deadbyte-mcp 0.8.9 → 0.9.0

package/test/semantic-lsp-backend.test.mjs

@@ -0,0 +1,99 @@
+import test from 'node:test';
+import assert from 'node:assert/strict';
+import { createHash } from 'node:crypto';
+import { mkdtemp, readFile, rm, writeFile } from 'node:fs/promises';
+import os from 'node:os';
+import path from 'node:path';
+import { fileURLToPath } from 'node:url';
+import { createSemanticLspBackend } from '../src/semantic-lsp-backend.mjs';
+
+const here=path.dirname(fileURLToPath(import.meta.url));
+const fixture=path.join(here,'fixtures','lsp-framed-server.mjs');
+const sha256=bytes=>createHash('sha256').update(bytes).digest('hex');
+const nodeSha=sha256(await readFile(process.execPath));
+
+async function makeFixture(){
+  const root=await mkdtemp(path.join(os.tmpdir(),'deadbyte-lsp-backend-'));
+  const source='export function alpha() {}\n';
+  await writeFile(path.join(root,'main.foo'),source,'utf8');
+  const codingRuntime={
+    policy:{roots:{project:{real_path:root,read:true,write:true,exec:false,deny_paths:['denied']}}},
+    async sessionStatus(){return {armed:true,reason:'standing-grant',root_ids:['project']};},
+    async fileRead({rootId,relativePath}){assert.equal(rootId,'project');const content=await readFile(path.join(root,relativePath),'utf8');return {status:'ok',content,sha256:sha256(Buffer.from(content,'utf8'))};},
+    async textReplace({rootId,relativePath,oldString,newString,expectedSha256,expectedReplacements}){
+      assert.equal(rootId,'project');assert.equal(expectedReplacements,1);
+      const file=path.join(root,relativePath);const before=await readFile(file,'utf8');assert.equal(sha256(Buffer.from(before)),expectedSha256);
+      const count=before.split(oldString).length-1;assert.equal(count,1);const after=before.replace(oldString,newString);await writeFile(file,after,'utf8');
+      return {status:'committed',receipt_id:'f'.repeat(24),sha256:sha256(Buffer.from(after))};
+    }
+  };
+  const backend=createSemanticLspBackend({id:'fixture-lsp',extensions:['.foo'],codingRuntime,server:{executable_path:process.execPath,executable_sha256:nodeSha,args:[fixture],initialization_options:{fixture:true},request_timeout_ms:1000,max_message_bytes:131072}});
+  return {root,source,codingRuntime,backend};
+}
+
+test('semantic LSP backend normalizes outline definition references diagnostics and receipt-path replacement',async()=>{
+  const f=await makeFixture();
+  try{
+    const outline=await f.backend.outline({rootId:'project',relativePath:'main.foo',maxSymbols:10});
+    assert.equal(outline.engine,'fixture-lsp');assert.equal(outline.symbols.length,1);
+    const symbol=outline.symbols[0];assert.equal(symbol.name,'alpha');assert.match(symbol.symbol_id,/^[0-9a-f]{64}$/);
+    const def=await f.backend.definition({rootId:'project',relativePath:'main.foo',line:0,column:18,maxResults:10});
+    assert.equal(def.locations[0].path,'main.foo');assert.equal(def.locations[0].start_column,16);
+    const refs=await f.backend.references({rootId:'project',relativePath:'main.foo',line:0,column:18,maxResults:10});
+    assert.equal(refs.locations[0].path,'main.foo');
+    const diagnostics=await f.backend.diagnostics({rootId:'project',relativePath:'main.foo',maxResults:10});
+    assert.equal(diagnostics.diagnostics[0].message,'fixture diagnostic');
+    const before=await f.codingRuntime.fileRead({rootId:'project',relativePath:'main.foo'});
+    const edited=await f.backend.replaceSymbol({rootId:'project',relativePath:'main.foo',symbolId:symbol.symbol_id,newBody:'export function beta() {}',expectedSha256:before.sha256});
+    assert.equal(edited.status,'committed');assert.equal(edited.symbol_name,'alpha');assert.equal(edited.engine,'fixture-lsp');
+    assert.equal(await readFile(path.join(f.root,'main.foo'),'utf8'),'export function beta() {}\n');
+  } finally {await rm(f.root,{recursive:true,force:true});}
+});
+
+test('semantic LSP backend rejects targets outside lease/root policy before launching server',async()=>{
+  const f=await makeFixture();
+  try{
+    await assert.rejects(f.backend.outline({rootId:'missing',relativePath:'main.foo',maxSymbols:10}),/outside active lease/i);
+    await assert.rejects(f.backend.outline({rootId:'project',relativePath:'denied/main.foo',maxSymbols:10}),/denied/i);
+  } finally {await rm(f.root,{recursive:true,force:true});}
+});
+
+test('semantic LSP backend forwards dependency pins before launching server',async()=>{
+  const f=await makeFixture();
+  try{
+    const backend=createSemanticLspBackend({id:'fixture-pinned',extensions:['.foo'],codingRuntime:f.codingRuntime,server:{executable_path:process.execPath,executable_sha256:nodeSha,args:[fixture],dependencies:[{path:fixture,expectedSha256:'0'.repeat(64)}],request_timeout_ms:1000,max_message_bytes:131072}});
+    await assert.rejects(backend.outline({rootId:'project',relativePath:'main.foo',maxSymbols:10}),/LSP dependency SHA-256 mismatch/i);
+  } finally {await rm(f.root,{recursive:true,force:true});}
+});
+
+test('semantic LSP backend separates engine id from LSP language id',async()=>{
+  const f=await makeFixture();
+  try{
+    const fixtureSha=sha256(await readFile(fixture));
+    const backend=createSemanticLspBackend({id:'fixture-engine',extensions:['.foo'],codingRuntime:f.codingRuntime,server:{language_id:'fixture-language',executable_path:process.execPath,executable_sha256:nodeSha,args:[fixture],dependencies:[{path:fixture,expectedSha256:fixtureSha}],initialization_options:{expectedLanguageId:'fixture-language'},request_timeout_ms:1000,max_message_bytes:131072}});
+    const outline=await backend.outline({rootId:'project',relativePath:'main.foo',maxSymbols:10});
+    assert.equal(outline.engine,'fixture-engine');
+    assert.equal(outline.symbols[0].name,'alpha');
+  } finally {await rm(f.root,{recursive:true,force:true});}
+});
+
+test('semantic LSP backend pre-opens bounded same-language project files for deterministic cross-file navigation',async()=>{
+  const root=await mkdtemp(path.join(os.tmpdir(),'deadbyte-lsp-project-'));
+  await writeFile(path.join(root,'main.foo'),'export function main() { return alpha(); }\n','utf8');
+  await writeFile(path.join(root,'peer.foo'),'export function alpha() { return 1; }\n','utf8');
+  const codingRuntime={
+    policy:{roots:{project:{real_path:root,read:true,write:true,exec:false,deny_paths:[]}}},
+    async sessionStatus(){return {armed:true,reason:'standing-grant',root_ids:['project']};},
+    async tree(){return {truncated:false,entries:[{type:'file',path:'main.foo'},{type:'file',path:'peer.foo'}]};},
+    async fileRead({relativePath}){const content=await readFile(path.join(root,relativePath),'utf8');return {status:'ok',content,sha256:sha256(Buffer.from(content,'utf8'))};},
+    async textReplace(){throw new Error('not used');}
+  };
+  try{
+    const fixtureSha=sha256(await readFile(fixture));
+    const backend=createSemanticLspBackend({id:'fixture-project',extensions:['.foo'],codingRuntime,server:{language_id:'fixture-language',executable_path:process.execPath,executable_sha256:nodeSha,args:[fixture],dependencies:[{path:fixture,expectedSha256:fixtureSha}],initialization_options:{expectedLanguageId:'fixture-language',requiredOpenCount:2},request_timeout_ms:1000,max_message_bytes:131072}});
+    const definition=await backend.definition({rootId:'project',relativePath:'main.foo',line:0,column:18,maxResults:10});
+    assert.ok(definition.locations.some(item=>item.path==='peer.foo'),JSON.stringify(definition.locations));
+    const references=await backend.references({rootId:'project',relativePath:'main.foo',line:0,column:18,maxResults:10});
+    assert.ok(references.locations.some(item=>item.path==='peer.foo'),JSON.stringify(references.locations));
+  } finally {await rm(root,{recursive:true,force:true});}
+});

package/test/semantic-lsp-config.test.mjs

@@ -0,0 +1,81 @@
+import test from 'node:test';
+import assert from 'node:assert/strict';
+import path from 'node:path';
+import os from 'node:os';
+import { createHash } from 'node:crypto';
+import { mkdtemp, rm, writeFile } from 'node:fs/promises';
+import { parseSemanticLspConfig, loadSemanticLspBackends, semanticConfigBindingFromEnv } from '../src/semantic-lsp-config.mjs';
+
+const H='a'.repeat(64);
+const sha256=bytes=>createHash('sha256').update(bytes).digest('hex');
+
+test('semantic LSP config normalizes explicit pinned server identities',()=>{
+  const exe=path.resolve('tools','server.exe');
+  const dep=path.resolve('tools','server.js');
+  const parsed=parseSemanticLspConfig({schema:'deadbyte.semantic-lsp-config.v1',servers:[{
+    id:'pyright',language_id:'python',extensions:['.PY','.pyi'],executable_path:exe,executable_sha256:H,
+    args:['server.js','--stdio'],dependencies:[{path:dep,expected_sha256:H}],required:true
+  }]});
+  assert.deepEqual(parsed.servers[0],{
+    id:'pyright',language_id:'python',extensions:['.py','.pyi'],executable_path:exe,executable_sha256:H,args:['server.js','--stdio'],env:{},dependencies:[{path:dep,expectedSha256:H}],initialization_options:{},request_timeout_ms:10000,max_message_bytes:4194304,startup_settle_ms:0,null_result_retry_ms:0,null_result_max_attempts:1,retry_empty_results:false,required:true
+  });
+});
+
+test('semantic LSP config rejects unpinned, relative, duplicate, or ambiguous server declarations',()=>{
+  const exe=path.resolve('tools','server.exe');
+  assert.throws(()=>parseSemanticLspConfig({schema:'wrong',servers:[]}),/schema/i);
+  assert.throws(()=>parseSemanticLspConfig({schema:'deadbyte.semantic-lsp-config.v1',servers:[{id:'python',extensions:['.py'],executable_path:'relative.exe',executable_sha256:H}]}),/absolute/i);
+  assert.throws(()=>parseSemanticLspConfig({schema:'deadbyte.semantic-lsp-config.v1',servers:[{id:'python',extensions:['.py'],executable_path:exe,executable_sha256:'bad'}]}),/sha-256/i);
+  assert.throws(()=>parseSemanticLspConfig({schema:'deadbyte.semantic-lsp-config.v1',servers:[{id:'a',extensions:['.x'],executable_path:exe,executable_sha256:H},{id:'a',extensions:['.y'],executable_path:exe,executable_sha256:H}]}),/duplicate.*id/i);
+  assert.throws(()=>parseSemanticLspConfig({schema:'deadbyte.semantic-lsp-config.v1',servers:[{id:'a',extensions:['.x'],executable_path:exe,executable_sha256:H},{id:'b',extensions:['.X'],executable_path:exe,executable_sha256:H}]}),/extension.*already/i);
+});
+
+test('semantic LSP config bounds startup settle to five seconds',()=>{
+  const exe=path.resolve('tools','server.exe');
+  const make=value=>({schema:'deadbyte.semantic-lsp-config.v1',servers:[{id:'ready',extensions:['.x'],executable_path:exe,executable_sha256:H,startup_settle_ms:value}]});
+  assert.equal(parseSemanticLspConfig(make(5000)).servers[0].startup_settle_ms,5000);
+  assert.throws(()=>parseSemanticLspConfig(make(-1)),/startup_settle_ms invalid/i);
+  assert.throws(()=>parseSemanticLspConfig(make(5001)),/startup_settle_ms invalid/i);
+});
+
+test('semantic LSP config bounds transient read retry policy and keeps empty-result retries opt-in',()=>{
+  const exe=path.resolve('tools','server.exe');
+  const make=extra=>({schema:'deadbyte.semantic-lsp-config.v1',servers:[{id:'retry',extensions:['.x'],executable_path:exe,executable_sha256:H,...extra}]});
+  const parsed=parseSemanticLspConfig(make({null_result_retry_ms:100,null_result_max_attempts:10,retry_empty_results:true})).servers[0];
+  assert.equal(parsed.null_result_retry_ms,100);assert.equal(parsed.null_result_max_attempts,10);assert.equal(parsed.retry_empty_results,true);
+  assert.throws(()=>parseSemanticLspConfig(make({null_result_retry_ms:0,null_result_max_attempts:2})),/retry_ms required/i);
+  assert.throws(()=>parseSemanticLspConfig(make({null_result_retry_ms:1001,null_result_max_attempts:2})),/retry_ms invalid/i);
+  assert.throws(()=>parseSemanticLspConfig(make({null_result_retry_ms:10,null_result_max_attempts:21})),/max_attempts invalid/i);
+  assert.throws(()=>parseSemanticLspConfig(make({retry_empty_results:'yes'})),/retry_empty_results invalid/i);
+});
+
+test('semantic LSP config load verifies executable and dependency bytes before producing backends',async()=>{
+  const root=await mkdtemp(path.join(os.tmpdir(),'deadbyte-semantic-config-'));
+  try{
+    const exe=process.execPath;
+    const exeSha=sha256(await import('node:fs/promises').then(m=>m.readFile(exe)));
+    const dep=path.join(root,'server.js');
+    const depBytes=Buffer.from('export default 1;\n','utf8');
+    await writeFile(dep,depBytes);
+    const configPath=path.join(root,'semantic.json');
+    const body={schema:'deadbyte.semantic-lsp-config.v1',servers:[{id:'python',extensions:['.py'],executable_path:exe,executable_sha256:exeSha,args:[dep,'--stdio'],dependencies:[{path:dep,expected_sha256:sha256(depBytes)}],required:true}]};
+    await writeFile(configPath,JSON.stringify(body),'utf8');
+    const configSha=sha256(Buffer.from(JSON.stringify(body),'utf8'));
+    const loaded=await loadSemanticLspBackends({configPath,expectedConfigSha256:configSha,codingRuntime:{}});
+    assert.equal(loaded.backends.length,1);
+    assert.equal(loaded.backends[0].id,'python');
+    assert.deepEqual(loaded.required_ids,['python']);
+    await assert.rejects(loadSemanticLspBackends({configPath,expectedConfigSha256:'0'.repeat(64),codingRuntime:{}}),/config SHA-256 mismatch/i);
+    body.servers[0].dependencies[0].expected_sha256='0'.repeat(64);
+    await writeFile(configPath,JSON.stringify(body),'utf8');
+    const tamperedConfigSha=sha256(Buffer.from(JSON.stringify(body),'utf8'));
+    await assert.rejects(loadSemanticLspBackends({configPath,expectedConfigSha256:tamperedConfigSha,codingRuntime:{}}),/dependency SHA-256 mismatch/i);
+  } finally {await rm(root,{recursive:true,force:true});}
+});
+
+test('semantic LSP environment binding requires config path and SHA-256 together',()=>{
+  assert.equal(semanticConfigBindingFromEnv({}),null);
+  assert.throws(()=>semanticConfigBindingFromEnv({DEADBYTE_SEMANTIC_LSP_CONFIG:'C:/semantic.json'}),/requires.*SHA-256/i);
+  assert.throws(()=>semanticConfigBindingFromEnv({DEADBYTE_SEMANTIC_LSP_CONFIG_SHA256:H}),/requires.*config path/i);
+  assert.deepEqual(semanticConfigBindingFromEnv({DEADBYTE_SEMANTIC_LSP_CONFIG:'C:/semantic.json',DEADBYTE_SEMANTIC_LSP_CONFIG_SHA256:H}),{configPath:'C:/semantic.json',expectedConfigSha256:H});
+});

package/test/semantic-lsp-readiness.test.mjs

@@ -0,0 +1,34 @@
+import test from 'node:test';
+import assert from 'node:assert/strict';
+import { createHash } from 'node:crypto';
+import { mkdtemp, readFile, rm, writeFile } from 'node:fs/promises';
+import os from 'node:os';
+import path from 'node:path';
+import { fileURLToPath } from 'node:url';
+import { createSemanticLspBackend } from '../src/semantic-lsp-backend.mjs';
+
+const here=path.dirname(fileURLToPath(import.meta.url));
+const fixture=path.join(here,'fixtures','lsp-framed-server.mjs');
+const sha256=bytes=>createHash('sha256').update(bytes).digest('hex');
+const nodeSha=sha256(await readFile(process.execPath));
+
+test('semantic LSP backend honors bounded startup settle before cross-file request',async()=>{
+  const root=await mkdtemp(path.join(os.tmpdir(),'deadbyte-lsp-ready-'));
+  await writeFile(path.join(root,'main.foo'),'export function main() { return alpha(); }\n','utf8');
+  await writeFile(path.join(root,'peer.foo'),'export function alpha() { return 1; }\n','utf8');
+  const codingRuntime={
+    policy:{roots:{project:{real_path:root,read:true,write:true,exec:false,deny_paths:[]}}},
+    async sessionStatus(){return {armed:true,reason:'standing-grant',root_ids:['project']};},
+    async tree(){return {truncated:false,entries:[{type:'file',path:'main.foo'},{type:'file',path:'peer.foo'}]};},
+    async fileRead({relativePath}){const content=await readFile(path.join(root,relativePath),'utf8');return {status:'ok',content,sha256:sha256(Buffer.from(content,'utf8'))};},
+    async textReplace(){throw new Error('not used');}
+  };
+  try{
+    const fixtureSha=sha256(await readFile(fixture));
+    const backend=createSemanticLspBackend({id:'fixture-ready',extensions:['.foo'],codingRuntime,server:{language_id:'fixture-language',executable_path:process.execPath,executable_sha256:nodeSha,args:[fixture],dependencies:[{path:fixture,expectedSha256:fixtureSha}],initialization_options:{expectedLanguageId:'fixture-language',requiredOpenCount:2,readyAfterMs:500},startup_settle_ms:600,request_timeout_ms:2000,max_message_bytes:131072}});
+    const started=Date.now();
+    const definition=await backend.definition({rootId:'project',relativePath:'main.foo',line:0,column:34,maxResults:10});
+    assert.ok(Date.now()-started>=500,'backend returned before configured server readiness boundary');
+    assert.ok(definition.locations.some(item=>item.path==='peer.foo'),JSON.stringify(definition.locations));
+  } finally {await rm(root,{recursive:true,force:true});}
+});

package/test/semantic-lsp-transient-empty.test.mjs

@@ -0,0 +1,32 @@
+import test from 'node:test';
+import assert from 'node:assert/strict';
+import { createHash } from 'node:crypto';
+import { mkdtemp, readFile, rm, writeFile } from 'node:fs/promises';
+import os from 'node:os';
+import path from 'node:path';
+import { fileURLToPath } from 'node:url';
+import { createSemanticLspBackend } from '../src/semantic-lsp-backend.mjs';
+
+const here=path.dirname(fileURLToPath(import.meta.url));
+const fixture=path.join(here,'fixtures','lsp-framed-server.mjs');
+const sha256=bytes=>createHash('sha256').update(bytes).digest('hex');
+const nodeSha=sha256(await readFile(process.execPath));
+
+test('semantic LSP backend retries transient empty read results only when explicitly enabled',async()=>{
+  const root=await mkdtemp(path.join(os.tmpdir(),'deadbyte-lsp-empty-'));
+  await writeFile(path.join(root,'main.foo'),'export function main() { return alpha(); }\n','utf8');
+  await writeFile(path.join(root,'peer.foo'),'export function alpha() { return 1; }\n','utf8');
+  const codingRuntime={
+    policy:{roots:{project:{real_path:root,read:true,write:true,exec:false,deny_paths:[]}}},
+    async sessionStatus(){return {armed:true,reason:'standing-grant',root_ids:['project']};},
+    async tree(){return {truncated:false,entries:[{type:'file',path:'main.foo'},{type:'file',path:'peer.foo'}]};},
+    async fileRead({relativePath}){const content=await readFile(path.join(root,relativePath),'utf8');return {status:'ok',content,sha256:sha256(Buffer.from(content,'utf8'))};},
+    async textReplace(){throw new Error('not used');}
+  };
+  try{
+    const fixtureSha=sha256(await readFile(fixture));
+    const backend=createSemanticLspBackend({id:'fixture-empty',extensions:['.foo'],codingRuntime,server:{language_id:'fixture-language',executable_path:process.execPath,executable_sha256:nodeSha,args:[fixture],dependencies:[{path:fixture,expectedSha256:fixtureSha}],initialization_options:{expectedLanguageId:'fixture-language',requiredOpenCount:2,referencesEmptyCount:1},null_result_retry_ms:25,null_result_max_attempts:3,retry_empty_results:true,request_timeout_ms:2000,max_message_bytes:131072}});
+    const references=await backend.references({rootId:'project',relativePath:'peer.foo',line:0,column:16,maxResults:20});
+    assert.ok(references.locations.some(item=>item.path==='main.foo'),JSON.stringify(references.locations));
+  } finally {await rm(root,{recursive:true,force:true});}
+});

package/test/semantic-lsp-transient-null.test.mjs

@@ -0,0 +1,31 @@
+import test from 'node:test';
+import assert from 'node:assert/strict';
+import { createHash } from 'node:crypto';
+import { mkdtemp, readFile, rm, writeFile } from 'node:fs/promises';
+import os from 'node:os';
+import path from 'node:path';
+import { fileURLToPath } from 'node:url';
+import { createSemanticLspBackend } from '../src/semantic-lsp-backend.mjs';
+
+const here=path.dirname(fileURLToPath(import.meta.url));
+const fixture=path.join(here,'fixtures','lsp-framed-server.mjs');
+const sha256=bytes=>createHash('sha256').update(bytes).digest('hex');
+const nodeSha=sha256(await readFile(process.execPath));
+
+test('semantic LSP backend retries only transient null read results within configured bound',async()=>{
+  const root=await mkdtemp(path.join(os.tmpdir(),'deadbyte-lsp-null-'));
+  await writeFile(path.join(root,'main.foo'),'export function alpha() { return 1; }\n','utf8');
+  const codingRuntime={
+    policy:{roots:{project:{real_path:root,read:true,write:true,exec:false,deny_paths:[]}}},
+    async sessionStatus(){return {armed:true,reason:'standing-grant',root_ids:['project']};},
+    async tree(){return {truncated:false,entries:[{type:'file',path:'main.foo'}]};},
+    async fileRead({relativePath}){const content=await readFile(path.join(root,relativePath),'utf8');return {status:'ok',content,sha256:sha256(Buffer.from(content,'utf8'))};},
+    async textReplace(){throw new Error('not used');}
+  };
+  try{
+    const fixtureSha=sha256(await readFile(fixture));
+    const backend=createSemanticLspBackend({id:'fixture-null',extensions:['.foo'],codingRuntime,server:{language_id:'fixture-language',executable_path:process.execPath,executable_sha256:nodeSha,args:[fixture],dependencies:[{path:fixture,expectedSha256:fixtureSha}],initialization_options:{expectedLanguageId:'fixture-language',documentSymbolNullCount:1},null_result_retry_ms:25,null_result_max_attempts:3,request_timeout_ms:2000,max_message_bytes:131072}});
+    const outline=await backend.outline({rootId:'project',relativePath:'main.foo',maxSymbols:20});
+    assert.ok(outline.symbols.some(item=>item.name==='alpha'),JSON.stringify(outline.symbols));
+  } finally {await rm(root,{recursive:true,force:true});}
+});

package/test/semantic-multilang.test.mjs

@@ -0,0 +1,72 @@
+import test from 'node:test';
+import assert from 'node:assert/strict';
+import { createHash } from 'node:crypto';
+import { cp, mkdtemp, mkdir, readFile, rm, writeFile } from 'node:fs/promises';
+import os from 'node:os';
+import path from 'node:path';
+import { fileURLToPath } from 'node:url';
+import { Client } from '@modelcontextprotocol/client';
+import { StdioClientTransport, getDefaultEnvironment } from '@modelcontextprotocol/client/stdio';
+import { generateTrustKeypair } from '../src/trust.mjs';
+import { loadCodingPolicy } from '../src/coding-plane.mjs';
+
+const here=path.dirname(fileURLToPath(import.meta.url));
+const repoRoot=path.resolve(here,'..');
+const serverPath=path.join(repoRoot,'src','mcp-server.mjs');
+const fixtureRoot=path.join(here,'fixtures','semantic');
+const semanticConfigPath=process.env.DEADBYTE_R35_SEMANTIC_CONFIG??'';
+const semanticConfigSha256=process.env.DEADBYTE_R35_SEMANTIC_CONFIG_SHA256??'';
+const sha256=bytes=>createHash('sha256').update(bytes).digest('hex');
+const sha256File=async file=>sha256(await readFile(file));
+
+function structured(value,label){
+  if(value.isError) throw new Error(`${label}: ${JSON.stringify(value.structuredContent??value.content)}`);
+  return value.structuredContent;
+}
+function positionOf(text,needle,occurrence=0){
+  let index=-1,start=0;
+  for(let i=0;i<=occurrence;i++){index=text.indexOf(needle,start);if(index<0)throw new Error(`missing ${needle} occurrence ${occurrence}`);start=index+needle.length;}
+  const before=text.slice(0,index);const lines=before.split('\n');return {line:lines.length-1,column:lines.at(-1).length};
+}
+
+async function makeFixture(language){
+  const root=await mkdtemp(path.join(os.tmpdir(),`deadbyte-semantic-${language}-`));
+  const project=path.join(root,'project');const trust=path.join(root,'trust');
+  await cp(path.join(fixtureRoot,language),project,{recursive:true});await mkdir(trust);
+  const keys=await generateTrustKeypair({privateKeyPath:path.join(trust,'private.pem'),publicKeyPath:path.join(trust,'public.pem')});
+  const policyPath=path.join(root,'coding-policy.json');const leasePath=path.join(root,'coding-lease.json');
+  await writeFile(policyPath,JSON.stringify({schema:'deadbyte.coding-policy.v1',enabled:true,lease_file:leasePath,evidence_dir:path.join(root,'evidence'),roots:{project:{path:project,read:true,write:true,exec:true,deny_paths:['.git','node_modules','target']}},commands:{node_script:{kind:'script',executable:process.execPath,executable_sha256:await sha256File(process.execPath),root_ids:['project'],prefix_args:[],extensions:['.mjs','.js'],timeout_ms:30000,max_output_bytes:262144}},max_read_bytes:524288,max_write_bytes:2097152},null,2),'utf8');
+  const policy=await loadCodingPolicy(policyPath);
+  await writeFile(leasePath,JSON.stringify({schema:'deadbyte.coding-lease.v1',policy_sha256:policy.policy_sha256,instance_nonce:'d'.repeat(64),root_ids:['project'],armed_at_utc:new Date().toISOString(),expires_at_utc:new Date(Date.now()+3600000).toISOString()}),'utf8');
+  const client=new Client({name:`deadbyte-r35-${language}`,version:'0.9.0'},{versionNegotiation:{mode:{pin:'2026-07-28'}}});
+  const transport=new StdioClientTransport({command:process.execPath,args:[serverPath],cwd:repoRoot,env:{...getDefaultEnvironment(),DEADBYTE_SIGNING_KEY:keys.privateKeyPath,DEADBYTE_VERIFY_KEY:keys.publicKeyPath,DEADBYTE_CODING_RUNTIME:'1',DEADBYTE_CODING_POLICY:policyPath,DEADBYTE_SEMANTIC_LSP_CONFIG:semanticConfigPath,DEADBYTE_SEMANTIC_LSP_CONFIG_SHA256:semanticConfigSha256},stderr:'pipe'});
+  return {root,project,client,transport};
+}
+
+const cases=[
+  {id:'python',engine:'pyright',outline:'lib.py',use:'main.py',useOccurrence:1,definitionPaths:['lib.py'],referencePath:'main.py',replacement:'def alpha(x: int) -> int:\n    return x + 2',replacementNeedle:'return x + 2'},
+  {id:'rust',engine:'rust-analyzer',outline:'src/math.rs',use:'src/main.rs',useOccurrence:1,definitionPaths:['src/math.rs'],referencePath:'src/main.rs',replacement:'pub fn alpha(x: i32) -> i32 {\n    x + 2\n}',replacementNeedle:'x + 2'},
+  {id:'cpp',engine:'clangd',outline:'lib.cpp',use:'main.cpp',useOccurrence:0,definitionPaths:['lib.hpp','lib.cpp'],referencePath:'main.cpp',replacement:'int alpha(int x) { return x + 2; }',replacementNeedle:'return x + 2'}
+];
+
+for(const entry of cases){
+  test(`R35 ${entry.id} semantic tracer proves outline definition references and receipt-backed replace`,{skip:!(semanticConfigPath&&semanticConfigSha256),timeout:120000},async()=>{
+    const f=await makeFixture(entry.id);
+    try{
+      await f.client.connect(f.transport);
+      const outline=structured(await f.client.callTool({name:'coding_symbol_outline',arguments:{root_id:'project',path:entry.outline,max_symbols:100}}),'outline');
+      assert.equal(outline.engine,entry.engine);
+      const alpha=outline.symbols.find(item=>item.name==='alpha');assert.ok(alpha,'alpha symbol missing');
+      const useText=await readFile(path.join(f.project,...entry.use.split('/')),'utf8');const usePos=positionOf(useText,'alpha',entry.useOccurrence);
+      const definition=structured(await f.client.callTool({name:'coding_symbol_definition',arguments:{root_id:'project',path:entry.use,line:usePos.line,column:usePos.column,max_results:50}}),'definition');
+      assert.ok(definition.locations.some(item=>entry.definitionPaths.includes(item.path)),`definition paths=${definition.locations.map(x=>x.path).join(',')}`);
+      const references=structured(await f.client.callTool({name:'coding_symbol_references',arguments:{root_id:'project',path:entry.outline,line:alpha.name_start_line,column:alpha.name_start_column,max_results:100}}),'references');
+      assert.ok(references.locations.some(item=>item.path===entry.referencePath),`references=${references.locations.map(x=>x.path).join(',')}`);
+      const before=structured(await f.client.callTool({name:'coding_file_read',arguments:{root_id:'project',path:entry.outline,encoding:'utf8'}}),'before');
+      const edited=structured(await f.client.callTool({name:'coding_symbol_replace',arguments:{root_id:'project',path:entry.outline,symbol_id:alpha.symbol_id,new_body:entry.replacement,expected_sha256:before.sha256}}),'replace');
+      assert.equal(edited.status,'committed');assert.equal(edited.engine,entry.engine);
+      const receipt=structured(await f.client.callTool({name:'coding_receipt_verify',arguments:{receipt_id:edited.receipt_id}}),'receipt');assert.equal(receipt.ok,true);
+      assert.match(await readFile(path.join(f.project,...entry.outline.split('/')),'utf8'),new RegExp(entry.replacementNeedle.replaceAll('+','\\+')));
+    } finally {await f.client.close().catch(()=>{});await rm(f.root,{recursive:true,force:true}).catch(()=>{});}
+  });
+}

package/test/semantic-runtime-routing.test.mjs

@@ -0,0 +1,32 @@
+import test from 'node:test';
+import assert from 'node:assert/strict';
+import { createSemanticCodeRuntime } from '../src/semantic-code.mjs';
+
+const codingRuntime={};
+const calls=[];
+const fake={
+  id:'fixture',extensions:new Set(['.foo']),
+  async outline(ctx){calls.push(['outline',ctx]);return {status:'ok',engine:'fixture',symbols:[]};},
+  async definition(ctx){calls.push(['definition',ctx]);return {status:'ok',engine:'fixture',locations:[]};},
+  async references(ctx){calls.push(['references',ctx]);return {status:'ok',engine:'fixture',locations:[]};},
+  async replaceSymbol(ctx){calls.push(['replaceSymbol',ctx]);return {status:'committed',engine:'fixture'};},
+  async diagnostics(ctx){calls.push(['diagnostics',ctx]);return {status:'ok',engine:'fixture',diagnostics:[]};}
+};
+
+test('semantic runtime routes all operations through an injected backend registry without changing public arguments',async()=>{
+  calls.length=0;
+  const runtime=createSemanticCodeRuntime({codingRuntime,backends:[fake]});
+  assert.equal((await runtime.outline({rootId:'r',relativePath:'src/a.foo',maxSymbols:7})).engine,'fixture');
+  assert.equal((await runtime.definition({rootId:'r',relativePath:'src/a.foo',line:1,column:2,maxResults:3})).engine,'fixture');
+  assert.equal((await runtime.references({rootId:'r',relativePath:'src/a.foo',line:1,column:2,maxResults:4})).engine,'fixture');
+  assert.equal((await runtime.replaceSymbol({rootId:'r',relativePath:'src/a.foo',symbolId:'s',newBody:'x',expectedSha256:'a'.repeat(64)})).engine,'fixture');
+  assert.equal((await runtime.diagnostics({rootId:'r',relativePath:'src/a.foo'})).engine,'fixture');
+  assert.deepEqual(calls.map(item=>item[0]),['outline','definition','references','replaceSymbol','diagnostics']);
+  assert.equal(calls[0][1].rootId,'r');
+  assert.equal(calls[0][1].relativePath,'src/a.foo');
+});
+
+test('semantic runtime fails closed instead of falling back to text search for unknown extensions',async()=>{
+  const runtime=createSemanticCodeRuntime({codingRuntime,backends:[fake]});
+  await assert.rejects(runtime.outline({rootId:'r',relativePath:'src/a.rs'}),/unsupported semantic language: \.rs/i);
+});

package/test/semantic-server-config-integration.test.mjs

@@ -0,0 +1,66 @@
+import test from 'node:test';
+import assert from 'node:assert/strict';
+import { createHash } from 'node:crypto';
+import { mkdtemp, mkdir, readFile, rm, writeFile } from 'node:fs/promises';
+import os from 'node:os';
+import path from 'node:path';
+import { fileURLToPath } from 'node:url';
+import { Client } from '@modelcontextprotocol/client';
+import { StdioClientTransport, getDefaultEnvironment } from '@modelcontextprotocol/client/stdio';
+import { generateTrustKeypair } from '../src/trust.mjs';
+import { loadCodingPolicy } from '../src/coding-plane.mjs';
+
+const here=path.dirname(fileURLToPath(import.meta.url));
+const repoRoot=path.resolve(here,'..');
+const cliPath=path.join(repoRoot,'src','deadbyte-cli.mjs');
+const lspFixture=path.join(here,'fixtures','lsp-framed-server.mjs');
+const sha256=bytes=>createHash('sha256').update(bytes).digest('hex');
+const sha256File=async file=>sha256(await readFile(file));
+
+function structured(value,label){
+  if(value.isError) throw new Error(`${label} failed: ${JSON.stringify(value.structuredContent??value.content)}`);
+  assert.ok(value.structuredContent&&typeof value.structuredContent==='object',`${label} missing structuredContent`);
+  return value.structuredContent;
+}
+
+async function fixture(){
+  const root=await mkdtemp(path.join(os.tmpdir(),'deadbyte-semantic-server-'));
+  const project=path.join(root,'project');
+  const trust=path.join(root,'trust');
+  await mkdir(project); await mkdir(trust);
+  const keys=await generateTrustKeypair({privateKeyPath:path.join(trust,'private.pem'),publicKeyPath:path.join(trust,'public.pem')});
+  await writeFile(path.join(project,'main.foo'),'export function alpha() {}\n','utf8');
+  const policyPath=path.join(root,'coding-policy.json');
+  const leasePath=path.join(root,'coding-lease.json');
+  await writeFile(policyPath,JSON.stringify({
+    schema:'deadbyte.coding-policy.v1',enabled:true,lease_file:leasePath,evidence_dir:path.join(root,'evidence'),
+    roots:{project:{path:project,read:true,write:true,exec:true,deny_paths:['.git','node_modules']}},
+    commands:{node_script:{kind:'script',executable:process.execPath,executable_sha256:await sha256File(process.execPath),root_ids:['project'],prefix_args:[],extensions:['.mjs','.js'],timeout_ms:30000,max_output_bytes:262144}},
+    max_read_bytes:524288,max_write_bytes:2097152
+  },null,2),'utf8');
+  const policy=await loadCodingPolicy(policyPath);
+  await writeFile(leasePath,JSON.stringify({schema:'deadbyte.coding-lease.v1',policy_sha256:policy.policy_sha256,instance_nonce:'c'.repeat(64),root_ids:['project'],armed_at_utc:new Date().toISOString(),expires_at_utc:new Date(Date.now()+3600000).toISOString()}),'utf8');
+  const semanticConfigPath=path.join(root,'semantic-lsp.json');
+  await writeFile(semanticConfigPath,JSON.stringify({schema:'deadbyte.semantic-lsp-config.v1',servers:[{
+    id:'fixture-lsp',extensions:['.foo'],executable_path:process.execPath,executable_sha256:await sha256File(process.execPath),
+    args:[lspFixture],dependencies:[{path:lspFixture,expected_sha256:await sha256File(lspFixture)}],required:true
+  }]},null,2),'utf8');
+  const client=new Client({name:'deadbyte-r35-semantic-config',version:'0.9.0'},{versionNegotiation:{mode:{pin:'2026-07-28'}}});
+  const transport=new StdioClientTransport({command:process.execPath,args:[cliPath,'mcp'],cwd:repoRoot,env:{...getDefaultEnvironment(),DEADBYTE_SIGNING_KEY:keys.privateKeyPath,DEADBYTE_VERIFY_KEY:keys.publicKeyPath,DEADBYTE_CODING_RUNTIME:'1',DEADBYTE_CODING_POLICY:policyPath,DEADBYTE_SEMANTIC_LSP_CONFIG:semanticConfigPath,DEADBYTE_SEMANTIC_LSP_CONFIG_SHA256:await sha256File(semanticConfigPath)},stderr:'pipe'});
+  return {root,client,transport};
+}
+
+test('MCP server loads pinned external semantic backends from explicit config without changing public tool names',async()=>{
+  const f=await fixture();
+  try{
+    await f.client.connect(f.transport);
+    const listed=await f.client.listTools();
+    assert.ok(listed.tools.some(tool=>tool.name==='coding_symbol_outline'));
+    const outline=structured(await f.client.callTool({name:'coding_symbol_outline',arguments:{root_id:'project',path:'main.foo',max_symbols:10}}),'semantic-outline');
+    assert.equal(outline.engine,'fixture-lsp');
+    assert.equal(outline.symbols[0].name,'alpha');
+  } finally {
+    await f.client.close().catch(()=>{});
+    await rm(f.root,{recursive:true,force:true}).catch(()=>{});
+  }
+});

package/test/tool-surface-ledger.test.mjs

@@ -0,0 +1,59 @@
+import test from 'node:test';
+import assert from 'node:assert/strict';
+import { canonicalSchemaHash, snapshotToolSurface, snapshotToolsListResult, diffToolSurface } from '../src/tool-surface-ledger.mjs';
+
+const alphaA={
+  name:'alpha',
+  inputSchema:{type:'object',properties:{x:{type:'string'},n:{type:'integer'}},required:['x'],additionalProperties:false},
+  outputSchema:{type:'object',properties:{ok:{type:'boolean'}},required:['ok'],additionalProperties:false}
+};
+const alphaReordered={
+  name:'alpha',
+  inputSchema:{additionalProperties:false,required:['x'],properties:{n:{type:'integer'},x:{type:'string'}},type:'object'},
+  outputSchema:{required:['ok'],properties:{ok:{type:'boolean'}},additionalProperties:false,type:'object'}
+};
+const beta={name:'beta',inputSchema:{type:'object',properties:{}},outputSchema:{type:'object',properties:{value:{type:'string'}}}};
+
+test('schema hash is canonical across object key ordering and preserves array ordering',()=>{
+  assert.equal(canonicalSchemaHash(alphaA.inputSchema),canonicalSchemaHash(alphaReordered.inputSchema));
+  assert.notEqual(
+    canonicalSchemaHash({type:'string',enum:['a','b']}),
+    canonicalSchemaHash({type:'string',enum:['b','a']})
+  );
+});
+
+test('tool surface snapshot is deterministic and rejects duplicate or non-JSON schema content',()=>{
+  const forward=snapshotToolSurface([alphaA,beta]);
+  const reverse=snapshotToolSurface([beta,alphaReordered]);
+  assert.equal(forward.schema,'deadbyte.tool-surface.v1');
+  assert.deepEqual(forward,reverse);
+  assert.deepEqual(forward.tools.map(tool=>tool.name),['alpha','beta']);
+  assert.match(forward.surface_sha256,/^[0-9a-f]{64}$/);
+  assert.throws(()=>snapshotToolSurface([alphaA,alphaReordered]),/duplicate tool/i);
+  assert.throws(()=>canonicalSchemaHash({type:'object',bad:undefined}),/JSON|unsupported|undefined/i);
+  assert.throws(()=>canonicalSchemaHash({type:'object',bad:()=>true}),/JSON|unsupported|function/i);
+});
+
+test('surface diff classifies removals additions and schema changes without ordering noise',()=>{
+  const baseline=snapshotToolSurface([alphaA,beta]);
+  const changed=snapshotToolSurface([
+    {...alphaReordered,outputSchema:{type:'object',properties:{ok:{type:'boolean'},message:{type:'string'}},required:['ok'],additionalProperties:false}},
+    {name:'gamma',inputSchema:{type:'object'},outputSchema:{type:'object'}}
+  ]);
+  const diff=diffToolSurface(baseline,changed);
+  assert.deepEqual(diff.unchanged,[]);
+  assert.deepEqual(diff.added,['gamma']);
+  assert.deepEqual(diff.removed,['beta']);
+  assert.deepEqual(diff.schema_changed,['alpha']);
+});
+
+test('MCP tools/list result snapshots the exact client-visible schemas and rejects malformed tools',()=>{
+  const snapshot=snapshotToolsListResult({tools:[
+    {name:'beta',description:'ignored for compatibility identity',inputSchema:beta.inputSchema,outputSchema:beta.outputSchema},
+    {name:'alpha',inputSchema:alphaA.inputSchema,outputSchema:alphaA.outputSchema}
+  ]});
+  assert.deepEqual(snapshot.tools.map(tool=>tool.name),['alpha','beta']);
+  assert.equal(snapshot.tools[0].input_sha256,canonicalSchemaHash(alphaA.inputSchema));
+  assert.throws(()=>snapshotToolsListResult({tools:[{name:'broken',inputSchema:{type:'object'}}]}),/outputSchema|output schema/i);
+  assert.throws(()=>snapshotToolsListResult({tools:'not-an-array'}),/tools\/list|tools.*array/i);
+});

package/test/tool-surface-snapshot.test.mjs

@@ -0,0 +1,17 @@
+import test from 'node:test';
+import assert from 'node:assert/strict';
+import path from 'node:path';
+import { fileURLToPath } from 'node:url';
+import { snapshotStdioServer } from '../scripts/tool-surface-snapshot.mjs';
+
+const root=path.resolve(fileURLToPath(new URL('..',import.meta.url)));
+const fixture=path.join(root,'test','fixtures','tool-surface-stdio-server.mjs');
+
+test('stdio snapshot negotiates the real MCP server and hashes its client-visible tool schemas',async()=>{
+  const snapshot=await snapshotStdioServer({command:process.execPath,args:[fixture],cwd:root});
+  assert.equal(snapshot.schema,'deadbyte.tool-surface.v1');
+  assert.deepEqual(snapshot.tools.map(tool=>tool.name),['alpha']);
+  assert.match(snapshot.tools[0].input_sha256,/^[0-9a-f]{64}$/);
+  assert.match(snapshot.tools[0].output_sha256,/^[0-9a-f]{64}$/);
+  assert.match(snapshot.surface_sha256,/^[0-9a-f]{64}$/);
+});

package/test/tracer-bullet.test.mjs

@@ -0,0 +1,77 @@
+import test from 'node:test';
+import assert from 'node:assert/strict';
+import { createHash } from 'node:crypto';
+import { mkdtemp, mkdir, readFile, rm, writeFile } from 'node:fs/promises';
+import os from 'node:os';
+import path from 'node:path';
+import { fileURLToPath } from 'node:url';
+import { Client } from '@modelcontextprotocol/client';
+import { StdioClientTransport, getDefaultEnvironment } from '@modelcontextprotocol/client/stdio';
+import { generateTrustKeypair } from '../src/trust.mjs';
+import { loadCodingPolicy } from '../src/coding-plane.mjs';
+
+const here=path.dirname(fileURLToPath(import.meta.url));
+const repoRoot=path.resolve(here,'..');
+const cliPath=path.join(repoRoot,'src','deadbyte-cli.mjs');
+const sha256=bytes=>createHash('sha256').update(bytes).digest('hex');
+const sha256File=async file=>sha256(await readFile(file));
+
+function structured(value,label){
+  if(value.isError) throw new Error(`${label} failed: ${JSON.stringify(value.structuredContent??value.content)}`);
+  assert.ok(value.structuredContent&&typeof value.structuredContent==='object',`${label} missing structuredContent`);
+  return value.structuredContent;
+}
+
+async function fixture(){
+  const root=await mkdtemp(path.join(os.tmpdir(),'deadbyte-tracer-'));
+  const project=path.join(root,'project');
+  const trust=path.join(root,'trust');
+  await mkdir(project); await mkdir(trust);
+  const keys=await generateTrustKeypair({privateKeyPath:path.join(trust,'private.pem'),publicKeyPath:path.join(trust,'public.pem')});
+  await writeFile(path.join(project,'app.mjs'),'export const value = 1;\n','utf8');
+  await writeFile(path.join(project,'verify.mjs'),"import { value } from './app.mjs';\nif(value!==2){console.error('expected value=2');process.exit(2)}\nprocess.stdout.write('TRACER_OK\\n');\n",'utf8');
+  const policyPath=path.join(root,'coding-policy.json');
+  const leasePath=path.join(root,'coding-lease.json');
+  await writeFile(policyPath,JSON.stringify({
+    schema:'deadbyte.coding-policy.v1',enabled:true,lease_file:leasePath,evidence_dir:path.join(root,'evidence'),
+    roots:{project:{path:project,read:true,write:true,exec:true,deny_paths:['.git','node_modules']}},
+    commands:{node_script:{kind:'script',executable:process.execPath,executable_sha256:await sha256File(process.execPath),root_ids:['project'],prefix_args:[],extensions:['.mjs','.js'],timeout_ms:30000,max_output_bytes:262144}},
+    max_read_bytes:524288,max_write_bytes:2097152
+  },null,2),'utf8');
+  const policy=await loadCodingPolicy(policyPath);
+  await writeFile(leasePath,JSON.stringify({schema:'deadbyte.coding-lease.v1',policy_sha256:policy.policy_sha256,instance_nonce:'b'.repeat(64),root_ids:['project'],armed_at_utc:new Date().toISOString(),expires_at_utc:new Date(Date.now()+3600000).toISOString()}),'utf8');
+  const client=new Client({name:'deadbyte-tracer-bullet',version:'0.8.11'},{versionNegotiation:{mode:{pin:'2026-07-28'}}});
+  const transport=new StdioClientTransport({command:process.execPath,args:[cliPath,'mcp'],cwd:repoRoot,env:{...getDefaultEnvironment(),DEADBYTE_SIGNING_KEY:keys.privateKeyPath,DEADBYTE_VERIFY_KEY:keys.publicKeyPath,DEADBYTE_CODING_RUNTIME:'1',DEADBYTE_CODING_POLICY:policyPath},stderr:'pipe'});
+  return {root,project,client,transport};
+}
+
+test('production tracer bullet negotiates MCP then reads, surgically edits, runs and verifies a real test',async()=>{
+  const f=await fixture();
+  try{
+    await f.client.connect(f.transport);
+    assert.equal(f.client.getNegotiatedProtocolVersion(),'2026-07-28');
+    const listed=await f.client.listTools();
+    const names=new Set(listed.tools.map(tool=>tool.name));
+    for(const name of ['coding_file_read','coding_text_replace','coding_command_run','coding_receipt_verify']) assert.ok(names.has(name),`missing ${name}`);
+
+    const before=structured(await f.client.callTool({name:'coding_file_read',arguments:{root_id:'project',path:'app.mjs',encoding:'utf8'}}),'read-before');
+    assert.equal(before.content,'export const value = 1;\n');
+
+    const edited=structured(await f.client.callTool({name:'coding_text_replace',arguments:{root_id:'project',path:'app.mjs',old_string:'value = 1',new_string:'value = 2',expected_sha256:before.sha256,expected_replacements:1}}),'edit');
+    assert.equal(edited.status,'committed');
+    const editReceipt=structured(await f.client.callTool({name:'coding_receipt_verify',arguments:{receipt_id:edited.receipt_id}}),'edit-receipt');
+    assert.equal(editReceipt.ok,true); assert.equal(editReceipt.signature_valid,true);
+
+    const scriptHash=await sha256File(path.join(f.project,'verify.mjs'));
+    const ran=structured(await f.client.callTool({name:'coding_command_run',arguments:{root_id:'project',command_id:'node_script',script_path:'verify.mjs',script_sha256:scriptHash,args:[],cwd:'.',timeout_ms:30000}}),'run-test');
+    assert.equal(ran.status,'passed'); assert.equal(ran.exit_code,0); assert.match(ran.stdout,/TRACER_OK/);
+    const runReceipt=structured(await f.client.callTool({name:'coding_receipt_verify',arguments:{receipt_id:ran.receipt_id}}),'run-receipt');
+    assert.equal(runReceipt.ok,true); assert.equal(runReceipt.signature_valid,true);
+
+    const after=structured(await f.client.callTool({name:'coding_file_read',arguments:{root_id:'project',path:'app.mjs',encoding:'utf8'}}),'read-after');
+    assert.equal(after.content,'export const value = 2;\n');
+  } finally {
+    await f.client.close().catch(()=>{});
+    await rm(f.root,{recursive:true,force:true}).catch(()=>{});
+  }
+});