fix(mcp): close the nine defects the v0.1.125 retest found

[singhpratech]

A deep retest of v0.1.125 confirmed all four of its Windows fixes on real hardware, then found nine more defects underneath them. All nine are fixed here. No new editor features — every change is a fix to the MCP surface.

The severe one: the leak came back through a different door

v0.1.125's fix was real, and it was the only place PathDenylist::isSecretPath ran — search_project's filesystem walk. So the leak survived in the plainest possible form. Stop searching, and just ask:

→ open_file  {"path": ".../.ssh/id_rsa"}
← "Opened .../.ssh/id_rsa as tab 8"          isError: false
→ read_tab   {"title": "id_rsa"}
← "-----BEGIN OPENSSH PRIVATE KEY-----\n<full key body>\n-----END..."

Three more paths were open alongside it. find_in_tab returns the matching lines of a tab, which is a content channel with extra steps. And search_project's open-tab leg read the file straight out of the buffer — the deny-list was guarding the disk while the identical bytes sat in a tab, unguarded.

All four now check the same list. open_file refuses before the tab exists, because opening a key and then declining to read it would still put it on screen.

The nine

	Defect	Root cause
NP-05	Private keys returned in full	isSecretPath ran in 1 of 4 read paths
NP-06	Mock data indistinguishable from real	Nothing on the wire said so; only --help, which a model never reads
NP-07	workspace_searched/scope never arrived	C++ sent them; the Rust SearchResults struct declared 2 fields, serde dropped the rest
NP-08	"No workspace open" for a query that missed	The error was gated on hits.isEmpty(), so match luck decided which fact you were told
NP-09	format_json invented structure, reported success	It called the JSON panel's auto-fixer
NP-10	read_tab unbounded	5 MB cap was the only bound; truncated omitted when false
NP-11	find_in_tab rejected title	Two hand-written resolvers that had drifted
NP-12	Bogus pagination cursor ignored	No validation at all
NP-13	No stable tab identity	Every verb addressed tabs positionally

format_json is the other one worth naming. Over MCP there is no human in the repair loop, so [1,2 came back as [1,2] with isError:false — a truncated config file made syntactically valid and semantically invented. An assistant that formats and writes it back has fabricated data the user never had. rust-core gains a strict non-repairing json_parse_error; the panel keeps its fixer, where a human sees the repair and can undo it.

Wire contract changes

• list_open_tabs publishes a stable id; every verb that names a tab accepts tab_id. tab_index keeps working everywhere it did.
• read_tab takes max_bytes and always reports truncated and total_chars.
• find_in_tab accepts title.
• search_project returns workspace_searched, scope, and notice. Zero matches is a success with an empty list.
• Mock results carry a [MOCK DATA] content block and _meta.mock; initialize reports serverInfo.mock.

Verification

76/76 C++ suites, 160 rust-core tests, sidecar green across both Cargo feature sets — the gap that hung four CI runners last release. release-check.sh clean apart from the working-tree check. Every new test red-state verified by restoring the pre-fix code rather than negating a condition; all nine went red on the intended assertion.

Two notes worth keeping:

• The mock marker is a separate content block, not a text prefix. Prefixing was the obvious implementation and it corrupted every JSON-returning tool on the surface — the suite caught it immediately.
• Known gap: the strict-JSON validator is unit-tested, but its wiring into MainWindow's formatText host lambda is verified by inspection — that lambda is not reachable from the bridge's fake host.

Also still uncovered, carried forward from the retest: the approval card's explicit Deny button (deny-by-timeout is proven; deny-by-click is inferred), and the remote gateway, which stays behind a non-default Cargo feature.

🤖 Generated with Claude Code

https://claude.ai/code/session_01W6BGY2dFUSujZeS3vTDikq