feat(apply): ship apply-engine steps 2–12 in one slice

Extend codemap apply from rename-preview-only to a full substrate-shaped
fix executor: three diff-shape recipes, rename-preview call/re-export CTEs,
auto_fixable gating with --force, agent row/diff inputs, fixpoint loop,
optional git commit, and config allowlist. Adds apply_rows MCP/HTTP tool.

Author: SutuSebastian

docs/plans/apply-engine-direction.md

@@ -1,6 +1,6 @@
 # Apply-engine direction — diff-shape recipes + agent-in-the-loop substrate
 
-> **Status:** open · substrate growth (Steps 5–7 partial) lives in [`substrate-extraction.md`](./substrate-extraction.md) (tiers 1–6 shipped). This plan owns the **apply-engine / diff-shape recipe** half of the richer-index synthesis.
+> **Status:** closing — Steps 2–4, 6–12 shipped (`feat/apply-engine-slices`). Substrate Steps 5–7 live in [`substrate-extraction.md`](./substrate-extraction.md) (tiers 1–6 shipped). This plan owns the **apply-engine / diff-shape recipe** half of the richer-index synthesis.
 >
 > **Motivator:** extend `codemap apply` from recipe-driven single-file hunks toward agent-in-the-loop row contracts (`apply --rows -`, diff-input, fixpoint loops) without crossing [Moat A](../roadmap.md#moats-load-bearing) (SQL/recipe API) or [Moat B](../roadmap.md#moats-load-bearing) (no re-extraction in apply).
 >
@@ -20,47 +20,47 @@
 
 ## Open steps (implementation sequence)
 
-### Step 2 — Three diff-shape recipes (S × 3)
+_All steps below shipped on branch `feat/apply-engine-slices` (single PR). Wave-2 recipes (`organize-imports`, `missing-exports`, …) remain backlog per synthesis § 4.3._
 
-Ship `replace-marker-kind`, `migrate-import-source`, `add-jsdoc-deprecated` — pure SQL + frontmatter; no engine/schema change.
+### Step 2 — Three diff-shape recipes (S × 3) — ✓ Shipped
 
-Open: sequential PRs per [tracer-bullets](../../.agents/rules/tracer-bullets.md); hold `organize-imports` / `missing-exports` for wave 2.
+`replace-marker-kind`, `migrate-import-source`, `add-jsdoc-deprecated` — bundled SQL + frontmatter + golden scenarios.
 
-### Step 3 — Per-row `actions[].command` template (S)
+### Step 3 — Per-row `actions[].command` template (S) — ✓ Shipped
 
-Extend `recipes-loader.ts` / `query-recipes.ts` so `actions[]` carries a rendered `command` template (reuse `recipe-params.ts`; block-list shape only).
+`RecipeAction.command` + `renderRecipeActionCommands` / `getQueryRecipeActionsRendered`.
 
-### Step 4 — `auto_fixable` gating (S)
+### Step 4 — `auto_fixable` gating (S) — ✓ Shipped
 
-Enforce `actions[].auto_fixable: true` (or `--force`) before write. `--force` bypasses gate only, not phase-1 conflict detection.
+`assertApplyAutoFixable` + CLI/MCP `--force`.
 
-### Step 6 — App-wide rename recipe (S; depends Step 5 substrate ✓)
+### Step 6 — App-wide rename recipe (S) — ✓ Shipped
 
-Extend `rename-preview.sql` with `call_rows` CTE. Bias: extend existing recipe id, not a second rename recipe. Preserve honest v1 gap list (re-exports, JSX, default-import binds).
+`rename-preview.sql` `call_rows` CTE; golden updated with `call_site` rows.
 
-### Step 7 (recipe) — `rename-preview` `re_export_rows` CTE (S)
+### Step 7 (recipe) — `rename-preview` `re_export_rows` CTE (S) — ✓ Shipped
 
-Substrate shipped; **recipe extension open**. Single-hop alias chains in v1; recursive CTE if gap appears.
+Single-hop `re_export_rows` CTE; gated by `include_re_exports`.
 
-### Step 8 — `apply --rows -` + `apply_rows` MCP/HTTP tool (M)
+### Step 8 — `apply --rows -` + `apply_rows` MCP/HTTP tool (M) — ✓ Shipped
 
-JSON array of `{file_path, line_start, before_pattern, after_pattern}` from stdin/args; existing phase-1/2 validation. Separate MCP tool (not polymorphic with recipe id).
+CLI `--rows`; MCP/HTTP `apply_rows` tool.
 
-### Step 9 — `apply --diff-input <file>` (S)
+### Step 9 — `apply --diff-input <file>` (S) — ✓ Shipped
 
-Unified diff → row contract → same engine. Hand-roll parser; per-file atomicity; cross-file rollback deferred.
+`parseUnifiedDiffToRows` + CLI `--diff-input`.
 
-### Step 10 — `apply --commit "<msg>"` (S)
+### Step 10 — `apply --commit "<msg>"` (S) — ✓ Shipped
 
-`git add` only files apply touched, then commit. Message templating deferred.
+`gitCommitAppliedFiles` + CLI `--commit`.
 
-### Step 11 — `--until-empty` + `--max-passes N` (S)
+### Step 11 — `--until-empty` + `--max-passes N` (S) — ✓ Shipped
 
-Apply → reindex → re-run recipe loop. Abort whole loop on phase-1 conflicts. Extend result envelope with `passes` + `terminated_by`.
+`runApplyUntilEmpty` + envelope `passes` / `terminated_by` (CLI only).
 
-### Step 12 — `apply.autoApplyRecipes` allowlist (S)
+### Step 12 — `apply.autoApplyRecipes` allowlist (S) — ✓ Shipped
 
-Config list of recipe ids allowed with `--yes` without interactive confirm. `--force` bypasses allowlist.
+`codemapUserConfigSchema.apply.autoApplyRecipes` + `assertApplyAllowlist`.
 
 ---
 

docs/roadmap.md

@@ -105,7 +105,7 @@ Predicate-as-API only — enrich row shape and audit deltas; no standalone pass/
 
 - [ ] **C.9 framework plugin layer** — static entry-point hints on `files` to sharpen reachability-predicate recipes (`untested-and-dead`, `unimported-exports`, future `dead-files-by-reachability`). Plan: [`plans/c9-plugin-layer.md`](./plans/c9-plugin-layer.md). Effort: XL; ships last in the impact-vs-cadence sequence (see plan § Shipping cadence).
 - [ ] **LSP diagnostic-push + VSCode extension** — recipes-as-`Diagnostic[]` server + paired extension; explicitly **not** a go-to-def / references shim (`tsserver` covers those). Plan: [`plans/lsp-diagnostic-push.md`](./plans/lsp-diagnostic-push.md). Effort: XL; soft ordering after C.9 for cleaner squigglies on framework files.
-- [ ] **Apply-engine direction** — diff-shape recipes, per-row `actions[].command`, `apply --rows` / `--diff-input` / fixpoint loop. Substrate tiers 1–6 shipped; open steps 2–12. Plan: [`plans/apply-engine-direction.md`](./plans/apply-engine-direction.md).
+- [x] **Apply-engine direction** — diff-shape recipes, `actions[].command`, `auto_fixable`/`--force`, `rename-preview` call/re-export CTEs, `apply --rows` / `apply_rows`, `--diff-input`, `--commit`, `--until-empty`, `apply.autoApplyRecipes`. Plan: [`plans/apply-engine-direction.md`](./plans/apply-engine-direction.md).
 - [ ] **`history` table** (deferred — revisit-triggered) — temporal queries: "when did symbol X get `@deprecated`?", "coverage trend over last 50 commits", "files that became dead this week". `audit --base <ref>` covers the most-common temporal question (PR-scoped diff) without schema growth, so the table earns its place only when bigger questions emerge. Two shapes (per-commit snapshots ~N × DB size; append-only event log heavier CTE walks); both pay an N-reindexes backfill cost (~30s per reindex). **Revisit triggers:** two consumers ship `jq`-based "audit-runs-over-time" workflows, OR `query_baselines` evolution becomes a recurring agent need.
 - [ ] **`codemap audit` verdict + thresholds** (v1.x) — `verdict: "pass" | "warn" | "fail"` driven by an `audit.deltas[<key>].{added_max, action}` field on the config object (`.codemap/config.{ts,js,json}`). Triggers: two consumers ship `jq`-based threshold scripts with similar shapes, OR one consumer asks with a concrete config sketch. Until then, raw deltas + consumer-side `jq` is the CI exit-code idiom. **Likely accelerant:** the Marketplace Action (next item) shipping is the most plausible path to firing the trigger — once `- uses: stainless-code/codemap@v1` is the dominant CI path, real `jq` threshold scripts will surface.
 - [ ] **GitHub Marketplace Action — publish + listing finish** — core Action implementation is in-tree: root `action.yml`, `query --ci`, `audit --format sarif` / `--ci`, package-manager detection, dogfood smoke, and opt-in `pr-comment` summary renderer have shipped. Remaining work is the release/listing slice: `MARKETPLACE.md`, `v1.0.0` / floating `v1` tags, Marketplace setup, sacrificial-repo smoke, and making `action-smoke` blocking once the Action tag exists. Action version stream is independent of CLI version (`package.json` currently drives CLI/npm version; Action publishes at its own `v1.0.0`). Plan: [`plans/github-marketplace-action.md`](./plans/github-marketplace-action.md). Effort: S.

fixtures/golden/minimal/add-jsdoc-deprecated.json

@@ -0,0 +1,11 @@
+[
+  {
+    "file_path": "src/api/client.ts",
+    "line_start": 20,
+    "line_end": 20,
+    "before_pattern": "export function createClient",
+    "after_pattern": "/** @deprecated Use createClientV2 */\nexport function createClient",
+    "location_kind": "definition",
+    "chain_depth": 0
+  }
+]

fixtures/golden/minimal/migrate-import-source.json

@@ -0,0 +1,20 @@
+[
+  {
+    "file_path": "src/components/shop/ApiBridge.tsx",
+    "line_start": 1,
+    "line_end": 1,
+    "before_pattern": "~/api/client",
+    "after_pattern": "~/api/client-v2",
+    "location_kind": "import_source",
+    "chain_depth": 0
+  },
+  {
+    "file_path": "src/consumer.ts",
+    "line_start": 1,
+    "line_end": 1,
+    "before_pattern": "~/api/client",
+    "after_pattern": "~/api/client-v2",
+    "location_kind": "import_source",
+    "chain_depth": 0
+  }
+]

fixtures/golden/minimal/rename-preview.json

@@ -8,6 +8,15 @@
     "location_kind": "import_specifier",
     "chain_depth": 0
   },
+  {
+    "file_path": "src/components/shop/ProductCard.tsx",
+    "line_start": 11,
+    "line_end": 11,
+    "before_pattern": "usePermissions",
+    "after_pattern": "useAccess",
+    "location_kind": "call_site",
+    "chain_depth": 0
+  },
   {
     "file_path": "src/components/shop/ShopButton.tsx",
     "line_start": 1,
@@ -17,6 +26,15 @@
     "location_kind": "import_specifier",
     "chain_depth": 0
   },
+  {
+    "file_path": "src/components/shop/ShopButton.tsx",
+    "line_start": 9,
+    "line_end": 9,
+    "before_pattern": "usePermissions",
+    "after_pattern": "useAccess",
+    "location_kind": "call_site",
+    "chain_depth": 0
+  },
   {
     "file_path": "src/usePermissions.ts",
     "line_start": 1,

fixtures/golden/minimal/replace-marker-kind.json

@@ -0,0 +1 @@
+[]

fixtures/golden/scenarios.json

@@ -723,6 +723,35 @@
       "id": "try-catch-rethrow-heuristics",
       "prompt": "catch_rethrows: nested arrow throw vs direct rethrow (complexity-fixture)",
       "sql": "SELECT s.name, t.catch_rethrows FROM try_catch t JOIN symbols s ON s.file_path = t.file_path AND s.kind = 'function' AND t.try_line_start >= s.line_start AND t.try_line_start <= s.line_end WHERE t.file_path = 'src/lib/complexity-fixture.ts' AND s.name IN ('catchInnerArrowRethrow', 'catchDirectRethrow') ORDER BY s.name"
+    },
+    {
+      "id": "replace-marker-kind",
+      "prompt": "Replace TODO markers with FIXME in notes",
+      "recipe": "replace-marker-kind",
+      "params": {
+        "from_kind": "TODO",
+        "to_kind": "FIXME",
+        "in_file": "src/notes"
+      }
+    },
+    {
+      "id": "migrate-import-source",
+      "prompt": "Rewrite consumer import source path",
+      "recipe": "migrate-import-source",
+      "params": {
+        "old_source": "~/api/client",
+        "new_source": "~/api/client-v2"
+      }
+    },
+    {
+      "id": "add-jsdoc-deprecated",
+      "prompt": "Insert @deprecated JSDoc above createClient",
+      "recipe": "add-jsdoc-deprecated",
+      "params": {
+        "name": "createClient",
+        "replacement": "createClientV2",
+        "in_file": "src/api/"
+      }
     }
   ]
 }

src/application/apply-command-template.test.ts

@@ -0,0 +1,21 @@
+import { describe, expect, it } from "bun:test";
+
+import { renderRecipeActionCommands } from "./apply-command-template";
+
+describe("renderRecipeActionCommands", () => {
+  it("substitutes {{param}} placeholders", () => {
+    const out = renderRecipeActionCommands(
+      [
+        {
+          type: "apply-rename",
+          command:
+            "codemap apply rename-preview --params old={{old}},new={{new}} --yes",
+        },
+      ],
+      { old: "foo", new: "bar" },
+    );
+    expect(out?.[0]?.command).toBe(
+      "codemap apply rename-preview --params old=foo,new=bar --yes",
+    );
+  });
+});

src/application/apply-command-template.ts

@@ -0,0 +1,38 @@
+import type { RecipeParamValues } from "./recipe-params";
+import type { RecipeAction } from "./recipes-loader";
+
+/**
+ * Renders `{{param}}` placeholders in recipe action `command` templates using
+ * bound param values (same names as recipe frontmatter `params:`).
+ */
+export function renderRecipeActionCommands(
+  actions: RecipeAction[] | undefined,
+  paramValues: RecipeParamValues,
+): RecipeAction[] | undefined {
+  if (actions === undefined || actions.length === 0) return actions;
+  const valueByName = new Map<string, string>();
+  for (const [name, value] of Object.entries(paramValues)) {
+    if (value === null) continue;
+    valueByName.set(name, String(value));
+  }
+  return actions.map((action) => {
+    if (action.command === undefined) return action;
+    return {
+      ...action,
+      command: renderCommandTemplate(action.command, valueByName),
+    };
+  });
+}
+
+function renderCommandTemplate(
+  template: string,
+  valueByName: Map<string, string>,
+): string {
+  return template.replace(
+    /\{\{([A-Za-z_][A-Za-z0-9_]*)\}\}/g,
+    (_m, name: string) => {
+      const value = valueByName.get(name);
+      return value ?? "";
+    },
+  );
+}

src/application/apply-diff-input.test.ts

@@ -0,0 +1,24 @@
+import { describe, expect, it } from "bun:test";
+
+import { parseUnifiedDiffToRows } from "./apply-diff-input";
+
+describe("parseUnifiedDiffToRows", () => {
+  it("pairs single-line -/+ hunks", () => {
+    const diff = `diff --git a/src/foo.ts b/src/foo.ts
+--- a/src/foo.ts
++++ b/src/foo.ts
+@@ -2,1 +2,1 @@
+-oldName
++newName
+`;
+    const rows = parseUnifiedDiffToRows(diff);
+    expect(rows).toEqual([
+      {
+        file_path: "src/foo.ts",
+        line_start: 2,
+        before_pattern: "oldName",
+        after_pattern: "newName",
+      },
+    ]);
+  });
+});