@expressivecss/mcp-server 0.4.0 → 0.5.0

package/smoke.mjs

@@ -1,9 +1,9 @@
 import assert from 'node:assert/strict';
-import { access, copyFile, mkdir, mkdtemp, readFile, rm, symlink, truncate, writeFile } from 'node:fs/promises';
+import { access, copyFile, cp, mkdir, mkdtemp, readFile, realpath, rm, symlink, truncate, writeFile } from 'node:fs/promises';
 import os from 'node:os';
 import path from 'node:path';
 import { execFileSync, spawnSync } from 'node:child_process';
-import { createHash } from 'node:crypto';
+import { createHash, hash } from 'node:crypto';
 import { createRequire } from 'node:module';
 import { fileURLToPath } from 'node:url';
 import { Client } from '@modelcontextprotocol/sdk/client/index.js';
@@ -12,6 +12,8 @@ import { AjvJsonSchemaValidator } from '@modelcontextprotocol/sdk/validation/ajv
 import { ReadResourceResultSchema } from '@modelcontextprotocol/sdk/types.js';
 
 const packageDir = path.dirname(fileURLToPath(import.meta.url));
+// Fixtures live in temp directories outside the server's default root, which is all an unset allowlist admits.
+process.env.EXPRESSIVECSS_MCP_ALLOWED_PROJECT_ROOTS ??= JSON.stringify([packageDir, os.tmpdir()]);
 const require = createRequire(import.meta.url);
 const packageManifest = JSON.parse(await readFile(path.join(packageDir, 'package.json'), 'utf8'));
 const jsdomManifest = JSON.parse(await readFile(require.resolve('jsdom/package.json'), 'utf8'));
@@ -23,7 +25,7 @@ assert.equal(packageManifest.scripts.test, 'node smoke.mjs');
 assert.equal(packageManifest.scripts.prepack, 'npm test');
 assert.ok(Object.values(packageManifest.scripts).every((command) => !command.includes('../..')));
 assert.equal(packageManifest.files.includes('scripts/sync-guides.mjs'), false);
-assert.equal(packageManifest.overrides.qs, '6.16.0');
+assert.equal(packageManifest.overrides.qs, '6.16.1');
 assert.equal(packageManifest.engines.node, jsdomManifest.engines.node);
 for (const [name, data] of Object.entries({ guideData, semanticsData, decisionsData, contractData })) {
   assert.equal(typeof data.generatedBy, 'string', `${name} has no generatedBy marker`);
@@ -47,13 +49,13 @@ async function writeLocalSourceFixture(projectRoot, { stale = false, contract =
   assert.ok(buttonGuide, 'bundled buttons guide fixture missing');
   await writeFile(path.join(projectRoot, 'skills', 'expressivecss', 'components', buttonGuide.file), buttonGuide.content);
 
-  const hash = createHash('sha256');
-  for (const source of contractData.sources) hash.update(`${source}\0${sourceContents.get(source)}\0`);
+  const hasher = createHash('sha256');
+  for (const source of contractData.sources) hasher.update(`${source}\0${sourceContents.get(source)}\0`);
   if (contract) {
     await writeFile(path.join(projectRoot, 'skills', 'expressivecss', 'references', 'contract.json'), JSON.stringify({
       ...contractData,
       frameworkVersion,
-      sourceHash: hash.digest('hex'),
+      sourceHash: hasher.digest('hex'),
     }));
   }
   if (stale) await writeFile(path.join(projectRoot, 'llm.md'), '# stale local contract source\n');
@@ -299,10 +301,13 @@ async function verifyResponseBudgets(matchingDir, versionedDir) {
       assert.equal(result.structuredContent.skipped, true);
       assert.equal(result.structuredContent.contractCompatibility, 'unknown');
     }
-    await assert.rejects(peer.callTool(request('component_syntax_expert', { components: Array(400).fill(1) })), (error) => error.code === -32001);
   }, { env: { SKIP_SETUP_EXPERT: 'true', SKIP_CREATIVE_DIRECTOR: 'true', SKIP_PAGE_ARCHITECT: 'true', SKIP_COMPONENT_SYNTAX_EXPERT: 'true' } });
   await withServer(1, async ({ peer }) => {
     await assert.rejects(peer.callTool(request('component_syntax_expert', { components: ['cards'] })), (error) => error.code === -32001);
+    // A validation error is budgeted like any result. Its size is zod's to
+    // decide (4.6.6 stops at the array's maxItems), so only a 1-byte budget
+    // overflows it on every version.
+    await assert.rejects(peer.callTool(request('component_syntax_expert', { components: Array(400).fill(1) })), (error) => error.code === -32001);
   }, { env: { SKIP_COMPONENT_SYNTAX_EXPERT: 'true' } });
   for (const invalid of ['', '0', '-1', '+1', '1.5', 'NaN', 'Infinity', '1e4', ' 64', '9007199254740992']) {
     const child = spawnSync(process.execPath, [path.join(packageDir, 'server.js')], { env: { ...process.env, [setting]: invalid }, encoding: 'utf8', timeout: 10_000 });
@@ -313,8 +318,7 @@ async function verifyResponseBudgets(matchingDir, versionedDir) {
   const fixtureDir = await mkdtemp(path.join(packageDir, '.budget-fixture-'));
   try {
     for (const file of ['server.js', 'package.json', 'component-decisions.json', 'capability-roadmap.json', 'contract.json', 'semantics-data.json']) await copyFile(path.join(packageDir, file), path.join(fixtureDir, file));
-    await mkdir(path.join(fixtureDir, 'scripts'));
-    await copyFile(path.join(packageDir, 'scripts', 'resolve-version.mjs'), path.join(fixtureDir, 'scripts', 'resolve-version.mjs'));
+    await cp(path.join(packageDir, 'scripts'), path.join(fixtureDir, 'scripts'), { recursive: true });
     const code = 'const text = "界🌍\\\\\\\"";\n'.repeat(500).trim();
     const markdown = '完整 Options 🌍 with an escaped \\" value.\n'.repeat(5_000).trim();
     const rules = ['`whole-first`: Preserve this full record.', '`huge-rule`: ' + '界🌍'.repeat(20_000)];
@@ -468,8 +472,7 @@ async function verifyCatalogueResources(expectedEntries, toolPayload, consumerRo
   const fixtureDir = await mkdtemp(path.join(packageDir, '.resource-fixture-'));
   try {
     for (const file of ['server.js', 'package.json', 'component-guides.json', 'component-decisions.json', 'capability-roadmap.json', 'contract.json', 'semantics-data.json']) await copyFile(path.join(packageDir, file), path.join(fixtureDir, file));
-    await mkdir(path.join(fixtureDir, 'scripts'));
-    await copyFile(path.join(packageDir, 'scripts', 'resolve-version.mjs'), path.join(fixtureDir, 'scripts', 'resolve-version.mjs'));
+    await cp(path.join(packageDir, 'scripts'), path.join(fixtureDir, 'scripts'), { recursive: true });
     const decisions = structuredClone(decisionsData);
     const unicode = '界🌍 "escaped" \\ value\n'.repeat(2_000);
     decisions.components.find((row) => row.slug === expectedEntries[0].slug).useWhen = [unicode];
@@ -735,8 +738,8 @@ async function verifyComponentResources(catalogueToolPayload, consumerRoots) {
   const assertCompletion = async (peer) => {
     for (const template of [guideTemplate, sectionTemplate]) {
       assert.deepEqual(await complete(peer, template, 'slug', ''), completed(slugs), `${template} lists every canonical slug`);
-      assert.deepEqual(await complete(peer, template, 'slug', 'ca'), completed(['cards', 'carousel']));
-      assert.deepEqual(await complete(peer, template, 'slug', 'CA'), completed(['cards', 'carousel']), 'slug prefixes ignore case');
+      assert.deepEqual(await complete(peer, template, 'slug', 'ca'), completed(['calendar', 'cards', 'carousel', 'cascader']));
+      assert.deepEqual(await complete(peer, template, 'slug', 'CA'), completed(['calendar', 'cards', 'carousel', 'cascader']), 'slug prefixes ignore case');
       assert.deepEqual(await complete(peer, template, 'slug', 's'), completed(slugs.filter((slug) => slug.startsWith('s'))));
       assert.deepEqual(await complete(peer, template, 'slug', 'date'), completed(['date-picker']));
       for (const slug of slugs) assert.deepEqual((await complete(peer, template, 'slug', slug)).completion.values[0], slug);
@@ -762,7 +765,7 @@ async function verifyComponentResources(catalogueToolPayload, consumerRoots) {
     }
     assert.deepEqual(await complete(peer, catalogueUri, 'slug', ''), noArgument, 'fixed catalogue URI has no arguments');
     await assert.rejects(peer.complete({ ref: { type: 'ref/prompt', name: 'component_guide' }, argument: { name: 'slug', value: '' } }), (error) => error.code === -32602);
-    assert.deepEqual(await complete(peer, guideTemplate, 'slug', 'ca'), completed(['cards', 'carousel']), 'failed completions do not affect later requests');
+    assert.deepEqual(await complete(peer, guideTemplate, 'slug', 'ca'), completed(['calendar', 'cards', 'carousel', 'cascader']), 'failed completions do not affect later requests');
     // Every completed name reads; completion never makes aliases or case variants readable.
     for (const slug of (await complete(peer, guideTemplate, 'slug', '')).completion.values) {
       await read(`${base}/${slug}`);
@@ -975,12 +978,122 @@ const transport = new StdioClientTransport({
   const cardContent = lint([cardContentMarkup]);
   assert.equal(cardContent.stdout.match(/legacy-card-content/gu)?.length, 1, cardContent.stdout);
   assert.match(cardContent.stdout, /card-content\.html:3:\d+ legacy-card-content/u);
+  // The rules for names 0.16.0 removed, one by one and in process: the lint CLI
+  // rewrites className= to class= before inspecting, so it cannot test JSX.
+  // Each rule lists markup it must flag and current markup that only shares a
+  // name with it, and every legacy rule must have such a list.
+  const { inspectAuthoringRules, authoringRules } = await import(path.join(packageDir, 'server.js'));
+  inspectAuthoringRules('<p></p>'); // loads jsdom before anything below is timed
+  const legacyCases = {
+    'legacy-material-icons': {
+      flag: ['<span class="material-icons">add</span>', '.material-icons { font-size: 20px }'],
+      pass: ['<span class="material-symbols" aria-hidden="true">add</span>'],
+    },
+    'legacy-i-icon': {
+      flag: ['<button><i>add</i></button>', '<li>\n  <i>home</i> Home</li>'],
+      pass: ['<p><i>sic</i> as written</p>', '<td><i>pending</i></td>', '<button><i class="material-symbols">add</i></button>'],
+    },
+    'legacy-visibility-alias': {
+      flag: ['<div class="hide-on-small-only"></div>', '<div class="show-on-xxl"></div>'],
+      pass: ['<div class="hide-on-med-and-down show-on-compact"></div>'],
+    },
+    'legacy-helper-class': {
+      flag: ['<div class="no-padding"></div>', '<div class="center-block"></div>', '<p class="no-select"></p>'],
+      pass: ['<div class="p-0 mx-auto"></div>'],
+    },
+    'legacy-renamed-component': {
+      flag: ['<div class="preloader"></div>', '<search class="searchbar"></search>', '<div class="range-field"></div>', '<div class="range">\n  <input type="range"></div>', '<div className="range"><input type=range></div>'],
+      pass: ['<input id="searchbar" type="search">', '<span class="range">Jan 1 to Jan 5</span>', '<div class="slider"><input type="range"></div>', '<div class="progress circular"></div>'],
+    },
+    'legacy-picker-root': {
+      flag: ['<input class="datepicker">', "<input class='timepicker validate'>", '<input className="datepicker">'],
+      pass: ['<input class="date-picker">', '<div class="datepicker-container"></div>'],
+    },
+    'legacy-sheet-class': {
+      flag: ['<dialog class="bottom"></dialog>', '<dialog class="right-sheet"></dialog>', '<dialog className="left"></dialog>', '<dialog class="bottom-sheet"><span class="handle"></span></dialog>'],
+      pass: ['<dialog class="bottom-sheet"><span class="drag-handle"></span></dialog>', '<dialog class="side-sheet start"></dialog>', '<dialog data-class="left" class="side-sheet"></dialog>', '<ul class="sortable"><li><span class="handle"></span></li></ul>', '<dialog class="no-bottom-sheet"><span class="handle"></span></dialog>'],
+    },
+    'legacy-variant-alias': {
+      flag: ['<div class="tooltip max"></div>', '<div class="toolbar filled"></div>', '<span class="chip active"></span>', '<div class="max toolbar"></div>', '<div className={"tooltip max"}></div>', '<div className={`chip active ${x}`}></div>'],
+      pass: ['<div class="tooltip rich"></div>', '<div class="toolbar docked vibrant"><button class="filled">Go</button><span class="max"></span></div>', '<span class="chip selected"></span>', '<button class="chip active:scale-95"></button>', '<nav class="tabs max"></nav>', '<div class="toolbar-group active"></div>'],
+    },
+    'legacy-markup-path': {
+      flag: ['<ul class="tabs"><li class="tab"><a href="#a">A</a></li></ul>', '<div class="switch"><label><input type="checkbox">Wifi</label></div>', '<button class="extra">Compose</button>', '<a class="button extra" href="/c">C</a>', '<span class="button extra">C</span>', '<button className="extra">C</button>'],
+      pass: ['<label class="switch"><input type="checkbox">Wifi</label>', '<button class="circle extra">+</button>', '<button class="extra circle large">+</button>', '<div class="extra">Notes</div>', '<td class="extra">1</td>'],
+    },
+    'legacy-carousel-flat': {
+      flag: ['<div class="carousel flat"></div>', 'Carousel.init(el, { fullWidth: true });', '<div class="carousel-fixed-item"></div>', '<div className={"carousel flat"}></div>'],
+      pass: ['<div class="carousel hero"></div>', '<div class="flat"></div>', 'Carousel.init(el, { fullWidth: false });'],
+    },
+    'legacy-color-role': {
+      flag: ['<p style="color: var(--md-sys-color-surface-variant)"></p>', ':root { --md-sys-color-background-dark: #000; }', '<p class="on-background-text"></p>', '<div class="surface-tint"></div>', '<p class="background-text"></p>'],
+      pass: ['<img class="background" src="hero.jpg" alt="">', '<p style="background: var(--md-sys-color-surface)"></p>', '<p class="on-surface-variant-text"></p>'],
+    },
+    'legacy-selector': {
+      flag: ['.preloader { color: red }', '.toolbar.max .item {}', '.chip.active {}', 'document.querySelector(".datepicker");', '.on-background-text {}'],
+      pass: ['this.preloader = loader;', 'import "./preloader.css";', '.datepicker-container {}', '.toolbar.docked {}', '.date-picker {}'],
+    },
+    'legacy-datepicker-range': {
+      flag: ['Datepicker.init(el, { startRange: start });', 'const options = { "endRange": end };', "init(el, { format: 'iso',\n  'startRange': start });"],
+      pass: ['const edge = isStart ? startRange : endRange;', 'selection.startRange'],
+    },
+    'legacy-range-export': {
+      flag: ['Expressive.Range.init(el);'],
+      pass: ['Expressive.Slider.init(el);', 'const range = new Range();'],
+    },
+  };
+  const legacyIds = authoringRules.map((rule) => rule.id).filter((id) => /^legacy-/.test(id) && !['legacy-btn-class', 'legacy-card-content', 'legacy-nav-wrapper', 'legacy-brand-logo', 'legacy-lever', 'legacy-filled-in', 'legacy-materialized-name', 'legacy-input-field', 'legacy-materialize-textarea'].includes(id));
+  assert.deepEqual(Object.keys(legacyCases).sort(), [...legacyIds].sort(), 'every 0.16.0 legacy rule needs cases, and every case a rule');
+  const idsFor = (snippet) => inspectAuthoringRules(snippet).map((issue) => issue.id);
+  for (const [id, { flag, pass }] of Object.entries(legacyCases)) {
+    for (const snippet of flag) assert.ok(idsFor(snippet).includes(id), `${id} misses ${JSON.stringify(snippet)}`);
+    for (const snippet of pass) assert.ok(!idsFor(snippet).includes(id), `${id} flags ${JSON.stringify(snippet)}`);
+  }
+  // Each pattern alone, against inputs built to make it backtrack. Every shape
+  // here once took seconds against some version of these patterns.
+  const fill = (text) => text.repeat(Math.ceil(200_000 / text.length));
+  const adversarial = [
+    fill('<input type="radio" '), fill('<i '), fill('<li '), fill('<dialog class="x '), fill('<dialog class="bottom-sheet">'),
+    '<dialog ' + fill('bottom-sheet '), '<a' + fill('-a'), fill('<a-'), '<div class="' + fill('a '), fill('<div class="'),
+    '<span>' + fill(' ') + '<i>add</i>', fill('<button><i>'), 'className={`' + fill('chip '), fill('<a class="button extra '),
+    '<div class="range">' + fill(' ') + '<input', fill(', startRange '), '<dialog class="bottom-sheet">' + fill('<span '), fill('.chip'),
+    // An attribute with no opening quote: two optional whitespace runs that
+    // can split the same spaces between them are quadratic.
+    'class=' + fill(' '), 'className={' + fill(' '), '{' + fill(' '),
+    // An unclosed class value: requiring the closing quote retried it once per `btn`.
+    'class="' + fill('btn '),
+    // A `.range` host with no `>` after it: an unbounded gap rescanned to the end from every host.
+    fill('class="range '),
+  ];
+  for (const rule of authoringRules.filter((entry) => legacyIds.includes(entry.id) || entry.id === 'legacy-btn-class')) {
+    const regex = new RegExp(rule.pattern.source, rule.pattern.flags);
+    for (const input of adversarial) {
+      regex.lastIndex = 0;
+      const start = performance.now();
+      while (regex.exec(input) !== null) if (regex.lastIndex === 0) break;
+      assert.ok(performance.now() - start < 250, `${rule.id} backtracks on ${JSON.stringify(input.slice(0, 30))}`);
+    }
+  }
+  // Deep nesting makes `:has()` rules quadratic and overflows `outerHTML`; it stops early instead.
+  for (const deep of ['<div aria-hidden="true">'.repeat(3_990) + '<a href=x>', '<nav aria-label=x>'.repeat(3_990), `<nav><template>${'<div>'.repeat(3_500)}</template></nav>`]) {
+    const start = performance.now();
+    assert.equal(inspectAuthoringRules(deep).truncatedReason, 'markup nesting limit reached');
+    // Parsing 4,000 nested tags takes about a second on CI runners; the rules alone took 20 s before the cap.
+    assert.ok(performance.now() - start < 3_000, `deep markup took ${Math.round(performance.now() - start)} ms`);
+  }
+  // Vue puts `template` inside SVG; there it is a foreign element with no content fragment.
+  assert.equal(inspectAuthoringRules('<svg><template v-for="item in items"><circle /></template></svg>').truncatedReason, undefined);
+  const deepMarkup = path.join(outsideDir, 'deep.html');
+  await writeFile(deepMarkup, '<nav aria-label=x>'.repeat(3_990));
+  const deepHook = lint(['--hook'], JSON.stringify({ tool_input: { file_path: deepMarkup } }));
+  assert.equal(deepHook.status, 2, deepHook.stderr);
+  assert.match(deepHook.stderr, /inspection-truncated/u);
   // Files the bounded reader refuses, and inspections that stop early, fail instead of passing silently.
   const linkedMarkup = path.join(outsideDir, 'linked.html');
   const crowdedMarkup = path.join(outsideDir, 'crowded.html');
   await symlink(invalidMarkupFile, linkedMarkup);
   await writeFile(crowdedMarkup, '<i></i>'.repeat(2_100));
-  for (const [file, reason] of [[oversizedFile, /read limit/u], [linkedMarkup, /symbolic link/u], [path.join(packageDir, 'README.md'), /outside projectRoot/u], [crowdedMarkup, /inspection-truncated/u]]) {
+  for (const [file, reason] of [[oversizedFile, /exceeds \d+ bytes/u], [linkedMarkup, /symbolic link/u], [path.join(packageDir, 'README.md'), /outside projectRoot/u], [crowdedMarkup, /inspection-truncated/u]]) {
     const refused = lint([file]);
     assert.equal(refused.status, 1, `${file} passed`);
     assert.match(refused.stdout, reason);
@@ -1009,6 +1122,14 @@ const transport = new StdioClientTransport({
     // procfs reports size 0 for files with content. A size-bound read must fail, not return a truncated file.
     await assert.rejects(readInspectionFile('/proc/self/status', '/proc', 1024 * 1024), /changed while reading/u);
   }
+  if (process.platform !== 'win32') {
+    // Opening a FIFO with no writer blocks; the reader must refuse it instead.
+    const fifo = path.join(outsideDir, 'pipe.html');
+    execFileSync('mkfifo', [fifo]);
+    const hung = new Promise((_, reject) => setTimeout(() => reject(new Error('FIFO read hung')), 2_000).unref());
+    await assert.rejects(Promise.race([readInspectionFile(fifo, outsideDir, 1024), hung]), /not a regular file/u);
+    await rm(fifo);
+  }
 }
 
 const client = new Client({ name: 'expressivecss-mcp-smoke', version: '0.1.0' });
@@ -1087,7 +1208,7 @@ try {
   for (const query of ['app-bar', '  APP BAR  ', 'navbar', 'screen-level actions']) {
     const result = await client.callTool({ name: 'component_catalog', arguments: { query, limit: 1 } });
     const matchType = query.includes('actions') ? 'heuristic' : query === 'navbar' ? 'exact-alias' : 'exact-name';
-    assertCatalogSearch(result, { query, limit: 1, entries: [{ ...appBarEntry, matchType }], totalMatches: matchType === 'exact-name' ? 2 : 1 });
+    assertCatalogSearch(result, { query, limit: 1, entries: [{ ...appBarEntry, matchType }], totalMatches: matchType === 'exact-name' ? 3 : 1 });
   }
   const recoveredSlugs = new Set();
   for (const entry of expectedCatalog) {
@@ -1163,7 +1284,6 @@ try {
     [tamperedGuideDir, 'match', 'divergent'],
     [symlinkSourceDir, 'unresolved', 'invalid'],
     [oversizedSourceDir, 'unresolved', 'invalid'],
-    [path.join(outsideDir, 'nonexistent-project'), 'unresolved', 'bundled-verified'],
   ]) {
     const result = await client.callTool({ name: 'component_catalog', arguments: { projectRoot } });
     assertScopedResult(result, 'target component_catalog');
@@ -1729,8 +1849,8 @@ try {
   assert.equal(matchingSyntax.structuredContent.contractCompatibility, 'match');
   assert.equal(matchingSyntax.structuredContent.status, 'available');
   const buttonCapability = matchingSyntax.structuredContent.found[0].capability;
-  assert.equal(buttonCapability.lastReviewedSupport, 'partial');
-  assert.equal(buttonCapability.support, buttonCapability.sourceReview === 'source-reviewed' ? 'partial' : 'unassessed');
+  assert.equal(buttonCapability.lastReviewedSupport, 'implemented');
+  assert.equal(buttonCapability.support, buttonCapability.sourceReview === 'source-reviewed' ? 'implemented' : 'unassessed');
   assert.match(matchingSyntax.structuredContent.capabilityEvidence.basis, /not proof of published package/);
 
   const fallbackRules = [
@@ -1868,8 +1988,7 @@ try {
     for (const file of ['server.js', 'package.json', 'component-decisions.json', 'capability-roadmap.json', 'contract.json', 'semantics-data.json']) {
       await copyFile(path.join(packageDir, file), path.join(optionsFixtureDir, file));
     }
-    await mkdir(path.join(optionsFixtureDir, 'scripts'));
-    await copyFile(path.join(packageDir, 'scripts', 'resolve-version.mjs'), path.join(optionsFixtureDir, 'scripts', 'resolve-version.mjs'));
+    await cp(path.join(packageDir, 'scripts'), path.join(optionsFixtureDir, 'scripts'), { recursive: true });
     const markdown = [
       '| Name | Description |', '| --- | --- |', '| example | Complete table |',
       '##### Nested guidance', '[Reference](https://example.test/options)',
@@ -2170,14 +2289,18 @@ try {
     name: 'quality_inspector',
     arguments: {
       projectRoot: packageDir,
-      files: [outsideFile],
+      files: [outsideFile, path.join(outsideDir, 'missing.txt')],
       runType: 'quick',
       workflowId,
     },
   });
+  // A missing outside path gets the same reason, so the reply is no existence oracle.
   assert.deepEqual(confined.structuredContent.filesSkipped, [{
     file: outsideFile,
     reason: 'file is outside projectRoot',
+  }, {
+    file: path.join(outsideDir, 'missing.txt'),
+    reason: 'file is outside projectRoot',
   }]);
   assert.equal(confined.structuredContent.status, 'blocked');
 
@@ -2306,6 +2429,52 @@ try {
     await timeoutClient.close();
   }
 
+  // Commands run in their own process group, so neither a cancelled call nor a closed
+  // session may leave one running.
+  for (const stop of ['cancel', 'close']) {
+    const lingerDir = path.join(outsideDir, `linger-${stop}`);
+    await mkdir(lingerDir);
+    await writeFile(path.join(lingerDir, 'package-lock.json'), '{}');
+    await writeFile(path.join(lingerDir, 'package.json'), JSON.stringify({
+      scripts: { typecheck: "node -e \"const fs = require('node:fs'); fs.writeFileSync('started.txt', ''); setTimeout(() => fs.writeFileSync('survived.txt', 'yes'), 1500);\"" },
+    }));
+    const lingerClient = new Client({ name: `expressivecss-mcp-${stop}-smoke`, version: '0.1.0' });
+    await lingerClient.connect(new StdioClientTransport({
+      command: process.execPath,
+      args: [path.join(packageDir, 'server.js')],
+      cwd: packageDir,
+      stderr: 'pipe',
+      env: { ...process.env, EXPRESSIVECSS_MCP_ALLOWED_COMMAND_ROOTS: lingerDir },
+    }));
+    const controller = new AbortController();
+    const call = lingerClient.callTool({
+      name: 'quality_inspector',
+      arguments: { projectRoot: lingerDir, files: [], runType: 'standard', runCommands: true },
+    }, undefined, { signal: controller.signal }).catch(() => {});
+    for (let waited = 0; await access(path.join(lingerDir, 'started.txt')).then(() => false, () => true); waited += 50) {
+      assert.ok(waited < 10_000, `${stop}: command never started`);
+      await new Promise((resolve) => setTimeout(resolve, 50));
+    }
+    if (stop === 'cancel') controller.abort();
+    else await lingerClient.close();
+    await call;
+    await new Promise((resolve) => setTimeout(resolve, 2_000));
+    await assert.rejects(access(path.join(lingerDir, 'survived.txt')), { code: 'ENOENT' }, `${stop} left the command running`);
+    if (stop === 'cancel') await lingerClient.close();
+  }
+  {
+    // A cancel that lands while the source pins are being checked must stop the command from starting.
+    const { runQualityCommands } = await import('./server.js');
+    const lingerDir = await realpath(path.join(outsideDir, 'linger-cancel'));
+    await rm(path.join(lingerDir, 'started.txt'));
+    const controller = new AbortController();
+    const run = runQualityCommands(lingerDir, ['typecheck'], 'npm', [], controller.signal);
+    controller.abort();
+    await assert.rejects(run, { name: 'AbortError' });
+    await new Promise((resolve) => setTimeout(resolve, 2_000));
+    await assert.rejects(access(path.join(lingerDir, 'started.txt')), { code: 'ENOENT' }, 'a command started after cancellation');
+  }
+
   const rootsClient = new Client({ name: 'expressivecss-mcp-project-roots-smoke', version: '0.1.0' });
   try {
     await rootsClient.connect(new StdioClientTransport({
@@ -2352,6 +2521,24 @@ try {
     }
   }
 
+  // Unset, the allowlist is the default root: a client cannot name `/` and hash files outside it.
+  const unsetEnv = { ...process.env };
+  delete unsetEnv.EXPRESSIVECSS_MCP_ALLOWED_PROJECT_ROOTS;
+  const unsetClient = new Client({ name: 'expressivecss-mcp-unset-roots-smoke', version: '0.1.0' });
+  try {
+    await unsetClient.connect(new StdioClientTransport({ command: process.execPath, args: [path.join(packageDir, 'server.js')], cwd: packageDir, stderr: 'pipe', env: unsetEnv }));
+    for (const projectRoot of [outsideDir, path.parse(outsideDir).root, path.join(packageDir, 'nonexistent-project')]) {
+      const denied = await unsetClient.callTool({ name: 'quality_inspector', arguments: { projectRoot, files: [outsideFile] } });
+      assert.equal(denied.isError, true, `an unset allowlist accepted ${projectRoot}`);
+      assert.match(denied.content[0].text, /EXPRESSIVECSS_MCP_ALLOWED_PROJECT_ROOTS/u);
+      assert.equal(JSON.stringify(denied).includes('sha256'), false);
+    }
+    const inside = await unsetClient.callTool({ name: 'quality_inspector', arguments: { projectRoot: packageDir, files: [] } });
+    assert.notEqual(inside.isError, true, inside.content[0].text);
+  } finally {
+    await unsetClient.close();
+  }
+
   const trapTransport = new StdioClientTransport({
     command: process.execPath,
     args: [path.join(packageDir, 'server.js')],
@@ -2419,7 +2606,7 @@ try {
   // Recoverable verification: exact input evidence, no automatic restoration, and no later scripts after failure.
   const originalManifest = await readFile(path.join(matchingDir, 'package.json'));
   const originalMarkup = await readFile(path.join(matchingDir, 'clean.html'));
-  const digest = bytes => createHash('sha256').update(bytes).digest('hex');
+  const digest = bytes => hash('sha256', bytes);
   const qualityArgs = { projectRoot: matchingDir, files: ['clean.html'], runType: 'full', runCommands: true };
   const setScripts = async typecheck => writeFile(path.join(matchingDir, 'package.json'), JSON.stringify({
     ...JSON.parse(originalManifest), scripts: { typecheck, test: `node -e "require('fs').writeFileSync('later-script.txt','ran')"` },