ast-mcp-server 0.12.0 → 0.13.0

package/CHANGELOG.md

@@ -6,7 +6,13 @@ The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.1.0/),
 
 ## [Unreleased]
 
-## [0.12.0] — local release candidate, pending release (2026-08-27)
+## [0.13.0] — local release candidate, pending release (2026-08-27)
+
+### Added
+
+- DeepSeek Harness Developer Preview adapter (roadmap initiative 4, first slice): `cordis.patch.yml` mounts the packaged `ast-mcp-server` stdio command through `@deepseek-ai/dsh-mcp-client`, declared via the exact `"dsh": {"bundle": {"patch": "./cordis.patch.yml"}}` contract with the pinned identity recorded separately in `deepseekHarness` (revision `cd5ef814…`, `dsh-v0.1.2-alpha.1`). The first surface is reads + prepare + preview with a fail-closed apply guard (`ast_apply_operation` registers only under an explicit `AST_MCP_APPLY_GUARD=allow`; unset, `deny`, or invalid denies it). `yarn test:dsh-adapter` is a mandatory, never-skipping gate: tarball fixture and hashes, guard matrix, and — against the clean source-built pinned Harness — native-mode profile composition plus Harness-mediated read, dry-run rename, preview, apply absence, and rejected direct apply invocation.
+
+## [0.12.0] — published to `latest` and `next`, registry verified (2026-08-27)
 
 ### Added
 
@@ -19,7 +25,7 @@ The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.1.0/),
 
 ### Release status
 
-- Version `0.12.0` remains pending its exact-tree two-runtime matrix, CI, and separately authorized delivery sequence. It has not been published, assigned to an npm dist-tag, tagged in Git, or released on GitHub.
+- npm published these immutable bytes under `next` with provenance and the expected Git commit. Public-registry consumer and release-preflight verification passed, `latest` and `next` both resolve to `0.12.0`, and the annotated `v0.12.0` tag plus GitHub Release resolve to the same release commit.
 
 ## [0.11.2] — published to `latest` and `next`, registry verified (2026-08-25)
 

package/README.md

@@ -55,12 +55,12 @@ Reads can start with a bounded file slice, a compact outline, or exact source on
 
 The server exposes evidence labels instead of collapsing every result into an unqualified confidence score:
 
-| Label                                                                                                 | Meaning                                                                                                                                                                                                       | Safe use                                                                                                 |
-| ----------------------------------------------------------------------------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | -------------------------------------------------------------------------------------------------------- |
-| `provenance: "compiler"`, `confidence: "exact"`, `resolution: "resolved"`, `freshness.state: "fresh"` | A relationship resolved by the active TypeScript compiler snapshot. This is the only combination that sets `compiler_authoritative: true`.                                                                    | May support bounded impact evidence and compiler-backed test candidates.                                 |
-| `provenance: "syntax"`                                                                                | Syntax or AST structure without semantic symbol resolution.                                                                                                                                                   | Navigation and structural context only; not proof that two symbols are related.                          |
-| `provenance: "heuristic"`                                                                             | A convention or name-based suggestion.                                                                                                                                                                        | Discovery hints only; never mutation authority or a compiler-backed test candidate.                      |
-| index evidence                                                                                        | A derived query accelerator, not compiler authority. The current production status reports the index as disabled; any future ready index still requires compiler selector validation and a compiler fallback. | Faster routing only; stale, missing or mismatched entries must fail closed or fall back to the compiler. |
+| Label                                                                                                 | Meaning                                                                                                                                                                                                                    | Safe use                                                                                                 |
+| ----------------------------------------------------------------------------------------------------- | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | -------------------------------------------------------------------------------------------------------- |
+| `provenance: "compiler"`, `confidence: "exact"`, `resolution: "resolved"`, `freshness.state: "fresh"` | A relationship resolved by the active TypeScript compiler snapshot. This is the only combination that sets `compiler_authoritative: true`.                                                                                 | May support bounded impact evidence and compiler-backed test candidates.                                 |
+| `provenance: "syntax"`                                                                                | Syntax or AST structure without semantic symbol resolution.                                                                                                                                                                | Navigation and structural context only; not proof that two symbols are related.                          |
+| `provenance: "heuristic"`                                                                             | A convention or name-based suggestion.                                                                                                                                                                                     | Discovery hints only; never mutation authority or a compiler-backed test candidate.                      |
+| index evidence                                                                                        | A derived query accelerator, not compiler authority. The production default uses native SQLite when persistence is absent or `enabled`; every indexed selector still requires compiler validation and a compiler fallback. | Faster routing only; stale, missing or mismatched entries must fail closed or fall back to the compiler. |
 
 Freshness is orthogonal to TypeScript diagnostics. `fresh` means the evidence matches the synchronized snapshot; `pending`, `rebuilding`, `stale`, or `degraded` means the response must not be presented as current compiler evidence. Read tools expose the state, causes (`source_change`, `config_change`, `index_failure`, `watcher_failure`, or `compiler_rebuild`), and bounded `checked_at` timestamp. `ast_get_impact` refuses non-fresh compiler relationships. `ast_explore` returns the state together with `completeness`, `unresolved`, `budget`, and `truncation` metadata rather than silently dropping evidence.
 
@@ -84,7 +84,7 @@ The included batch benchmark records a 50% reduction in model round-trips and a
 
 ## Supported environment and trust boundary
 
-The local `0.12.0` release candidate requires Node.js `>=22.13.0`; its evidence matrix targets exact Node.js 22.13.0 and the current Node.js 24 line. Published v0.11.2 retains its immutable historical Node.js 22.13.0/24 evidence. Managed setup-file publication additionally requires GNU coreutils 9.7 `mv` supporting `--update=none-fail`, `--exchange`, `--no-copy`, and `--no-target-directory`, GNU coreutils `ln -L -T`, procfs descriptor paths at `/proc/self/fd`, and `O_DIRECTORY`/`O_NOFOLLOW`. Other Linux architectures or systems without those filesystem primitives, macOS, and Windows remain unverified.
+Published v0.12.0 requires Node.js `>=22.13.0`; its immutable evidence matrix targets exact Node.js 22.13.0 and the current Node.js 24 line. Managed setup-file publication additionally requires GNU coreutils 9.7 `mv` supporting `--update=none-fail`, `--exchange`, `--no-copy`, and `--no-target-directory`, GNU coreutils `ln -L -T`, procfs descriptor paths at `/proc/self/fd`, and `O_DIRECTORY`/`O_NOFOLLOW`. Other Linux architectures or systems without those filesystem primitives, macOS, and Windows remain unverified.
 
 This is a local stdio server. It runs with the invoking user's filesystem permissions, and clients may request any `project_root` that user can access. It does not provide HTTP authentication, sandboxing, tenant isolation, or a remote-service security boundary. Remote, untrusted, and multi-tenant operation is unsupported.
 
@@ -100,7 +100,7 @@ The parent waits for child readiness before replaying bounded initialization sta
 
 The scoped Linux canary passed on exact Node.js 22.13.0 and Node.js 24 with repeatable PSS reclamation, stable compiler fingerprints, unchanged SQLite reuse, bounded redacted diagnostics, and no orphan after parent death. This is one child per connection, not a shared daemon, pool, or new default. See [ADR 0014](docs/adr/0014-supervised-compiler-worker.md).
 
-In published v0.11.2 and the local `0.12.0` release candidate, an absent `AST_SYMBOL_INDEX_PERSISTENCE` or explicit `enabled` selects the private SQLite symbol-index cache. `disabled` is the immediate memory-only rollback. `canary` requires an explicit absolute normalized `AST_SYMBOL_INDEX_CACHE_ROOT`. Invalid policy or storage fails closed to compiler-authoritative memory reads with bounded path-free status.
+In published v0.12.0, an absent `AST_SYMBOL_INDEX_PERSISTENCE` or explicit `enabled` selects the private SQLite symbol-index cache. `disabled` is the immediate memory-only rollback. `canary` requires an explicit absolute normalized `AST_SYMBOL_INDEX_CACHE_ROOT`. Invalid policy or storage fails closed to compiler-authoritative memory reads with bounded path-free status.
 
 The default cache root is selected from `AST_SYMBOL_INDEX_CACHE_ROOT`, then `XDG_CACHE_HOME`, then `HOME`. Inspect or clear only derived cache artifacts through the bounded CLI:
 
@@ -261,7 +261,7 @@ Claude Code supports local stdio MCP servers. After building this repository, re
 
 ```bash
 AST_MCP_DIR="$(pwd)"
-claude mcp add --scope user --transport stdio ast -- \
+claude mcp add --scope user --env AST_MCP_APPLY_GUARD=allow --transport stdio ast -- \
   node "$AST_MCP_DIR/dist/index.js"
 claude mcp get ast
 ```
@@ -316,12 +316,44 @@ Use `/mcp` inside Claude Code to inspect server status and tools. Outside the se
 Hermes Agent:
 
 ```bash
-hermes mcp add ast --command node --args /absolute/path/to/ast-mcp-server/dist/index.js
+hermes mcp add ast --command node --env AST_MCP_APPLY_GUARD=allow --args /absolute/path/to/ast-mcp-server/dist/index.js
 hermes mcp test ast
 ```
 
 Project-scoped tools accept `project_root`, either the project directory or an explicit `tsconfig.json` path. The server contains no repository-specific paths.
 
+### DeepSeek Harness (Developer Preview)
+
+A thin adapter ships inside this package: `cordis.patch.yml` mounts the packaged
+`ast-mcp-server` stdio command through the official
+[`@deepseek-ai/dsh-mcp-client`](https://github.com/deepseek-ai/deepseek-harness/blob/cd5ef8148158c3a752a658978873241fdf8e2bbc/packages/mcp/mcp-client/README.md)
+bridge, declared through exactly `"dsh": { "bundle": { "patch": "./cordis.patch.yml" } }`.
+This is a Developer Preview against a pinned, **source-built** Harness revision
+(`dsh-v0.1.2-alpha.1` at `cd5ef8148158c3a752a658978873241fdf8e2bbc`); that revision
+is validated from source, and `ast-mcp-server@0.13.0` is not published yet. Install a
+locally packed tarball instead:
+
+```bash
+yarn pack --out ast-mcp-server-%v.tgz
+dsh plugin --profile web add ./ast-mcp-server-0.13.0.tgz
+```
+
+The first supported surface is **reads + prepare + preview**. Every apply path is
+denied by a fail-closed guard: `ast_apply_operation` is not registered unless
+`AST_MCP_APPLY_GUARD=allow` is set explicitly (the shipped patch instead pins `deny`,
+so the Harness surface stays deny-by-default; an unset or invalid value also denies). Known upstream
+gaps apply and are never safety authority: the official bridge drops MCP tool
+annotations (`readOnlyHint`/`destructiveHint`) and launches the stdio child outside
+the Harness sandbox.
+
+`yarn test:dsh-adapter` is the mandatory verification: it packs the exact tarball,
+installs it into an isolated profile on the pinned Harness, proves `--dump-config`
+composition including effective `tools.mode: native`, and — through the Harness registry
+itself — invokes the server-qualified read, dry-run rename prepare, and preview tools.
+It separately proves `mcp__ast__ast_apply_operation` is absent and that a bounded direct
+registry invocation is rejected. The smoke fails (never skips) if the pinned Harness
+revision, tag, CLI/client version, clean source identity, or a prerequisite is missing.
+
 ## MCP tools
 
 | Tool                        | Purpose                                                              | Mutates files |

package/SECURITY.md

@@ -11,7 +11,7 @@ Security fixes are provided for the exact version currently identified by the np
 | Earlier npm versions                        | No        |
 | Unpublished release candidates              | No        |
 
-This project supports trusted single-user local stdio use; the supported operating-system and architecture boundary remains Linux x64 only. The local `0.12.0` release candidate requires Node.js `>=22.13.0`, with evidence targeted at exact Node.js 22.13.0 and the governed Node.js 24 major. Published v0.11.2 retains its immutable Node.js 22.13.0/24 release matrix. Managed setup mutation requires GNU coreutils 9.7 `mv --update=none-fail --exchange --no-copy --no-target-directory`, GNU coreutils `ln -L -T`, and procfs descriptor-relative paths at `/proc/self/fd` with `O_DIRECTORY`/`O_NOFOLLOW`. The candidate's default SQLite cache also relies on Linux ownership, mode, no-follow, link-count and inode-identity checks; it does not defend against a malicious same-UID process. Other Linux architectures and systems without those primitives are unverified, as are macOS and Windows. Remote, untrusted, and multi-tenant use is outside the supported security boundary.
+This project supports trusted single-user local stdio use; the supported operating-system and architecture boundary remains Linux x64 only. Published v0.12.0 requires Node.js `>=22.13.0`, with immutable evidence targeted at exact Node.js 22.13.0 and the governed Node.js 24 major. Managed setup mutation requires GNU coreutils 9.7 `mv --update=none-fail --exchange --no-copy --no-target-directory`, GNU coreutils `ln -L -T`, and procfs descriptor-relative paths at `/proc/self/fd` with `O_DIRECTORY`/`O_NOFOLLOW`. The release's default SQLite cache also relies on Linux ownership, mode, no-follow, link-count and inode-identity checks; it does not defend against a malicious same-UID process. Other Linux architectures and systems without those primitives are unverified, as are macOS and Windows. Remote, untrusted, and multi-tenant use is outside the supported security boundary.
 
 ## Reporting a vulnerability
 

package/cordis.patch.yml

@@ -0,0 +1,31 @@
+# DeepSeek Harness adapter patch for ast-mcp-server (roadmap initiative 4).
+#
+# Mounts the packaged `ast-mcp-server` stdio command through the official
+# `@deepseek-ai/dsh-mcp-client` bridge. Harness does not resolve MCP binaries
+# from PATH, so the entrypoint is resolved relative to the profile directory
+# (`baseUrl`), where `dsh plugin --profile <name> add ./ast-mcp-server-0.13.0.tgz`
+# installs a locally packed package as a dependency.
+#
+# First-slice surface: reads + prepare + preview. Every apply path is denied
+# by the server-side guard activated through `AST_MCP_APPLY_GUARD=deny`.
+#
+# Known upstream gaps (documented, never safety authority):
+# - the official bridge drops MCP tool.annotations, incl. readOnlyHint and
+#   destructiveHint, so the guard enumerates tool names instead of hints;
+# - the stdio child runs outside the Harness sandbox.
+- insert:
+    - id: mcp-ast
+      name: "@deepseek-ai/dsh-mcp-client"
+      config:
+        serverName: ast
+        transport: stdio
+        command: !!js process.execPath
+        args:
+          - !!js >-
+            process.getBuiltinModule('node:url').fileURLToPath(
+              new URL('node_modules/ast-mcp-server/dist/index.js', baseUrl)
+            )
+        env:
+          AST_MCP_APPLY_GUARD: "deny"
+        cwd: !!js process.cwd()
+        failOnStartupError: true

package/dist/server.js

@@ -25,6 +25,11 @@ export function createServer(options = {}) {
     });
     if (options.runtimeActivity)
         installRuntimeActivityTracking(server, options.runtimeActivity);
-    toolCatalog.registerAll(server);
+    if (options.denyApply === undefined) {
+        toolCatalog.registerAll(server);
+    }
+    else {
+        toolCatalog.registerAll(server, { denyApply: options.denyApply });
+    }
     return server;
 }

package/dist/services/agent-setup.js

@@ -9,7 +9,7 @@ import { applySkillInstallationPlan, planBundledSkillInstallation, SkillConflict
 import { planManagedGuidance, } from "./managed-guidance.js";
 import { applyManagedFilePlan, createManagedFileApplyContext, ManagedFileApplyError, ManagedFileRollbackError, revalidateManagedFilePlan, verifyManagedFilePostimage, } from "./managed-file.js";
 import { AGENT_IDS, classifyAgentVersion, getAgentTarget, MCP_SERVER_NAME, } from "./agent-targets.js";
-import { applyOpenCodeConfigPlan, planOpenCodeConfig, resolveOpenCodeConfigPath, withIsolatedOpenCodeConfig, } from "./opencode-config.js";
+import { applyOpenCodeConfigPlan, classifyOpenCodeAstRegistration, planOpenCodeConfig, resolveOpenCodeConfigPath, OpenCodeConfigRecoveryError, runOpenCodeConfigTransaction, withIsolatedOpenCodeConfig, } from "./opencode-config.js";
 const DEFAULT_COMMAND_TIMEOUT_MS = 120_000;
 const MAX_COMMAND_OUTPUT_BYTES = 1024 * 1024;
 export class AgentSetupError extends Error {
@@ -238,10 +238,12 @@ async function verifyOpenCode(detection, environment, timeoutMs, context) {
             throw new AgentSetupError("OpenCode resolved configuration output is unknown.", "AGENT_VERIFICATION_FAILED", { agent: "opencode" });
         }
         const command = config?.mcp?.ast?.command;
+        const guard = config?.mcp?.ast?.environment?.AST_MCP_APPLY_GUARD;
         if (!Array.isArray(command) ||
             command.length !== 2 ||
             command[0] !== context.nodeExecutable ||
-            command[1] !== context.serverEntryPath) {
+            command[1] !== context.serverEntryPath ||
+            guard !== "allow") {
             throw new AgentSetupError("OpenCode resolved configuration does not contain the expected ast server.", "AGENT_VERIFICATION_FAILED", { agent: "opencode" });
         }
         const listed = await runtime.run(["mcp", "list", "--pure"]);
@@ -265,6 +267,63 @@ async function configureMcp(agent, detection, serverEntryPath, nodeExecutable, e
         throw new AgentSetupError(`${target.label} saved the MCP registration but verification did not match.`, "AGENT_VERIFICATION_FAILED", { agent, inspection: verified });
     }
 }
+async function repairMcp(agent, detection, serverEntryPath, nodeExecutable, environment, timeoutMs) {
+    const target = getAgentTarget(agent);
+    const runtime = targetRuntime(detection, environment, timeoutMs);
+    const context = { serverEntryPath, nodeExecutable };
+    const authenticated = await target.mcp.inspect(runtime, context);
+    if (authenticated.status !== "repairable") {
+        throw new AgentSetupError(`${target.label} legacy registration changed before repair and was not removed.`, "AGENT_MCP_CONFLICT", { agent, inspection: authenticated });
+    }
+    const recover = async (cause) => {
+        const durable = await target.mcp.inspect(runtime, context);
+        if (durable.status === "current")
+            return;
+        if (durable.status === "repairable")
+            throw cause;
+        if (durable.status !== "missing") {
+            throw new AgentSetupError(`${target.label} migration outcome conflicts with the authenticated registration; it was preserved.`, "AGENT_MCP_CONFLICT", { agent, inspection: durable });
+        }
+        // The authenticated preimage is absent. Add it directly: never unregister
+        // here, because a concurrent replacement must make this add fail harmlessly.
+        const restored = await target.mcp.registerLegacy(runtime, context);
+        const afterRestore = await target.mcp.inspect(runtime, context);
+        if (afterRestore.status === "current")
+            return;
+        if (afterRestore.status === "repairable")
+            throw cause;
+        if (!target.mcp.registrationAccepted(restored) && afterRestore.status === "conflict") {
+            throw new AgentSetupError(`${target.label} changed concurrently during migration recovery; the replacement was preserved.`, "AGENT_MCP_CONFLICT", { agent, inspection: afterRestore });
+        }
+        throw new AgentSetupError(`${target.label} migration failed and its authenticated legacy registration is missing.`, "AGENT_VERIFICATION_FAILED", { agent, cause: cause instanceof Error ? cause.message : String(cause), afterRestore });
+    };
+    try {
+        let removalError;
+        try {
+            const removed = await target.mcp.unregister(runtime);
+            if (!target.mcp.removalAccepted(removed)) {
+                removalError = commandFailure(agent, "legacy MCP removal", removed);
+            }
+        }
+        catch (error) {
+            removalError = error;
+        }
+        if (removalError !== undefined) {
+            return recover(removalError);
+        }
+        const added = await target.mcp.register(runtime, context);
+        if (!target.mcp.registrationAccepted(added)) {
+            throw commandFailure(agent, "MCP registration repair", added);
+        }
+        const verified = await target.mcp.inspect(runtime, context);
+        if (verified.status !== "current") {
+            throw new AgentSetupError(`${target.label} saved the repaired MCP registration but verification did not match.`, "AGENT_VERIFICATION_FAILED", { agent, inspection: verified });
+        }
+    }
+    catch (error) {
+        return recover(error);
+    }
+}
 async function assertRegularFile(filePath, label) {
     let fileStat;
     try {
@@ -367,16 +426,11 @@ export async function runAgentSetup(options) {
         catch {
             throw new AgentSetupError("OpenCode effective configuration output is unknown.", "AGENT_MCP_CONFLICT", { agent: "opencode", correlation_id: correlationId });
         }
-        const effectiveAst = effectiveConfig?.mcp?.ast;
-        const desiredAst = {
-            type: "local",
-            command: [nodeExecutable, options.serverEntryPath],
-            enabled: true,
-        };
-        if (effectiveAst !== undefined && JSON.stringify(effectiveAst) !== JSON.stringify(desiredAst)) {
+        const effectiveAstStatus = classifyOpenCodeAstRegistration(effectiveConfig?.mcp?.ast, nodeExecutable, options.serverEntryPath);
+        if (effectiveAstStatus === "conflict") {
             throw new AgentSetupError("OpenCode effective configuration conflict at mcp.ast.", "AGENT_MCP_CONFLICT", { agent: "opencode", correlation_id: correlationId });
         }
-        if (effectiveAst !== undefined && openCodePlan.status === "installed") {
+        if (effectiveAstStatus === "current" && openCodePlan.status === "installed") {
             openCodePlan = { ...openCodePlan, status: "unchanged" };
         }
     }
@@ -434,23 +488,35 @@ export async function runAgentSetup(options) {
         const inspection = inspections.find((item) => item.agent === agent);
         try {
             await verifyManagedAssetPlans(skillPlan, guidancePlan, applyContext);
-            if (inspection.status === "missing") {
+            if (inspection.status === "missing" || inspection.status === "repairable") {
                 if (agent === "opencode") {
-                    await applyOpenCodeConfigPlan(openCodePlan);
-                    if (openCodePlan.status === "installed") {
+                    try {
+                        await runOpenCodeConfigTransaction(openCodePlan, async () => {
+                            await applyOpenCodeConfigPlan(openCodePlan);
+                            await verifyOpenCode(detection, environment, timeoutMs, {
+                                nodeExecutable,
+                                serverEntryPath: options.serverEntryPath,
+                            });
+                        });
+                    }
+                    catch (error) {
+                        if (error instanceof OpenCodeConfigRecoveryError)
+                            throw new AgentSetupError("OpenCode configuration outcome could not be restored safely.", "AGENT_VERIFICATION_FAILED", { cause: error.message });
+                        throw error;
+                    }
+                    if (openCodePlan.status === "installed")
                         physicalWrites.push({
                             path: openCodePlan.filePath,
                             asset: "mcp_config",
                             status: "installed",
                         });
-                    }
-                    await verifyOpenCode(detection, environment, timeoutMs, {
-                        nodeExecutable,
-                        serverEntryPath: options.serverEntryPath,
-                    });
                 }
-                else
+                else if (inspection.status === "repairable") {
+                    await repairMcp(agent, detection, options.serverEntryPath, nodeExecutable, environment, timeoutMs);
+                }
+                else {
                     await configureMcp(agent, detection, options.serverEntryPath, nodeExecutable, environment, timeoutMs);
+                }
             }
             else if (agent === "opencode") {
                 await verifyOpenCode(detection, environment, timeoutMs, {

package/dist/services/agent-targets.js

@@ -1,6 +1,9 @@
 import { toolCatalog } from "../tools/catalog.js";
 export const MCP_SERVER_NAME = "ast";
 const EXPECTED_TOOLS = toolCatalog.compatibility.required;
+const APPLY_TOOL = "ast_apply_operation";
+/** Ambient agent surfaces opt into the apply-effect tool (fail-closed guard default is deny). */
+const APPLY_GUARD_ALLOW_ENV = "AST_MCP_APPLY_GUARD=allow";
 function semver(value) {
     const match = value.match(/(?:^|\s|v)(\d+)\.(\d+)\.(\d+)(?=\s|$|[-+()]|\.(?:\s|$))/);
     return match ? [Number(match[1]), Number(match[2]), Number(match[3])] : undefined;
@@ -28,6 +31,32 @@ function expected(context, command, args) {
         args.length === 1 &&
         args[0] === context.serverEntryPath);
 }
+function structuredGuardStatus(...values) {
+    const provided = values.filter((value) => value !== undefined);
+    if (provided.length === 0)
+        return "repairable";
+    const records = provided.filter((value) => value !== null && typeof value === "object" && !Array.isArray(value));
+    return records.length === provided.length &&
+        records.length === 1 &&
+        Object.keys(records[0]).length === 1 &&
+        records[0].AST_MCP_APPLY_GUARD === "allow"
+        ? "current"
+        : "conflict";
+}
+function matchingRegistration(hasExpectedCommand, guardStatus) {
+    if (!hasExpectedCommand) {
+        return {
+            status: "conflict",
+            detail: "The existing 'ast' registration does not match this package.",
+        };
+    }
+    return guardStatus === "conflict"
+        ? {
+            status: "conflict",
+            detail: "The existing 'ast' registration has unsupported environment settings.",
+        }
+        : { status: guardStatus };
+}
 function parseJson(result) {
     try {
         return JSON.parse(result.stdout);
@@ -46,12 +75,7 @@ function structuredInspection(result, context) {
     if (!value || value.name !== MCP_SERVER_NAME)
         return { status: "error", operation: "MCP inspection", result };
     const transport = (value.transport ?? value);
-    return expected(context, transport.command, transport.args)
-        ? { status: "current" }
-        : {
-            status: "conflict",
-            detail: "The existing 'ast' registration does not match this package.",
-        };
+    return matchingRegistration(transport.type === "stdio" && expected(context, transport.command, transport.args), structuredGuardStatus(transport.env, transport.environment));
 }
 function copilotStructuredInspection(result, context) {
     if (result.exitCode !== 0) {
@@ -65,18 +89,35 @@ function copilotStructuredInspection(result, context) {
         return { status: "error", operation: "MCP inspection", result };
     }
     const configuration = server;
-    return configuration.type === "local" &&
+    const matches = configuration.type === "local" &&
         configuration.source === "user" &&
         configuration.enabled === true &&
         Array.isArray(configuration.tools) &&
         configuration.tools.length === 1 &&
         configuration.tools[0] === "*" &&
-        expected(context, configuration.command, configuration.args)
-        ? { status: "current" }
-        : {
-            status: "conflict",
+        expected(context, configuration.command, configuration.args);
+    const inspection = matchingRegistration(matches, structuredGuardStatus(configuration.env, configuration.environment));
+    return inspection.status === "conflict"
+        ? {
+            ...inspection,
             detail: "The existing user-scoped 'ast' registration does not match this package.",
-        };
+        }
+        : inspection;
+}
+function claudeRegister(runtime, context, guarded) {
+    return runtime.run([
+        "mcp",
+        "add",
+        "--scope",
+        "user",
+        ...(guarded ? ["--env", APPLY_GUARD_ALLOW_ENV] : []),
+        "--transport",
+        "stdio",
+        MCP_SERVER_NAME,
+        "--",
+        context.nodeExecutable,
+        context.serverEntryPath,
+    ]);
 }
 const claudeMcp = {
     async inspect(runtime, context) {
@@ -88,87 +129,140 @@ const claudeMcp = {
                 : { status: "error", operation: "MCP inspection", result };
         const fields = new Map();
         for (const line of result.stdout.split(/\r?\n/)) {
-            const match = line.match(/^\s*(Status|Type|Command|Args):\s*(.*)$/i);
+            const match = line.match(/^\s*(Scope|Status|Type|Command|Args):\s*(.*)$/i);
             if (match)
                 fields.set(match[1].toLowerCase(), match[2].trim());
         }
-        return /connected/i.test(fields.get("status") ?? "") &&
+        const matches = /^user config\b/i.test(fields.get("scope") ?? "") &&
+            /connected/i.test(fields.get("status") ?? "") &&
             fields.get("type")?.toLowerCase() === "stdio" &&
-            expected(context, fields.get("command"), [fields.get("args")])
-            ? { status: "current" }
-            : {
-                status: "conflict",
+            expected(context, fields.get("command"), [fields.get("args")]);
+        const hasEnvironment = /^\s*Environment:\s*$/im.test(result.stdout);
+        const inspection = matchingRegistration(matches, /(?:^|\s)AST_MCP_APPLY_GUARD\s*=\s*allow(?:\s|$)/m.test(result.stdout)
+            ? "current"
+            : hasEnvironment
+                ? "conflict"
+                : "repairable");
+        return inspection.status === "conflict"
+            ? {
+                ...inspection,
                 detail: "The existing user-scoped 'ast' registration does not match this package.",
-            };
+            }
+            : inspection;
     },
-    register: (runtime, context) => runtime.run([
+    register: (runtime, context) => claudeRegister(runtime, context, true),
+    unregister: (runtime) => runtime.run(["mcp", "remove", MCP_SERVER_NAME, "--scope", "user"]),
+    registerLegacy: (runtime, context) => claudeRegister(runtime, context, false),
+    registrationAccepted: (result) => result.exitCode === 0,
+    removalAccepted: (result) => result.exitCode === 0,
+};
+function hermesRegister(runtime, context, guarded) {
+    return runtime.run([
         "mcp",
         "add",
-        "--scope",
-        "user",
-        "--transport",
-        "stdio",
         MCP_SERVER_NAME,
-        "--",
+        "--command",
         context.nodeExecutable,
+        ...(guarded ? ["--env", APPLY_GUARD_ALLOW_ENV] : []),
+        "--args",
         context.serverEntryPath,
-    ]),
-    registrationAccepted: (result) => result.exitCode === 0,
-};
+    ], "\n");
+}
 const hermesMcp = {
-    async inspect(runtime) {
+    async inspect(runtime, context) {
         const listed = await runtime.run(["mcp", "list"]);
         if (listed.exitCode !== 0)
             return { status: "error", operation: "MCP list", result: listed };
         if (!/^\s*ast(?:\s|$)/im.test(listed.stdout))
             return { status: "missing" };
-        const tested = await runtime.run(["mcp", "test", MCP_SERVER_NAME]);
-        return tested.exitCode === 0 && EXPECTED_TOOLS.every((tool) => tested.stdout.includes(tool))
-            ? { status: "current" }
-            : {
+        const configured = await runtime.run(["config", "get", "mcp_servers.ast", "--json"]);
+        const registration = parseJson(configured);
+        if (configured.exitCode !== 0 ||
+            !registration ||
+            Array.isArray(registration) ||
+            !expected(context, registration.command, registration.args)) {
+            return {
                 status: "conflict",
-                detail: "The existing 'ast' registration does not expose the expected structural tools.",
+                detail: "The existing 'ast' registration cannot be authenticated as this package.",
             };
+        }
+        const guardStatus = structuredGuardStatus(registration.env);
+        const admittedKeys = guardStatus === "repairable" ? ["args", "command"] : ["args", "command", "env"];
+        if (guardStatus === "conflict" ||
+            Object.keys(registration).sort().join(",") !== admittedKeys.join(",")) {
+            return {
+                status: "conflict",
+                detail: "The existing 'ast' registration has unsupported configuration.",
+            };
+        }
+        const tested = await runtime.run(["mcp", "test", MCP_SERVER_NAME]);
+        const expectedWithoutApply = EXPECTED_TOOLS.filter((tool) => tool !== APPLY_TOOL);
+        if (tested.exitCode === 0 &&
+            expectedWithoutApply.every((tool) => tested.stdout.includes(tool))) {
+            const applyPresent = !EXPECTED_TOOLS.includes(APPLY_TOOL) || tested.stdout.includes(APPLY_TOOL);
+            return guardStatus === "current" && applyPresent
+                ? { status: "current" }
+                : guardStatus === "repairable" && !tested.stdout.includes(APPLY_TOOL)
+                    ? { status: "repairable" }
+                    : {
+                        status: "conflict",
+                        detail: "The existing 'ast' registration tool surface contradicts its configuration.",
+                    };
+        }
+        return {
+            status: "conflict",
+            detail: "The existing 'ast' registration does not expose the expected structural tools.",
+        };
     },
-    register: (runtime, context) => runtime.run([
+    register: (runtime, context) => hermesRegister(runtime, context, true),
+    unregister: (runtime) => runtime.run(["mcp", "remove", MCP_SERVER_NAME]),
+    registerLegacy: (runtime, context) => hermesRegister(runtime, context, false),
+    registrationAccepted: (result) => result.exitCode === 0 && /saved\s+'ast'/i.test(result.stdout),
+    removalAccepted: (result) => result.exitCode === 0,
+};
+function separatorRegister(runtime, context, guarded) {
+    return runtime.run([
         "mcp",
         "add",
         MCP_SERVER_NAME,
-        "--command",
+        ...(guarded ? ["--env", APPLY_GUARD_ALLOW_ENV] : []),
+        "--",
         context.nodeExecutable,
-        "--args",
         context.serverEntryPath,
-    ], "\n"),
-    registrationAccepted: (result) => result.exitCode === 0 && /saved\s+'ast'/i.test(result.stdout),
-};
+    ]);
+}
 const codexMcp = {
     async inspect(runtime, context) {
         return structuredInspection(await runtime.run(["mcp", "get", MCP_SERVER_NAME, "--json"]), context);
     },
-    register: (runtime, context) => runtime.run([
-        "mcp",
-        "add",
-        MCP_SERVER_NAME,
-        "--",
-        context.nodeExecutable,
-        context.serverEntryPath,
-    ]),
+    register: (runtime, context) => separatorRegister(runtime, context, true),
+    unregister: (runtime) => runtime.run(["mcp", "remove", MCP_SERVER_NAME]),
+    registerLegacy: (runtime, context) => separatorRegister(runtime, context, false),
     registrationAccepted: (result) => result.exitCode === 0,
+    removalAccepted: (result) => result.exitCode === 0,
 };
 const copilotMcp = {
     async inspect(runtime, context) {
         return copilotStructuredInspection(await runtime.run(["mcp", "get", MCP_SERVER_NAME, "--json"]), context);
     },
-    register: (runtime, context) => runtime.run([
+    register: (runtime, context) => separatorRegister(runtime, context, true),
+    unregister: (runtime) => runtime.run(["mcp", "remove", MCP_SERVER_NAME]),
+    registerLegacy: (runtime, context) => separatorRegister(runtime, context, false),
+    registrationAccepted: (result) => result.exitCode === 0,
+    removalAccepted: (result) => result.exitCode === 0,
+};
+function geminiRegister(runtime, context, guarded) {
+    return runtime.run([
         "mcp",
         "add",
         MCP_SERVER_NAME,
-        "--",
+        ...(guarded ? ["--env", APPLY_GUARD_ALLOW_ENV] : []),
         context.nodeExecutable,
         context.serverEntryPath,
-    ]),
-    registrationAccepted: (result) => result.exitCode === 0,
-};
+        "--scope",
+        "user",
+    ]);
+}
 const geminiMcp = {
     async inspect(runtime, context) {
         const result = await runtime.run(["mcp", "list"]);
@@ -187,23 +281,24 @@ const geminiMcp = {
         const match = result.stdout.match(pattern);
         if (!match)
             return { status: "error", operation: "MCP inspection", result };
-        return expected(context, match[1]?.trim(), match[2]?.split(",").map((item) => item.trim()))
-            ? { status: "current" }
-            : {
+        const matches = expected(context, match[1]?.trim(), match[2]?.split(",").map((item) => item.trim()));
+        const inspection = matchingRegistration(matches, /(?:^|\s|,)AST_MCP_APPLY_GUARD\s*=\s*allow(?:\s|$|,)/m.test(result.stdout)
+            ? "current"
+            : /\benv(?:ironment)?\s*:/i.test(result.stdout)
+                ? "conflict"
+                : "repairable");
+        return inspection.status === "conflict"
+            ? {
                 status: "conflict",
                 detail: "The existing Gemini 'ast' registration does not match this package.",
-            };
+            }
+            : inspection;
     },
-    register: (runtime, context) => runtime.run([
-        "mcp",
-        "add",
-        MCP_SERVER_NAME,
-        context.nodeExecutable,
-        context.serverEntryPath,
-        "--scope",
-        "user",
-    ]),
+    register: (runtime, context) => geminiRegister(runtime, context, true),
+    unregister: (runtime) => runtime.run(["mcp", "remove", MCP_SERVER_NAME, "--scope", "user"]),
+    registerLegacy: (runtime, context) => geminiRegister(runtime, context, false),
     registrationAccepted: (result) => result.exitCode === 0,
+    removalAccepted: (result) => result.exitCode === 0,
 };
 const opencodeMcp = {
     async inspect() {
@@ -220,7 +315,14 @@ const opencodeMcp = {
     async register() {
         return { exitCode: 1, stdout: "", stderr: "OpenCode CLI registration is disabled." };
     },
+    async unregister() {
+        return { exitCode: 1, stdout: "", stderr: "OpenCode CLI removal is disabled." };
+    },
+    async registerLegacy() {
+        return { exitCode: 1, stdout: "", stderr: "OpenCode CLI registration is disabled." };
+    },
     registrationAccepted: () => false,
+    removalAccepted: () => false,
 };
 export const AGENT_TARGETS = [
     { id: "claude", label: "Claude Code", command: "claude", skillTarget: "claude", mcp: claudeMcp },

package/dist/services/opencode-config.js

@@ -3,6 +3,49 @@ import { link, mkdir, mkdtemp, open, readFile, rename, rm, stat, writeFile, } fr
 import os from "node:os";
 import path from "node:path";
 import { applyEdits, modify, parse } from "jsonc-parser";
+export class OpenCodeConfigRecoveryError extends Error {
+    constructor(message, options) {
+        super(message, options);
+        this.name = "OpenCodeConfigRecoveryError";
+    }
+}
+function desiredAst(nodeExecutable, serverEntryPath) {
+    return {
+        type: "local",
+        command: [nodeExecutable, serverEntryPath],
+        enabled: true,
+        environment: { AST_MCP_APPLY_GUARD: "allow" },
+    };
+}
+export function classifyOpenCodeAstRegistration(value, nodeExecutable, serverEntryPath) {
+    if (value === undefined)
+        return "missing";
+    if (value === null || typeof value !== "object" || Array.isArray(value))
+        return "conflict";
+    const registration = value;
+    const command = registration.command;
+    const baseMatches = registration.type === "local" &&
+        registration.enabled === true &&
+        Array.isArray(command) &&
+        command.length === 2 &&
+        command[0] === nodeExecutable &&
+        command[1] === serverEntryPath;
+    if (!baseMatches)
+        return "conflict";
+    const keys = Object.keys(registration).sort().join(",");
+    if (keys === "command,enabled,type")
+        return "repairable";
+    if (keys !== "command,enabled,environment,type")
+        return "conflict";
+    const environment = registration.environment;
+    return environment !== null &&
+        typeof environment === "object" &&
+        !Array.isArray(environment) &&
+        Object.keys(environment).length === 1 &&
+        environment.AST_MCP_APPLY_GUARD === "allow"
+        ? "current"
+        : "conflict";
+}
 function hash(value) {
     return createHash("sha256").update(value).digest("hex");
 }
@@ -80,14 +123,11 @@ export async function planOpenCodeConfig(options) {
     }
     if (!parsed || typeof parsed !== "object")
         throw new Error("OpenCode configuration must contain an object.");
-    const desired = {
-        type: "local",
-        command: [options.nodeExecutable, options.serverEntryPath],
-        enabled: true,
-    };
-    if (parsed.mcp?.ast !== undefined && JSON.stringify(parsed.mcp.ast) !== JSON.stringify(desired))
+    const desired = desiredAst(options.nodeExecutable, options.serverEntryPath);
+    const registrationStatus = classifyOpenCodeAstRegistration(parsed.mcp?.ast, options.nodeExecutable, options.serverEntryPath);
+    if (registrationStatus === "conflict")
         throw new Error("OpenCode configuration conflict at mcp.ast.");
-    const content = parsed.mcp?.ast === undefined
+    const content = registrationStatus === "missing" || registrationStatus === "repairable"
         ? applyEdits(before, modify(before, ["mcp", "ast"], desired, {
             formattingOptions: { insertSpaces: true, tabSize: 2, eol: "\n" },
         }))
@@ -96,6 +136,7 @@ export async function planOpenCodeConfig(options) {
         filePath: options.filePath,
         beforeHash: hash(beforeExists ? before : ""),
         beforeExists,
+        beforeContent: beforeExists ? before : "",
         mode,
         content,
         status: content === before ? "unchanged" : "installed",
@@ -146,3 +187,39 @@ export async function applyOpenCodeConfigPlan(plan) {
         await rm(temporary, { force: true });
     }
 }
+async function inspectOpenCodeConfigPlanState(plan) {
+    let content = "";
+    let exists = true;
+    let mode;
+    try {
+        content = await readFile(plan.filePath, "utf8");
+        mode = (await stat(plan.filePath)).mode & 0o777;
+    }
+    catch (error) {
+        if (error.code === "ENOENT")
+            exists = false;
+        else
+            throw error;
+    }
+    if (!plan.beforeExists && !exists)
+        return "preimage";
+    if (plan.beforeExists && exists && content === plan.beforeContent && mode === plan.mode)
+        return "preimage";
+    if (exists && content === plan.content && mode === plan.mode)
+        return "postimage";
+    return "conflict";
+}
+export async function runOpenCodeConfigTransaction(plan, operation) {
+    try {
+        return await operation();
+    }
+    catch (error) {
+        const state = await inspectOpenCodeConfigPlanState(plan);
+        if (state === "postimage")
+            return undefined;
+        if (state === "conflict") {
+            throw new OpenCodeConfigRecoveryError("OpenCode configuration changed concurrently after an ambiguous write outcome; the concurrent bytes were preserved.", { cause: error });
+        }
+        throw error;
+    }
+}

package/dist/services/runtime-policy.js

@@ -7,6 +7,7 @@ export const RUNTIME_POLICY_ENV_KEYS = Object.freeze([
     "AST_SHUTDOWN_DRAIN_TIMEOUT_MS",
     "AST_COMPILER_WORKER_MODE",
     "AST_COMPILER_WORKER_IDLE_TTL_MS",
+    "AST_MCP_APPLY_GUARD",
 ]);
 function parseBoundedInteger(rawValue, defaultValue, minimum, maximum) {
     if (rawValue === undefined)
@@ -37,6 +38,15 @@ export function parseRuntimePolicy(environment) {
             ? "configured"
             : "invalid_mode";
     const compilerWorkerIdleTtlMs = parseBoundedInteger(environment.AST_COMPILER_WORKER_IDLE_TTL_MS, 60_000, 0, 86_400_000);
+    const rawApplyGuard = environment.AST_MCP_APPLY_GUARD;
+    // Fail-closed: only an explicit `allow` permits the apply-effect MCP tool on
+    // this surface. A missing value, `deny`, or any invalid value denies apply.
+    const denyApply = rawApplyGuard !== "allow";
+    const applyGuardReason = rawApplyGuard === undefined
+        ? "default"
+        : rawApplyGuard === "allow" || rawApplyGuard === "deny"
+            ? "configured"
+            : "invalid_mode";
     const reasons = Object.freeze({
         AST_MAX_PROJECT_SESSIONS: maxProjectSessions.reason,
         AST_MAX_QUEUED_OPERATIONS_PER_PROJECT: maxQueuedOperationsPerProject.reason,
@@ -45,6 +55,7 @@ export function parseRuntimePolicy(environment) {
         AST_SHUTDOWN_DRAIN_TIMEOUT_MS: shutdownDrainTimeoutMs.reason,
         AST_COMPILER_WORKER_MODE: compilerWorkerModeReason,
         AST_COMPILER_WORKER_IDLE_TTL_MS: compilerWorkerIdleTtlMs.reason,
+        AST_MCP_APPLY_GUARD: applyGuardReason,
     });
     return Object.freeze({
         maxProjectSessions: maxProjectSessions.value,
@@ -54,6 +65,7 @@ export function parseRuntimePolicy(environment) {
         shutdownDrainTimeoutMs: shutdownDrainTimeoutMs.value,
         compilerWorkerMode,
         compilerWorkerIdleTtlMs: compilerWorkerIdleTtlMs.value,
+        denyApply,
         reasons,
     });
 }
@@ -95,6 +107,9 @@ export function createCompilerWorkerSpawnSpec(workerEntryPath, environment) {
         AST_QUEUE_WAIT_TIMEOUT_MS: String(policy.queueWaitTimeoutMs),
         AST_OPERATION_DEADLINE_MS: String(policy.operationDeadlineMs),
         AST_SHUTDOWN_DRAIN_TIMEOUT_MS: String(policy.shutdownDrainTimeoutMs),
+        // Forward the parent's resolved apply-guard policy so the supervised worker
+        // registers the same tool surface (deny-by-default fail-closed, allow opt-in).
+        AST_MCP_APPLY_GUARD: policy.denyApply ? "deny" : "allow",
     });
     return {
         ok: true,

package/dist/tools/catalog.js

@@ -54,9 +54,12 @@ export function defineToolCatalog(input) {
             apply: names((item) => item.effect === "apply"),
         }),
         directToon: names((item) => item.directOutputFormats.length === 2),
-        registerAll(server) {
-            for (const descriptor of descriptors)
+        registerAll(server, options = {}) {
+            for (const descriptor of descriptors) {
+                if (options.denyApply === true && descriptor.effect === "apply")
+                    continue;
                 descriptor.register(server);
+            }
         },
     });
 }

package/dist/worker-runtime.js

@@ -14,11 +14,11 @@ export async function runStdioServer(options = {}) {
     prepareProjectRuntimeForStartup();
     const runtimeActivity = options.runtimeActivity ?? new RuntimeActivityTracker();
     runtimeActivity.prepareForStartup();
-    const server = options.server ?? createServer({ runtimeActivity });
+    const runtimePolicy = options.runtimePolicy ?? readRuntimePolicy();
+    const server = options.server ?? createServer({ runtimeActivity, denyApply: runtimePolicy.denyApply });
     const transport = options.transport ?? new StdioServerTransport();
     const send = transport.send.bind(transport);
     transport.send = (message, sendOptions) => runtimeActivity.trackSend(() => send(message, sendOptions));
-    const runtimePolicy = options.runtimePolicy ?? readRuntimePolicy();
     const installProcessHandlers = options.installProcessHandlers ?? true;
     const exit = options.exit ?? ((code) => process.exit(code));
     const protocol = server.server;

package/docs/support.md

@@ -1,20 +1,20 @@
 # Support policy
 
-This document defines the supported platform, runtime, persistence, and operational boundary for published `ast-mcp-server` v0.11.2 and the local `0.12.0` release candidate.
+This document defines the supported platform, runtime, persistence, and operational boundary for published `ast-mcp-server` v0.12.0.
 
 ## Supported release target
 
 | Environment                                                                   | Status      | Contract                                                                                      |
 | ----------------------------------------------------------------------------- | ----------- | --------------------------------------------------------------------------------------------- |
 | Linux x64 with required GNU coreutils and procfs, Node.js 22.5.0              | Historical  | Immutable v0.8.1 release evidence; not the runtime floor of the published or candidate lines. |
-| Linux x64 with required GNU coreutils and procfs, exact Node.js 22.13.0       | Supported   | Published v0.11.2 and local 0.12.0 matrices, each bound to its own package and tree bytes.    |
-| Linux x64 with required GNU coreutils and procfs, current Node.js 24 line     | Supported   | Published v0.11.2 and local 0.12.0 matrices, each bound to its own package and tree bytes.    |
+| Linux x64 with required GNU coreutils and procfs, exact Node.js 22.13.0       | Supported   | Published v0.12.0 matrix bound to its immutable package and tree bytes.                       |
+| Linux x64 with required GNU coreutils and procfs, current Node.js 24 line     | Supported   | Published v0.12.0 matrix bound to its immutable package and tree bytes.                       |
 | Other Linux architectures or systems without the required filesystem features | Unverified  | Not supported until equivalent architecture, mutation, and filesystem-publication gates pass. |
 | macOS                                                                         | Unverified  | Not supported until equivalent filesystem, process, package, mutation, and canary gates pass. |
 | Windows                                                                       | Unverified  | Not supported until equivalent filesystem, process, package, mutation, and canary gates pass. |
 | Remote, untrusted, or multi-tenant service use                                | Unsupported | No network authentication, sandbox, or tenant-isolation boundary is provided.                 |
 
-The local `0.12.0` release candidate requires Node.js `>=22.13.0`; its matrix targets exact Node.js 22.13.0 and the governed Node.js 24 major. Published v0.11.2 retains its immutable `>=22.13.0` metadata and exact Node.js 22.13.0/24 release evidence. The earlier v0.8.1 Node.js 22.5.0/24 matrix remains historical evidence for those bytes only. A future runtime satisfying an engine range is not automatically a verified release target.
+Published v0.12.0 requires Node.js `>=22.13.0`; its immutable matrix targets exact Node.js 22.13.0 and the governed Node.js 24 major. The earlier v0.8.1 Node.js 22.5.0/24 matrix remains historical evidence for those bytes only. A future runtime satisfying an engine range is not automatically a verified release target.
 
 The checked-evidence freezer requires GNU coreutils 9.7 `mv` with `--update=none-fail`, `--no-copy`, and `--no-target-directory`. Managed setup-file mutation additionally requires that same `mv` with `--exchange`, GNU coreutils `ln -L -T`, procfs descriptor paths at `/proc/self/fd`, `O_DIRECTORY`, and `O_NOFOLLOW`. It fails closed when any verified Linux primitive is unavailable. Equivalent publication, exchange, descriptor-link, and descriptor-relative mutation semantics have not been verified on other operating systems or architectures.
 
@@ -50,7 +50,7 @@ The scoped Linux evidence passed on exact Node.js 22.13.0 and the governed Node.
 
 ## Symbol-index persistence
 
-Published v0.11.2 and the local `0.12.0` release candidate select native SQLite when the persistence setting is absent or explicitly `enabled`; operators requiring no persistent index state must set `disabled` explicitly:
+Published v0.12.0 selects native SQLite when the persistence setting is absent or explicitly `enabled`; operators requiring no persistent index state must set `disabled` explicitly:
 
 ```bash
 AST_SYMBOL_INDEX_PERSISTENCE=disabled \
@@ -76,11 +76,11 @@ ast-tool cache inspect
 ast-tool cache clear --yes
 ```
 
-Both commands are bounded and path-free. Clear preflights the tree, refuses unsafe or active SQLite artifacts, rechecks identity before unlink and preserves unknown regular files/directories. There is no automatic garbage collection in this candidate.
+Both commands are bounded and path-free. Clear preflights the tree, refuses unsafe or active SQLite artifacts, rechecks identity before unlink and preserves unknown regular files/directories. There is no automatic garbage collection in this release.
 
 ## Production-readiness acceptance
 
-The four retained Linux x64 production-readiness reports cover `ast-mcp-server` and `x-scraper` under Node.js 22.5.0 and Node.js 24 for package version 0.6.0, commit `2d0b21bbb80fae1acfca6a85d5891d87e68b59c1`, and tree `af931d49769fabdf06f623965a6cfe1f9afb8a81`. They are historical integration evidence only: they are not reattributed to v0.8.1, published-next v0.9.0 or v0.9.1, the local 0.9.2 candidate, published v0.10.0, published-next v0.11.0 or v0.11.1, published v0.11.2, or the local v0.12.0 release candidate. The exact 0.9.0 and 0.9.1 release matrices remain historical evidence for their immutable published-next bytes, the exact 0.9.2 matrix remains historical local-candidate evidence, the exact 0.10.0 matrix remains historical published-release evidence, the exact 0.11.0 and 0.11.1 matrices remain historical evidence for their immutable published-next bytes before public-registry verification exposed their distinct verifier defects, and the exact 0.11.2 matrix remains historical published-release evidence. A separate exact 0.12.0 release matrix is the release-candidate gate for current repository bytes under both supported runtime lines, including bounded diagnostic aggregates, catalog-derived tool capability projections, and their independent release oracles; none of these matrices rebinds the older retained reports. MCP-PROD-404 remains normative for admission:
+The four retained Linux x64 production-readiness reports cover `ast-mcp-server` and `x-scraper` under Node.js 22.5.0 and Node.js 24 for package version 0.6.0, commit `2d0b21bbb80fae1acfca6a85d5891d87e68b59c1`, and tree `af931d49769fabdf06f623965a6cfe1f9afb8a81`. They are historical integration evidence only: they are not reattributed to v0.8.1, published-next v0.9.0 or v0.9.1, the local 0.9.2 candidate, published v0.10.0, published-next v0.11.0 or v0.11.1, published v0.11.2, or published v0.12.0. The exact 0.9.0 and 0.9.1 release matrices remain historical evidence for their immutable published-next bytes, the exact 0.9.2 matrix remains historical local-candidate evidence, the exact 0.10.0 matrix remains historical published-release evidence, the exact 0.11.0 and 0.11.1 matrices remain historical evidence for their immutable published-next bytes before public-registry verification exposed their distinct verifier defects, and the exact 0.11.2 matrix remains historical published-release evidence. The exact 0.12.0 matrix is current published-release evidence under both supported runtime lines, including bounded diagnostic aggregates, catalog-derived tool capability projections, and their independent release oracles; none of these matrices rebinds the older retained reports. MCP-PROD-404 remains normative for admission:
 
 - zero semantic mismatches across disabled, cold, warm, restart, and rollback reads;
 - byte-identical real-repository status and worktree trees;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "ast-mcp-server",
-  "version": "0.12.0",
+  "version": "0.13.0",
   "description": "Structural code MCP server and batch CLI for compact TypeScript/JavaScript reads and hash-bound AST edits.",
   "keywords": [
     "mcp",
@@ -26,6 +26,16 @@
   },
   "type": "module",
   "packageManager": "yarn@4.15.0",
+  "dsh": {
+    "bundle": {
+      "patch": "./cordis.patch.yml"
+    }
+  },
+  "deepseekHarness": {
+    "revision": "cd5ef8148158c3a752a658978873241fdf8e2bbc",
+    "tag": "dsh-v0.1.2-alpha.1",
+    "mcpClientVersion": "0.1.2-alpha.1"
+  },
   "main": "dist/index.js",
   "bin": {
     "ast-mcp-server": "dist/index.js",
@@ -34,6 +44,7 @@
   "files": [
     "dist",
     "skills",
+    "cordis.patch.yml",
     "README.md",
     "CHANGELOG.md",
     "SECURITY.md",
@@ -56,6 +67,7 @@
     "test:cli": "yarn build && node scripts/cli-smoke.mjs",
     "test:errors": "yarn build && node scripts/public-error-smoke.mjs",
     "test:package": "node scripts/package-smoke.mjs",
+    "test:dsh-adapter": "node scripts/dsh-adapter-smoke.mjs",
     "test:local-registry": "node scripts/local-registry-consumer-smoke.mjs",
     "test:installed-agents": "yarn build && node scripts/installed-agent-guidance-smoke.mjs",
     "test:agent-fixtures": "node scripts/admit-agent-fixtures.mjs --check",
@@ -95,7 +107,8 @@
     "prettier": "^3.9.6",
     "typescript": "^5.6.0",
     "typescript-eslint": "^8.65.0",
-    "vitest": "^4.1.10"
+    "vitest": "^4.1.10",
+    "yaml": "^2.9.0"
   },
-  "gitHead": "3991d0a74e672c6c4d3fbd1c8bbb1a60009515ec"
+  "gitHead": "75302189733f40aba6a36a8379c5b1f65fc3bd84"
 }

package/skills/structural-code-editing/SKILL.md

@@ -18,7 +18,7 @@ Cargar este skill antes de navegar semánticamente, analizar impacto o referenci
 
 No forzar un roundtrip AST para Markdown, configuración, comentarios ni una edición textual trivial en un archivo ya conocido. Si las tools `ast_*` no están disponibles, declarar el fallback y no presentar búsquedas textuales como evidencia compiler-backed.
 
-The local 0.12.0 release candidate requires Node.js `>=22.13.0` and is verified with exact Node.js 22.13.0 plus the governed Node.js 24 line. Published v0.11.2 retains its immutable Node.js 22.13.0/24 release evidence.
+Published v0.12.0 requires Node.js `>=22.13.0` and retains immutable release evidence from exact Node.js 22.13.0 plus the governed Node.js 24 line.
 
 ## Hard Rules
 

package/skills/structural-code-editing/releases.json

@@ -6,7 +6,7 @@
     "files": [
       {
         "path": "SKILL.md",
-        "sha256": "d0048ffd9a585d00791540c6fa5e0bec91ff95b1448479678f85702e6b09be8a"
+        "sha256": "df2ebc3f3903cf5abf4eb6612da527cad97a92f29f1a9a475ea6e8b4cf47abfb"
       },
       {
         "path": "references/operations.md",
@@ -94,6 +94,11 @@
       "version": "4.5.0",
       "sha256": "18132b4b747d135e4ccfbca9e2190a9afb41e144cc06c31c5e6bc0f1571e11da",
       "npm_versions": ["0.11.2"]
+    },
+    {
+      "version": "4.6.0",
+      "sha256": "d0048ffd9a585d00791540c6fa5e0bec91ff95b1448479678f85702e6b09be8a",
+      "npm_versions": ["0.12.0"]
     }
   ]
 }