+};
+
+export const BUILTIN_PLUGINS: Plugin[] = [guardPlugin, secretsPlugin, bellPlugin, timePlugin, formatPlugin];
+
+/**
+ * Enabled unless the config turns them off.
+ *
+ * `guard` and `secrets` are refusals, so they are on: a user who has to opt into a
+ * safety check does not have it. `bell` and `format` both act on their own — one
+ * makes noise, the other writes files — so they are opt-in.
+ */
+export const DEFAULT_ENABLED = ['guard', 'secrets', 'time'];
+
+export { DESTRUCTIVE, SECRET_PATHS };

src/tools.ts

@@ -4,6 +4,7 @@ import { join, resolve } from 'node:path';
 import { z } from 'zod';
 import { jail, posix, walk } from './ignore';
 import { GIT_TOOL_NAMES, gitTools } from './tools-git';
+import { NET_TOOL_NAMES, netTools } from './tools-net';
 
 /** Max chars returned by any single tool. Beyond this the output is truncated. */
 const MAX_OUTPUT = 30_000;
@@ -85,6 +86,169 @@ export const readManyFilesTool = tool({
   },
 });
 
+export type PatchOp =
+  | { kind: 'add'; path: string; content: string }
+  | { kind: 'update'; path: string; moveTo?: string; oldString: string; newString: string }
+  | { kind: 'delete'; path: string };
+
+const MARKER = /^\*\*\* (Add|Update|Delete) File: (.+)$/;
+const MOVE = /^\*\*\* Move to: (.+)$/;
+
+/**
+ * Parses the patch envelope. Exported so the format is testable without a disk.
+ *
+ * The shape follows Codex's `apply_patch`, which is worth copying for one reason:
+ * models have seen it. A bespoke format costs schema description and gets malformed
+ * calls until the model learns it.
+ *
+ *     *** Add File: src/new.ts
+ *     +export const a = 1;
+ *     *** Update File: src/old.ts
+ *     *** Move to: src/renamed.ts
+ *     -const a = 1;
+ *     +const a = 2;
+ *     *** Delete File: src/gone.ts
+ */
+export function parsePatch(patch: string): PatchOp[] {
+  const lines = patch.replace(/\r\n/g, '\n').split('\n');
+  const ops: PatchOp[] = [];
+  let i = 0;
+
+  while (i < lines.length) {
+    const line = lines[i]!;
+    if (line.trim().length === 0) {
+      i++;
+      continue;
+    }
+
+    const marker = MARKER.exec(line);
+    if (!marker) throw new Error(`patch line ${i + 1} is not a marker or part of a hunk: ${line.slice(0, 60)}`);
+
+    const kind = marker[1]!.toLowerCase() as 'add' | 'update' | 'delete';
+    const path = marker[2]!.trim();
+    i++;
+
+    if (kind === 'delete') {
+      ops.push({ kind: 'delete', path });
+      continue;
+    }
+
+    let moveTo: string | undefined;
+    const move = i < lines.length ? MOVE.exec(lines[i]!) : null;
+    if (move) {
+      if (kind === 'add') throw new Error(`${path}: "Move to" is only valid on an Update`);
+      moveTo = move[1]!.trim();
+      i++;
+    }
+
+    const removed: string[] = [];
+    const added: string[] = [];
+    while (i < lines.length && !MARKER.test(lines[i]!)) {
+      const body = lines[i]!;
+      if (body.startsWith('+')) added.push(body.slice(1));
+      else if (body.startsWith('-')) removed.push(body.slice(1));
+      else if (body.trim().length > 0) {
+        throw new Error(`${path}: hunk line ${i + 1} starts with neither + nor -: ${body.slice(0, 60)}`);
+      }
+      i++;
+    }
+
+    if (kind === 'add') {
+      if (removed.length > 0) throw new Error(`${path}: an Add cannot remove lines`);
+      ops.push({ kind: 'add', path, content: added.join('\n') });
+      continue;
+    }
+
+    if (removed.length === 0) throw new Error(`${path}: an Update needs at least one - line to locate the change`);
+    ops.push({
+      kind: 'update',
+      path,
+      ...(moveTo ? { moveTo } : {}),
+      oldString: removed.join('\n'),
+      newString: added.join('\n'),
+    });
+  }
+
+  if (ops.length === 0) throw new Error('the patch is empty');
+  return ops;
+}
+
+export const applyPatchTool = tool({
+  description:
+    'Apply one patch across several files: add, update, move, and delete in a single call. All or nothing — if any ' +
+    'part fails, nothing is written. Use it when a change spans files that must land together, such as a rename ' +
+    'plus its callers. For several edits to one file use multi_edit; for one edit use edit_file.\n' +
+    'Format, one marker per file:\n' +
+    '*** Add File: path      then + lines for the whole new file\n' +
+    '*** Update File: path   then - lines to find and + lines to replace them with\n' +
+    '*** Move to: path       directly after an Update marker, to rename\n' +
+    '*** Delete File: path   no hunk\n' +
+    'The - lines must match the file byte-for-byte and appear exactly once.',
+  inputSchema: z.object({
+    patch: z.string().describe('The patch envelope, as described above'),
+  }),
+  execute: async ({ patch }) => {
+    const ops = parsePatch(patch);
+
+    // Every operation is resolved and validated against the real files before
+    // anything is written. A patch that fails on its fourth file must not leave
+    // the first three applied — that is the only reason to have this tool rather
+    // than a sequence of edit_file calls.
+    const writes: { abs: string; content: string }[] = [];
+    const removals: string[] = [];
+    const summary: string[] = [];
+    const seen = new Set<string>();
+
+    for (const op of ops) {
+      if (seen.has(op.path)) throw new Error(`${op.path} appears twice in one patch`);
+      seen.add(op.path);
+      const abs = jail(op.path);
+
+      if (op.kind === 'delete') {
+        if (!(await Bun.file(abs).exists())) throw new Error(`cannot delete ${op.path}: no such file`);
+        removals.push(abs);
+        summary.push(`deleted ${op.path}`);
+        continue;
+      }
+
+      if (op.kind === 'add') {
+        if (await Bun.file(abs).exists()) throw new Error(`cannot add ${op.path}: it already exists`);
+        writes.push({ abs, content: op.content.endsWith('\n') ? op.content : `${op.content}\n` });
+        summary.push(`added ${op.path}`);
+        continue;
+      }
+
+      const file = Bun.file(abs);
+      if (!(await file.exists())) throw new Error(`cannot update ${op.path}: no such file`);
+      if (await isBinary(abs)) throw new Error(`cannot update ${op.path}: it is a binary file`);
+
+      const before = await file.text();
+      const count = before.split(op.oldString).length - 1;
+      if (count === 0) throw new Error(`${op.path}: the - lines do not match the file. Nothing was written.`);
+      if (count > 1) {
+        throw new Error(`${op.path}: the - lines appear ${count} times. Add context to make them unique.`);
+      }
+
+      const after = before.replace(op.oldString, op.newString);
+      if (op.moveTo) {
+        const target = jail(op.moveTo);
+        if (await Bun.file(target).exists()) throw new Error(`cannot move ${op.path}: ${op.moveTo} already exists`);
+        writes.push({ abs: target, content: after });
+        removals.push(abs);
+        summary.push(`moved ${op.path} to ${op.moveTo}`);
+      } else {
+        writes.push({ abs, content: after });
+        summary.push(`updated ${op.path}`);
+      }
+    }
+
+    for (const { abs, content } of writes) await Bun.write(abs, content);
+    for (const abs of removals) await Bun.file(abs).delete();
+
+    return `Applied ${ops.length} change${ops.length === 1 ? '' : 's'}:\n${summary.map((s) => `- ${s}`).join('\n')}`;
+  },
+});
+
 export const writeFileTool = tool({
   description: 'Create a file or overwrite it completely. Prefer edit_file for existing files.',
   inputSchema: z.object({
@@ -504,11 +668,13 @@ export const tools = {
   write_file: writeFileTool,
   edit_file: editFileTool,
   multi_edit: multiEditTool,
+  apply_patch: applyPatchTool,
   list_dir: listDirTool,
   glob: globTool,
   grep: grepTool,
   bash: bashTool,
   ...gitTools,
+  ...netTools,
 };
 
 /**
@@ -517,11 +683,16 @@ export const tools = {
  * Measured at ~550 chars of JSON schema per tool on every request, and selection
  * accuracy falls as the list grows, so this is both a cost and a quality knob.
  * `core` is not listable here: without read, edit, and bash the agent is not an agent.
+ *
+ * `net` is the exception that is off unless asked for. Every other tool stays inside
+ * the workspace; `web_fetch` reaches the internet and brings a stranger's text back
+ * into the context, which is a decision rather than a default.
  */
 export const TOOL_SETS = {
   core: ['read_file', 'write_file', 'edit_file', 'glob', 'grep', 'bash'],
-  'edit-plus': ['multi_edit', 'list_dir', 'read_many_files'],
+  'edit-plus': ['multi_edit', 'list_dir', 'read_many_files', 'apply_patch'],
   git: GIT_TOOL_NAMES,
+  net: NET_TOOL_NAMES,
 } as const satisfies Record<string, readonly string[]>;
 
 export type ToolSetName = keyof typeof TOOL_SETS;
@@ -530,6 +701,9 @@ export const TOOL_SET_NAMES = Object.keys(TOOL_SETS) as ToolSetName[];
 
 export const isToolSetName = (v: string): v is ToolSetName => (TOOL_SET_NAMES as string[]).includes(v);
 
+/** Sets offered when the config says nothing. `net` is opt-in. */
+export const DEFAULT_TOOL_SETS: ToolSetName[] = ['core', 'edit-plus', 'git'];
+
 /** Which set a tool came from, for `/tools`. Session, plugin, and MCP tools have none. */
 export function toolSetOf(name: string): ToolSetName | undefined {
   return TOOL_SET_NAMES.find((set) => (TOOL_SETS[set] as readonly string[]).includes(name));
@@ -538,14 +712,16 @@ export function toolSetOf(name: string): ToolSetName | undefined {
 /**
  * Names to withhold given the enabled sets. A tool belonging to no set is never
  * withheld: session, plugin, and MCP tools are not part of this budget.
+ *
+ * Omitting `toolSets` entirely means the defaults, not everything — `net` has to be
+ * asked for by name.
  */
 export function disabledToolNames(enabled: readonly ToolSetName[] | undefined): string[] {
-  if (!enabled) return [];
-  const live = new Set<ToolSetName>([...enabled, 'core']);
+  const live = new Set<ToolSetName>([...(enabled ?? DEFAULT_TOOL_SETS), 'core']);
   return TOOL_SET_NAMES.filter((set) => !live.has(set)).flatMap((set) => [...TOOL_SETS[set]]);
 }
 
 /** Tools that mutate the workspace or run arbitrary code always ask the user first. */
-export const MUTATING_TOOLS = ['write_file', 'edit_file', 'multi_edit', 'bash'] as const;
+export const MUTATING_TOOLS = ['write_file', 'edit_file', 'multi_edit', 'apply_patch', 'bash'] as const;
 
 export { jail };