fix(runtime): single-source the write-kind set and add apply_patch CAS behavior tests

Review follow-ups (#3487, Opus5/Luna):

- `operationAccess` (write | apply_patch | edit | format_json) now lives
  once in the shared protocol module; the client, the worker and the
  executor's T0-marker decision all call it, so the set cannot drift —
  the executor previously hand-copied a third list that silently dropped
  apply_patch onto 'unchecked'.
- Worker-level behavior tests: an apply_patch update against a swapped
  inode fails path_changed and leaves the replacement content untouched
  (delete and edit already had such tests; update was the gap).
- Format the smoke-test fixtures so the exact-head format check passes.

Generated-by: DSv4F-AstroHan

Author: Astro-Han

packages/runtime/src/__tests__/filesystem-target-identity.test.ts

@@ -155,6 +155,37 @@ describe('filesystem worker target identity CAS', () => {
     assert.equal(await readFile(target, 'utf8'), 'replacement\nold\n');
   });
 
+  test('rejects an apply_patch update when the target inode changed after authorisation', async () => {
+    const cwd = await temporaryDirectory('maka-identity-applypatch-update-');
+    const target = join(cwd, 'file.txt');
+    const replacement = join(cwd, 'replacement.txt');
+    await writeFile(target, 'line\noriginal\n', 'utf8');
+    await writeFile(replacement, 'line\nreplacement\n', 'utf8');
+
+    const identity = await captureIdentity(target);
+    await rename(replacement, target);
+
+    const response = await executeFilesystemWorkerRequest(
+      requestFor(
+        {
+          kind: 'apply_patch',
+          cwd,
+          path: target,
+          action: 'update',
+          diff: '--- a\n+++ b\n@@ -1,2 +1,2 @@\n line\n-original\n+updated\n',
+        },
+        { enforcementPath: target, access: 'write', scope: 'exact', targetType: 'file' },
+        identity,
+      ),
+    );
+
+    assert.equal(response.ok, false);
+    assert.equal(response.error?.code, 'path_changed');
+    // The replacement content must be untouched (the patch never applied).
+    const { readFile } = await import('node:fs/promises');
+    assert.equal(await readFile(target, 'utf8'), 'line\nreplacement\n');
+  });
+
   test('creates a missing target without requiring an identity', async () => {
     const cwd = await temporaryDirectory('maka-identity-missing-');
     const target = join(cwd, 'brand-new.txt');

packages/runtime/src/__tests__/filesystem-worker-linux-smoke.test.ts

@@ -61,15 +61,15 @@ describe('Linux filesystem worker smoke', { skip }, () => {
       },
       cwd: workspace,
       mode: 'ask',
-    expectedIdentity: 'unchecked',
+      expectedIdentity: 'unchecked',
     });
     assert.equal(await readFile(sourceFile, 'utf8'), 'export const healthSignal = true;\n');
 
     const read = await client.execute({
       operation: { kind: 'read', path: sourceFile },
       cwd: workspace,
       mode: 'ask',
-    expectedIdentity: 'unchecked',
+      expectedIdentity: 'unchecked',
     });
     assert.deepEqual(read, {
       kind: 'read',
@@ -103,7 +103,7 @@ describe('Linux filesystem worker smoke', { skip }, () => {
       },
       cwd: workspace,
       mode: 'ask',
-    expectedIdentity: 'unchecked',
+      expectedIdentity: 'unchecked',
     });
     assert.deepEqual(glob, { kind: 'glob', files: ['health.ts'] });
 
@@ -118,7 +118,7 @@ describe('Linux filesystem worker smoke', { skip }, () => {
       },
       cwd: workspace,
       mode: 'ask',
-    expectedIdentity: 'unchecked',
+      expectedIdentity: 'unchecked',
     });
     assert.equal(grep.kind, 'grep');
     if (grep.kind === 'grep') {
@@ -139,7 +139,7 @@ describe('Linux filesystem worker smoke', { skip }, () => {
       },
       cwd: workspace,
       mode: 'ask',
-    expectedIdentity: 'unchecked',
+      expectedIdentity: 'unchecked',
     });
 
     assert.equal(await readFile(target, 'utf8'), 'created');
@@ -155,7 +155,7 @@ describe('Linux filesystem worker smoke', { skip }, () => {
         operation: { kind: 'write', path: allowedPath, content: 'blocked' },
         cwd: workspace,
         mode: 'ask',
-      expectedIdentity: 'unchecked',
+        expectedIdentity: 'unchecked',
       }),
       isPathDenied,
     );
@@ -165,7 +165,7 @@ describe('Linux filesystem worker smoke', { skip }, () => {
         cwd: workspace,
         mode: 'ask',
         executionBoundary,
-      expectedIdentity: 'unchecked',
+        expectedIdentity: 'unchecked',
       }),
       (error: unknown) => {
         assert.ok(error instanceof FilesystemWorkerClientError);
@@ -184,7 +184,7 @@ describe('Linux filesystem worker smoke', { skip }, () => {
       cwd: workspace,
       mode: 'ask',
       executionBoundary,
-    expectedIdentity: 'unchecked',
+      expectedIdentity: 'unchecked',
     });
     assert.equal(await readFile(allowedPath, 'utf8'), 'outside-ok');
   });

packages/runtime/src/__tests__/filesystem-worker-smoke.test.ts

@@ -46,7 +46,7 @@ describe('macOS filesystem worker smoke', { skip: process.platform !== 'darwin'
       operation: { kind: 'write', path: insidePath, content: 'inside-ok' },
       cwd: workspace,
       mode: 'ask',
-    expectedIdentity: 'unchecked',
+      expectedIdentity: 'unchecked',
     });
     assert.equal(await readFile(insidePath, 'utf8'), 'inside-ok');
 
@@ -55,7 +55,7 @@ describe('macOS filesystem worker smoke', { skip: process.platform !== 'darwin'
         operation: { kind: 'write', path: outsidePath, content: 'blocked' },
         cwd: workspace,
         mode: 'ask',
-      expectedIdentity: 'unchecked',
+        expectedIdentity: 'unchecked',
       }),
       (error: unknown) =>
         error instanceof FilesystemWorkerClientError && error.reason === 'path_denied',
@@ -74,7 +74,7 @@ describe('macOS filesystem worker smoke', { skip: process.platform !== 'darwin'
       },
       cwd: workspace,
       mode: 'ask',
-    expectedIdentity: 'unchecked',
+      expectedIdentity: 'unchecked',
     });
 
     assert.equal(await readFile(target, 'utf8'), 'created');
@@ -110,7 +110,7 @@ describe('macOS filesystem worker smoke', { skip: process.platform !== 'darwin'
         cwd: workspace,
         mode: 'ask',
         executionBoundary,
-      expectedIdentity: 'unchecked',
+        expectedIdentity: 'unchecked',
       }),
       (error: unknown) => {
         assert.ok(error instanceof FilesystemWorkerClientError);
@@ -128,7 +128,7 @@ describe('macOS filesystem worker smoke', { skip: process.platform !== 'darwin'
       cwd: workspace,
       mode: 'ask',
       executionBoundary,
-    expectedIdentity: 'unchecked',
+      expectedIdentity: 'unchecked',
     });
     assert.equal(await readFile(allowedPath, 'utf8'), 'outside-ok');
   });
@@ -143,7 +143,7 @@ describe('macOS filesystem worker smoke', { skip: process.platform !== 'darwin'
       operation: grepOperation(sourceFile, 'healthSignal'),
       cwd: workspace,
       mode: 'ask',
-    expectedIdentity: 'unchecked',
+      expectedIdentity: 'unchecked',
     });
     assert.equal(fileResult.kind, 'grep');
     if (fileResult.kind === 'grep') {
@@ -155,7 +155,7 @@ describe('macOS filesystem worker smoke', { skip: process.platform !== 'darwin'
       operation: grepOperation(sourceDirectory, 'healthSignal'),
       cwd: workspace,
       mode: 'ask',
-    expectedIdentity: 'unchecked',
+      expectedIdentity: 'unchecked',
     });
     assert.equal(directoryResult.kind, 'grep');
     if (directoryResult.kind === 'grep') {
@@ -167,7 +167,7 @@ describe('macOS filesystem worker smoke', { skip: process.platform !== 'darwin'
       operation: grepOperation(sourceDirectory, 'does-not-exist'),
       cwd: workspace,
       mode: 'ask',
-    expectedIdentity: 'unchecked',
+      expectedIdentity: 'unchecked',
     });
     assert.deepEqual(emptyResult, { kind: 'grep', matches: [] });
   });

packages/runtime/src/__tests__/filesystem-worker-windows-smoke.test.ts

@@ -103,7 +103,7 @@ describe('Windows filesystem worker smoke', { skip: !enabled }, () => {
       operation: { kind: 'read', path: target },
       cwd: workspace,
       mode: 'ask',
-    expectedIdentity: 'unchecked',
+      expectedIdentity: 'unchecked',
     });
     assert.equal(read.kind, 'read');
     if (read.kind === 'read') assert.match(read.content, /windows-relay-ok/);
@@ -119,7 +119,7 @@ describe('Windows filesystem worker smoke', { skip: !enabled }, () => {
         operation: { kind: 'write', path: missing, content: 'blocked' },
         cwd: workspace,
         mode: 'ask',
-      expectedIdentity: 'unchecked',
+        expectedIdentity: 'unchecked',
       }),
       (error: unknown) =>
         error instanceof FilesystemWorkerClientError &&
@@ -139,7 +139,7 @@ describe('Windows filesystem worker smoke', { skip: !enabled }, () => {
       operation: { kind: 'glob', path: sourceDirectory, pattern: '**/*.ts' },
       cwd: workspace,
       mode: 'ask',
-    expectedIdentity: 'unchecked',
+      expectedIdentity: 'unchecked',
     });
     assert.equal(globResult.kind, 'glob');
     if (globResult.kind === 'glob') {
@@ -162,7 +162,7 @@ describe('Windows filesystem worker smoke', { skip: !enabled }, () => {
         },
         cwd: workspace,
         mode: 'ask',
-      expectedIdentity: 'unchecked',
+        expectedIdentity: 'unchecked',
       }),
       (error: unknown) =>
         error instanceof FilesystemWorkerClientError && error.reason === 'grep_unavailable',
@@ -179,7 +179,7 @@ describe('Windows filesystem worker smoke', { skip: !enabled }, () => {
         },
         cwd: workspace,
         mode: 'ask',
-      expectedIdentity: 'unchecked',
+        expectedIdentity: 'unchecked',
       }),
       (error: unknown) =>
         error instanceof FilesystemWorkerClientError && error.reason === 'path_denied',

packages/runtime/src/filesystem-executor.ts

@@ -31,6 +31,7 @@ import type {
 } from './filesystem-worker/client.js';
 import { isSupportedImagePath, type ImageMimeType } from './image-file.js';
 import type { FilesystemWorkerResult } from './filesystem-worker/protocol.js';
+import { operationAccess } from './filesystem-worker/protocol.js';
 import { resolveCanonicalDirectoryEntryTarget } from './path-containment.js';
 import { normalizeSandboxBoundaryPath } from './sandbox-boundary-path.js';
 import { SandboxCommandError } from './sandbox/errors.js';
@@ -217,16 +218,13 @@ export function createBoundaryFilesystemExecutor(
       ...(call.abortSignal ? { abortSignal: call.abortSignal } : {}),
       // The worker client now requires an explicit T0 marker (#3484): a
       // mutation carries its captured identity, or 'missing' when T0 saw no
-      // target; a read never participates in CAS and says so. The kind list
-      // deliberately mirrors `operationAccess` in the worker client
-      // (write | apply_patch | edit | format_json) — `mutates` is narrower
-      // and would silently drop the apply_patch identity onto 'unchecked',
-      // disabling the queue-window CAS on the main editing channel.
+      // target; a read never participates in CAS and says so. `operationAccess`
+      // is the single authority on which kinds are writes (write | apply_patch
+      // | edit | format_json) — `mutates` is narrower and would silently drop
+      // the apply_patch identity onto 'unchecked', disabling the queue-window
+      // CAS on the main editing channel.
       expectedIdentity:
-        call.operation.kind === 'write' ||
-        call.operation.kind === 'apply_patch' ||
-        call.operation.kind === 'edit' ||
-        call.operation.kind === 'format_json'
+        operationAccess(call.operation.kind) === 'write'
           ? (expectedIdentity ?? 'missing')
           : 'unchecked',
     });

packages/runtime/src/filesystem-worker/client.ts

@@ -25,6 +25,7 @@ import {
 import {
   FILESYSTEM_WORKER_PROTOCOL_VERSION,
   FilesystemWorkerOperationSchema,
+  operationAccess,
   operationUsesDirectoryEntry,
   parseFilesystemWorkerResponse,
   type FilesystemWorkerErrorCode,
@@ -652,12 +653,6 @@ function deriveWorkerProfile(
   };
 }
 
-function operationAccess(kind: FilesystemWorkerOperation['kind']): 'read' | 'write' {
-  return kind === 'write' || kind === 'apply_patch' || kind === 'edit' || kind === 'format_json'
-    ? 'write'
-    : 'read';
-}
-
 function operationScope(kind: FilesystemWorkerOperation['kind']): 'exact' | 'subtree' | 'auto' {
   if (kind === 'glob') return 'subtree';
   return kind === 'grep' ? 'auto' : 'exact';

packages/runtime/src/filesystem-worker/operations.ts

@@ -24,6 +24,7 @@ import {
 import { isSupportedImagePath, readWorkspaceImage } from '../image-file.js';
 import {
   FILESYSTEM_WORKER_PROTOCOL_VERSION,
+  operationAccess,
   operationUsesDirectoryEntry,
   type FilesystemWorkerErrorCode,
   type FilesystemWorkerOperation,
@@ -67,12 +68,6 @@ export type FilesystemWorkerGrepRunner = (
   input: FilesystemWorkerGrepRunInput,
 ) => Promise<FilesystemWorkerGrepRunResult>;
 
-function operationAccess(kind: FilesystemWorkerOperation['kind']): 'read' | 'write' {
-  return kind === 'write' || kind === 'apply_patch' || kind === 'edit' || kind === 'format_json'
-    ? 'write'
-    : 'read';
-}
-
 export async function executeFilesystemWorkerRequest(
   request: FilesystemWorkerRequest,
   dependencies: FilesystemWorkerOperationDependencies = {},

packages/runtime/src/filesystem-worker/protocol.ts

@@ -8,6 +8,15 @@ import { validateSandboxBoundaryExpansion } from '@maka/core/sandbox-boundary';
 // JSON protocol boundary.
 export const FILESYSTEM_WORKER_PROTOCOL_VERSION = 7 as const;
 
+/** The single authority on which operation kinds are writes. Shared by the
+ * client (permission/identity decisions) and the worker (operation guards) so
+ * the set cannot drift. */
+export function operationAccess(kind: FilesystemWorkerOperation['kind']): 'read' | 'write' {
+  return kind === 'write' || kind === 'apply_patch' || kind === 'edit' || kind === 'format_json'
+    ? 'write'
+    : 'read';
+}
+
 const path = z.string().min(1).max(4096);
 const cwd = z.string().min(1).max(4096);