@orangepro/orangepro-mcp 0.1.0 → 0.2.1

package/scripts/spikes/java-mutate.mjs

@@ -0,0 +1,264 @@
+#!/usr/bin/env node
+// java-mutate.mjs — AST-based body replacer for the Java dynamic-proof spike (J-1).
+//
+// Locates ONE simplest-shape method `[modifiers] ReturnType name(params) { ... }`
+// by exact name via tree-sitter Java (the SAME grammar the static layer already
+// uses — tree-sitter-wasms + web-tree-sitter, no new dependency) and replaces its
+// BODY with a signature-derived, type-compatible sentinel by splicing the body
+// block's byte range. It is a spike helper only: it writes no product artifacts and
+// is not wired into prove / RTM / mint.
+//
+// J-1 scope is the SIMPLEST SHAPE ONLY: a concrete non-void, non-type-variable
+// return type, EXACTLY one top-level `return <expr>;` (no nested return in an
+// if/loop/try, no second return anywhere), no generics, and no overload ambiguity.
+// Everything else is refused with a distinct reason (deferred to J-2), never
+// silently mutated — the sentinel replaces the whole body, so a method with more
+// than one exit shape or an unknown (type-variable) return is not safe to mutate.
+//
+// Modes:
+//   sentinel   — replace the body with `{ return <wrong-but-compiling value>; }`.
+//                The sentinel is a FIXED value derived from the declared return
+//                type, so it can only ever cause a FALSE SURVIVE, never a false
+//                Proven — the trust bias is safe by construction.
+//   equivalent — leave the body byte-for-byte unchanged (the original source is
+//                re-written) so a value-only test still passes -> the orchestrator
+//                classifies it associated_survived.
+//
+// Exit codes (distinct, so the Node orchestrator can classify precisely):
+//   0  ok, mutated file written
+//   2  usage / IO / parse error
+//   3  ambiguous: more than one method with that name (overloads)
+//   4  not found: no method with that name
+//   5  out of scope: void, constructor, generic, or no single concrete return
+//      (J-2), refused in J-1
+//   6  not mutable: could not derive a type-compatible sentinel for the return type
+//
+// Like the Go helper, it prints a stable MUTATE_ERROR:<code> marker to stderr so a
+// caller that cannot see the process status can still classify.
+import { createRequire } from "node:module";
+import { readFileSync, writeFileSync } from "node:fs";
+import path from "node:path";
+import { fileURLToPath } from "node:url";
+
+const require = createRequire(import.meta.url);
+
+function fail(code, message) {
+  process.stderr.write(`MUTATE_ERROR:${code}\n`);
+  process.stderr.write(`${message}\n`);
+  process.exit(code);
+}
+
+function parseArgs(argv) {
+  const args = { mode: "sentinel" };
+  for (let i = 0; i < argv.length; i += 1) {
+    const arg = argv[i];
+    if (!arg.startsWith("--")) fail(2, `unexpected positional argument: ${arg}`);
+    const key = arg.slice(2);
+    const value = argv[i + 1];
+    if (value === undefined || value.startsWith("--")) fail(2, `missing value for ${arg}`);
+    args[key] = value;
+    i += 1;
+  }
+  if (!args.file || !args.func) {
+    fail(2, "usage: node java-mutate.mjs --file <path> --func <name> [--out <path>] [--mode sentinel|equivalent]");
+  }
+  if (args.mode !== "sentinel" && args.mode !== "equivalent") {
+    fail(2, "--mode must be sentinel or equivalent");
+  }
+  return args;
+}
+
+/** Load tree-sitter + the Java grammar exactly as the static analyzer does. */
+async function loadJavaParser() {
+  const { Parser, Language } = require("web-tree-sitter");
+  await Parser.init();
+  const wasm = require.resolve("tree-sitter-wasms/out/tree-sitter-java.wasm");
+  const language = await Language.load(wasm);
+  const parser = new Parser();
+  parser.setLanguage(language);
+  return parser;
+}
+
+// A method is J-1 SIMPLEST-SHAPE when: it is a real method_declaration (not a
+// constructor — those are a distinct node type and never match here), its return
+// type is a concrete non-void, non-type-variable type, it declares no type
+// parameters (no generics), and its body is EXACTLY one top-level `return <expr>;`
+// — no nested return (inside an if/loop/try/lambda) and no second return anywhere.
+// Anything else is out of scope for J-1: the sentinel replaces the WHOLE body, so a
+// method whose real control flow has more than one exit shape (or a return buried in
+// a branch) is not a value we can safely mutate 0->1.
+function topLevelReturns(body) {
+  // Direct named children of the body block that are return statements.
+  return body.namedChildren.filter((c) => c.type === "return_statement");
+}
+
+function allReturns(body) {
+  // Every return anywhere in the body — nested ones included.
+  return body.descendantsOfType("return_statement");
+}
+
+// The set of type-parameter names in scope for a method: its own `<T>` plus every
+// enclosing class/interface `<T>`. A return type that names one of these is a type
+// VARIABLE — no type-derived sentinel is safe (the runtime type is unknown), so it
+// is refused as out of scope for J-1.
+function typeParamNamesInScope(method) {
+  const names = new Set();
+  const collect = (node) => {
+    if (!node) return;
+    for (const tp of node.descendantsOfType("type_parameter")) {
+      // A type_parameter's identifier child is the variable name (T, U, …).
+      const id = tp.namedChildren.find((c) => c.type === "identifier" || c.type === "type_identifier");
+      if (id?.text) names.add(id.text);
+    }
+  };
+  // Method-level type parameters.
+  const ownTp = method.childForFieldName("type_parameters");
+  if (ownTp) collect(ownTp);
+  // Enclosing class/interface/record/enum type parameters.
+  for (let n = method.parent; n; n = n.parent) {
+    if (/_declaration$/.test(n.type)) {
+      const tp = n.childForFieldName("type_parameters");
+      if (tp) collect(tp);
+    }
+  }
+  return names;
+}
+
+// True when the declared return type is a bare type variable (a type_identifier
+// whose text is a type parameter in scope), e.g. `<T> T foo()` or a method that
+// returns the enclosing class's `T`. tree-sitter reports both as a `type_identifier`
+// with no way to distinguish a class from a type variable except the in-scope set.
+function isTypeVariableReturn(typeNode, method) {
+  if (typeNode.type !== "type_identifier") return false;
+  return typeParamNamesInScope(method).has(typeNode.text);
+}
+
+function main() {
+  const args = parseArgs(process.argv.slice(2));
+  const dst = args.out || args.file;
+  let source;
+  try {
+    source = readFileSync(args.file, "utf8");
+  } catch (error) {
+    fail(2, `read error: ${error instanceof Error ? error.message : String(error)}`);
+    return;
+  }
+
+  return loadJavaParser().then((parser) => {
+    let tree;
+    try {
+      tree = parser.parse(source);
+    } catch (error) {
+      fail(2, `parse error: ${error instanceof Error ? error.message : String(error)}`);
+      return;
+    }
+    if (!tree) fail(2, "parse produced no tree");
+
+    const matches = tree.rootNode
+      .descendantsOfType("method_declaration")
+      .filter((m) => m.childForFieldName("name")?.text === args.func);
+
+    if (matches.length > 1) {
+      fail(3, `ambiguous: ${matches.length} methods named ${JSON.stringify(args.func)} (overloads)`);
+    }
+    if (matches.length === 0) {
+      // Distinguish a constructor of that name from a genuinely missing method.
+      const ctor = tree.rootNode
+        .descendantsOfType("constructor_declaration")
+        .some((c) => c.childForFieldName("name")?.text === args.func);
+      if (ctor) fail(5, `out of scope: ${JSON.stringify(args.func)} is a constructor (J-2)`);
+      fail(4, `not found: no method named ${JSON.stringify(args.func)}`);
+    }
+
+    const method = matches[0];
+    const typeNode = method.childForFieldName("type");
+    const body = method.childForFieldName("body");
+    if (!typeNode || !body || body.type !== "block") {
+      fail(5, `out of scope: ${JSON.stringify(args.func)} has no concrete body/return type (abstract/interface?)`);
+    }
+    if (typeNode.type === "void_type") {
+      fail(5, `out of scope: ${JSON.stringify(args.func)} returns void (J-2)`);
+    }
+    if (method.descendantsOfType("type_parameters").length > 0) {
+      fail(5, `out of scope: ${JSON.stringify(args.func)} is generic (J-2)`);
+    }
+    // A return type that is a type variable (a method or enclosing-class `<T>`) has
+    // no type-derived sentinel that is safe, so refuse it as out of scope.
+    if (isTypeVariableReturn(typeNode, method)) {
+      fail(5, `out of scope: ${JSON.stringify(args.func)} returns a type variable ${JSON.stringify(typeNode.text)} (J-2)`);
+    }
+    // Exactly one TOP-LEVEL return and no other return anywhere in the body. A
+    // nested return (inside an if/loop/try) has topLevel === 0; a second return
+    // anywhere makes all > 1. Both are refused: the sentinel replaces the whole body.
+    const topReturns = topLevelReturns(body);
+    const everyReturn = allReturns(body);
+    if (topReturns.length !== 1 || everyReturn.length !== 1) {
+      fail(5, `out of scope: ${JSON.stringify(args.func)} is not a single top-level return (nested/multiple returns) (J-2)`);
+    }
+
+    if (args.mode === "equivalent") {
+      // Re-write the original bytes unchanged: a value-only test still passes.
+      try {
+        writeFileSync(dst, source);
+      } catch (error) {
+        fail(2, `write error: ${error instanceof Error ? error.message : String(error)}`);
+      }
+      return;
+    }
+
+    const sentinel = sentinelReturn(typeNode);
+    if (sentinel === null) {
+      fail(6, `not mutable: cannot derive a type-compatible sentinel for return type ${JSON.stringify(typeNode.text)}`);
+    }
+
+    // Splice the body block's byte range with a minimal `{ return <sentinel>; }`.
+    const before = source.slice(0, body.startIndex);
+    const after = source.slice(body.endIndex);
+    const mutated = `${before}{ return ${sentinel}; }${after}`;
+    try {
+      writeFileSync(dst, mutated);
+    } catch (error) {
+      fail(2, `write error: ${error instanceof Error ? error.message : String(error)}`);
+    }
+  });
+}
+
+// A FIXED, deliberately-wrong-but-compiling value derived from the declared return
+// type. A fixed sentinel can only cause a FALSE SURVIVE (associated_survived) when
+// the real return happens to equal it — NEVER a false Proven. Returns null when no
+// type-compatible constant can be named (fail closed -> exit 6, never mutated).
+function sentinelReturn(typeNode) {
+  const type = typeNode.type;
+  const text = typeNode.text;
+  if (type === "integral_type") {
+    // int / short / byte / long -> a distinct wrong integer. char is integral in
+    // the grammar but -999 is not a char; give it a distinct char literal.
+    if (text === "char") return "'\\u0000'";
+    if (text === "long") return "-999L";
+    return "-999";
+  }
+  if (type === "floating_point_type") {
+    return text === "float" ? "-999.0f" : "-999.0";
+  }
+  if (type === "boolean_type") {
+    // A fixed constant. If the real value is false, the mutant SURVIVES (safe); if
+    // it is true, the assertion FAILS -> proven. Exactly the trust bias.
+    return "false";
+  }
+  if (type === "type_identifier" && text === "String") {
+    return '"__opro_sentinel__"';
+  }
+  // Any other reference type (a class, an array, a boxed type, ...) -> null is a
+  // valid, always-compiling wrong value for a test asserting a non-null result.
+  if (
+    type === "type_identifier" ||
+    type === "array_type" ||
+    type === "scoped_type_identifier" ||
+    type === "generic_type"
+  ) {
+    return "null";
+  }
+  return null;
+}
+
+main();

package/scripts/spikes/python-dynamic-proof-spike.mjs

@@ -0,0 +1,245 @@
+#!/usr/bin/env node
+// python-dynamic-proof-spike.mjs — Python dynamic-proof mechanism (P-1).
+// Runs one pytest node in an isolated copy, applies a minimal AST sentinel
+// mutation, and proves only when the mutant fails with a real assertion failure.
+
+import { cpSync, existsSync, mkdtempSync, rmSync } from "node:fs";
+import { spawnSync } from "node:child_process";
+import { tmpdir } from "node:os";
+import path from "node:path";
+import { fileURLToPath } from "node:url";
+
+const here = path.dirname(fileURLToPath(import.meta.url));
+
+function usage() {
+  return [
+    "Usage: node scripts/spikes/python-dynamic-proof-spike.mjs --root <repo> --test <nodeid> --target <rel.py> --func <name> [--mode sentinel|equivalent] [--json]",
+    "",
+    "P-1 supports a single safe shape: one Python def/async def with a block suite. Ambiguous or unsupported shapes fail closed."
+  ].join("\n");
+}
+
+function parseArgs(argv) {
+  const out = { mode: "sentinel", json: false, timeoutMs: 30000 };
+  for (let i = 0; i < argv.length; i++) {
+    const arg = argv[i];
+    if (arg === "--json") {
+      out.json = true;
+      continue;
+    }
+    if (!arg.startsWith("--")) throw new Error(`Unexpected positional arg: ${arg}`);
+    const key = arg.slice(2).replace(/-([a-z])/g, (_, c) => c.toUpperCase());
+    const value = argv[++i];
+    if (!value) throw new Error(`Missing value for ${arg}`);
+    out[key] = value;
+  }
+  for (const required of ["root", "test", "target", "func"]) {
+    if (!out[required]) throw new Error(`Missing required --${required.replace(/[A-Z]/g, (c) => `-${c.toLowerCase()}`)}`);
+  }
+  const timeoutMs = Number(out.timeoutMs);
+  if (!Number.isFinite(timeoutMs) || timeoutMs <= 0) throw new Error("--timeout-ms must be positive");
+  out.timeoutMs = timeoutMs;
+  if (!["sentinel", "equivalent"].includes(out.mode)) throw new Error("--mode must be sentinel or equivalent");
+  return out;
+}
+
+function contained(root, rel) {
+  const absRoot = path.resolve(root);
+  const abs = path.resolve(absRoot, rel);
+  const relative = path.relative(absRoot, abs);
+  if (!relative || relative.startsWith("..") || path.isAbsolute(relative)) throw new Error(`Path escapes root: ${rel}`);
+  return { absRoot, abs, rel: relative };
+}
+
+function copyRoot(root, dest) {
+  cpSync(root, dest, {
+    recursive: true,
+    dereference: false,
+    filter(src) {
+      const base = path.basename(src);
+      return ![".git", ".orangepro", ".pytest_cache", "__pycache__", ".venv", "venv", "node_modules"].includes(base);
+    }
+  });
+}
+
+function cleanEnv(repoRoot) {
+  const keep = {};
+  for (const key of ["PATH", "HOME", "SystemRoot", "WINDIR"]) {
+    if (process.env[key]) keep[key] = process.env[key];
+  }
+  keep.PYTHONDONTWRITEBYTECODE = "1";
+  keep.PYTEST_DISABLE_PLUGIN_AUTOLOAD = "1";
+  delete keep.PYTHONPATH;
+  if (repoRoot) {
+    const srcRoot = path.join(repoRoot, "src");
+    if (existsSync(srcRoot)) keep.PYTHONPATH = srcRoot;
+  }
+  return keep;
+}
+
+function runPytest(repoRoot, nodeid, timeoutMs) {
+  const result = spawnSync("python3", ["-m", "pytest", "-q", nodeid, "--tb=short"], {
+    cwd: repoRoot,
+    env: cleanEnv(repoRoot),
+    encoding: "utf8",
+    stdio: ["ignore", "pipe", "pipe"],
+    timeout: timeoutMs
+  });
+  const stdout = result.stdout ?? "";
+  const stderr = result.stderr ?? "";
+  return {
+    exitCode: result.status ?? null,
+    signal: result.signal ?? null,
+    timedOut: Boolean(result.error && result.error.code === "ETIMEDOUT"),
+    stdout,
+    stderr,
+    output: `${stdout}\n${stderr}`
+  };
+}
+
+function exactNodeIdPattern(nodeid) {
+  const escaped = nodeid.replace(/[.*+?^${}()|[\]\\]/g, "\\$&").replace(/\\\//g, "[/\\\\]");
+  const selectedParamSet = /\[[^\]]+\]$/.test(nodeid);
+  return new RegExp(`FAILED\\s+${escaped}${selectedParamSet ? "" : "(?:\\[[^\\]\\n]+\\])?"}(?:\\s|$)`);
+}
+
+function isExactPytestNodeId(nodeid) {
+  const parts = nodeid.split("::");
+  if (parts.length < 2) return false;
+  const last = parts[parts.length - 1];
+  return /^test[A-Za-z0-9_]*(?:\[.+\])?$/.test(last);
+}
+
+function classifyPytest(run, nodeid) {
+  if (run.timedOut) return { kind: "otherError", reason: "pytest timed out" };
+  if (run.exitCode === 0) return { kind: "passed" };
+  const output = run.output;
+  const normalized = output.replace(/\r/g, "");
+  const hasErrorSummary =
+    /(^|\n)ERROR(?:S)?(?:\s|$)/.test(normalized) ||
+    /(^|\n)ERROR\s+collecting\s+/i.test(normalized) ||
+    /(^|\n)ImportError\b|(^|\n)ModuleNotFoundError\b|(^|\n)SyntaxError\b/i.test(normalized);
+  if (hasErrorSummary) return { kind: "otherError", reason: "pytest reported collection/import/setup error" };
+  const failedTarget = exactNodeIdPattern(nodeid).test(normalized);
+  const exceptionLine = normalized.match(/(?:^|\n)E\s+([A-Za-z_][A-Za-z0-9_.]*):/);
+  if (exceptionLine && exceptionLine[1] !== "AssertionError" && !exceptionLine[1].endsWith(".AssertionError")) {
+    return { kind: "otherError", reason: "pytest failure raised before a trusted assertion mismatch" };
+  }
+  const assertionLike = /\bAssertionError\b|(^|\n)E\s+assert\s/m.test(normalized);
+  if (run.exitCode === 1 && failedTarget && assertionLike) return { kind: "assertionFailure" };
+  return { kind: "otherError", reason: "pytest failure was not a trusted assertion failure" };
+}
+
+function mutate(repoRoot, targetRel, func, mode, timeoutMs) {
+  const helper = path.join(here, "python-mutate.py");
+  const targetAbs = path.join(repoRoot, targetRel);
+  const result = spawnSync("python3", [helper, "--file", targetAbs, "--func", func, "--mode", mode], {
+    cwd: repoRoot,
+    env: cleanEnv(),
+    encoding: "utf8",
+    stdio: ["ignore", "pipe", "pipe"],
+    timeout: timeoutMs
+  });
+  if (result.status !== 0 || result.error) {
+    return { ok: false, reason: result.error?.message || result.stderr || "mutator failed" };
+  }
+  try {
+    return JSON.parse(result.stdout || "{}");
+  } catch {
+    return { ok: false, reason: "mutator produced invalid json" };
+  }
+}
+
+function summarize(run) {
+  const line = run.output
+    .split(/\r?\n/)
+    .map((s) => s.trim())
+    .find(Boolean);
+  return line ? line.slice(0, 240) : "";
+}
+
+function main() {
+  let args;
+  try {
+    args = parseArgs(process.argv.slice(2));
+  } catch (error) {
+    console.error(error.message);
+    console.error(usage());
+    process.exit(2);
+  }
+
+  const root = path.resolve(args.root);
+  const target = contained(root, args.target);
+  const testPath = args.test.split("::", 1)[0];
+  const test = contained(root, testPath);
+  if (!isExactPytestNodeId(args.test)) {
+    const verdict = {
+      status: "unrunnable",
+      proven: false,
+      reason: "pytest selector must identify exactly one test function",
+      runner: "pytest",
+      test: args.test,
+      target: target.rel,
+      func: args.func,
+      mutant: { assertionFailure: false }
+    };
+    process.stdout.write(JSON.stringify(verdict, null, args.json ? 2 : 0));
+    return;
+  }
+  const tmp = mkdtempSync(path.join(tmpdir(), "opro-python-proof-"));
+  const repoRoot = path.join(tmp, "repo");
+
+  try {
+    copyRoot(root, repoRoot);
+    const baseline = runPytest(repoRoot, args.test, args.timeoutMs);
+    const baselineClass = classifyPytest(baseline, args.test);
+    if (baselineClass.kind !== "passed") {
+      const verdict = {
+        status: "unrunnable",
+        proven: false,
+        reason: "baseline test did not pass",
+        runner: "pytest",
+        baseline: { exitCode: baseline.exitCode, timedOut: baseline.timedOut, failureSummary: summarize(baseline) },
+        mutant: { assertionFailure: false }
+      };
+      process.stdout.write(JSON.stringify(verdict, null, args.json ? 2 : 0));
+      return;
+    }
+
+    const mutation = mutate(repoRoot, target.rel, args.func, args.mode, args.timeoutMs);
+    if (!mutation.ok) {
+      const verdict = {
+        status: "unrunnable",
+        proven: false,
+        reason: `mutation refused: ${mutation.reason}`,
+        runner: "pytest",
+        baseline: { exitCode: baseline.exitCode, timedOut: baseline.timedOut },
+        mutant: { assertionFailure: false }
+      };
+      process.stdout.write(JSON.stringify(verdict, null, args.json ? 2 : 0));
+      return;
+    }
+
+    const mutant = runPytest(repoRoot, args.test, args.timeoutMs);
+    const mutantClass = classifyPytest(mutant, args.test);
+    const proven = mutantClass.kind === "assertionFailure";
+    const survived = mutantClass.kind === "passed";
+    const verdict = {
+      status: proven ? "proven" : survived ? "associated_survived" : "unrunnable",
+      proven,
+      reason: proven ? "mutant failed at a trusted pytest assertion" : survived ? "mutant survived" : mutantClass.reason,
+      runner: "pytest",
+      replacementMode: args.mode,
+      test: args.test,
+      target: target.rel,
+      func: args.func,
+      baseline: { exitCode: baseline.exitCode, timedOut: baseline.timedOut },
+      mutant: { exitCode: mutant.exitCode, timedOut: mutant.timedOut, assertionFailure: proven, failureSummary: proven ? "" : summarize(mutant) }
+    };
+    process.stdout.write(JSON.stringify(verdict, null, args.json ? 2 : 0));
+  } finally {
+    rmSync(tmp, { recursive: true, force: true });
+  }
+}
+
+main();

package/scripts/spikes/python-mutate.py

@@ -0,0 +1,89 @@
+#!/usr/bin/env python3
+"""Minimal Python mutation helper for the P-1 proof spike.
+
+This intentionally supports only the first safe shape: exactly one function or
+method named --func in the target file, with a block suite that can be replaced
+by a simple return sentinel. Unsupported or ambiguous shapes fail closed.
+"""
+
+from __future__ import annotations
+
+import argparse
+import ast
+import json
+import re
+from pathlib import Path
+
+
+def fail(reason: str) -> None:
+    print(json.dumps({"ok": False, "reason": reason}))
+    raise SystemExit(0)
+
+
+def leading_ws(line: str) -> str:
+    return line[: len(line) - len(line.lstrip(" \t"))]
+
+
+def main() -> None:
+    parser = argparse.ArgumentParser()
+    parser.add_argument("--file", required=True)
+    parser.add_argument("--func", required=True)
+    parser.add_argument("--mode", choices=["sentinel", "equivalent"], default="sentinel")
+    args = parser.parse_args()
+
+    if args.mode == "equivalent":
+        print(json.dumps({"ok": True, "changed": False}))
+        return
+
+    target = Path(args.file)
+    text = target.read_text(encoding="utf8")
+    lines = text.splitlines(keepends=True)
+
+    try:
+        tree = ast.parse(text, filename=str(target))
+    except SyntaxError as exc:
+        fail(f"syntax_error:{exc.lineno}")
+
+    candidates: list[ast.FunctionDef | ast.AsyncFunctionDef] = []
+    for node in ast.walk(tree):
+        if isinstance(node, (ast.FunctionDef, ast.AsyncFunctionDef)) and node.name == args.func:
+            candidates.append(node)
+
+    if len(candidates) != 1:
+        fail("ambiguous_function" if candidates else "function_not_found")
+
+    fn = candidates[0]
+    if fn.end_lineno is None or not fn.body:
+        fail("unsupported_function_shape")
+    if any(isinstance(n, (ast.Yield, ast.YieldFrom)) for n in ast.walk(fn)):
+        fail("unsupported_generator")
+
+    first_body = fn.body[0]
+    start = first_body.lineno
+    end = fn.end_lineno
+    if start < 1 or end < start or end > len(lines):
+        fail("unsupported_function_range")
+
+    if start == fn.lineno and end == fn.lineno:
+        header_line = lines[fn.lineno - 1]
+        match = re.match(r"^(\s*(?:async\s+)?def\s+[A-Za-z_][A-Za-z0-9_]*\([^)]*\)(?:\s*->\s*[^:]+)?):\s*.+$", header_line)
+        if not match:
+            fail("unsupported_inline_suite")
+        body_indent = leading_ws(header_line) + "    "
+        lines[start - 1 : end] = [f"{match.group(1)}:\n", f"{body_indent}return 0\n"]
+        target.write_text("".join(lines), encoding="utf8")
+        print(json.dumps({"ok": True, "changed": True, "start_line": start, "end_line": end}))
+        return
+
+    indent = leading_ws(lines[start - 1])
+    if not indent or len(indent.replace("\t", "    ")) <= len(leading_ws(lines[fn.lineno - 1]).replace("\t", "    ")):
+        fail("unsupported_suite_indent")
+
+    replacement = f"{indent}return 0\n"
+    lines[start - 1 : end] = [replacement]
+    target.write_text("".join(lines), encoding="utf8")
+    print(json.dumps({"ok": True, "changed": True, "start_line": start, "end_line": end}))
+
+
+if __name__ == "__main__":
+    main()