deadbyte-mcp 0.9.0 → 0.10.0

package/src/remote-mcp-smoke-client.mjs

@@ -30,7 +30,7 @@ const agentTools = [
 const codingTools = [
   'coding_benchmark_run', 'coding_command_run', 'coding_file_read', 'coding_file_write', 'coding_files_read',
   'coding_receipt_verify', 'coding_search', 'coding_session_status', 'coding_stat',
-  'coding_symbol_definition', 'coding_symbol_outline', 'coding_symbol_references', 'coding_symbol_replace',
+  'coding_symbol_definition', 'coding_symbol_diagnostics', 'coding_symbol_implementations', 'coding_symbol_outline', 'coding_symbol_references', 'coding_symbol_rename_preview', 'coding_symbol_replace',
   'coding_task_approve', 'coding_task_cancel', 'coding_task_events', 'coding_task_run',
   'coding_task_status', 'coding_task_submit', 'coding_task_verify', 'coding_text_replace', 'coding_tree'
 ];
@@ -39,6 +39,18 @@ const autonomousTools = [
   'autonomous_goal_status', 'autonomous_goal_submit', 'autonomous_goal_verify', 'autonomous_release_gate',
   'autonomous_session_status', 'native_diff_apply', 'native_diff_preview', 'native_diff_verify'
 ];
+const r36CompactTools = [
+  'autonomous_goal_approve','autonomous_goal_cancel','autonomous_goal_events','autonomous_goal_run','autonomous_goal_status','autonomous_goal_submit','autonomous_goal_verify','autonomous_release_gate','autonomous_session_status',
+  'capability_manifest',
+  'coding_benchmark_run','coding_command_run','coding_file_read','coding_file_write','coding_inspect','coding_receipt_verify','coding_session_status','coding_symbol_replace',
+  'coding_task_approve','coding_task_cancel','coding_task_events','coding_task_run','coding_task_status','coding_task_submit','coding_task_verify','coding_text_replace','coding_tree',
+  'evidence_verify',
+  'host_exec','host_file_read','host_file_write',
+  'machine_fs','machine_list','machine_observe','machine_ping','machine_revoke','machine_status',
+  'native_diff_apply','native_diff_preview','native_diff_verify',
+  'process_session'
+].sort();
+if (r36CompactTools.length !== 41) throw new Error(`R36 compact catalog constant drift: ${r36CompactTools.length}`);
 const allowedCatalogs = [];
 for (const machine of [false, true]) for (const host of [false, true]) for (const agent of [false, true]) {
   for (const processPlane of [false, true]) for (const machineFs of [false, true]) for (const observation of [false, true]) for (const codingMode of ['none', 'coding', 'autonomous']) {
@@ -68,13 +80,21 @@ function structured(result, label) {
   if (!result.structuredContent || typeof result.structuredContent !== 'object') throw new Error(`${label} returned no structured object`);
   return result.structuredContent;
 }
+function gateway(result, label) {
+  const value = structured(result, label);
+  if (value.status !== 'ok' || !value.result || typeof value.result !== 'object') {
+    throw new Error(`${label} gateway status=${String(value.status)} error=${String(value.error ?? '')}`);
+  }
+  return value.result;
+}
 
 try {
   await client.connect(transport);
   if (client.getProtocolEra() !== 'modern') throw new Error(`expected modern MCP era, got ${String(client.getProtocolEra())}`);
   const listed = await client.listTools();
   const names = listed.tools.map(t => t.name).sort();
-  const catalogOk = allowedCatalogs.some(expected => JSON.stringify(names) === JSON.stringify(expected));
+  const compactProfile = JSON.stringify(names) === JSON.stringify(r36CompactTools);
+  const catalogOk = compactProfile || allowedCatalogs.some(expected => JSON.stringify(names) === JSON.stringify(expected));
   if (!catalogOk) throw new Error(`tool catalog mismatch: ${JSON.stringify(names)}`);
   for (const tool of listed.tools) {
     if (tool.outputSchema?.type !== 'object' || tool.outputSchema?.additionalProperties !== false || !tool.outputSchema?.properties) {
@@ -90,72 +110,108 @@ try {
   const codingRuntime = codingTools.every(name => names.includes(name));
   const autonomousRuntime = autonomousTools.every(name => names.includes(name));
 
-  const opened = structured(await client.callTool({ name: 'workspace_open', arguments: { workspace_id: 'demo' } }), 'workspace_open');
-  if (opened.status !== 'ok') throw new Error(`workspace_open status=${String(opened.status)}`);
-
-  const proofOutput = `remote-proof.${randomBytes(8).toString('hex')}.txt`;
-  const proof = structured(await client.callTool({
-    name: 'proof_execute', arguments: { workspace_id: 'demo', input: 'input.txt', output: proofOutput }
-  }), 'proof_execute');
-  if (proof.status !== 'passed' || !/^[0-9a-f]{64}$/.test(proof.request_sha256)) throw new Error('remote proof request identity missing');
-  const proofVerify = structured(await client.callTool({
-    name: 'evidence_verify', arguments: { workspace_id: 'demo', receipt_path: proof.receipt_path }
-  }), 'evidence_verify proof');
-  if (proofVerify.ok !== true || proofVerify.signature_valid !== true || proofVerify.receipt_schema !== 'deadbyte.receipt.v2' ||
-      proofVerify.request_sha256 !== proof.request_sha256) throw new Error(`remote proof verify failed: ${JSON.stringify(proofVerify)}`);
-
+  let compact = null;
+  let proofOutput = null;
+  let proof = null;
   let contained = null;
-  if (mode === 'full') {
-    const output = `remote-contained.${randomBytes(8).toString('hex')}.txt`;
-    const exec = structured(await client.callTool({
-      name: 'contained_transform',
-      arguments: { workspace_id: 'demo', input: 'input.txt', output, operation: 'uppercase_ascii' }
-    }), 'contained_transform');
-    if (exec.status !== 'passed' || exec.output_sha256 !== '3e740f6fcf2c6659bc5f99e0706b09f3c127407bbabe74d05285d2e3276946c2' ||
-        !/^[0-9a-f]{64}$/.test(exec.request_sha256)) throw new Error(`remote contained result mismatch: ${JSON.stringify(exec)}`);
-    const verify = structured(await client.callTool({
-      name: 'evidence_verify', arguments: { workspace_id: 'demo', receipt_path: exec.receipt_path }
-    }), 'evidence_verify contained');
-    if (verify.ok !== true || verify.signature_valid !== true || verify.containment_verified !== true ||
-        verify.active_network_denial_verified !== true || verify.receipt_schema !== 'deadbyte.receipt.v2' ||
-        verify.request_sha256 !== exec.request_sha256) throw new Error(`remote contained verification failed: ${JSON.stringify(verify)}`);
-    contained = { output, receipt_sha256: exec.receipt_sha256, request_sha256: exec.request_sha256, output_sha256: exec.output_sha256 };
-  }
   let agent = null;
-  if (mode === 'full' && agentRuntime) {
-    const submissionId = `remote-gate-${randomBytes(8).toString('hex')}`;
-    const submitted = structured(await client.callTool({
-      name: 'agent_task_submit', arguments: {
-        workspace_id: 'demo', submission_id: submissionId, title: 'remote R22 gate',
-        steps: [
-          { step_id: 'proof', kind: 'proof_execute', input: { kind: 'workspace', path: 'input.txt' }, retry_limit: 0 },
-          { step_id: 'contained', kind: 'contained_transform', operation: 'uppercase_ascii', input: { kind: 'step_output', step_id: 'proof' }, retry_limit: 0 }
-        ]
+  if (compactProfile) {
+    const manifest = gateway(await client.callTool({ name: 'capability_manifest', arguments: {} }), 'capability_manifest');
+    if (manifest.schema !== 'deadbyte.capability-manifest.v1' || manifest.profile !== 'compact' ||
+        !Array.isArray(manifest.capabilities) || !/^[0-9a-f]{64}$/.test(String(manifest.ledger_sha256 ?? ''))) {
+      throw new Error('R36 compact capability manifest malformed');
+    }
+    const required = manifest.capabilities.filter(item => item?.production === true && item?.host_only !== true);
+    for (const item of required) {
+      if (typeof item.compact_tool !== 'string' || !names.includes(item.compact_tool)) {
+        throw new Error(`R36 compact capability route missing: ${String(item.id)}`);
+      }
+    }
+    const machine = gateway(await client.callTool({ name: 'machine_observe', arguments: { op: 'machine_status' } }), 'machine_status');
+    const nonce = `remote-smoke-${randomBytes(16).toString('hex')}`;
+    const ping = gateway(await client.callTool({ name: 'machine_observe', arguments: { op: 'machine_ping', nonce } }), 'machine_ping');
+    if (ping.nonce !== nonce || ping.machine_id !== machine.machine_id ||
+        ping.release_id !== machine.release_id || ping.release_manifest_sha256 !== machine.release_manifest_sha256) {
+      throw new Error('R36 compact machine ping binding mismatch');
+    }
+    compact = {
+      profile: 'compact',
+      ledger_sha256: manifest.ledger_sha256,
+      capability_count: manifest.capabilities.length,
+      production_non_host_capabilities: required.length,
+      capability_closure: true,
+      machine_id: machine.machine_id,
+      release_id: machine.release_id,
+      release_manifest_sha256: machine.release_manifest_sha256,
+      ping_signature_valid: ping.signature_valid === true
+    };
+  } else {
+    const opened = structured(await client.callTool({ name: 'workspace_open', arguments: { workspace_id: 'demo' } }), 'workspace_open');
+    if (opened.status !== 'ok') throw new Error(`workspace_open status=${String(opened.status)}`);
+
+    proofOutput = `remote-proof.${randomBytes(8).toString('hex')}.txt`;
+    proof = structured(await client.callTool({
+      name: 'proof_execute', arguments: { workspace_id: 'demo', input: 'input.txt', output: proofOutput }
+    }), 'proof_execute');
+    if (proof.status !== 'passed' || !/^[0-9a-f]{64}$/.test(proof.request_sha256)) throw new Error('remote proof request identity missing');
+    const proofVerify = structured(await client.callTool({
+      name: 'evidence_verify', arguments: { workspace_id: 'demo', receipt_path: proof.receipt_path }
+    }), 'evidence_verify proof');
+    if (proofVerify.ok !== true || proofVerify.signature_valid !== true || proofVerify.receipt_schema !== 'deadbyte.receipt.v2' ||
+        proofVerify.request_sha256 !== proof.request_sha256) throw new Error(`remote proof verify failed: ${JSON.stringify(proofVerify)}`);
+
+    if (mode === 'full') {
+      const output = `remote-contained.${randomBytes(8).toString('hex')}.txt`;
+      const exec = structured(await client.callTool({
+        name: 'contained_transform',
+        arguments: { workspace_id: 'demo', input: 'input.txt', output, operation: 'uppercase_ascii' }
+      }), 'contained_transform');
+      if (exec.status !== 'passed' || exec.output_sha256 !== '3e740f6fcf2c6659bc5f99e0706b09f3c127407bbabe74d05285d2e3276946c2' ||
+          !/^[0-9a-f]{64}$/.test(exec.request_sha256)) throw new Error(`remote contained result mismatch: ${JSON.stringify(exec)}`);
+      const verify = structured(await client.callTool({
+        name: 'evidence_verify', arguments: { workspace_id: 'demo', receipt_path: exec.receipt_path }
+      }), 'evidence_verify contained');
+      if (verify.ok !== true || verify.signature_valid !== true || verify.containment_verified !== true ||
+          verify.active_network_denial_verified !== true || verify.receipt_schema !== 'deadbyte.receipt.v2' ||
+          verify.request_sha256 !== exec.request_sha256) throw new Error(`remote contained verification failed: ${JSON.stringify(verify)}`);
+      contained = { output, receipt_sha256: exec.receipt_sha256, request_sha256: exec.request_sha256, output_sha256: exec.output_sha256 };
+    }
+    if (mode === 'full' && agentRuntime) {
+      const submissionId = `remote-gate-${randomBytes(8).toString('hex')}`;
+      const submitted = structured(await client.callTool({
+        name: 'agent_task_submit', arguments: {
+          workspace_id: 'demo', submission_id: submissionId, title: 'remote R22 gate',
+          steps: [
+            { step_id: 'proof', kind: 'proof_execute', input: { kind: 'workspace', path: 'input.txt' }, retry_limit: 0 },
+            { step_id: 'contained', kind: 'contained_transform', operation: 'uppercase_ascii', input: { kind: 'step_output', step_id: 'proof' }, retry_limit: 0 }
+          ]
+        }
+      }), 'agent_task_submit');
+      const run = structured(await client.callTool({
+        name: 'agent_task_run', arguments: { workspace_id: 'demo', task_id: submitted.task_id, max_steps: 8 }
+      }), 'agent_task_run');
+      if (run.state !== 'succeeded' || run.completed_steps !== 2) throw new Error(`agent task run failed: ${JSON.stringify(run)}`);
+      const verified = structured(await client.callTool({
+        name: 'agent_task_verify', arguments: { workspace_id: 'demo', task_id: submitted.task_id }
+      }), 'agent_task_verify');
+      if (verified.ok !== true || verified.signature_valid !== true || verified.step_receipts_verified !== 2) {
+        throw new Error(`agent task verify failed: ${JSON.stringify(verified)}`);
       }
-    }), 'agent_task_submit');
-    const run = structured(await client.callTool({
-      name: 'agent_task_run', arguments: { workspace_id: 'demo', task_id: submitted.task_id, max_steps: 8 }
-    }), 'agent_task_run');
-    if (run.state !== 'succeeded' || run.completed_steps !== 2) throw new Error(`agent task run failed: ${JSON.stringify(run)}`);
-    const verified = structured(await client.callTool({
-      name: 'agent_task_verify', arguments: { workspace_id: 'demo', task_id: submitted.task_id }
-    }), 'agent_task_verify');
-    if (verified.ok !== true || verified.signature_valid !== true || verified.step_receipts_verified !== 2) {
-      throw new Error(`agent task verify failed: ${JSON.stringify(verified)}`);
+      agent = { task_id: submitted.task_id, plan_sha256: submitted.plan_sha256,
+        task_receipt_sha256: verified.task_receipt_sha256, step_receipts_verified: verified.step_receipts_verified };
     }
-    agent = { task_id: submitted.task_id, plan_sha256: submitted.plan_sha256,
-      task_receipt_sha256: verified.task_receipt_sha256, step_receipts_verified: verified.step_receipts_verified };
   }
   console.log(JSON.stringify({
-    status: 'passed', mode,
+    status: 'passed', mode, profile: compactProfile ? 'compact' : 'legacy-full',
     protocol_revision: '2026-07-28', protocol_era: 'modern', tools: names,
     output_schemas_strict: true,
     machine_runtime: machineRuntime, privileged_host_plane: privilegedHostPlane,
     agent_runtime: agentRuntime, process_runtime: processRuntime,
     machine_fs_runtime: machineFsRuntime, observation_runtime: observationRuntime,
     coding_runtime: codingRuntime, autonomous_runtime: autonomousRuntime,
-    proof: { output: proofOutput, receipt_sha256: proof.receipt_sha256,
-      request_sha256: proof.request_sha256, signature_valid: true },
+    compact,
+    proof: proof ? { output: proofOutput, receipt_sha256: proof.receipt_sha256,
+      request_sha256: proof.request_sha256, signature_valid: true } : null,
     contained, agent
   }, null, 2));
 } finally {

package/src/runtime-update.mjs

@@ -497,6 +497,34 @@ export function runControllerStartNoCapture(ctx,timeoutMs=45000){
   const call=controllerInvocation(ctx,'start');
   return controlResult(call.exe,call.args,{cwd:call.cwd,timeoutMs,stdio:'ignore'});
 }
+export async function readControllerStartFailure(ctx){
+  const file=path.join(ctx.runtime_root,'controller-start-failure.json');
+  let bytes;
+  try { bytes=await readFile(file); }
+  catch(error){ if(error?.code==='ENOENT') return null; throw error; }
+  const text=bytes.toString('utf8').replace(/^\uFEFF/,'');
+  let value;
+  try { value=JSON.parse(text); } catch(error){ throw new Error(`controller start failure evidence JSON invalid: ${error.message}`); }
+  if(value?.schema!=='deadbyte.controller-start-failure.v1'||!['start','resume','restart'].includes(String(value?.command??''))||
+      typeof value?.message!=='string'||value.message.length<1||typeof value?.failed_at_utc!=='string') {
+    throw new Error('controller start failure evidence schema invalid');
+  }
+  return {path:file,sha256:sha256Bytes(bytes),...value};
+}
+export async function preserveControllerStartFailure(ctx,evidenceDir){
+  const evidence=await readControllerStartFailure(ctx);
+  if(!evidence) return null;
+  const source=path.join(ctx.runtime_root,'controller-start-failure.json');
+  const bytes=await readFile(source);
+  const sourceSha256=sha256Bytes(bytes);
+  if(sourceSha256!==evidence.sha256) throw new Error('controller start failure evidence changed before preservation');
+  const destination=path.join(path.resolve(evidenceDir),'controller-start-failure.json');
+  await atomicBytes(destination,bytes);
+  const persistedSha256=sha256Bytes(await readFile(destination));
+  if(persistedSha256!==sourceSha256) throw new Error('preserved controller start failure evidence SHA-256 mismatch');
+  return {path:destination,sha256:persistedSha256,schema:evidence.schema,command:evidence.command,
+    failed_at_utc:evidence.failed_at_utc,message:evidence.message};
+}
 async function readLedger(ctx,name){
   const file=path.join(ctx.runtime_root,`${name}.instance.json`);
   const value=JSON.parse((await readFile(file,'utf8')).replace(/^\uFEFF/,''));
@@ -554,12 +582,20 @@ async function waitCoreGone(runtime,timeoutMs=10000){
 }
 async function startAndVerify(ctx,oldRuntime){
   let start=null;
+  await rm(path.join(ctx.runtime_root,'controller-start-failure.json'),{force:true});
   for(let attempt=1;attempt<=3;attempt+=1){
     start=runControllerStartNoCapture(ctx,45000);
     if(!start.error&&start.status===0) break;
     if(attempt<3) await sleep(1500);
   }
-  if(start.error||start.status!==0) throw new Error(`controller start transport failed status=${start.status} error=${start.error?.message??'none'}`);
+  if(start.error||start.status!==0){
+    let detail='';
+    try {
+      const evidence=await readControllerStartFailure(ctx);
+      if(evidence) detail=` controller=${evidence.message} evidence_sha256=${evidence.sha256}`;
+    } catch(error) { detail=` controller_evidence_error=${error.message}`; }
+    throw new Error(`controller start transport failed status=${start.status} error=${start.error?.message??'none'}${detail}`);
+  }
   let statusText=''; let status=null;
   const started=Date.now();
   while(Date.now()-started<45000){
@@ -879,6 +915,18 @@ export async function performSlotUpdate({stage,developmentRoot,expectedVersion,e
     return {ok:true,update_id:updateId,state_path:statePath,receipt_path:receiptPath,receipt_sha256:receipt.receipt_sha256,
       pointer:newPointer,new_runtime:newRuntime,final_authority:finalAuthority,workspace_root:workspace.target};
   } catch(error){
+    let controllerStartFailure=null,controllerStartFailurePreservationError=null;
+    if(pointerCommitted&&newCtx){
+      try {
+        controllerStartFailure=await preserveControllerStartFailure(newCtx,evidenceDir);
+        const claimed=/evidence_sha256=([0-9a-f]{64})/.exec(String(error?.message??error));
+        if(claimed&&(!controllerStartFailure||controllerStartFailure.sha256!==claimed[1])) {
+          controllerStartFailurePreservationError=`controller start failure evidence claim mismatch expected=${claimed[1]} preserved=${controllerStartFailure?.sha256??'missing'}`;
+        }
+      } catch(preserveError) {
+        controllerStartFailurePreservationError=String(preserveError?.message??preserveError);
+      }
+    }
     const rollback={attempted:false,new_runtime_stopped:false,pointer_restored:false,launchers_restored:false,workspace_restored:false,
       mcp_url_restored:false,old_runtime_restarted:false,authority_restored:false,errors:[]};
     try {
@@ -916,6 +964,8 @@ export async function performSlotUpdate({stage,developmentRoot,expectedVersion,e
     } catch(rollbackError){ rollback.errors.push(`rollback:${rollbackError.message}`); }
     const failure={schema:FAILURE_SCHEMA,update_id:updateId,release_version:expectedVersion,candidate_manifest_sha256:expectedManifest,
       failed_at_utc:new Date().toISOString(),phase:journal.phase??'unknown',error:{name:error?.name??'Error',code:error?.code??null,message:String(error?.message??error)},
+      controller_start_failure:controllerStartFailure,
+      controller_start_failure_preservation_error:controllerStartFailurePreservationError,
       predecessor_mode:predecessor?.mode??null,prior_pointer:publicPointer(pointerInfo?.pointer??null),attempted_pointer:publicPointer(newPointer),old_runtime:generationTuple(oldRuntime),rollback};
     await writeState(statePath,journal,'failed',{failure,rollback}).catch(()=>{});
     let failureReceipt=null;

package/src/search-cursor.mjs

@@ -0,0 +1,45 @@
+import { sign as cryptoSign, verify as cryptoVerify } from 'node:crypto';
+import { canonicalJson } from './canonical-json.mjs';
+import { loadPrivateSigningKey, loadPublicVerifyKey } from './trust.mjs';
+
+const DOMAIN=Buffer.from('DEADBYTE-SEARCH-CURSOR-V1\0','utf8');
+const HEX64=/^[0-9a-f]{64}$/;
+const SCHEMA='deadbyte.search-cursor.v1';
+
+function validateBody(body){
+  if(!body||typeof body!=='object'||Array.isArray(body)||body.schema!==SCHEMA) throw new Error('search cursor body invalid');
+  if(!HEX64.test(body.query_sha256??'')) throw new Error('search cursor query identity invalid');
+  if(!HEX64.test(body.snapshot_sha256??'')) throw new Error('search cursor snapshot identity invalid');
+  if(!Number.isInteger(body.offset)||body.offset<0||body.offset>1_000_000) throw new Error('search cursor offset invalid');
+  return {schema:SCHEMA,query_sha256:body.query_sha256,snapshot_sha256:body.snapshot_sha256,offset:body.offset};
+}
+
+export function createSearchCursorCodec({signingKeyPath,verifyKeyPath}){
+  if(!signingKeyPath||!verifyKeyPath) throw new Error('search cursor codec requires signing and verify keys');
+  return Object.freeze({
+    async encode(input){
+      const body=validateBody({...input,schema:SCHEMA});
+      const signing=await loadPrivateSigningKey(signingKeyPath);
+      const bytes=Buffer.from(canonicalJson(body),'utf8');
+      const signature=cryptoSign(null,Buffer.concat([DOMAIN,bytes]),signing.privateKey).toString('base64');
+      const envelope={body,attestation:{algorithm:'ed25519',key_id:signing.keyId,signature_base64:signature}};
+      return Buffer.from(canonicalJson(envelope),'utf8').toString('base64url');
+    },
+    async decode(cursor){
+      if(typeof cursor!=='string'||cursor.length<1||cursor.length>8192) throw new Error('search cursor invalid');
+      let envelope;
+      try{envelope=JSON.parse(Buffer.from(cursor,'base64url').toString('utf8'));}catch{throw new Error('search cursor invalid');}
+      const body=validateBody(envelope?.body);
+      const verifyKey=await loadPublicVerifyKey(verifyKeyPath);
+      const att=envelope?.attestation;
+      if(att?.algorithm!=='ed25519'||att?.key_id!==verifyKey.keyId||typeof att?.signature_base64!=='string') throw new Error('search cursor attestation invalid');
+      const signature=Buffer.from(att.signature_base64,'base64');
+      if(signature.length!==64||signature.toString('base64')!==att.signature_base64) throw new Error('search cursor signature encoding invalid');
+      const bytes=Buffer.from(canonicalJson(body),'utf8');
+      if(!cryptoVerify(null,Buffer.concat([DOMAIN,bytes]),verifyKey.publicKey,signature)) throw new Error('search cursor signature invalid');
+      return body;
+    }
+  });
+}
+
+export const SEARCH_CURSOR_SCHEMA=SCHEMA;

package/src/semantic-code.mjs

@@ -149,7 +149,7 @@ export function createTypeScriptSemanticBackend({codingRuntime}){
   }
   async function diagnostics({rootId,relativePath,maxResults=200}){
     if(!Number.isInteger(maxResults)||maxResults<1||maxResults>500) throw new Error('max_results must be in [1, 500]');
-    await codingRuntime.fileRead({rootId,relativePath,encoding:'utf8'});
+    const file=await codingRuntime.fileRead({rootId,relativePath,encoding:'utf8'});
     const project=await buildProject(codingRuntime,rootId); const target=targetFile(project,relativePath);
     const all=[...project.service.getSyntacticDiagnostics(target.absolute),...project.service.getSemanticDiagnostics(target.absolute)];
     const diagnosticsOut=all.slice(0,maxResults).map(item=>{
@@ -157,23 +157,90 @@ export function createTypeScriptSemanticBackend({codingRuntime}){
       const loc=locationFromSpan(project,target.absolute,span,'','diagnostic');
       return {message:ts.flattenDiagnosticMessageText(item.messageText,'\n'),code:String(item.code),severity:diagnosticCategory(item.category),...(loc?{location:loc}:{})};
     });
-    return {status:'ok',root_id:rootId,path:relativePath,engine:`typescript-${ts.version}`,diagnostics:diagnosticsOut,truncated:all.length>maxResults};
+    const stable={root_id:rootId,path:relativePath,file_sha256:file.sha256,engine:`typescript-${ts.version}`,diagnostics:diagnosticsOut,truncated:all.length>maxResults};
+    return {status:'ok',...stable,result_sha256:digest({schema:'deadbyte.semantic-diagnostics.v1',...stable})};
+  }
+  async function implementations({rootId,relativePath,line,column,maxResults=200}){
+    if(!Number.isInteger(maxResults)||maxResults<1||maxResults>500) throw new Error('max_results must be in [1, 500]');
+    const file=await codingRuntime.fileRead({rootId,relativePath,encoding:'utf8'});
+    const project=await buildProject(codingRuntime,rootId); const target=targetFile(project,relativePath); const pos=offsetAt(target.source,line,column);
+    const raw=project.service.getImplementationAtPosition(target.absolute,pos)??[];
+    const locations=raw.map(item=>locationFromSpan(project,item.fileName,item.textSpan,item.name??'',item.kind??'implementation')).filter(Boolean).slice(0,maxResults);
+    const stable={root_id:rootId,path:relativePath,line,column,file_sha256:file.sha256,engine:`typescript-${ts.version}`,locations,truncated:raw.length>maxResults};
+    return {status:'ok',...stable,result_sha256:digest({schema:'deadbyte.semantic-implementations.v1',...stable})};
   }
-  return Object.freeze({id:'typescript',extensions:new Set(SOURCE_EXTENSIONS),outline,definition,references,replaceSymbol,diagnostics});
+  async function renameEdits({rootId,relativePath,line,column,newName}){
+    const file=await codingRuntime.fileRead({rootId,relativePath,encoding:'utf8'});
+    const project=await buildProject(codingRuntime,rootId); const target=targetFile(project,relativePath); const pos=offsetAt(target.source,line,column);
+    const info=project.service.getRenameInfo(target.absolute,pos,{allowRenameOfImportPath:false});
+    if(!info?.canRename) throw new Error(`semantic rename unavailable: ${info?.localizedErrorMessage??'symbol cannot be renamed'}`);
+    const raw=project.service.findRenameLocations(target.absolute,pos,false,false,true)??[];
+    if(raw.length<1) throw new Error('semantic rename produced no locations');
+    const edits=[];
+    for(const item of raw){
+      const loc=locationFromSpan(project,item.fileName,item.textSpan,'','rename');
+      if(!loc) continue;
+      edits.push({path:loc.path,start:item.textSpan.start,length:item.textSpan.length,new_text:`${item.prefixText??''}${newName}${item.suffixText??''}`});
+    }
+    if(edits.length<1) throw new Error('semantic rename produced no allowed edits');
+    edits.sort((a,b)=>a.path.localeCompare(b.path,'en')||a.start-b.start||a.length-b.length);
+    return {status:'ok',root_id:rootId,path:relativePath,engine:`typescript-${ts.version}`,target_file_sha256:file.sha256,edits};
+  }
+  return Object.freeze({id:'typescript',extensions:new Set(SOURCE_EXTENSIONS),outline,definition,references,replaceSymbol,diagnostics,implementations,renameEdits});
 }
 
-export function createSemanticCodeRuntime({codingRuntime,backends=[]}){
+export function createSemanticCodeRuntime({codingRuntime,backends=[],nativeDiffRuntime=null}){
   if(!codingRuntime) throw new Error('semantic runtime requires coding runtime');
   if(!Array.isArray(backends)) throw new Error('semantic runtime backends must be an array');
   const typescript=createTypeScriptSemanticBackend({codingRuntime});
   const registry=createSemanticBackendRegistry({backends:[typescript,...backends]});
-  const route=(method,args)=>registry.backendForPath(args.relativePath)[method](args);
+  const backendFor=args=>registry.backendForPath(args.relativePath);
+  const route=(method,args)=>{
+    const backend=backendFor(args);
+    if(typeof backend[method]!=='function') return {status:'unsupported',capability:method,engine:backend.id};
+    return backend[method](args);
+  };
+  async function renamePreview({rootId,relativePath,line,column,newName}){
+    if(typeof newName!=='string'||!/^[A-Za-z_$][A-Za-z0-9_$]{0,127}$/.test(newName)) throw new Error('semantic rename new name must be a valid bounded identifier');
+    if(!nativeDiffRuntime||typeof nativeDiffRuntime.preview!=='function') throw new Error('semantic rename preview requires Native Diff runtime');
+    const backend=backendFor({relativePath});
+    if(typeof backend.renameEdits!=='function') return {status:'unsupported',capability:'rename_preview',engine:backend.id};
+    const plan=await backend.renameEdits({rootId,relativePath,line,column,newName});
+    if(plan?.status==='unsupported') return plan;
+    if(!plan||plan.status!=='ok'||!Array.isArray(plan.edits)||plan.edits.length<1) throw new Error('semantic rename backend returned no normalized edits');
+    const groups=new Map();
+    for(const edit of plan.edits){
+      if(!edit||typeof edit.path!=='string'||!Number.isInteger(edit.start)||edit.start<0||!Number.isInteger(edit.length)||edit.length<0||typeof edit.new_text!=='string') throw new Error('semantic rename edit malformed');
+      const list=groups.get(edit.path)??[]; list.push(edit); groups.set(edit.path,list);
+    }
+    const operations=[]; const preimages=[]; let editCount=0;
+    for(const filePath of [...groups.keys()].sort((a,b)=>a.localeCompare(b,'en'))){
+      const file=await codingRuntime.fileRead({rootId,relativePath:filePath,encoding:'utf8'});
+      const edits=[...groups.get(filePath)].sort((a,b)=>a.start-b.start||a.length-b.length);
+      let priorEnd=-1;
+      for(const edit of edits){
+        if(edit.start<priorEnd) throw new Error(`semantic rename overlapping edits in ${filePath}`);
+        if(edit.start+edit.length>file.content.length) throw new Error(`semantic rename edit outside ${filePath}`);
+        priorEnd=edit.start+edit.length;
+      }
+      let next=file.content;
+      for(const edit of [...edits].sort((a,b)=>b.start-a.start)) next=next.slice(0,edit.start)+edit.new_text+next.slice(edit.start+edit.length);
+      operations.push({kind:'write',path:filePath,content:next,encoding:'utf8',expected_sha256:file.sha256});
+      preimages.push({path:filePath,sha256:file.sha256});
+      editCount+=edits.length;
+    }
+    const diff=await nativeDiffRuntime.preview({rootId,title:`semantic rename ${relativePath} -> ${newName}`,operations});
+    return {status:'ready',diff_id:diff.diff_id,affected_files:operations.length,edit_count:editCount,
+      backend:plan.engine??backend.id,preimages};
+  }
   return Object.freeze({
     outline:async args=>route('outline',args),
     definition:async args=>route('definition',args),
     references:async args=>route('references',args),
     replaceSymbol:async args=>route('replaceSymbol',args),
     diagnostics:async args=>route('diagnostics',args),
+    implementations:async args=>route('implementations',args),
+    renamePreview,
     languages:()=>registry.languages()
   });
 }

package/src/semantic-lsp-backend.mjs

@@ -119,7 +119,7 @@ export function createSemanticLspBackend({id,extensions,codingRuntime,server}){
   const open=async ctx=>{
     const client=createLspStdioClient({executablePath:server.executable_path,expectedSha256:server.executable_sha256,args:server.args??[],cwd:ctx.root.real_path,env:server.env??{},dependencies:server.dependencies??[],requestTimeoutMs:server.request_timeout_ms??10000,maxMessageBytes:server.max_message_bytes??4*1024*1024});
     try{
-      await client.initialize({processId:null,rootPath:ctx.root.real_path,rootUri:ctx.rootUri,workspaceFolders:[{uri:ctx.rootUri,name:path.basename(ctx.root.real_path)}],capabilities:{workspace:{workspaceFolders:true},textDocument:{documentSymbol:{hierarchicalDocumentSymbolSupport:true},definition:{},references:{},diagnostic:{}}},initializationOptions:server.initialization_options??{}});
+      await client.initialize({processId:null,rootPath:ctx.root.real_path,rootUri:ctx.rootUri,workspaceFolders:[{uri:ctx.rootUri,name:path.basename(ctx.root.real_path)}],capabilities:{workspace:{workspaceFolders:true},textDocument:{documentSymbol:{hierarchicalDocumentSymbolSupport:true},definition:{},references:{},implementation:{},rename:{prepareSupport:false},diagnostic:{}}},initializationOptions:server.initialization_options??{}});
       for(const document of await workspaceDocuments(ctx)) client.notify('textDocument/didOpen',{textDocument:{uri:document.uri,languageId,version:1,text:document.text}});
       if(startupSettleMs>0) await new Promise(resolve=>setTimeout(resolve,startupSettleMs));
       return client;
@@ -163,7 +163,43 @@ export function createSemanticLspBackend({id,extensions,codingRuntime,server}){
     const raw=await withClient(ctx,client=>requestRead(client,'textDocument/diagnostic',{textDocument:{uri:ctx.uri}}));
     const items=Array.isArray(raw?.items)?raw.items:[];
     const diagnosticsOut=items.slice(0,maxResults).filter(item=>validRange(item?.range)).map(item=>({message:String(item.message??''),code:String(item.code??''),severity:SEVERITY[Number(item.severity)]??'unknown',location:{path:ctx.relativePath,name:'',kind:'diagnostic',start_line:item.range.start.line,start_column:item.range.start.character,end_line:item.range.end.line,end_column:item.range.end.character}}));
-    return {status:'ok',root_id:rootId,path:ctx.relativePath,engine:id,diagnostics:diagnosticsOut,truncated:items.length>maxResults};
+    const stable={root_id:rootId,path:ctx.relativePath,file_sha256:ctx.file.sha256,engine:id,diagnostics:diagnosticsOut,truncated:items.length>maxResults};
+    return {status:'ok',...stable,result_sha256:digest({schema:'deadbyte.semantic-diagnostics.v1',...stable})};
+  }
+  async function implementations({rootId,relativePath,line,column,maxResults=200}){
+    if(!Number.isInteger(maxResults)||maxResults<1||maxResults>500) throw new Error('max_results must be in [1, 500]');
+    const ctx=await rootContext(codingRuntime,rootId,relativePath);
+    let raw;
+    try { raw=await withClient(ctx,client=>requestRead(client,'textDocument/implementation',{textDocument:{uri:ctx.uri},position:{line,character:column}})); }
+    catch(error){ if(/-32601|method not found/i.test(String(error))) return {status:'unsupported',capability:'implementations',engine:id}; throw error; }
+    const normalized=normalizeLocations(raw,ctx,maxResults);
+    const stable={root_id:rootId,path:ctx.relativePath,line,column,file_sha256:ctx.file.sha256,engine:id,...normalized};
+    return {status:'ok',...stable,result_sha256:digest({schema:'deadbyte.semantic-implementations.v1',...stable})};
+  }
+  async function renameEdits({rootId,relativePath,line,column,newName}){
+    const ctx=await rootContext(codingRuntime,rootId,relativePath);
+    let raw;
+    try { raw=await withClient(ctx,client=>requestRead(client,'textDocument/rename',{textDocument:{uri:ctx.uri},position:{line,character:column},newName})); }
+    catch(error){ if(/-32601|method not found/i.test(String(error))) return {status:'unsupported',capability:'rename_preview',engine:id}; throw error; }
+    const byUri=[];
+    if(raw?.changes&&typeof raw.changes==='object') for(const [uri,edits] of Object.entries(raw.changes)) byUri.push({uri,edits});
+    for(const change of raw?.documentChanges??[]){ if(change?.textDocument?.uri&&Array.isArray(change.edits)) byUri.push({uri:change.textDocument.uri,edits:change.edits}); }
+    const normalized=[];
+    for(const group of byUri){
+      let absolute; try{absolute=path.resolve(fileURLToPath(group.uri));}catch{continue;}
+      if(!inside(ctx.root.real_path,absolute)||denied(ctx.root,absolute)) continue;
+      const rel=relNormalized(path.relative(ctx.root.real_path,absolute));
+      const file=await codingRuntime.fileRead({rootId,relativePath:rel,encoding:'utf8'});
+      for(const edit of group.edits??[]){
+        if(!validRange(edit?.range)||typeof edit?.newText!=='string') throw new Error('semantic LSP rename edit malformed');
+        const start=positionToOffset(file.content,edit.range.start); const end=positionToOffset(file.content,edit.range.end);
+        if(end<start) throw new Error('semantic LSP rename range invalid');
+        normalized.push({path:rel,start,length:end-start,new_text:edit.newText});
+      }
+    }
+    if(normalized.length<1) throw new Error('semantic LSP rename produced no allowed edits');
+    normalized.sort((a,b)=>a.path.localeCompare(b.path,'en')||a.start-b.start||a.length-b.length);
+    return {status:'ok',root_id:rootId,path:ctx.relativePath,engine:id,target_file_sha256:ctx.file.sha256,edits:normalized};
   }
   async function replaceSymbol({rootId,relativePath,symbolId,newBody,expectedSha256}){
     if(typeof newBody!=='string'||newBody.length>524288) throw new Error('new_body exceeds 524288 characters');
@@ -179,5 +215,5 @@ export function createSemanticLspBackend({id,extensions,codingRuntime,server}){
     const result=await codingRuntime.textReplace({rootId,relativePath:ctx.relativePath,oldString:oldBody,newString:newBody,expectedSha256,expectedReplacements:1});
     return {...result,symbol_id:symbolId,symbol_name:symbol.name,engine:id};
   }
-  return Object.freeze({id,extensions:extensionSet,outline,definition,references,replaceSymbol,diagnostics});
+  return Object.freeze({id,extensions:extensionSet,outline,definition,references,replaceSymbol,diagnostics,implementations,renameEdits});
 }

package/src/version.mjs

@@ -1,4 +1,4 @@
-export const DEADBYTE_VERSION = '0.9.0';
+export const DEADBYTE_VERSION = '0.10.0';
 export const MCP_PROTOCOL_VERSION = '2026-07-28';
 export const RECEIPT_SCHEMA_V1 = 'deadbyte.receipt.v1';
 export const RECEIPT_SCHEMA_V2 = 'deadbyte.receipt.v2';