Test Explorer hardening, and the debug-adapter defects its new suites found

.agents/skills/ci-prep/SKILL.md

@@ -45,10 +45,10 @@ Read **every line** of `--log-failed` output. For each failure note the exact fi
 1. Read **every** `.github/workflows/ci*.yml` completely — the PR pipeline is split into reusable workflows ([DIST-CI-LAYOUT]), so `ci.yml` alone only shows the orchestration:
    - `ci.yml` — orchestrator: `detect-changes`, dependency review, manifest validation, one `uses:` job per leg
    - `ci-lint.yml` — Rust / Zed / .NET / VS Code lint + format gates
-   - `ci-rust.yml` — sharded Rust e2e suite, coverage gate, version contract
-   - `ci-dotnet.yml` — sidecar tests (Ubuntu) + win32 named-pipe transport
-   - `ci-vsix.yml` — full VS Code suite + coverage gate (Ubuntu)
-   - `ci-vsix-windows.yml` — VS Code feature chunks on Windows ([DIST-CI-WIN-VSIX])
+   - `ci-test-rust.yml` — sharded Rust e2e suite, coverage gate, version contract
+   - `ci-test-dotnet.yml` — sidecar tests (Ubuntu) + win32 named-pipe transport
+   - `ci-test-vsix.yml` — full VS Code suite + coverage gate (Ubuntu)
+   - `ci-test-vsix-windows.yml` — VS Code feature chunks on Windows ([DIST-CI-WIN-VSIX])
 2. Parse every job and every step, then extract the ordered list of commands the CI actually runs.
 3. Note any environment variables, matrix strategies, or conditional steps that affect execution. In particular the Windows VS Code matrix expands from `src/editors/vscode/test-chunks.json` — enumerate the chunks with `node tools/vsix/vsix-test-chunks.mjs matrix` and run each locally as `make _test-vsix-win CHUNK=<name>`.
 

.claude/settings.json

@@ -0,0 +1,10 @@
+{
+  "permissions": {
+    "deny": [
+      "Agent",
+      "Task"
+    ]
+  },
+  "disableWorkflows": true,
+  "autoMemoryEnabled": false
+}

.github/actions/build-platform/action.yml

@@ -0,0 +1,148 @@
+# agent-pmo:0b21609
+---
+# PHASE 2 (FULL BUILD) + PHASE 3 (CACHE) for ONE platform. [DIST-CI-LAYOUT]
+#
+# One composite action so the Linux and Windows build jobs are the SAME
+# pipeline, not two hand-maintained copies of it. They differ only in the inputs
+# below; everything either of them compiles, it compiles here, exactly once:
+#
+#   * the VS Code test suite (tsc + the instrumented esbuild bundle)
+#   * the release `sharplsp` host
+#   * both .NET sidecars
+#   * the patched netcoredbg adapter (from cache - see ../netcoredbg)
+#   * the packaged VSIX
+#
+# and every one of those outputs is uploaded here, because PHASE 3 is the
+# handoff boundary: no job downstream of this action is permitted to compile
+# anything. A test leg that rebuilds is a bug.
+#
+# STEP ORDER IS LOAD-BEARING. `_build-vsix-suite` writes the INSTRUMENTED bundle
+# to src/editors/vscode/dist and that is what the coverage shards measure;
+# `_build-vsix` then overwrites the same directory with the PRODUCTION bundle,
+# which has no sourcemap. The suite artifact is therefore uploaded BEFORE the
+# VSIX is packed. Reordering these two silently strips end-to-end coverage - it
+# does not fail, it just reports a smaller number.
+name: Build one platform
+description: >-
+  Compiles the VS Code suite, the release host, both sidecars, netcoredbg and
+  the VSIX for a single platform, and publishes every artifact the test phase
+  consumes.
+inputs:
+  platform:
+    description: '"linux" or "win" - selects which feature chunks this platform runs.'
+    required: true
+  vsix-platform:
+    description: Platform triple for netcoredbg and the standalone archive, e.g. linux-x64.
+    required: true
+  host-binary:
+    description: Path of the built host binary, e.g. target/release/sharplsp.
+    required: true
+  suite-artifact:
+    description: Artifact name for the compiled VS Code suite.
+    required: true
+  binaries-artifact:
+    description: Artifact name for the host binary and both sidecars.
+    required: true
+  debugger-artifact:
+    description: Artifact name for the patched netcoredbg build.
+    required: true
+  archive:
+    description: >-
+      '"true" to also build and verify the standalone server archive and the
+      package-manager manifests. Ubuntu only - one platform is enough to catch a
+      layout regression, and release.yml builds the rest at tag time.'
+    required: false
+    default: 'false'
+outputs:
+  chunks:
+    description: JSON array of feature-chunk names for this platform's test matrix.
+    value: ${{ steps.suite.outputs.chunks }}
+runs:
+  using: composite
+  steps:
+    - uses: dtolnay/rust-toolchain@29eef336d9b2848a0b548edc03f92a220660cdb8 # stable
+      with:
+        toolchain: stable
+    - uses: Swatinem/rust-cache@e18b497796c12c097a38f9edb9d0641fb99eee32 # v2
+    - uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
+      with:
+        path: "~/.nuget/packages"
+        key: >-
+          ${{ runner.os }}-nuget-${{ hashFiles('src/sidecars/**/*.csproj',
+          'src/sidecars/Directory.Build.props') }}
+        restore-keys: "${{ runner.os }}-nuget-"
+
+    # ── The VS Code suite, and this platform's chunk matrix ────────
+    # First, because it publishes the INSTRUMENTED bundle the shards measure.
+    - name: Compile the VS Code suite and resolve the chunk matrix
+      id: suite
+      uses: ./.github/actions/vsix-suite
+      with:
+        platform: ${{ inputs.platform }}
+        suite-artifact: ${{ inputs.suite-artifact }}
+
+    # ── The host, the sidecars and the debug adapter ───────────────
+    - name: Build sharplsp host and both sidecars (release)
+      shell: bash
+      run: make _build-rust _build-dotnet
+    - name: Build or restore patched netcoredbg
+      uses: ./.github/actions/netcoredbg
+      with:
+        vsix-platform: ${{ inputs.vsix-platform }}
+
+    # ── PHASE 3: publish everything the test phase consumes ────────
+    - name: Upload LSP binaries
+      uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
+      with:
+        name: ${{ inputs.binaries-artifact }}
+        retention-days: 1
+        path: |
+          ${{ inputs.host-binary }}
+          target/sidecar-csharp
+          target/sidecar-fsharp
+    - name: Upload patched debugger
+      uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
+      with:
+        name: ${{ inputs.debugger-artifact }}
+        retention-days: 1
+        include-hidden-files: true
+        path: target/netcoredbg/${{ inputs.vsix-platform }}/netcoredbg
+
+    # ── Packaging checks over what was just built ──────────────────
+    # These assert the SHAPE of the build outputs, so they belong to the build
+    # phase and not to a test leg. They add seconds, because everything they
+    # package is already compiled above.
+    - name: Sidecar pack smoke test
+      if: ${{ inputs.archive == 'true' }}
+      shell: bash
+      run: |-
+        set -euo pipefail
+        dotnet pack src/sidecars/SharpLsp.Sidecar.CSharp/SharpLsp.Sidecar.CSharp.csproj \
+          -p:PackageVersion=0.0.0-ci -c Release -o /tmp/nupkg-smoke
+        dotnet pack src/sidecars/SharpLsp.Sidecar.FSharp/SharpLsp.Sidecar.FSharp.fsproj \
+          -p:PackageVersion=0.0.0-ci -c Release -o /tmp/nupkg-smoke
+        ls -la /tmp/nupkg-smoke/*.nupkg
+    - name: Package and verify the standalone server archive
+      # [DIST-ARCHIVE] How Rider, Zed, Neovim, Helix and the Homebrew/Scoop
+      # formulas install SharpLsp - no VSIX, no shipwright, so the host must
+      # find its sidecars by the archive layout alone. Only release.yml built
+      # it before, which meant a layout regression surfaced at tag time with the
+      # release already half-published.
+      if: ${{ inputs.archive == 'true' }}
+      shell: bash
+      run: |-
+        set -euo pipefail
+        make _package-archive VSIX_PLAT=${{ inputs.vsix-platform }} ARCHIVE_LSP=${{ inputs.host-binary }}
+        bash tools/packaging/verify-archive.sh ${{ inputs.vsix-platform }}
+    - name: Verify Homebrew formula and Scoop manifest renderer
+      # Both are only rendered on a tag, so without this the first sign of a
+      # broken one is a user's failed `brew install`. [DIST-PATH-INSTALL]
+      if: ${{ inputs.archive == 'true' }}
+      shell: bash
+      run: node tools/packaging/verify-package-manifests.mjs
+
+    # ── The VSIX, LAST ─────────────────────────────────────────────
+    # Overwrites src/editors/vscode/dist with the production bundle, which is
+    # why it runs after the suite artifact is already published.
+    - name: Pack and verify the VSIX
+      uses: ./.github/actions/vsix-payload

.github/actions/netcoredbg/action.yml

@@ -0,0 +1,46 @@
+# agent-pmo:0b21609
+---
+# PHASE 2 (FULL BUILD). Puts the patched netcoredbg debug adapter for one
+# platform on disk. [DIST-DEBUGGER-BUNDLE]
+#
+# It does not decide HOW. tools/netcoredbg/provide.mjs owns that: it downloads
+# the SHA-256-pinned archive named in netcoredbg.lock.json and verifies the
+# bytes, and only compiles from source for a platform that has no pin yet. Both
+# CI and `make` go through it, so there is one answer to "which netcoredbg is
+# this" everywhere.
+#
+# The cache below covers the source-build path only. Compiling the adapter cost
+# 1m27 on Ubuntu and 4m38 on Windows, on EVERY pull request, for a binary whose
+# inputs change only when the pinned commits or the patch change - and on the
+# Windows leg it was the single largest item on the critical path. The key
+# hashes exactly the inputs that determine the result, so a bump misses and
+# rebuilds, and nothing else does. Once the lock file carries pins, a run
+# restores from cache or downloads a verified archive and never compiles at all.
+name: Provide the patched netcoredbg
+description: >-
+  Downloads the SHA-256-pinned netcoredbg archive for the given platform, or
+  builds and caches it when that platform has no pin.
+inputs:
+  vsix-platform:
+    description: Target platform triple, e.g. linux-x64 or win32-x64.
+    required: true
+outputs:
+  path:
+    description: Directory holding the adapter.
+    value: target/netcoredbg/${{ inputs.vsix-platform }}/netcoredbg
+runs:
+  using: composite
+  steps:
+    - name: Restore a previously built adapter
+      uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
+      with:
+        # The `.sharplsp-dap-hot-reload` marker provide.mjs checks is a dotfile;
+        # actions/cache preserves it, so a hit short-circuits both the download
+        # and the build.
+        path: target/netcoredbg/${{ inputs.vsix-platform }}/netcoredbg
+        key: >-
+          netcoredbg-${{ inputs.vsix-platform }}-${{ hashFiles('tools/netcoredbg/netcoredbg.lock.json',
+          'tools/netcoredbg/dap-hot-reload.patch', 'tools/vsix/build-netcoredbg.sh') }}
+    - name: Download or build the patched adapter
+      shell: bash
+      run: node tools/netcoredbg/provide.mjs ${{ inputs.vsix-platform }}

.github/actions/vsix-node-deps/action.yml

@@ -0,0 +1,47 @@
+# agent-pmo:0b21609
+---
+# ONE way to put the VS Code extension's `node_modules` on a runner.
+#
+# `npm ci` for this package takes 3m16 on Ubuntu and 4m31 on Windows even with a
+# warm `~/.npm`, because the cost is not the download - it is unpacking 524
+# packages and running their install scripts. PHASE 4 pays that once per shard
+# across ~30 shards, plus once per platform in PHASE 2 and once in PHASE 1, and
+# every one of those minutes is on the critical path of the job that pays it.
+#
+# So cache the RESULT rather than the inputs. `~/.npm` (what `setup-node`'s
+# `cache: npm` restores) only makes the download free; a `node_modules` cache
+# makes the whole install free. `npm ci` still runs on a miss, and `setup-node`
+# still primes `~/.npm` so that miss is as cheap as it can be.
+#
+# The key carries the lockfile hash, the OS and the runner architecture, because
+# the tree contains platform-specific optional dependencies (esbuild's native
+# binary among them) that must never cross between runners. There is
+# deliberately NO `restore-keys`: a partial `node_modules` from a different
+# lockfile is worse than no cache at all - `npm ci` would be skipped and the
+# tree would be silently wrong.
+name: Install VS Code extension dependencies
+description: >-
+  Sets up Node and restores src/editors/vscode/node_modules from cache, running
+  `npm ci` only when the cache misses.
+runs:
+  using: composite
+  steps:
+    - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
+      with:
+        node-version: '20'
+        cache: npm
+        cache-dependency-path: src/editors/vscode/package-lock.json
+    - name: Restore the installed dependency tree
+      id: node-modules
+      uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
+      with:
+        path: src/editors/vscode/node_modules
+        key: >-
+          vsix-node-modules-${{ runner.os }}-${{ runner.arch }}-node20-${{
+          hashFiles('src/editors/vscode/package-lock.json') }}
+    - name: Install VS Code extension deps
+      # Only on a miss. On a hit the tree is already exactly what this lockfile
+      # resolves to, and `npm ci` would delete it and rebuild it from scratch.
+      if: steps.node-modules.outputs.cache-hit != 'true'
+      shell: bash
+      run: npm ci --prefix src/editors/vscode

.github/actions/vsix-payload/action.yml

@@ -1,57 +1,30 @@
 # agent-pmo:0b21609
 ---
-# Implements [DIST-CI-VSIX-SHARDS]. ONE composite action packing the real VSIX
-# and proving the platform binary is inside it, used verbatim by both platform
-# legs.
+# PHASE 2 (FULL BUILD). Packs the real VSIX and proves the platform binary is
+# actually inside it. Used by both platform build jobs via ../build-platform.
 #
-# This check used to be a prerequisite of every test job, which meant one
-# production esbuild plus a `vsce ls` per chunk for an answer that cannot vary by
-# chunk - and, worse, it left the PRODUCTION bundle in `dist/`, whose missing
-# sourcemap silently stripped the end-to-end coverage the shards exist to
-# collect. As its own job on each leg it reports in minutes and touches nothing
-# the shards depend on.
+# This was its own job on each leg, which had to re-install npm dependencies and
+# re-download the host + sidecars it was about to package - a full job prelude
+# for a `vsce package` over binaries that already existed on the build machine.
+# Running it as the LAST step of the build that produced those binaries removes
+# both round trips, and puts the VSIX where PHASE 2 says it belongs: built with
+# everything else, exactly once, per platform.
+#
+# It must stay last. `npm run build` writes the PRODUCTION bundle over
+# src/editors/vscode/dist, and the production bundle carries no sourcemap; the
+# instrumented bundle the coverage shards measure has to have been published
+# before this runs.
 name: Verify the packaged VSIX payload
 description: >-
-  Packs the VSIX from prebuilt binaries and asserts the platform `sharplsp`
-  binary is actually in the archive.
-inputs:
-  binaries-artifact:
-    description: Artifact holding the release host and both sidecars.
-    required: true
-  debugger-artifact:
-    description: Artifact holding the patched netcoredbg build.
-    required: true
-  debugger-path:
-    description: Where the debugger artifact unpacks, e.g. target/netcoredbg/linux-x64/netcoredbg.
-    required: true
+  Packs the VSIX from the binaries already built in this job and asserts the
+  platform `sharplsp` binary is in the archive.
 runs:
   using: composite
   steps:
-    - uses: actions/setup-dotnet@26b0ec14cb23fa6904739307f278c14f94c95bf1 # v5.4.0
-      with:
-        dotnet-version: |
-          9.0.x
-          10.0.303
-    - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
-      with:
-        node-version: '20'
-        cache: npm
-        cache-dependency-path: src/editors/vscode/package-lock.json
-    - name: Install VS Code extension deps
-      shell: bash
-      run: npm ci --prefix src/editors/vscode
-    - name: Download the prebuilt host and sidecars
-      uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
-      with:
-        name: ${{ inputs.binaries-artifact }}
-        path: target
-    - name: Download the patched debugger
-      uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
-      with:
-        name: ${{ inputs.debugger-artifact }}
-        path: ${{ inputs.debugger-path }}
     - name: Build the VSIX
       shell: bash
+      # VSIX_PREBUILT=1 stages the host and sidecars this job just built rather
+      # than invoking cargo and dotnet a second time.
       run: env VSIX_PREBUILT=1 make _build-vsix
     - name: Verify the VSIX contains the platform binary
       shell: bash

.github/actions/vsix-shard/action.yml

@@ -54,14 +54,8 @@ runs:
         dotnet-version: |
           9.0.x
           10.0.303
-    - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
-      with:
-        node-version: '20'
-        cache: npm
-        cache-dependency-path: src/editors/vscode/package-lock.json
     - name: Install VS Code extension deps
-      shell: bash
-      run: npm ci --prefix src/editors/vscode
+      uses: ./.github/actions/vsix-node-deps
     - name: Download the compiled suite
       uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
       with:

.github/actions/vsix-suite/action.yml

@@ -37,14 +37,8 @@ runs:
         dotnet-version: |
           9.0.x
           10.0.303
-    - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
-      with:
-        node-version: '20'
-        cache: npm
-        cache-dependency-path: src/editors/vscode/package-lock.json
     - name: Install VS Code extension deps
-      shell: bash
-      run: npm ci --prefix src/editors/vscode
+      uses: ./.github/actions/vsix-node-deps
     - name: Resolve the feature chunk matrix
       id: chunks
       shell: bash