test: keep child deadlines that rule out fallback exits

These fixtures' descendants exit on their own after 20 or 30 seconds. The
shorter explicit deadline is what proves cleanup stopped them first.

Co-Authored-By: gensokyo-dev <[email protected]>
Co-Authored-By: Claude Opus 5.5 <[email protected]>

docs/development/testing.md

@@ -307,7 +307,10 @@ assertion. `vitest.config.ts` applies the deadlines in
 and 120 seconds for built projects, with hooks sharing their project's
 deadline. Coverage doubles every deadline, and so does hosted CI, where
 CPU-bound cases share every core with other workers and their subprocesses.
-Do not pass a per-test timeout to fit a slow host. Tag a bounded workload that needs longer with
+Do not pass a per-test timeout to fit a slow host. A child run through a
+test process registry (`processTest`, `cli.run`, or `createTestProcessRegistry`)
+gets the running test's remaining deadline less a reporting reserve, so a hung
+child fails with its captured output. Pass `timeoutMs` only when the child's deadline is itself under test. Tag a bounded workload that needs longer with
 `{ tags: ["long-running"] }`, or a whole file with
 `// @module-tag long-running`. Assert elapsed time explicitly when speed is the
 behavior under test. Derive an explicit deadline only when a test must outlive
@@ -357,17 +360,11 @@ The process restarts when the environment changes, after 32 commands, or when
 the worker reports a resident set of at least 1 GiB. A fatal worker failure
 or a broken session frame retires that process and waits for it to exit before
 the next command starts.
-In a `cliTest` file, `cli.run` uses that shared process when it reports the
-command exactly as a fresh `rea` process would. Both run the same one-shot
-owner (`src/cliOneShot.ts`), and the shared process presents the launcher's
-entrypoint. A command starts a fresh process instead when it supplies stdin or
-an explicit deadline, enters MCP or the MCP doctor (which the launcher routes
-first), sets `NODE_OPTIONS`, or enables logging, which writes outside the
-per-command capture. Pass `freshProcess: true` for process-level facts such as
-startup, signals, or exit, and keep one fresh check beside reused cases where
-dispatch itself is under test. `createTestCli` drivers always start a fresh
-process. File teardown stops the shared CLI process, including startup still in
-flight, and does not open another after close.
+`cli.run` still starts a fresh process, including stdin and explicit deadlines.
+`runFileCli` uses the file session for commands that have neither. Go binary,
+IL2CPP metadata, and dylib-resolution commands use that session. File teardown
+stops the shared CLI process, including startup still in flight, and does not
+open another after close.
 `exportedFunctionBindingsCli.test.ts` uses the shared compiled CLI session for
 its file and compares its JSON command results with the MCP session. It selects
 20-second startup and command deadlines; other callers retain their existing

src/application/McpRegistrationCatalog.test.ts

@@ -296,7 +296,6 @@ it(
         process.execPath,
         ["--import", "tsx", "--input-type=module", "--eval", CATALOG_PROGRAM],
         {
-          timeoutMs: 50_000,
           env: {
             PATH: process.env.PATH,
             SystemRoot: process.env.SystemRoot,

src/application/SetupClientConfiguration.nativeSyntax.test.ts

@@ -102,7 +102,6 @@ it("repairs equal-launcher Copilot JSONC syntax while strict JSON and standard J
       process.execPath,
       ["--import", "tsx", entrypoint],
       {
-        timeoutMs: 20_000,
         env: {
           PATH: process.env.PATH,
           SystemRoot: process.env.SystemRoot,

src/application/process/ProcessScenarioPreparation.test.ts

@@ -13,29 +13,40 @@ import { prepareProcessScenarioPlan } from "./ProcessScenarioPreparation.js";
 
 afterEach(() => vi.restoreAllMocks());
 
-it("rejects observation roots that capture admission rejects", async () => {
-  const root = await createTestTempDirectory("rea-process-plan-");
-  const file = join(root, "selected");
-  await writeFile(file, "not a directory");
-  const scenario = processScenarioSchema.parse({
-    executable: process.execPath,
-    working_directory: root,
-    filesystem_observation_paths: [join(file, "child")],
-  });
+/**
+ * Windows refuses capture before root admission runs. The cancellation cases
+ * replace admission, so they plan for a platform that reaches it on any host.
+ */
+const capturePlatform = "linux";
 
-  const prepared = await prepareProcessScenarioPlan(
-    scenario,
-    {},
-    process.platform,
-  );
+// A path below a regular file is ENOTDIR on POSIX. Windows reports ENOENT,
+// which admission accepts as a root the scenario may create.
+it.skipIf(process.platform === "win32")(
+  "rejects observation roots that capture admission rejects",
+  async () => {
+    const root = await createTestTempDirectory("rea-process-plan-");
+    const file = join(root, "selected");
+    await writeFile(file, "not a directory");
+    const scenario = processScenarioSchema.parse({
+      executable: process.execPath,
+      working_directory: root,
+      filesystem_observation_paths: [join(file, "child")],
+    });
 
-  expect(prepared.ok).toBe(false);
-  if (prepared.ok) return;
-  expect(prepared.error).toMatchObject({
-    _tag: "ProcessCaptureError",
-    userMessage: "filesystem observation admission failed",
-  });
-});
+    const prepared = await prepareProcessScenarioPlan(
+      scenario,
+      {},
+      process.platform,
+    );
+
+    expect(prepared.ok).toBe(false);
+    if (prepared.ok) return;
+    expect(prepared.error).toMatchObject({
+      _tag: "ProcessCaptureError",
+      userMessage: "filesystem observation admission failed",
+    });
+  },
+);
 
 it("reports cancellation normalized inside admission as planning cancellation", async () => {
   const scenario = processScenarioSchema.parse({
@@ -59,7 +70,7 @@ it("reports cancellation normalized inside admission as planning cancellation",
   const prepared = await prepareProcessScenarioPlan(
     scenario,
     {},
-    process.platform,
+    capturePlatform,
     controller.signal,
   );
 
@@ -100,7 +111,7 @@ it("reports cancellation after the last awaited admission step", async () => {
   const planning = prepareProcessScenarioPlan(
     scenario,
     {},
-    process.platform,
+    capturePlatform,
     controller.signal,
   );
 

src/artifacts/RegularFileAdmission.test.ts

@@ -44,7 +44,12 @@ it("returns the original validated metadata snapshot with its actual descriptor"
     });
     return handle;
   });
-  const descriptor = await openRegularFile(path, { symlinks: "reject" });
+  // The test just wrote this file. Settling its fresh Windows ChangeTime would
+  // replace the first observation, so admit it as written on every host.
+  const descriptor = await openRegularFile(path, {
+    symlinks: "reject",
+    changeTime: "as-written",
+  });
   try {
     expect(descriptor.handle).toBe(opened);
     expect(descriptor.initial).toBe(validated);

src/browser/history/CaptureJson.test.ts

@@ -21,19 +21,15 @@ it("retains escape-heavy strings within a heap near their decoded size", async (
     if (!Array.isArray(parsed) || parsed.length !== 463 || parsed.some((value) => value !== body)) process.exit(3);
   `;
 
-  const child = await processes.run(
-    process.execPath,
-    [
-      "--max-old-space-size=48",
-      "--max-semi-space-size=8",
-      "--import",
-      "tsx",
-      "--input-type=module",
-      "--eval",
-      program,
-    ],
-    { timeoutMs: 30_000 },
-  );
+  const child = await processes.run(process.execPath, [
+    "--max-old-space-size=48",
+    "--max-semi-space-size=8",
+    "--import",
+    "tsx",
+    "--input-type=module",
+    "--eval",
+    program,
+  ]);
 
   expect(child.exitCode, child.stderr).toBe(0);
 });

src/ghidra/GhidraDolProfile.test.ts

@@ -19,7 +19,10 @@ import {
   ghidraDolSectionFile,
 } from "./GhidraDolProfile.js";
 import { GhidraProvider } from "./GhidraProvider.js";
-import { ghidraProfileInstallationHost as host } from "./GhidraInstallation.fixture.js";
+import {
+  ghidraProfileInstallationHost as host,
+  simulatedInstallDirectory,
+} from "./GhidraInstallation.fixture.js";
 
 // Abbreviated from Ghidra 12.1.4 ppc.ldefs and x86.ldefs: the stock PowerPC
 // default, the optional Broadway variant, and one little-endian language to refuse.
@@ -47,7 +50,7 @@ const configFor = (environment: NodeJS.ProcessEnv) => {
 };
 
 const installedConfig = async (environment: NodeJS.ProcessEnv) => {
-  const installDir = await createTestTempDirectory("rea-ghidra-dol-");
+  const installDir = await simulatedInstallDirectory("rea-ghidra-dol-");
   const languages = join(
     installDir,
     "Ghidra/Processors/PowerPC/data/languages",

src/ghidra/GhidraInstallation.fixture.ts

@@ -1,3 +1,9 @@
+import { mkdir, mkdtemp, realpath } from "node:fs/promises";
+import { tmpdir } from "node:os";
+import { join, parse, relative } from "node:path";
+import { onTestFinished } from "vitest";
+import { normalizeTestTemporaryPrefix } from "../../scripts/lib/test-temporary-ownership.mjs";
+import { removeTestWorkspace } from "../../tests/support/workspace/workspaceFixture.js";
 import { ok as javaProbeOk, err } from "../domain/result.js";
 import type {
   GhidraJavaObservation,
@@ -23,6 +29,44 @@ export const ghidraProfileInstallationHost: GhidraInstallationHost = {
     }),
 };
 
+/**
+ * A temporary installation directory the simulated Linux host accepts as
+ * absolute. On Windows it is made under the working directory and spelled as a
+ * POSIX path on that drive; other hosts get an ordinary test directory. The
+ * caller owns and disposes the native directory.
+ */
+export const createSimulatedInstallDirectory = async (
+  prefix: string,
+): Promise<{
+  readonly path: string;
+  readonly dispose: () => Promise<void>;
+}> => {
+  const root =
+    process.platform === "win32"
+      ? join(process.cwd(), "build")
+      : await realpath(tmpdir());
+  await mkdir(root, { recursive: true });
+  const owned = await realpath(
+    await mkdtemp(join(root, normalizeTestTemporaryPrefix(prefix))),
+  );
+  return {
+    path:
+      process.platform === "win32"
+        ? `/${relative(parse(owned).root, owned).replaceAll("\\", "/")}`
+        : owned,
+    dispose: () => removeTestWorkspace(owned),
+  };
+};
+
+/** Own the simulated directory for a single test. */
+export const simulatedInstallDirectory = async (
+  prefix: string,
+): Promise<string> => {
+  const directory = await createSimulatedInstallDirectory(prefix);
+  onTestFinished(directory.dispose);
+  return directory.path;
+};
+
 /** A confirmed absent Java command for installation admission fixtures. */
 export const missingJavaProbe = err<GhidraJavaProbeFailure>({
   _tag: "GhidraJavaProbeFailure",

src/ghidra/GhidraLanguageOverride.test.ts

@@ -1,13 +1,5 @@
-import {
-  chmod,
-  mkdir,
-  mkdtemp,
-  readdir,
-  rm,
-  writeFile,
-} from "node:fs/promises";
-import { tmpdir } from "node:os";
-import { join, parse, relative } from "node:path";
+import { chmod, mkdir, readdir, rm, writeFile } from "node:fs/promises";
+import { join } from "node:path";
 import { afterAll, beforeAll, describe, expect, it } from "vitest";
 import { createTestTempDirectory } from "../../tests/fixtures/temporaryDirectory.js";
 import { parseConfig } from "../config/parseConfig.js";
@@ -18,7 +10,10 @@ import {
   ghidraProfileLanguageOverride,
   sameGhidraLanguageOverride,
 } from "./GhidraAnalysisProfile.js";
-import { ghidraProfileInstallationHost as host } from "./GhidraInstallation.fixture.js";
+import {
+  createSimulatedInstallDirectory,
+  ghidraProfileInstallationHost as host,
+} from "./GhidraInstallation.fixture.js";
 import {
   admitGhidraLanguageOverride,
   parseGhidraLanguageDefinitions,
@@ -106,25 +101,19 @@ const legacyMips: BinaryTarget = {
 };
 
 let installDir = "";
-let ownedInstallDir = "";
+let disposeInstallDir: (() => Promise<void>) | undefined;
 beforeAll(async () => {
-  const root =
-    process.platform === "win32" ? join(process.cwd(), "build") : tmpdir();
-  await mkdir(root, { recursive: true });
-  ownedInstallDir = await mkdtemp(join(root, "rea-ghidra-languages-"));
-  // The simulated Linux host needs a POSIX absolute path. Keep the owned
-  // native path for cleanup and derive the simulated path on the same drive.
-  installDir =
-    process.platform === "win32"
-      ? `/${relative(parse(ownedInstallDir).root, ownedInstallDir).replaceAll("\\", "/")}`
-      : ownedInstallDir;
+  const directory = await createSimulatedInstallDirectory(
+    "rea-ghidra-languages-",
+  );
+  installDir = directory.path;
+  disposeInstallDir = directory.dispose;
   const languages = join(installDir, "Ghidra/Processors/x86/data/languages");
   await mkdir(languages, { recursive: true });
   await writeFile(join(languages, "x86.ldefs"), X86_LDEFS);
 });
 afterAll(async () => {
-  if (ownedInstallDir !== "")
-    await rm(ownedInstallDir, { recursive: true, force: true });
+  await disposeInstallDir?.();
 });
 
 const provider = (environment: Record<string, string>) => {

src/ghidra/GhidraMipsProfile.test.ts

@@ -1,7 +1,6 @@
 import { describe, expect, it } from "vitest";
 import { mkdir, writeFile } from "node:fs/promises";
 import { join } from "node:path";
-import { createTestTempDirectory } from "../../tests/fixtures/temporaryDirectory.js";
 import { ok } from "../domain/result.js";
 import { parseConfig } from "../config/parseConfig.js";
 import type {
@@ -17,7 +16,10 @@ import {
   ghidraMipsProfileMismatchReason,
   ghidraMipsProfileParameters,
 } from "./GhidraMipsProfile.js";
-import { ghidraProfileInstallationHost as host } from "./GhidraInstallation.fixture.js";
+import {
+  ghidraProfileInstallationHost as host,
+  simulatedInstallDirectory,
+} from "./GhidraInstallation.fixture.js";
 import { GHIDRA_SESSION_CAPABILITIES } from "./GhidraSessionValues.js";
 import type { GhidraMipsSoftFloatReport } from "./GhidraMipsProfile.js";
 import {
@@ -45,7 +47,7 @@ const MIPS_LANGUAGE_DEFINITIONS = `<?xml version="1.0" encoding="UTF-8"?>
 `;
 
 const installedMipsConfig = async () => {
-  const installDir = await createTestTempDirectory("rea-ghidra-mips-");
+  const installDir = await simulatedInstallDirectory("rea-ghidra-mips-");
   const languages = join(installDir, "Ghidra/Processors/MIPS/data/languages");
   await mkdir(languages, { recursive: true });
   await writeFile(join(languages, "mips.ldefs"), MIPS_LANGUAGE_DEFINITIONS);

src/ghidra/GhidraPowerPcProfile.test.ts

@@ -1,7 +1,6 @@
-import { mkdir, mkdtemp, rm, writeFile } from "node:fs/promises";
-import { tmpdir } from "node:os";
-import { join, parse, relative } from "node:path";
-import { describe, expect, it, onTestFinished } from "vitest";
+import { mkdir, writeFile } from "node:fs/promises";
+import { join } from "node:path";
+import { describe, expect, it } from "vitest";
 import { parseConfig } from "../config/parseConfig.js";
 import type {
   BinaryTarget,
@@ -16,7 +15,10 @@ import {
   ghidraProfileLanguageOverride,
 } from "./GhidraAnalysisProfile.js";
 import { GhidraProvider } from "./GhidraProvider.js";
-import { ghidraProfileInstallationHost as host } from "./GhidraInstallation.fixture.js";
+import {
+  ghidraProfileInstallationHost as host,
+  simulatedInstallDirectory,
+} from "./GhidraInstallation.fixture.js";
 
 // Abbreviated from Ghidra 12.1.4 Processors/PowerPC/data/languages/ppc.ldefs.
 const PPC_LDEFS = `<?xml version="1.0" encoding="UTF-8"?>
@@ -76,19 +78,7 @@ describe("bounded Ghidra PowerPC admission", () => {
   });
 
   it("lets a configured language replace the lane default", async () => {
-    const root =
-      process.platform === "win32" ? join(process.cwd(), "build") : tmpdir();
-    await mkdir(root, { recursive: true });
-    const ownedInstallDir = await mkdtemp(join(root, "rea-ghidra-ppc-"));
-    onTestFinished(async () => {
-      await rm(ownedInstallDir, { recursive: true, force: true });
-    });
-    // The simulated Linux host needs a POSIX absolute path. Keep the owned
-    // native path for cleanup and derive the simulated path on the same drive.
-    const installDir =
-      process.platform === "win32"
-        ? `/${relative(parse(ownedInstallDir).root, ownedInstallDir).replaceAll("\\", "/")}`
-        : ownedInstallDir;
+    const installDir = await simulatedInstallDirectory("rea-ghidra-ppc-");
     const languages = join(
       installDir,
       "Ghidra/Processors/PowerPC/data/languages",

src/ghidra/GhidraRiscvProfile.test.ts

@@ -1,6 +1,5 @@
-import { mkdir, mkdtemp, readFile, rm, writeFile } from "node:fs/promises";
-import { tmpdir } from "node:os";
-import { join, parse, relative } from "node:path";
+import { mkdir, readFile, writeFile } from "node:fs/promises";
+import { join } from "node:path";
 import { afterAll, beforeAll, describe, expect, it } from "vitest";
 import { parseConfig } from "../config/parseConfig.js";
 import type {
@@ -31,7 +30,10 @@ import {
   GHIDRA_SESSION_CAPABILITIES,
   type GhidraSessionInfo,
 } from "./GhidraSessionValues.js";
-import { ghidraProfileInstallationHost as host } from "./GhidraInstallation.fixture.js";
+import {
+  createSimulatedInstallDirectory,
+  ghidraProfileInstallationHost as host,
+} from "./GhidraInstallation.fixture.js";
 import {
   ghidraPinnedLanguage,
   ghidraProfileLanguageOverride,
@@ -107,21 +109,19 @@ const ilp32 = (
   });
 
 let installDir = "";
+let disposeInstallDir: (() => Promise<void>) | undefined;
 beforeAll(async () => {
-  const root =
-    process.platform === "win32" ? join(process.cwd(), "build") : tmpdir();
-  await mkdir(root, { recursive: true });
-  installDir = await mkdtemp(join(root, "rea-ghidra-riscv-languages-"));
-  // The simulated Linux host needs a POSIX absolute path. A current-drive root
-  // path also reaches this real fixture on Windows without changing admission.
-  if (process.platform === "win32")
-    installDir = `/${relative(parse(installDir).root, installDir).replaceAll("\\", "/")}`;
+  const directory = await createSimulatedInstallDirectory(
+    "rea-ghidra-riscv-languages-",
+  );
+  installDir = directory.path;
+  disposeInstallDir = directory.dispose;
   const languages = join(installDir, "Ghidra/Processors/RISCV/data/languages");
   await mkdir(languages, { recursive: true });
   await writeFile(join(languages, "riscv.ldefs"), RISCV_LDEFS);
 });
 afterAll(async () => {
-  await rm(installDir, { recursive: true, force: true });
+  await disposeInstallDir?.();
 });
 
 const ghidra = (environment: Record<string, string> = {}) =>

src/main/messages.ts

@@ -10,5 +10,6 @@ export const MCP_SHUTDOWN_FAILED =
   "REA could not close cleanly. End the REA process before starting it again.";
 export const SERVER_START_FAILED =
   "Do not repeat this startup. Tell the user REA could not start and ask them to restart the MCP client, then run `rea doctor`.";
-export const MCP_HTTP_LISTEN_FAILED =
-  "REA could not listen for MCP HTTP connections on the selected host and port. Choose another --port or stop the process using it.";
+/** The listener error owns recovery for its parsed failure; never its native cause text. */
+export const mcpHttpListenFailed = (remediation: string): string =>
+  `REA could not listen for MCP HTTP connections. ${remediation}`;

src/main/transport.ts

@@ -12,7 +12,7 @@ import type { OptionalProviderLoadResult } from "../application/OptionalObservat
 import { OwnedMcpServers } from "./OwnedMcpServers.js";
 import {
   MCP_CONNECTION_START_FAILED,
-  MCP_HTTP_LISTEN_FAILED,
+  mcpHttpListenFailed,
 } from "./messages.js";
 import { reportMcpTransportError } from "./reportMcpTransportError.js";
 
@@ -181,10 +181,7 @@ export const startMcpTransport = async (
     if (!cancelled) {
       const startFailure =
         cause instanceof StreamableHttpListenError
-          ? cause.classification.ok &&
-            cause.classification.value.kind === "host_allowlist"
-            ? cause.remediationAction
-            : MCP_HTTP_LISTEN_FAILED
+          ? mcpHttpListenFailed(cause.remediationAction)
           : MCP_CONNECTION_START_FAILED;
       serverLogger.error(
         {

tests/acceptance/apkZip64FramingCli.test.ts

@@ -12,7 +12,7 @@ import { createTestTempDirectory } from "../fixtures/temporaryDirectory.js";
 import { cliTest, type TestCli } from "../support/cli/cliFixture.js";
 
 const inspectBoth = async (cli: TestCli, path: string) => {
-  const output = await cli.run({
+  const output = await cli.sharedCliRun!({
     arguments: [
       "inspect-apk-signature",
       path,

tests/acceptance/appleIpsCli.test.ts

@@ -29,7 +29,6 @@ cliTest(
         "--json",
       ],
       environment: { NODE_OPTIONS: "--max-old-space-size=256" },
-      timeoutMs: 30000,
     });
     expect(result.exitCode, result.stderr).toBe(0);
     const evidence = toolContract("inspect_apple_ips").outputSchema.parse(

tests/acceptance/applications/adbListingNumbers.test.ts

@@ -6,7 +6,7 @@ import { expect } from "vitest";
 import { toolContract } from "../../../src/contracts/toolContracts.js";
 import { connectLocalToolsMcp } from "../../fixtures/localToolsMcp.js";
 import { createTestTempDirectory } from "../../fixtures/temporaryDirectory.js";
-import { cliTest } from "../../support/cli/cliFixture.js";
+import { cliTest, runFileCli } from "../../support/cli/cliFixture.js";
 
 const SERIAL = "listing-numbers-device";
 const UNSAFE = "9007199254740993";
@@ -224,10 +224,9 @@ process.stdout.write(require('node:fs').readFileSync(path));
           arguments: [operation.replaceAll("_", "-"), SERIAL, "--json"],
           environment,
         };
-        const output = await cli.run({
-          ...invocation,
-          freshProcess: variant === "safe",
-        });
+        const output = await (variant === "safe"
+          ? cli.run(invocation)
+          : runFileCli(cli, invocation));
         expect(output.exitCode, output.stderr).toBe(0);
         const evidence = contract.outputSchema.parse(output.json);
         expect(evidence.parameters).toMatchObject({ serial: SERIAL });

tests/acceptance/applications/adbNumericDeclarations.test.ts

@@ -9,7 +9,7 @@ import { adbDisplayPartialObservationSchema } from "../../../src/domain/adb/adbD
 import { connectLocalToolsMcp } from "../../fixtures/localToolsMcp.js";
 import { parseMcpToolError } from "../../fixtures/mcpToolError.js";
 import { createTestTempDirectory } from "../../fixtures/temporaryDirectory.js";
-import { cliTest } from "../../support/cli/cliFixture.js";
+import { cliTest, runFileCli } from "../../support/cli/cliFixture.js";
 
 const SERIAL = "numeric-declarations-device";
 const PACKAGE = "com.example.numeric";
@@ -224,10 +224,9 @@ cliTest.skipIf(process.platform === "win32")(
         arguments: ["inspect-adb-display", SERIAL, "--json"],
         environment: fixture.environment,
       };
-      const output = await cli.run({
-        ...invocation,
-        freshProcess: scenario === displayScenarios[0],
-      });
+      const output = await (scenario === displayScenarios[0]
+        ? cli.run(invocation)
+        : runFileCli(cli, invocation));
       expect(output.exitCode, `${scenario.name}: ${output.stderr}`).toBe(0);
       const evidence = contract.outputSchema.parse(output.json);
       expect(evidence.parameters).toEqual({ serial: SERIAL });
@@ -282,10 +281,9 @@ cliTest.skipIf(process.platform === "win32")(
         arguments: ["inspect-adb-display", SERIAL, "--json"],
         environment: fixture.environment,
       };
-      const output = await cli.run({
-        ...invocation,
-        freshProcess: value === null,
-      });
+      const output = await (value === null
+        ? cli.run(invocation)
+        : runFileCli(cli, invocation));
       expect(output.exitCode, output.stderr).toBe(1);
       const projected = analysisErrorProjectionSchema.parse(output.json);
       expect(projected.code).toBe("unreadable_output");
@@ -456,10 +454,9 @@ cliTest.skipIf(process.platform === "win32")(
         arguments: ["inspect-adb-package", SERIAL, PACKAGE, "--json"],
         environment: fixture.environment,
       };
-      const output = await cli.run({
-        ...invocation,
-        freshProcess: scenario === packageScenarios[0],
-      });
+      const output = await (scenario === packageScenarios[0]
+        ? cli.run(invocation)
+        : runFileCli(cli, invocation));
       expect(output.exitCode, `${scenario.name}: ${output.stderr}`).toBe(0);
       const evidence = contract.outputSchema.parse(output.json);
       expect(evidence.parameters).toEqual({ serial: SERIAL, package: PACKAGE });

tests/acceptance/applications/adbPackageInventoryCoverage.test.ts

@@ -8,7 +8,7 @@ import { toolContract } from "../../../src/contracts/toolContracts.js";
 import { parseEvidence } from "../../../src/domain/evidence.js";
 import { connectLocalToolsMcp } from "../../fixtures/localToolsMcp.js";
 import { createTestTempDirectory } from "../../fixtures/temporaryDirectory.js";
-import { cliTest } from "../../support/cli/cliFixture.js";
+import { cliTest, runFileCli } from "../../support/cli/cliFixture.js";
 
 const PACKAGE_LINE = "package:/data/app/example/base.apk=com.example.app";
 
@@ -139,10 +139,9 @@ process.exit(91);
           arguments: [command, "emulator-5554", ...tail, "--json"],
           environment,
         };
-        const output = await cli.run({
-          ...invocation,
-          freshProcess: count === 0,
-        });
+        const output = await (count === 0
+          ? cli.run(invocation)
+          : runFileCli(cli, invocation));
         expect(output.exitCode, output.stderr).toBe(0);
         const evidence = parseEvidence(output.json);
         expect(

tests/acceptance/applications/apiContract.test.ts

@@ -131,7 +131,7 @@ const checkCliPublication = async (
   },
 ) => {
   const { root, path, parent, summary, selected } = context;
-  const run = cli.run.bind(cli);
+  const run = cli.sharedCliRun?.bind(cli) ?? cli.run.bind(cli);
   const complete = await run({
     arguments: ["inspect-api-contract", path, "--json"],
   });
@@ -395,7 +395,7 @@ cliTest(
       coverage: { total: 3 },
       source_coverage: { status: "partial" },
     });
-    const run = cli.run.bind(cli);
+    const run = cli.sharedCliRun?.bind(cli) ?? cli.run.bind(cli);
     const cliResult = await run({
       arguments: ["inspect-api-contract", path, "--json"],
     });
@@ -442,7 +442,7 @@ cliTest(
       details: { partial_observation: snapshot },
     });
     expect(JSON.stringify(response)).not.toContain("u:p@h");
-    const run = cli.run.bind(cli);
+    const run = cli.sharedCliRun?.bind(cli) ?? cli.run.bind(cli);
     const result = await run({
       arguments: ["inspect-api-contract", path, "--json"],
     });

tests/acceptance/applications/applicationVersionMatchingCli.test.ts

@@ -7,7 +7,7 @@ import { parseEvidence } from "../../../src/domain/evidence.js";
 import { javascriptApplicationAnalysisResultSchema } from "../../../src/domain/javascript/javascriptApplicationAnalysis.js";
 import { applicationVersionComparisonResultSchema } from "../../../src/domain/javascript/javascriptApplicationVersionComparisonSchemas.js";
 import { createTestTempDirectory } from "../../fixtures/temporaryDirectory.js";
-import { cliTest } from "../../support/cli/cliFixture.js";
+import { cliTest, runFileCli } from "../../support/cli/cliFixture.js";
 
 cliTest(
   "keeps unavailable source-selection scopes unknown in version comparisons",
@@ -72,7 +72,7 @@ cliTest(
     ) => {
       const inputPath = join(root, `${name}.json`);
       await writeFile(inputPath, JSON.stringify({ left, right }));
-      const response = await cli.run({
+      const response = await runFileCli(cli, {
         arguments: ["compare-application-versions", inputPath, "--json"],
         environment: { REA_LOG_LEVEL: "silent" },
       });
@@ -492,7 +492,7 @@ cliTest(
     const compare = async (left: unknown, right: unknown) => {
       const inputPath = join(root, `comparison-${Math.random()}.json`);
       await writeFile(inputPath, JSON.stringify({ left, right }));
-      const response = await cli.run({
+      const response = await runFileCli(cli, {
         arguments: ["compare-application-versions", inputPath, "--json"],
         environment: { REA_LOG_LEVEL: "silent" },
       });

tests/acceptance/applications/electronBlankPathCli.test.ts

@@ -16,7 +16,6 @@ cliTest.for(["", " \t "])(
         "--json",
       ],
       environment: { REA_LOG_LEVEL: "silent" },
-      timeoutMs: 15000,
     });
     expect(response.exitCode).toBe(1);
     expect(response.json).toMatchObject({

tests/acceptance/applications/erlangBeamViews.test.ts

@@ -107,7 +107,7 @@ cliTest(
     const root = await createTestTempDirectory("rea-beam-views-");
     const path = join(root, "app.beam");
     await writeFile(path, erlangBeamFixture("views"));
-    const run = cli.run.bind(cli);
+    const run = cli.sharedCliRun?.bind(cli) ?? cli.run.bind(cli);
     const complete = await run({
       arguments: ["inspect-erlang-beam", path, "--json"],
     });
@@ -312,7 +312,7 @@ cliTest(
   async ({ cli }) => {
     const root = await createTestTempDirectory("rea-beam-invalid-view-");
     const output = join(root, "unused.json");
-    const run = cli.run.bind(cli);
+    const run = cli.sharedCliRun?.bind(cli) ?? cli.run.bind(cli);
     const view = JSON.stringify({ kind: "beam", collection: "exports" });
     for (const [flags, key] of [
       [["--detail", "summary"], "evidence_output"],

tests/acceptance/applications/firmwareComparison.test.ts

@@ -137,7 +137,7 @@ cliTest(
         },
       }),
     );
-    const run = cli.run.bind(cli);
+    const run = cli.sharedCliRun?.bind(cli) ?? cli.run.bind(cli);
     const result = await run({
       arguments: ["compare-artifacts", requestPath, "--json"],
     });

tests/acceptance/applications/graphqlContract.test.ts

@@ -35,7 +35,7 @@ const checkCliPublication = async (
   },
 ) => {
   const { root, parent, selected } = context;
-  const run = cli.run.bind(cli);
+  const run = cli.sharedCliRun?.bind(cli) ?? cli.run.bind(cli);
   const args = [
     "inspect-api-contract",
     "./SDL 雪.graphql",
@@ -271,7 +271,7 @@ cliTest(
         },
       }),
     );
-    const run = cli.run.bind(cli);
+    const run = cli.sharedCliRun?.bind(cli) ?? cli.run.bind(cli);
     const offline = await run({
       arguments: ["inspect-analysis-view", queryPath, "--json"],
     });
@@ -339,7 +339,7 @@ cliTest(
         source_coverage: { status: "partial", operations: "unavailable" },
       },
     });
-    const run = cli.run.bind(cli);
+    const run = cli.sharedCliRun?.bind(cli) ?? cli.run.bind(cli);
     const cliResult = await run({
       arguments: [
         "inspect-api-contract",
@@ -392,7 +392,7 @@ cliTest(
       items: [{ code: "schema-parse-refused", source: { role: "schema" } }],
     });
     await writeFile(path, text);
-    const run = cli.run.bind(cli);
+    const run = cli.sharedCliRun?.bind(cli) ?? cli.run.bind(cli);
     const result = await run({
       arguments: [
         "inspect-api-contract",

tests/acceptance/applications/interfaceBuilderPlistNumbers.test.ts

@@ -9,7 +9,11 @@ import { interfaceBuilderAnalysisSchema } from "../../../src/domain/apple/interf
 import { thinMach } from "../../../src/domain/binaryTarget.fixture.js";
 import { parseEvidence } from "../../../src/domain/evidence.js";
 import { createTestTempDirectory } from "../../fixtures/temporaryDirectory.js";
-import { cliTest, type TestCli } from "../../support/cli/cliFixture.js";
+import {
+  cliTest,
+  runFileCli,
+  type TestCli,
+} from "../../support/cli/cliFixture.js";
 
 const unknownMixedInteger = {
   $plist_type: "unknown",
@@ -35,7 +39,7 @@ const inspectArchive = (cli: TestCli, app: string, fresh: boolean) => {
     arguments: ["decode-interface-builder", app, "--json"],
     environment: { REA_LOG_LEVEL: "silent", REA_ANALYSIS_PROVIDER: "auto" },
   };
-  return cli.run({ ...invocation, freshProcess: fresh });
+  return fresh ? cli.run(invocation) : runFileCli(cli, invocation);
 };
 
 cliTest.for(scenarios)(

tests/acceptance/applications/javascriptCallLiteralTransfer.test.ts

@@ -30,7 +30,6 @@ cliTest(
         bundlePath,
         "--json",
       ],
-      timeoutMs: 60_000,
     });
     expect(response.exitCode).toBe(0);
     const bundle = evidenceBundleSchema.parse(

tests/acceptance/applications/javascriptCancellationCli.test.ts

@@ -9,16 +9,12 @@ processTest(
   "returns a nonzero exit for a streamed JSON analysis failure",
   async ({ processes }) => {
     const root = await createTestTempDirectory("rea-cli-js-missing-");
-    const result = await processes.run(
-      process.execPath,
-      [
-        "scripts/rea.mjs",
-        "analyze-javascript-application",
-        join(root, "missing"),
-        "--json",
-      ],
-      { timeoutMs: 20_000 },
-    );
+    const result = await processes.run(process.execPath, [
+      "scripts/rea.mjs",
+      "analyze-javascript-application",
+      join(root, "missing"),
+      "--json",
+    ]);
     expect(result.exitCode).toBe(1);
     expect(JSON.parse(result.stdout)).toMatchObject({
       code: "invalid_request",

tests/acceptance/applications/javascriptCheckpointReserveCli.test.ts

@@ -84,7 +84,6 @@ cliTest.skipIf(process.versions.bun !== undefined).for([
       environment: {
         NODE_OPTIONS: `--max-old-space-size=${String(heapMb)} --max-semi-space-size=8`,
       },
-      timeoutMs: 60_000,
     });
     expect(response.exitCode).toBe(0);
     const result = javascriptApplicationAnalysisResultSchema.parse(
@@ -201,7 +200,6 @@ cliTest.skipIf(process.versions.bun !== undefined)(
       environment: {
         NODE_OPTIONS: "--max-old-space-size=640 --max-semi-space-size=8",
       },
-      timeoutMs: 75_000,
     });
     expect(response.stderr).not.toMatch(/FATAL ERROR:.*heap/iu);
     expect(

tests/acceptance/applications/javascriptChildProcessArgumentsCli.test.ts

@@ -32,11 +32,10 @@ cliTest.for(["CLI", "stdio MCP"] as const)(
       ["a", "b"],
       [],
     ]) {
-      const control = await processes.run(
-        process.execPath,
-        [join(root, "child.cjs"), ...values],
-        { timeoutMs: 5_000 },
-      );
+      const control = await processes.run(process.execPath, [
+        join(root, "child.cjs"),
+        ...values,
+      ]);
       expect(control.exitCode, control.stderr).toBe(0);
       counts.push(Number(control.stdout));
     }

tests/acceptance/applications/javascriptConfigurationReadsCli.test.ts

@@ -27,7 +27,7 @@ cliTest.for(["CLI", "stdio MCP"] as const)(
     const control = await processes.run(
       process.execPath,
       [join(root, "entry.mjs"), "abc", " mode "],
-      { env: { REA_ENDPOINT: "endpoint" }, timeoutMs: 15_000 },
+      { env: { REA_ENDPOINT: "endpoint" } },
     );
     expect(control.exitCode, control.stderr).toBe(0);
     expect(JSON.parse(control.stdout)).toEqual([

tests/acceptance/applications/javascriptEndpointPayload.test.ts

@@ -46,7 +46,6 @@ cliTest(
         "directory",
         "--json",
       ],
-      timeoutMs: 60_000,
     });
     expect(cliResponse.exitCode).toBe(0);
     const cliEvidence = toolContract(

tests/acceptance/applications/javascriptEventPayload.test.ts

@@ -35,7 +35,6 @@ cliTest(
         "directory",
         "--json",
       ],
-      timeoutMs: 60_000,
     });
     expect(cliResponse.exitCode).toBe(0);
     const cliEvidence = toolContract(
@@ -160,7 +159,6 @@ cliTest(
         "directory",
         "--json",
       ],
-      timeoutMs: 60_000,
     });
     expect(analyzed.exitCode, analyzed.stderr).toBe(0);
     const application = toolContract(
@@ -193,7 +191,6 @@ cliTest(
     );
     const traced = await cli.run({
       arguments: ["trace-javascript-semantics", request, "--json"],
-      timeoutMs: 60_000,
     });
     expect(traced.exitCode, traced.stdout).toBe(0);
     const trace = javaScriptSemanticTraceResultSchema.parse(

tests/acceptance/applications/javascriptExportBindingModuleView.test.ts

@@ -6,7 +6,7 @@ import { expect } from "vitest";
 import { analysisViewResultSchema } from "../../../src/domain/analysisView/analysisView.js";
 import { parseEvidence } from "../../../src/domain/evidence.js";
 import { createTestTempDirectory } from "../../fixtures/temporaryDirectory.js";
-import { cliTest } from "../../support/cli/cliFixture.js";
+import { cliTest, runFileCli } from "../../support/cli/cliFixture.js";
 
 cliTest(
   "pages only module units for a CommonJS file that exports symbols",
@@ -23,7 +23,7 @@ cliTest(
         "exports.beta = function beta() { return 2; };",
       ].join("\n"),
     );
-    const analyzed = await cli.run({
+    const analyzed = await runFileCli(cli, {
       arguments: ["analyze-javascript-application", root, "--format", "json"],
     });
     expect(analyzed.exitCode, analyzed.stdout + analyzed.stderr).toBe(0);
@@ -54,7 +54,7 @@ cliTest(
         traceInput,
         JSON.stringify({ application: evidence, seed }),
       );
-      const traced = await cli.run({
+      const traced = await runFileCli(cli, {
         arguments: ["trace-application-feature", traceInput, "--json"],
       });
       expect(traced.exitCode, traced.stdout + traced.stderr).toBe(0);
@@ -86,7 +86,7 @@ cliTest(
           view,
         }),
       );
-      const result = await cli.run({
+      const result = await runFileCli(cli, {
         arguments: ["inspect-analysis-view", queryPath, "--json"],
       });
       expect(result.exitCode, result.stdout + result.stderr).toBe(0);

tests/acceptance/applications/javascriptFeatureTraceSeedSelectionCli.test.ts

@@ -13,6 +13,7 @@ import { findApplicationFeatureSeeds } from "../../../src/domain/javascript/java
 import { createTestTempDirectory } from "../../fixtures/temporaryDirectory.js";
 import {
   cliTest,
+  runFileCli,
   type SharedMcpCall,
   type TestCli,
 } from "../../support/cli/cliFixture.js";
@@ -169,7 +170,7 @@ const traceThroughCli = async (
   const invocation = {
     arguments: ["trace-application-feature", input, "--json"],
   };
-  const response = await cli.run(invocation);
+  const response = await runFileCli(cli, invocation);
   expect(response.exitCode, `${scenario.name} via CLI`).toBe(0);
   const evidence = toolContract("trace_application_feature").outputSchema.parse(
     response.json,

tests/acceptance/applications/javascriptPartialEndpointsCli.test.ts

@@ -19,7 +19,6 @@ cliTest(
     const cliResult = await driver.run({
       arguments: ["analyze-javascript-application", root, "--json"],
       environment: process.env,
-      timeoutMs: 15_000,
     });
     expect(cliResult.exitCode, cliResult.stderr).toBe(0);
     const result = javascriptApplicationAnalysisResultSchema.parse(

tests/acceptance/applications/javascriptWorkerUrlCli.test.ts

@@ -591,7 +591,7 @@ cliTest(
 
     const result = await analyzeJavaScriptDirectory(
       "CLI",
-      { run: (invocation) => cli.run({ ...invocation, timeoutMs: 20_000 }) },
+      { run: (invocation) => cli.run({ ...invocation }) },
       root,
     );
     expect(result.statistics.parse_failures).toBe(0);

tests/acceptance/applications/keyedArchiveTextUnicode.test.ts

@@ -8,7 +8,7 @@ import { afterAll, expect } from "vitest";
 import { parse as parseYaml } from "yaml";
 
 import { createTestTempDirectory } from "../../fixtures/temporaryDirectory.js";
-import { cliTest } from "../../support/cli/cliFixture.js";
+import { cliTest, runFileCli } from "../../support/cli/cliFixture.js";
 
 afterAll(() => disposeMdItInstance());
 
@@ -45,10 +45,9 @@ cliTest.for([
       const invocation = {
         arguments: ["inspect-keyed-archive", path, ...args],
       };
-      return cli.run({
-        ...invocation,
-        freshProcess: label === "high" || label === "pair",
-      });
+      return label === "high" || label === "pair"
+        ? cli.run(invocation)
+        : runFileCli(cli, invocation);
     };
     for (const format of ["json", "yaml"] as const) {
       const output = await run(["--format", format]);
@@ -121,7 +120,9 @@ cliTest(
         const invocation = {
           arguments: ["inspect-keyed-archive", path, ...args],
         };
-        return cli.run({ ...invocation, freshProcess: label === "nul" });
+        return label === "nul"
+          ? cli.run(invocation)
+          : runFileCli(cli, invocation);
       };
       const json = await run(["--json"]);
       expect(json.exitCode, json.stderr).toBe(0);

tests/acceptance/applications/keyedArchiveXmlNumbers.test.ts

@@ -8,7 +8,7 @@ import { expect } from "vitest";
 import { keyedArchiveResultSchema } from "../../../src/domain/apple/keyedArchive.js";
 import { parseEvidence } from "../../../src/domain/evidence.js";
 import { createTestTempDirectory } from "../../fixtures/temporaryDirectory.js";
-import { cliTest } from "../../support/cli/cliFixture.js";
+import { cliTest, runFileCli } from "../../support/cli/cliFixture.js";
 
 cliTest.for([
   { name: "plain real", element: "<real>1.25</real>", expected: 1.25 },
@@ -74,7 +74,7 @@ cliTest.for([
     await writeFile(path, bytes);
     const call = await cli.sharedMcpCall?.();
     if (call === undefined) throw new Error("Missing file-scoped MCP session");
-    const output = await cli.run({
+    const output = await runFileCli(cli, {
       arguments: [
         "inspect-keyed-archive",
         path,
@@ -155,7 +155,7 @@ cliTest(
         }).replace("<string>__VALUE__</string>", element),
       );
       await writeFile(path, bytes);
-      const output = await cli.run({
+      const output = await runFileCli(cli, {
         arguments: ["inspect-keyed-archive", path, "--json"],
         environment: { REA_LOG_LEVEL: "silent" },
       });

tests/acceptance/applications/mobileDirectoryComponents.test.ts

@@ -19,7 +19,7 @@ import { parseEvidence } from "../../../src/domain/evidence.js";
 import { harmonyApplicationProjectionResultSchema } from "../../../src/domain/harmony/harmonyApplication.js";
 import { connectLocalToolsMcp } from "../../fixtures/localToolsMcp.js";
 import { createTestTempDirectory } from "../../fixtures/temporaryDirectory.js";
-import { cliTest, type CliInvocation } from "../../support/cli/cliFixture.js";
+import { cliTest, runFileCli } from "../../support/cli/cliFixture.js";
 
 const harmony = {
   family: "HarmonyOS",
@@ -146,8 +146,10 @@ cliTest.for(fixtures)(
     const { call } = await connectLocalToolsMcp(environment);
     for (const mode of ["directories", "files", "nested"] as const) {
       // Keep one fresh dispatcher check per family; reuse later commands.
-      const run = (invocation: CliInvocation) =>
-        cli.run({ ...invocation, freshProcess: mode === "directories" });
+      const run =
+        mode === "directories"
+          ? cli.run.bind(cli)
+          : runFileCli.bind(undefined, cli);
       const writer = new ZipWriter(new Uint8ArrayWriter());
       for (const path of fixture.paths) {
         if (mode !== "files")
@@ -322,8 +324,9 @@ cliTest.for([
     const environment = { HOME: root, USERPROFILE: root };
     const { call } = await connectLocalToolsMcp(environment);
     for (const encrypted of [false, true]) {
-      const run = (invocation: CliInvocation) =>
-        cli.run({ ...invocation, freshProcess: !encrypted });
+      const run = encrypted
+        ? runFileCli.bind(undefined, cli)
+        : cli.run.bind(cli);
       const writer = new ZipWriter(new Uint8ArrayWriter());
       for (const member of fixture.paths)
         await writer.add(

tests/acceptance/applications/nativeExportsViews.test.ts

@@ -40,7 +40,7 @@ cliTest.for(["pe", "elf"] as const)(
             versionDefinitions: ["fixture", "V1"],
           });
     await writeFile(path, bytes);
-    const run = cli.run.bind(cli);
+    const run = cli.sharedCliRun?.bind(cli) ?? cli.run.bind(cli);
     const complete = await run({
       arguments: ["inspect-native-exports", path, "--json"],
     });

tests/acceptance/applications/peResources.test.ts

@@ -9,7 +9,11 @@ import { peResourceFixture } from "../../../src/native/pe/PeResources.fixture.js
 import { connectLocalToolsMcp } from "../../fixtures/localToolsMcp.js";
 import { createTestTempDirectory } from "../../fixtures/temporaryDirectory.js";
 import { parseMcpToolError } from "../../fixtures/mcpToolError.js";
-import { cliTest, type TestCli } from "../../support/cli/cliFixture.js";
+import {
+  cliTest,
+  runFileCli,
+  type TestCli,
+} from "../../support/cli/cliFixture.js";
 
 type PeResourceCall = (
   arguments_: Record<string, unknown>,
@@ -22,7 +26,7 @@ const expectPeInputFailureAcrossAdapters = async (input: {
   readonly reason: "invalid_format" | "invalid_value";
 }) => {
   const { cli, call, path, reason } = input;
-  const result = await cli.run({
+  const result = await runFileCli(cli, {
     arguments: ["inspect-pe-resources", path, "--json"],
   });
   expect(result.exitCode).toBe(1);
@@ -113,7 +117,7 @@ const expectPeWordAlignedRecordsAcrossAdapters = async (input: {
       );
       const path = join(root, `word-aligned-${plus}-${index}.exe`);
       await writeFile(path, fixture.bytes);
-      const result = await cli.run({
+      const result = await runFileCli(cli, {
         arguments: ["inspect-pe-resources", path, "--json"],
       });
       expect(result.exitCode, result.stderr).toBe(0);
@@ -204,7 +208,7 @@ const expectPeMappingOwnershipAcrossAdapters = async (
       });
       continue;
     }
-    const result = await cli.run({
+    const result = await runFileCli(cli, {
       arguments: ["inspect-pe-resources", path, "--json"],
     });
     expect(result.exitCode, name).toBe(0);
@@ -262,7 +266,9 @@ const expectPeInventoriesAcrossAdapters = async (
     };
     // Keep an independent public-wrapper process for both PE32 and PE32+.
     // The empty-payload variants reuse only compiled-command startup.
-    const result = await (empty ? cli.run(invocation) : cli.run(invocation));
+    const result = await (empty
+      ? runFileCli(cli, invocation)
+      : cli.run(invocation));
     expect(result.exitCode).toBe(0);
     const evidence = contract.outputSchema.parse(result.json);
     const report = peResourcesSchema.parse(evidence.normalized_result);
@@ -342,7 +348,7 @@ const expectPeEmptyBranchesAcrossAdapters = async (
       shared ? "shared-empty64.exe" : "empty-branches32.exe",
     );
     await writeFile(path, fixture.bytes);
-    const result = await cli.run({
+    const result = await runFileCli(cli, {
       arguments: ["inspect-pe-resources", path, "--json"],
     });
     expect(result.exitCode, result.stderr).toBe(0);

tests/acceptance/applications/playwrightTrace.test.ts

@@ -73,7 +73,7 @@ cliTest(
       (await call("inspect_playwright_trace", { path: fixture.path, view }))
         .structuredContent,
     ).toEqual(selected);
-    const run = cli.run.bind(cli);
+    const run = cli.sharedCliRun?.bind(cli) ?? cli.run.bind(cli);
     const result = await run({
       arguments: ["inspect-playwright-trace", fixture.path, "--json"],
     });
@@ -102,7 +102,7 @@ const checkCliPublication = async ({
   call: McpCall;
 }) => {
   const source = { kind: "retained-evidence", evidence_id: parent.evidence_id };
-  const run = cli.run.bind(cli);
+  const run = cli.sharedCliRun?.bind(cli) ?? cli.run.bind(cli);
   const fullCli = await run({
     arguments: ["inspect-playwright-trace", fixture.path, "--json"],
   });
@@ -420,7 +420,7 @@ cliTest(
     expect(
       parseEvidence(full.structuredContent).normalized_result,
     ).toMatchObject({ items: [{ text: message }] });
-    const run = cli.run.bind(cli);
+    const run = cli.sharedCliRun?.bind(cli) ?? cli.run.bind(cli);
     const result = await run({
       arguments: ["inspect-playwright-trace", fixture.path, "--json"],
     });

tests/acceptance/applications/pythonPycViews.test.ts

@@ -74,7 +74,7 @@ cliTest(
     const root = await createTestTempDirectory("rea-pyc-views-");
     const path = join(root, "module.pyc");
     await writeSameNamePyc(path);
-    const run = cli.run.bind(cli);
+    const run = cli.sharedCliRun?.bind(cli) ?? cli.run.bind(cli);
     const complete = await run({
       arguments: ["inspect-python-pyc", path, "--json"],
     });
@@ -222,7 +222,7 @@ cliTest(
   async ({ cli }) => {
     const root = await createTestTempDirectory("rea-pyc-invalid-delivery-");
     const output = join(root, "unused.json");
-    const run = cli.run.bind(cli);
+    const run = cli.sharedCliRun?.bind(cli) ?? cli.run.bind(cli);
     const view = JSON.stringify({
       kind: "python-pyc",
       collection: "code_objects",

tests/acceptance/applications/staticObservedEndpoints.test.ts

@@ -47,7 +47,7 @@ const prepareInputs = async (cli: TestCli) => {
     "f0e7d2c869c811d4272a7b2916c6531c8c6cc7938336a35575e2a6b7b6346714",
   );
   await writeFile(harPath, harBytes);
-  const run = cli.run.bind(cli);
+  const run = cli.sharedCliRun?.bind(cli) ?? cli.run.bind(cli);
   const analyzed = await run({
     arguments: [
       "analyze-javascript-application",

tests/acceptance/applications/typescriptThisParametersCli.test.ts

@@ -39,11 +39,9 @@ cliTest.for(["CLI", "stdio MCP"] as const)(
         "console.log(JSON.stringify([a, b, c, d, first.length, rest.length, mixed.length]));",
       ].join("\n"),
     });
-    const control = await processes.run(
-      process.execPath,
-      [join(root, "entry.mts")],
-      { timeoutMs: 15_000 },
-    );
+    const control = await processes.run(process.execPath, [
+      join(root, "entry.mts"),
+    ]);
     expect(control.exitCode, control.stderr).toBe(0);
     expect(JSON.parse(control.stdout)).toEqual([
       7,

tests/acceptance/artifactComparisonPlist.test.ts

@@ -25,7 +25,6 @@ cliTest(
     const cliResult = await driver.run({
       arguments: ["inspect-artifact", leftPath, "--json"],
       environment: process.env,
-      timeoutMs: 15_000,
     });
     expect(cliResult.exitCode, cliResult.stderr).toBe(0);
     const cliEvidence = parseEvidence(JSON.parse(cliResult.stdout));

tests/acceptance/artifactComparisonUnavailableMetadata.test.ts

@@ -23,7 +23,6 @@ cliTest(
       const result = await driver.run({
         arguments: ["inspect-artifact", path, "--detail", "complete", "--json"],
         environment: process.env,
-        timeoutMs: 15_000,
       });
       expect(result.exitCode, result.stderr).toBe(0);
       const inspection = artifactInspectionResultSchema.parse(

tests/acceptance/artifactDmgAttachmentRecoveryCli.test.ts

@@ -77,8 +77,6 @@ cliTest.skipIf(process.platform !== "darwin")(
       expect(before.length).toBeGreaterThan(0);
       expect(await attachedImagePaths()).toContain(resolvedImage);
       const busy = await cli.run({
-        // Each command must release its own attachment when its process ends.
-        freshProcess: true,
         arguments: ["inspect-artifact", image, "--json"],
       });
       expect(busy.exitCode, busy.stdout).toBe(1);
@@ -117,7 +115,6 @@ cliTest.skipIf(process.platform !== "darwin")(
     }
     expect(await mountedDevices()).toEqual([]);
     const control = await cli.run({
-      freshProcess: true,
       arguments: ["inspect-artifact", image, "--json"],
     });
     expect(control.exitCode, control.stdout).toBe(0);

tests/acceptance/browser/browserScenarioLaunchFailure.test.ts

@@ -39,7 +39,6 @@ cliTest.skipIf(process.platform === "win32")(
           "--json",
         ],
         environment: { BROWSER_FIXTURE_SECRET: secret },
-        timeoutMs: 20_000,
       });
       expect(response.exitCode, response.stdout + response.stderr).toBe(1);
       expect(response.stdout).not.toContain(secret);

tests/acceptance/browser/webBundleContainmentCli.test.ts

@@ -47,7 +47,6 @@ cliTest(
           "--total-analysis-timeout-ms",
           "1",
         ],
-        timeoutMs: 30_000,
       });
       expect(
         interrupted.exitCode,
@@ -74,7 +73,6 @@ cliTest(
 
       const recovered = await cli.run({
         arguments: baseArguments,
-        timeoutMs: 30_000,
       });
       expect(recovered.exitCode, recovered.stdout + recovered.stderr).toBe(0);
       expect(recovered.json).toMatchObject({

tests/acceptance/browserScenarioReferenceDiagnostics.test.ts

@@ -46,7 +46,6 @@ cliTest.for([
       const result = await cli.run({
         arguments: ["capture-browser-scenario", path, "--json"],
         environment: { HOME: home, REA_LOG_LEVEL: "silent" },
-        timeoutMs: 30_000,
       });
       expect(result.exitCode).toBe(1);
       expect(result.json).toMatchObject(expected);

tests/acceptance/cliBuiltinDocumentTokens.test.ts

@@ -2,6 +2,7 @@ import { estimateTokenCount } from "tokenx";
 import { expect } from "vitest";
 
 import { workspaceCliTest } from "../support/cli/workspaceCliFixture.js";
+import { runFileCli } from "../support/cli/cliFixture.js";
 
 workspaceCliTest(
   "applies token controls to SDK manifest and schema documents",
@@ -11,15 +12,12 @@ workspaceCliTest(
       const freshTokenCount = arguments_.join(" ") === "--llms --token-count";
       const freshTokenLimit =
         arguments_.join(" ") === "--llms-full --token-limit 1";
-      const result = await cli.run({
-        ...invocation,
-        freshProcess: !(
-          !freshTokenCount &&
-          !freshTokenLimit &&
-          (arguments_.includes("--token-count") ||
-            arguments_.includes("--token-limit"))
-        ),
-      });
+      const result = await (!freshTokenCount &&
+      !freshTokenLimit &&
+      (arguments_.includes("--token-count") ||
+        arguments_.includes("--token-limit"))
+        ? runFileCli(cli, invocation)
+        : cli.run(invocation));
       expect(result.exitCode, result.stderr).toBe(0);
       expect(result.stderr).toBe("");
       return result.stdout;

tests/acceptance/elfNoteCoreProfile.test.ts

@@ -36,7 +36,7 @@ cliTest.for([
     bytes[8] = version;
     await writeFile(path, bytes);
     const hash = createHash("sha256").update(bytes).digest("hex");
-    const output = await cli.run({
+    const output = await cli.sharedCliRun!({
       arguments: ["inspect-elf-notes", path, "--json"],
     });
     expect(output.exitCode, output.stderr).toBe(0);

tests/acceptance/elfNotesAbiEndian.test.ts

@@ -51,7 +51,7 @@ for (const { bits, ownership, machine } of [
       });
       await writeFile(path, bytes);
 
-      const output = await cli.run({
+      const output = await cli.sharedCliRun!({
         arguments: ["inspect-elf-notes", path, "--json"],
       });
       expect(output.exitCode, output.stderr).toBe(0);

tests/acceptance/elfNotesAndroid.test.ts

@@ -65,7 +65,7 @@ for (const target of [
         }),
       );
 
-      const cliOut = await cli.run({
+      const cliOut = await cli.sharedCliRun!({
         arguments: ["inspect-elf-notes", path, "--json"],
       });
       expect(cliOut.exitCode, cliOut.stderr).toBe(0);

tests/acceptance/elfNotesCore.test.ts

@@ -152,7 +152,7 @@ cliTest(
     });
     await writeFile(path, bytes);
 
-    const output = await cli.run({
+    const output = await cli.sharedCliRun!({
       arguments: ["inspect-elf-notes", path, "--json"],
     });
     expect(output.exitCode, output.stderr).toBe(0);

tests/acceptance/goBinaryCli.test.ts

@@ -21,7 +21,7 @@ import {
 } from "../fixtures/go/image.js";
 import { createGoRodataStringFixture } from "../fixtures/go/rodataStringImage.js";
 import { createTestTempDirectory } from "../fixtures/temporaryDirectory.js";
-import { cliTest } from "../support/cli/cliFixture.js";
+import { cliTest, runFileCli } from "../support/cli/cliFixture.js";
 import { parseEvidence } from "../../src/domain/evidence.js";
 import { connectLocalToolsMcp } from "../fixtures/localToolsMcp.js";
 import { expectCliMcpEvidenceParity } from "../fixtures/cliMcpEvidenceParity.js";
@@ -47,7 +47,7 @@ cliTest(
     ] as const) {
       const path = join(root, `${item.name}.macho`);
       await writeFile(path, item.bytes);
-      const result = await cli.run({
+      const result = await runFileCli(cli, {
         arguments: ["inspect-go-binary", path, "--json"],
       });
       const response = await call("inspect_go_binary", { path });
@@ -130,7 +130,7 @@ cliTest(
         );
       const path = join(root, `${item.name}.elf`);
       await writeFile(path, item.fixture.bytes);
-      const result = await cli.run({
+      const result = await runFileCli(cli, {
         arguments: ["inspect-go-binary", path, "--json"],
       });
       const response = await call("inspect_go_binary", { path });
@@ -199,12 +199,12 @@ cliTest(
     const path = join(root, "application.elf");
     const output = join(root, "source.json");
     await writeFile(path, createGoBinaryFixture().bytes);
-    const complete = await cli.run({
+    const complete = await runFileCli(cli, {
       arguments: ["inspect-go-binary", path, "--json"],
     });
     expect(complete.exitCode, complete.stderr).toBe(0);
     const full = evidenceResultOf(goBinarySchema).parse(complete.json);
-    const summary = await cli.run({
+    const summary = await runFileCli(cli, {
       arguments: [
         "inspect-go-binary",
         path,
@@ -233,7 +233,7 @@ cliTest(
         .map((record) => parseEvidence(record))
         .find((record) => record.evidence_id === full.evidence_id),
     ).toEqual(full);
-    const refused = await cli.run({
+    const refused = await runFileCli(cli, {
       arguments: [
         "inspect-go-binary",
         join(root, "missing"),
@@ -256,7 +256,7 @@ cliTest(
     const root = await createTestTempDirectory("rea-go-overlap-");
     const path = join(root, "overlapping.elf");
     await writeFile(path, createGoOverlappingElfFixture());
-    const result = await cli.run({
+    const result = await runFileCli(cli, {
       arguments: ["inspect-go-binary", path, "--json"],
     });
     expect(result.exitCode).toBe(1);
@@ -289,7 +289,7 @@ cliTest(
       const fixture = createGoSplitElfFixture({ sectionless });
       const path = join(root, sectionless ? "sectionless.elf" : "original.elf");
       await writeFile(path, fixture.bytes);
-      const result = await cli.run({
+      const result = await runFileCli(cli, {
         arguments: ["inspect-go-binary", path, "--json"],
       });
       expect(result.exitCode, result.stderr).toBe(0);
@@ -324,7 +324,7 @@ for (const bits of [32, 64] as const) {
         ] as const) {
           const path = join(root, `${label}.exe`);
           await writeFile(path, bytes);
-          const result = await cli.run({
+          const result = await runFileCli(cli, {
             arguments: ["inspect-go-binary", path, "--json"],
           });
           expect(result.exitCode, result.stderr).toBe(0);
@@ -379,7 +379,7 @@ cliTest(
         path,
         machoImageWithUnknownCommand(fixture.wide, fixture.size),
       );
-      const result = await cli.run({
+      const result = await runFileCli(cli, {
         arguments: ["inspect-go-binary", path, "--json"],
       });
       const response = await call("inspect_go_binary", { path });
@@ -418,7 +418,7 @@ for (const expectedErrno of ["ELOOP", "ENAMETOOLONG"] as const) {
         root,
         expectedErrno,
       );
-      const result = await cli.run({
+      const result = await runFileCli(cli, {
         arguments: ["inspect-go-binary", path, "--json"],
       });
       expect(result.exitCode).toBe(1);
@@ -449,7 +449,7 @@ cliTest(
     const path = join(root, "byte-strings.elf");
     const fixture = createGoBinaryByteStringFixture();
     await writeFile(path, fixture.bytes);
-    const result = await cli.run({
+    const result = await runFileCli(cli, {
       arguments: ["inspect-go-binary", path, "--json"],
     });
     expect(result.exitCode, result.stderr).toBe(0);
@@ -467,7 +467,7 @@ for (const fixture of createGoBinaryDiagnosticFixtures()) {
       const root = await createTestTempDirectory("rea-go-cli-mz-");
       const path = join(root, `${fixture.name}.exe`);
       await writeFile(path, fixture.bytes);
-      const result = await cli.run({
+      const result = await runFileCli(cli, {
         arguments: ["inspect-go-binary", path, "--json"],
       });
       expect(result.exitCode).toBe(1);
@@ -488,7 +488,7 @@ cliTest(
     const root = await createTestTempDirectory("rea-go-cli-");
     const path = join(root, "text.bin");
     await writeFile(path, "This is not an executable container.");
-    const result = await cli.run({
+    const result = await runFileCli(cli, {
       arguments: ["inspect-go-binary", path, "--json"],
     });
     expect(result.exitCode).toBe(1);
@@ -508,7 +508,7 @@ for (const format of ["elf", "pe", "macho"] as const) {
         const fixture = createGoBinaryFixture({ format, encoding });
         const path = join(root, "application.bin");
         await writeFile(path, fixture.bytes);
-        const result = await cli.run({
+        const result = await runFileCli(cli, {
           arguments: ["inspect-go-binary", "application.bin", "--json"],
           cwd: root,
         });
@@ -582,7 +582,7 @@ cliTest("preserves MIPS identity in Go CLI Evidence", async ({ cli }) => {
   fixture.bytes.writeUInt16LE(8, 18); // ELF EM_MIPS.
   const path = join(root, "application.elf");
   await writeFile(path, fixture.bytes);
-  const result = await cli.run({
+  const result = await runFileCli(cli, {
     arguments: ["inspect-go-binary", path, "--json"],
   });
   expect(result.exitCode, result.stderr).toBe(0);
@@ -601,7 +601,7 @@ cliTest(
     const root = await createTestTempDirectory("rea-go-cli-");
     const path = join(root, "metadata-free.elf");
     await writeFile(path, createGoBinaryFixture({ omitBuildInfo: true }).bytes);
-    const result = await cli.run({
+    const result = await runFileCli(cli, {
       arguments: ["inspect-go-binary", path, "--json"],
     });
     expect(result.exitCode).toBe(0);
@@ -625,7 +625,7 @@ cliTest(
     const root = await createTestTempDirectory("rea-go-gopath-cli-");
     const path = join(root, "application.elf");
     await writeFile(path, createGoBinaryFixture({ moduleText }).bytes);
-    const result = await cli.run({
+    const result = await runFileCli(cli, {
       arguments: ["inspect-go-binary", path, "--json"],
     });
     expect(result.exitCode, result.stderr).toBe(0);
@@ -662,7 +662,7 @@ cliTest(
     });
     await writeFile(path, fixture.bytes);
 
-    const standaloneCap = await cli.run({
+    const standaloneCap = await runFileCli(cli, {
       arguments: [
         "inspect-go-binary",
         path,
@@ -680,7 +680,7 @@ cliTest(
       },
     });
 
-    const cliResult = await cli.run({
+    const cliResult = await runFileCli(cli, {
       arguments: [
         "inspect-go-binary",
         path,

tests/acceptance/goBinaryP32PointerCli.test.ts

@@ -5,7 +5,7 @@ import { evidenceResultOf } from "../../src/contracts/toolOutputSchemaPrimitives
 import { goBinarySchema } from "../../src/domain/go/goBinary.js";
 import { createGoBinaryFixture, GO_MODULE_TEXT } from "../fixtures/go/image.js";
 import { createTestTempDirectory } from "../fixtures/temporaryDirectory.js";
-import { cliTest } from "../support/cli/cliFixture.js";
+import { cliTest, runFileCli } from "../support/cli/cliFixture.js";
 
 cliTest(
   "inspects ELF64 Go metadata with four-byte amd64p32 pointers through CLI",
@@ -20,7 +20,7 @@ cliTest(
     });
     const path = join(root, "nacl-amd64p32.nexe");
     await writeFile(path, fixture.bytes);
-    const result = await cli.run({
+    const result = await runFileCli(cli, {
       arguments: ["inspect-go-binary", path, "--json"],
     });
 

tests/acceptance/goBinaryPointerMappingsCli.test.ts

@@ -12,7 +12,7 @@ import { connectLocalToolsMcp } from "../fixtures/localToolsMcp.js";
 import { expectCliMcpEvidenceParity } from "../fixtures/cliMcpEvidenceParity.js";
 import { parseMcpToolError } from "../fixtures/mcpToolError.js";
 import { createTestTempDirectory } from "../fixtures/temporaryDirectory.js";
-import { cliTest } from "../support/cli/cliFixture.js";
+import { cliTest, runFileCli } from "../support/cli/cliFixture.js";
 
 cliTest(
   "retains header-backed PE and cross-load ELF pointer metadata through CLI and MCP",
@@ -34,7 +34,7 @@ cliTest(
     for (const { name, fixture } of cases) {
       const path = join(root, name);
       await writeFile(path, fixture.bytes);
-      const result = await cli.run({
+      const result = await runFileCli(cli, {
         arguments: ["inspect-go-binary", path, "--json"],
       });
       expect(result.exitCode, result.stderr).toBe(0);
@@ -64,7 +64,7 @@ cliTest(
     damaged.bytes.writeBigUInt64LE(0x11001n, 200); // A one-byte virtual gap.
     const path = join(root, "elf-cross-load-gap");
     await writeFile(path, damaged.bytes);
-    const rejected = await cli.run({
+    const rejected = await runFileCli(cli, {
       arguments: ["inspect-go-binary", path, "--json"],
     });
     expect(rejected.exitCode).toBe(1);

tests/acceptance/gpuCodeObjectsCli.test.ts

@@ -13,7 +13,7 @@ import { parseEvidence, createEvidence } from "../../src/domain/evidence.js";
 import { createTestTempDirectory } from "../fixtures/temporaryDirectory.js";
 import { connectLocalToolsMcp } from "../fixtures/localToolsMcp.js";
 import { parseMcpToolError } from "../fixtures/mcpToolError.js";
-import { cliTest } from "../support/cli/cliFixture.js";
+import { cliTest, runFileCli } from "../support/cli/cliFixture.js";
 import {
   cudaFixture,
   peGpuFixture,
@@ -38,7 +38,7 @@ cliTest(
     ] as const) {
       const path = join(root, name);
       await writeFile(path, bytes);
-      const response = await cli.run({
+      const response = await runFileCli(cli, {
         arguments: [
           "inspect-gpu-code-objects",
           path,
@@ -76,7 +76,7 @@ cliTest(
     const bytes = cubinFixture({ name: "k".repeat(65_536) });
     const path = join(root, "long-symbol.cubin");
     await writeFile(path, bytes);
-    const response = await cli.run({
+    const response = await runFileCli(cli, {
       arguments: [
         "inspect-gpu-code-objects",
         path,
@@ -124,7 +124,7 @@ cliTest(
       const bytes = Buffer.concat([header, compressed]),
         path = join(root, `v${version}`);
       await writeFile(path, bytes);
-      const response = await cli.run({
+      const response = await runFileCli(cli, {
         arguments: [
           "inspect-gpu-code-objects",
           path,
@@ -183,7 +183,7 @@ cliTest(
       const bytes = hipFixture(payload, bundleId),
         path = join(root, name);
       await writeFile(path, bytes);
-      const response = await cli.run({
+      const response = await runFileCli(cli, {
         arguments: [
           "inspect-gpu-code-objects",
           path,
@@ -233,7 +233,7 @@ cliTest(
     }
     const path = join(root, "raw-bitcode");
     await writeFile(path, bitcode);
-    const raw = await cli.run({
+    const raw = await runFileCli(cli, {
       arguments: [
         "inspect-gpu-code-objects",
         path,
@@ -271,7 +271,7 @@ cliTest(
         ]),
         path = join(root, name);
       await writeFile(path, bytes);
-      const response = await cli.run({
+      const response = await runFileCli(cli, {
         arguments: [
           "inspect-gpu-code-objects",
           path,
@@ -355,7 +355,7 @@ cliTest(
         ]),
         path = join(root, name);
       await writeFile(path, bytes);
-      const response = await cli.run({
+      const response = await runFileCli(cli, {
         arguments: [
           "inspect-gpu-code-objects",
           path,
@@ -396,7 +396,7 @@ cliTest(
       ]),
       path = join(root, "large-parameter.cubin");
     await writeFile(path, bytes);
-    const response = await cli.run({
+    const response = await runFileCli(cli, {
       arguments: [
         "inspect-gpu-code-objects",
         path,
@@ -433,7 +433,7 @@ cliTest(
     const bytes = hipFixture(payload, "hip-amdgcn-amd-amdhsa--gfx906+xnack"),
       path = join(root, "feature.bundle");
     await writeFile(path, bytes);
-    const response = await cli.run({
+    const response = await runFileCli(cli, {
       arguments: [
         "inspect-gpu-code-objects",
         path,
@@ -478,7 +478,7 @@ cliTest(
       root = await createTestTempDirectory("rea-ptx-callprototype-"),
       path = join(root, "prototype.ptx");
     await writeFile(path, source);
-    const response = await cli.run({
+    const response = await runFileCli(cli, {
       arguments: [
         "inspect-gpu-code-objects",
         path,
@@ -528,7 +528,7 @@ cliTest(
     const bytes = cubinFixture({ extendedSectionIndex: true });
     const path = join(root, "extended.cubin");
     await writeFile(path, bytes);
-    const response = await cli.run({
+    const response = await runFileCli(cli, {
       arguments: [
         "inspect-gpu-code-objects",
         path,
@@ -576,7 +576,7 @@ cliTest(
     malformedBytes.writeBigUInt64LE(4n, sectionTable + indexTable! * 64 + 32);
     const malformedPath = join(root, "short-shndx.cubin");
     await writeFile(malformedPath, malformedBytes);
-    const malformed = await cli.run({
+    const malformed = await runFileCli(cli, {
       arguments: [
         "inspect-gpu-code-objects",
         malformedPath,
@@ -607,7 +607,7 @@ cliTest(
       const text = `.version 7.0\n.target sm_80\n.address_size 64\n.visible .entry kernel() {\n.reg .b32 ${register};\nmov.u32 ${register}, 0;\nret;\n}\n`;
       const path = join(root, `${register.slice(1)}.ptx`);
       await writeFile(path, text);
-      const response = await cli.run({
+      const response = await runFileCli(cli, {
         arguments: [
           "inspect-gpu-code-objects",
           path,
@@ -644,7 +644,7 @@ cliTest(
     const text = `.version 8.8\n.target sm_80\n.address_size 64\n.entry %kernel(.param .u32 input) {\nret;\n}\n`;
     const path = join(root, "identifiers.ptx");
     await writeFile(path, text);
-    const response = await cli.run({
+    const response = await runFileCli(cli, {
       arguments: [
         "inspect-gpu-code-objects",
         path,
@@ -707,7 +707,7 @@ cliTest(
       const text = `${preamble}${declaration}\n`,
         path = join(root, `${name}.ptx`);
       await writeFile(path, text);
-      const response = await cli.run({
+      const response = await runFileCli(cli, {
         arguments: [
           "inspect-gpu-code-objects",
           path,
@@ -757,7 +757,7 @@ cliTest(
     const text = `.version 8.8\n.target compute_80\n.address_size 64\n.entry kernel() {\nret;\n}\n`;
     const path = join(root, "target.ptx");
     await writeFile(path, text);
-    const response = await cli.run({
+    const response = await runFileCli(cli, {
       arguments: [
         "inspect-gpu-code-objects",
         path,
@@ -787,7 +787,7 @@ cliTest(
     const text = `.version 1.3\n.target sm_80\n.address_size 64\n.entry kernel {\n.param .u32 input;\nret;\n}\n`;
     const path = join(root, "legacy.ptx");
     await writeFile(path, text);
-    const response = await cli.run({
+    const response = await runFileCli(cli, {
       arguments: [
         "inspect-gpu-code-objects",
         path,
@@ -826,7 +826,7 @@ cliTest(
       malformedPath,
       `.version 1.3\n.target sm_80\n.entry kernel {\n.param .u32 input\n`,
     );
-    const malformed = await cli.run({
+    const malformed = await runFileCli(cli, {
       arguments: [
         "inspect-gpu-code-objects",
         malformedPath,
@@ -853,7 +853,7 @@ cliTest(
   "attributes malformed selector JSON to its actual CLI option",
   async ({ cli }) => {
     for (const name of ["object_ids", "targets", "view"]) {
-      const response = await cli.run({
+      const response = await runFileCli(cli, {
         arguments: [
           "inspect-gpu-code-objects",
           "/not-opened-for-invalid-selectors",
@@ -893,7 +893,7 @@ cliTest(
       },
     });
     // PowerShell's Get-FileHash prints the digest in upper case.
-    const response = await cli.run({
+    const response = await runFileCli(cli, {
       arguments: [
         "inspect-gpu-code-objects",
         "/not-opened-for-invalid-selectors",
@@ -1339,7 +1339,7 @@ cliTest(
     ] as const) {
       const path = join(root, name);
       await writeFile(path, bytes);
-      const response = await cli.run({
+      const response = await runFileCli(cli, {
         arguments: [
           "inspect-gpu-code-objects",
           path,

tests/acceptance/il2cppMetadataCli.test.ts

@@ -44,7 +44,7 @@ import {
 import { connectLocalToolsMcp } from "../fixtures/localToolsMcp.js";
 import { parseMcpToolError } from "../fixtures/mcpToolError.js";
 import { createTestTempDirectory } from "../fixtures/temporaryDirectory.js";
-import { cliTest } from "../support/cli/cliFixture.js";
+import { cliTest, runFileCli } from "../support/cli/cliFixture.js";
 
 const parseCliMetadata = (value: unknown) =>
   il2cppMetadataSchema.parse(
@@ -75,7 +75,7 @@ cliTest(
     }
     strings.copy(bytes, 500);
     await writeFile(path, bytes);
-    const result = await cli.run({
+    const result = await runFileCli(cli, {
       arguments: ["inspect-il2cpp-metadata", path, "--json"],
     });
     expect(result.exitCode).toBe(1);
@@ -122,7 +122,7 @@ cliTest(
       createLinkedIl2cppMetadataFixture({ version: 39 }).bytes,
     );
     await writeFile(binaryPath, createIl2cppBinaryFixture());
-    const produced = await cli.run({
+    const produced = await runFileCli(cli, {
       arguments: [
         "inspect-il2cpp-metadata",
         path,
@@ -161,7 +161,7 @@ cliTest(
       };
       const query = join(root, `image-${image}.json`);
       await writeFile(query, JSON.stringify(request));
-      const result = await cli.run({
+      const result = await runFileCli(cli, {
         arguments: ["inspect-analysis-view", query, "--json"],
       });
       const mcp = await call("inspect_analysis_view", request);
@@ -222,7 +222,7 @@ cliTest(
       };
       const query = join(root, `${scenario}.json`);
       await writeFile(query, JSON.stringify(request));
-      const cliResult = await cli.run({
+      const cliResult = await runFileCli(cli, {
         arguments: ["inspect-analysis-view", query, "--json"],
       });
       const mcp = await call("inspect_analysis_view", request);
@@ -249,7 +249,7 @@ cliTest(
       });
       const path = join(root, `valid-${count}.dat`);
       await writeFile(path, bytes);
-      const output = await cli.run({
+      const output = await runFileCli(cli, {
         arguments: ["inspect-il2cpp-metadata", path, "--json"],
       });
       expect(output.exitCode, output.stderr).toBe(0);
@@ -282,7 +282,7 @@ cliTest(
       );
       const path = join(root, `invalid-${declaredCount}-${declaredBytes}.dat`);
       await writeFile(path, fixture.bytes);
-      const output = await cli.run({
+      const output = await runFileCli(cli, {
         arguments: ["inspect-il2cpp-metadata", path, "--json"],
       });
       expect(output.exitCode).toBe(1);
@@ -321,7 +321,7 @@ cliTest(
       propertiesAndEvents: true,
     });
     await writeFile(path, bytes);
-    const result = await cli.run({
+    const result = await runFileCli(cli, {
       arguments: ["inspect-il2cpp-metadata", path, "--json"],
     });
     expect(result.exitCode, result.stderr).toBe(0);
@@ -472,7 +472,7 @@ cliTest(
     ] as const) {
       const path = join(root, name);
       await writeFile(path, bytes);
-      const result = await cli.run({
+      const result = await runFileCli(cli, {
         arguments: ["inspect-il2cpp-metadata", path, "--json"],
       });
       expect(result.exitCode).toBe(1);
@@ -521,7 +521,7 @@ cliTest(
           },
         },
       };
-      const result = await cli.run({
+      const result = await runFileCli(cli, {
         arguments: ["inspect-il2cpp-metadata", path, "--json"],
       });
       expect(result.exitCode).toBe(1);
@@ -828,7 +828,7 @@ cliTest(
     const root = await createTestTempDirectory("rea-il2cpp-cli-export-");
     const path = join(root, "global-metadata.dat");
     const bundle = join(root, "evidence.json");
-    const refused = await cli.run({
+    const refused = await runFileCli(cli, {
       arguments: [
         "inspect-il2cpp-metadata",
         join(root, "must-not-be-read"),
@@ -852,14 +852,14 @@ cliTest(
       bundle,
       "--json",
     ];
-    const result = await cli.run({ arguments: args });
+    const result = await runFileCli(cli, { arguments: args });
     expect(result.exitCode, result.stderr).toBe(0);
     expect(result.json).toMatchObject({
       evidence_bundle: { path: bundle, bytes: expect.any(Number) },
       summary: { normalized_result: { kind: "summary" } },
     });
     const before = await readFile(bundle);
-    const overwrite = await cli.run({ arguments: args });
+    const overwrite = await runFileCli(cli, { arguments: args });
     expect(overwrite.exitCode).toBe(1);
     expect(Buffer.compare(await readFile(bundle), before)).toBe(0);
     const saved = await readEvidenceBundle(bundle);
@@ -887,7 +887,7 @@ cliTest(
         },
       }),
     );
-    const selected = await cli.run({
+    const selected = await runFileCli(cli, {
       arguments: ["inspect-analysis-view", query, "--json"],
     });
     expect(selected.exitCode, selected.stderr).toBe(0);
@@ -913,7 +913,7 @@ cliTest.skipIf(process.platform === "win32")(
     const decoy = join(root, "evidence.json");
     await writeFile(decoy, "unrelated caller data");
     const selected = `${root}/link/../evidence.json`;
-    const result = await cli.run({
+    const result = await runFileCli(cli, {
       arguments: [
         "inspect-il2cpp-metadata",
         path,
@@ -932,7 +932,7 @@ cliTest.skipIf(process.platform === "win32")(
     expect(
       JSON.parse(await readFile(join(actual, "evidence.json"), "utf8")),
     ).toEqual(saved.value);
-    const read = await cli.run({
+    const read = await runFileCli(cli, {
       arguments: [
         "inspect-evidence-bundle",
         JSON.stringify({ path: selected, detail: "summary" }),
@@ -966,7 +966,7 @@ cliTest(
             rva: `0x${(address - FIXTURE_BINARY_BASE).toString(16)}`,
           },
     );
-    const result = await cli.run({
+    const result = await runFileCli(cli, {
       arguments: [
         "inspect-il2cpp-metadata",
         path,
@@ -1044,7 +1044,7 @@ cliTest(
     await writeFile(path, createLinkedIl2cppMetadataFixture().bytes);
     await writeFile(binaryPath, createIl2cppDyldBindFixture(0n));
 
-    const result = await cli.run({
+    const result = await runFileCli(cli, {
       arguments: [
         "inspect-il2cpp-metadata",
         path,
@@ -1089,7 +1089,7 @@ cliTest(
     await writeFile(path, createLinkedIl2cppMetadataFixture().bytes);
     const inspect = async (bytes: Buffer) => {
       await writeFile(binaryPath, bytes);
-      const output = await cli.run({
+      const output = await runFileCli(cli, {
         arguments: [
           "inspect-il2cpp-metadata",
           path,
@@ -1162,7 +1162,7 @@ cliTest(
       bytes.fill(0xff, 0x604, 0x608);
       const binaryPath = join(root, `registration-${tailBytes}.dylib`);
       await writeFile(binaryPath, bytes);
-      const output = await cli.run({
+      const output = await runFileCli(cli, {
         arguments: [
           "inspect-il2cpp-metadata",
           path,
@@ -1252,7 +1252,7 @@ cliTest(
       const binaryPath = join(root, `${entry.name}.dylib`);
       await writeFile(path, entry.metadata.bytes);
       await writeFile(binaryPath, entry.binary);
-      const cliResult = await cli.run({
+      const cliResult = await runFileCli(cli, {
         arguments: [
           "inspect-il2cpp-metadata",
           path,
@@ -1307,7 +1307,7 @@ cliTest(
         { machine: 62 },
       ),
     );
-    const result = await cli.run({
+    const result = await runFileCli(cli, {
       arguments: [
         "inspect-il2cpp-metadata",
         path,
@@ -1338,7 +1338,7 @@ cliTest(
     await writeFile(path, createLinkedIl2cppMetadataFixture().bytes);
     await writeFile(binaryPath, createElfFixture(createIl2cppBinaryFixture()));
     const run = (output: string, extra: readonly string[] = []) =>
-      cli.run({
+      runFileCli(cli, {
         arguments: [
           "inspect-il2cpp-metadata",
           path,
@@ -1393,7 +1393,7 @@ cliTest(
     });
     expect(await readFile(seeds, "utf8")).toBe("kept\n");
 
-    const unlinked = await cli.run({
+    const unlinked = await runFileCli(cli, {
       arguments: [
         "inspect-il2cpp-metadata",
         path,
@@ -1432,7 +1432,7 @@ cliTest(
       binaryPath,
       createElfFixture(createIl2cppBinaryFixture({ genericMethods: {} })),
     );
-    const linked = await cli.run({
+    const linked = await runFileCli(cli, {
       arguments: [
         "inspect-il2cpp-metadata",
         path,
@@ -1458,7 +1458,7 @@ cliTest(
       ].join("\n"),
     );
 
-    const unlinked = await cli.run({
+    const unlinked = await runFileCli(cli, {
       arguments: [
         "inspect-il2cpp-metadata",
         path,
@@ -1508,7 +1508,7 @@ cliTest(
 
     const inspect = async (binary: Buffer) => {
       await writeFile(binaryPath, binary);
-      const result = await cli.run({
+      const result = await runFileCli(cli, {
         arguments: [
           "inspect-il2cpp-metadata",
           path,
@@ -1551,7 +1551,7 @@ cliTest.skipIf(process.platform === "win32")(
     await writeFile(path, createLinkedIl2cppMetadataFixture().bytes);
     await writeFile(binaryPath, createElfFixture(createIl2cppBinaryFixture()));
     await writeFile(parent, "unchanged");
-    const result = await cli.run({
+    const result = await runFileCli(cli, {
       arguments: [
         "inspect-il2cpp-metadata",
         path,

tests/acceptance/il2cppStructuralExtentsCli.test.ts

@@ -5,7 +5,7 @@ import { createIl2cppMetadataFixture } from "../fixtures/il2cpp/metadata.js";
 import { connectLocalToolsMcp } from "../fixtures/localToolsMcp.js";
 import { parseMcpToolError } from "../fixtures/mcpToolError.js";
 import { createTestTempDirectory } from "../fixtures/temporaryDirectory.js";
-import { cliTest } from "../support/cli/cliFixture.js";
+import { cliTest, runFileCli } from "../support/cli/cliFixture.js";
 
 cliTest(
   "rejects partial IL2CPP table extents through CLI and MCP without a binary",
@@ -24,7 +24,7 @@ cliTest(
       });
       const path = join(root, `${version}-${name}.dat`);
       await writeFile(path, fixture.bytes);
-      const intact = await cli.run({
+      const intact = await runFileCli(cli, {
         arguments: ["inspect-il2cpp-metadata", path, "--json"],
       });
       expect(intact.exitCode, intact.stderr).toBe(0);
@@ -35,7 +35,7 @@ cliTest(
         fixture.header(name, "size"),
       );
       await writeFile(path, damaged);
-      const invalid = await cli.run({
+      const invalid = await runFileCli(cli, {
         arguments: ["inspect-il2cpp-metadata", path, "--json"],
       });
       const expected = {

tests/acceptance/javascriptAsyncChunkBudget.test.ts

@@ -30,7 +30,6 @@ cliTest(
         "30000",
         "--json",
       ],
-      timeoutMs: 55_000,
     });
     // Analysis retains the interrupted file rather than failing the command.
     expect(response.exitCode, `${response.stdout}\n${response.stderr}`).toBe(0);

tests/acceptance/javascriptRouteBudgetRecovery.test.ts

@@ -29,7 +29,6 @@ cliTest(
         }),
         "--json",
       ],
-      timeoutMs: 60_000,
     });
     expect(unpublished.exitCode, unpublished.stderr).toBe(1);
     expect(unpublished.json).toMatchObject({
@@ -60,7 +59,6 @@ cliTest(
         bundle,
         "--json",
       ],
-      timeoutMs: 60_000,
     });
     expect(analyzed.exitCode, analyzed.stderr).toBe(0);
     const request = (fields?: readonly string[]) =>

tests/acceptance/localPathAdmissionCli.test.ts

@@ -6,7 +6,7 @@ import { expect } from "vitest";
 import { parseEvidence } from "../../src/domain/evidence.js";
 import { pythonPycFixture } from "../../src/python/PythonPyc.fixture.js";
 import { createTestTempDirectory } from "../fixtures/temporaryDirectory.js";
-import { cliTest } from "../support/cli/cliFixture.js";
+import { cliTest, runFileCli } from "../support/cli/cliFixture.js";
 
 const fileCommands = [
   "inspect-sqlite-database",
@@ -51,7 +51,7 @@ cliTest(
       },
     ];
     for (const selection of selections) {
-      const result = await cli.run({
+      const result = await runFileCli(cli, {
         arguments: [...selection.arguments, "--json"],
         cwd,
       });
@@ -161,7 +161,7 @@ cliTest(
       },
     ];
     for (const selection of selections) {
-      const result = await cli.run({
+      const result = await runFileCli(cli, {
         arguments: [...selection.arguments, "--json"],
         cwd,
       });
@@ -183,7 +183,7 @@ cliTest(
     const bytes = pythonPycFixture();
     const path = join(cwd, "selected.pyc");
     await writeFile(path, bytes);
-    const result = await cli.run({
+    const result = await runFileCli(cli, {
       arguments: ["inspect-python-pyc", "./selected.pyc", "--json"],
       cwd,
     });

tests/acceptance/managedCliOutput.test.ts

@@ -7,7 +7,7 @@ import { expect } from "vitest";
 import { elf, thinMach } from "../../src/domain/binaryTarget.fixture.js";
 import { buildManagedPeFixture } from "../../src/dotnet/ManagedPe.fixture.js";
 import { createTestTempDirectory } from "../fixtures/temporaryDirectory.js";
-import { cliTest } from "../support/cli/cliFixture.js";
+import { cliTest, runFileCli } from "../support/cli/cliFixture.js";
 
 cliTest(
   "recovers the same managed artifact through decimal CLI budgets and retains caller choices",
@@ -157,7 +157,7 @@ cliTest(
           ilBody: Buffer.concat([Buffer.from([(il.length << 2) | 2]), il]),
         }),
       );
-      const result = await cli.run({
+      const result = await runFileCli(cli, {
         arguments: ["inspect-managed-members", path, "--json"],
       });
       expect(result.exitCode, result.stderr).toBe(0);
@@ -546,7 +546,7 @@ cliTest(
       });
       const path = join(root, `virtual-${virtualSectionSize}.dll`);
       await writeFile(path, bytes);
-      const result = await cli.run({
+      const result = await runFileCli(cli, {
         arguments: ["inspect-managed-members", path, "--json"],
       });
       expect(result.exitCode).toBe(0);
@@ -647,7 +647,7 @@ cliTest(
       "inspect-managed-members",
       "inspect-managed-native-boundaries",
     ]) {
-      const result = await cli.run({
+      const result = await runFileCli(cli, {
         arguments: [command, path, "--json"],
       });
       expect(result.exitCode).toBe(1);
@@ -682,7 +682,7 @@ cliTest(
         "inspect-managed-members",
         "inspect-managed-native-boundaries",
       ]) {
-        const result = await cli.run({
+        const result = await runFileCli(cli, {
           arguments: [command, path, "--json"],
         });
         expect(result.exitCode).not.toBe(0);

tests/acceptance/managedMetadataDelta.test.ts

@@ -37,7 +37,7 @@ cliTest(
         ],
       ] as const) {
         const selected = operation === "inspect_managed_members";
-        const output = await cli.run({
+        const output = await cli.sharedCliRun!({
           arguments: [
             command,
             path,

tests/acceptance/managedSelectedScope.test.ts

@@ -27,7 +27,7 @@ cliTest(
       ["Inner", "Fixture.Inner"],
       ["Fixture.Inner"],
     ]) {
-      const output = await cli.run({
+      const output = await cli.sharedCliRun!({
         arguments: [
           "inspect-managed-members",
           path,
@@ -99,7 +99,7 @@ cliTest(
       const sha256 = createHash("sha256").update(content).digest("hex");
       await writeFile(path, content);
       for (const isSelected of [true, false]) {
-        const output = await cli.run({
+        const output = await cli.sharedCliRun!({
           arguments: [
             "inspect-managed-members",
             path,

tests/acceptance/modelArtifactCli.test.ts

@@ -22,7 +22,11 @@ import {
   safetensorsFixture,
 } from "../fixtures/model/model.js";
 import { createTestTempDirectory } from "../fixtures/temporaryDirectory.js";
-import { cliTest, createSharedMcpSession } from "../support/cli/cliFixture.js";
+import {
+  cliTest,
+  createSharedMcpSession,
+  runFileCli,
+} from "../support/cli/cliFixture.js";
 
 // Model queries are target-free; share immutable registration and schema setup.
 // Portable export keeps its separate post-CLI connection below.
@@ -109,7 +113,7 @@ cliTest(
       });
       const bytes = Buffer.concat([fixture.bytes, Buffer.alloc(16)]);
       await writeFile(path, bytes);
-      const cliResult = await cli.run({
+      const cliResult = await runFileCli(cli, {
         arguments: [
           "inspect-model-artifact",
           path,
@@ -361,7 +365,7 @@ cliTest(
         tensors,
       });
       await writeFile(path, fixture.bytes);
-      const response = await cli.run({
+      const response = await runFileCli(cli, {
         arguments: [
           "inspect-model-artifact",
           path,
@@ -995,7 +999,7 @@ cliTest(
     ] as const) {
       const path = join(root, name);
       await writeFile(path, bytes);
-      const result = await cli.run({
+      const result = await runFileCli(cli, {
         arguments: [
           "inspect-model-artifact",
           path,
@@ -1043,7 +1047,7 @@ cliTest(
         Buffer.alloc(0),
       ).bytes,
     );
-    const mapCli = await cli.run({
+    const mapCli = await runFileCli(cli, {
       arguments: [
         "inspect-model-artifact",
         mapPath,
@@ -1080,7 +1084,7 @@ cliTest(
         safetensorsFixture(`{"__metadata__":${numeric}}`, Buffer.alloc(0))
           .bytes,
       );
-      const malformedCli = await cli.run({
+      const malformedCli = await runFileCli(cli, {
         arguments: ["inspect-model-artifact", malformedPath, "--json"],
       });
       expect(malformedCli.exitCode).toBe(1);

tests/acceptance/nonBinaryComposition.test.ts

@@ -66,7 +66,6 @@ for (const { jarConfigured, setting } of [
       const cliResult = await cli.run({
         arguments: ["inspect-android-package", apk, "--json"],
         environment,
-        timeoutMs: 10_000,
       });
       expect(cliResult.exitCode).toBe(1);
       expect(cliResult.json).toMatchObject({ code: "capability_unavailable" });
@@ -91,7 +90,6 @@ cliTest.skipIf(process.platform === "win32")(
       const cliResult = await cli.run({
         arguments: ["inspect-android-package", apk, "--json"],
         environment: { REA_LOG_LEVEL: "silent", ...environment },
-        timeoutMs: 10_000,
       });
       expect(cliResult.exitCode).toBe(1);
       const client = await connect({ REA_LOG_LEVEL: "silent", ...environment });
@@ -146,7 +144,6 @@ cliTest.skipIf(process.platform !== "linux")(
     const cliResult = await cli.run({
       arguments: ["inspect-firmware-regions", path, "--json"],
       environment,
-      timeoutMs: 10_000,
     });
     expect(cliResult.exitCode).toBe(1);
     expect(cliResult.json).toMatchObject({ code: "capability_unavailable" });
@@ -172,7 +169,6 @@ cliTest.skipIf(process.platform !== "linux")(
       arguments: ["inspect-firmware-regions", "input.bin", "--json"],
       cwd: root,
       environment: { REA_LOG_LEVEL: "silent" },
-      timeoutMs: 10_000,
     });
     // A relative path must pass input validation and reach the provider,
     // which reports the missing firmware engine — not a validation error.
@@ -199,7 +195,6 @@ cliTest(
         "--json",
       ],
       environment,
-      timeoutMs: 10000,
     });
     expect(cliResult.exitCode).toBe(1);
     expect(cliResult.json).toMatchObject({ code: "capability_unavailable" });
@@ -239,7 +234,6 @@ cliTest(
           "--json",
         ],
         environment,
-        timeoutMs: 10_000,
       });
       const response = await client.callTool({
         name: "recover_javascript_sources",

tests/acceptance/pcapCredentialErrorsCliMcp.test.ts

@@ -60,7 +60,6 @@ cliTest.skipIf(missingNative)(
     const success = await cli.run({
       arguments: ["inspect-pcap-capture", single, "--json"],
       environment: environmentFor(root),
-      timeoutMs: 60_000,
     });
     expect(success.exitCode, success.stderr).toBe(0);
     expect(success.stdout.includes(credential)).toBe(false);
@@ -78,7 +77,6 @@ cliTest.skipIf(missingNative)(
     const failed = await cli.run({
       arguments: ["inspect-pcap-capture", many, "--json"],
       environment: environmentFor(root),
-      timeoutMs: 60_000,
     });
     expect(failed.exitCode, failed.stderr).toBe(1);
     expect(failed.stdout.includes(credential)).toBe(false);

tests/acceptance/peCertificatesCli.test.ts

@@ -12,7 +12,7 @@ import {
 import { repeatedCertificateSignedData } from "../fixtures/peCertificateAllowance.js";
 import { parseMcpToolError } from "../fixtures/mcpToolError.js";
 import { createTestTempDirectory } from "../fixtures/temporaryDirectory.js";
-import { cliTest } from "../support/cli/cliFixture.js";
+import { cliTest, runFileCli } from "../support/cli/cliFixture.js";
 
 cliTest.for([0x00, 0x01, 0x7f, 0xfe, 0xff, null])(
   "requires canonical extension critical encoding %s through CLI and MCP",
@@ -41,7 +41,7 @@ cliTest.for([0x00, 0x01, 0x7f, 0xfe, 0xff, null])(
       }),
     );
     await writeFile(path, bytes);
-    const result = await cli.run({
+    const result = await runFileCli(cli, {
       arguments: ["inspect-pe-certificates", path, "--json"],
     });
     const call = await cli.sharedMcpCall!();
@@ -104,7 +104,7 @@ cliTest.for(["extra-field", "empty-rdn"] as const)(
     );
     const bytes = peCertificateFixture(false, payload);
     await writeFile(path, bytes);
-    const result = await cli.run({
+    const result = await runFileCli(cli, {
       arguments: ["inspect-pe-certificates", path, "--json"],
     });
     expect.soft(result.exitCode, result.stdout).toBe(1);
@@ -138,7 +138,7 @@ cliTest.for(["pubkey", "signature"])(
     expect(at).toBeGreaterThanOrEqual(0);
     payload[at + 2] = 1;
     await writeFile(path, peCertificateFixture(false, payload));
-    const invalid = await cli.run({
+    const invalid = await runFileCli(cli, {
       arguments: ["inspect-pe-certificates", path, "--json"],
     });
     expect(invalid.exitCode).toBe(1);
@@ -159,7 +159,7 @@ cliTest.for(["pubkey", "signature"])(
     const last = at + marker.length - 1;
     payload[last] = payload[last]! & 0xfe;
     await writeFile(path, peCertificateFixture(false, payload));
-    const valid = await cli.run({
+    const valid = await runFileCli(cli, {
       arguments: ["inspect-pe-certificates", path, "--json"],
     });
     expect(valid.exitCode, valid.stderr).toBe(0);
@@ -210,7 +210,7 @@ cliTest("reports unsigned attributes through CLI and MCP", async ({ cli }) => {
     [1, 3, 6, 1, 4, 1, 311, 3, 3, 1],
   ]);
   await writeFile(path, peCertificateFixture(true, payload));
-  const result = await cli.run({
+  const result = await runFileCli(cli, {
     arguments: ["inspect-pe-certificates", path, "--json"],
   });
   expect(result.exitCode, result.stderr).toBe(0);
@@ -239,7 +239,7 @@ cliTest(
     const payload = pkcs7SignedDataIndefiniteEnvelopeFixture();
     await writeFile(path, peCertificateFixture(false, payload));
 
-    const result = await cli.run({
+    const result = await runFileCli(cli, {
       arguments: ["inspect-pe-certificates", path, "--json"],
     });
 
@@ -297,7 +297,7 @@ cliTest("reports a truncated PE as invalid input", async ({ cli }) => {
   const root = await createTestTempDirectory("rea-pe-cert-cli-bad-");
   const path = join(root, "broken.exe");
   await writeFile(path, Buffer.from("MZ"));
-  const result = await cli.run({
+  const result = await runFileCli(cli, {
     arguments: ["inspect-pe-certificates", path, "--json"],
   });
   expect(result.exitCode).toBe(1);
@@ -318,7 +318,7 @@ cliTest(
     // Replace an equal-length UTF8String with T.61's acute accent plus 'e'.
     Buffer.from([0x14, 0x02, 0xc2, 0x65]).copy(payload, nameAt);
     await writeFile(path, peCertificateFixture(false, payload));
-    const result = await cli.run({
+    const result = await runFileCli(cli, {
       arguments: ["inspect-pe-certificates", path, "--json"],
     });
     expect(result.exitCode, result.stderr).toBe(0);
@@ -348,7 +348,7 @@ cliTest(
       payload.subarray(4),
     ]);
     await writeFile(path, peCertificateFixture(false, malformed));
-    const result = await cli.run({
+    const result = await runFileCli(cli, {
       arguments: ["inspect-pe-certificates", path, "--json"],
     });
     expect(result.exitCode).toBe(1);
@@ -372,7 +372,7 @@ cliTest(
     // Equal-size replacement keeps the DER lengths and all unrelated fields intact.
     Buffer.from([0x1e, 0x04, 0xd8, 0, 0xdc, 0]).copy(payload, nameAt);
     await writeFile(path, peCertificateFixture(false, payload));
-    const invalid = await cli.run({
+    const invalid = await runFileCli(cli, {
       arguments: ["inspect-pe-certificates", path, "--json"],
     });
     expect(invalid.exitCode).toBe(1);
@@ -382,7 +382,7 @@ cliTest(
     });
     Buffer.from([0x1e, 0x04, 0xd7, 0xff, 0xe0, 0]).copy(payload, nameAt);
     await writeFile(path, peCertificateFixture(false, payload));
-    const valid = await cli.run({
+    const valid = await runFileCli(cli, {
       arguments: ["inspect-pe-certificates", path, "--json"],
     });
     expect(valid.exitCode, valid.stderr).toBe(0);
@@ -407,7 +407,7 @@ cliTest(
     // 2025 has no 29 February; the equal-length edit keeps every DER length.
     payload.write("250229000000Z", timeAt, "ascii");
     await writeFile(path, peCertificateFixture(false, payload));
-    const invalid = await cli.run({
+    const invalid = await runFileCli(cli, {
       arguments: ["inspect-pe-certificates", path, "--json"],
     });
     expect(invalid.exitCode).toBe(1);
@@ -417,7 +417,7 @@ cliTest(
     });
     payload.write("240229000000Z", timeAt, "ascii");
     await writeFile(path, peCertificateFixture(false, payload));
-    const valid = await cli.run({
+    const valid = await runFileCli(cli, {
       arguments: ["inspect-pe-certificates", path, "--json"],
     });
     expect(valid.exitCode, valid.stderr).toBe(0);
@@ -521,7 +521,7 @@ cliTest.for([
     expect(at).toBeGreaterThanOrEqual(0);
     payload[at] = tag;
     await writeFile(path, peCertificateFixture(false, payload));
-    const invalid = await cli.run({
+    const invalid = await runFileCli(cli, {
       arguments: ["inspect-pe-certificates", path, "--json"],
     });
     expect(invalid.exitCode).toBe(1);
@@ -532,7 +532,7 @@ cliTest.for([
     // Only restore the string tag: the same bytes are valid UTF8String content.
     payload[at] = 0x0c;
     await writeFile(path, peCertificateFixture(false, payload));
-    const valid = await cli.run({
+    const valid = await runFileCli(cli, {
       arguments: ["inspect-pe-certificates", path, "--json"],
     });
     expect(valid.exitCode, valid.stderr).toBe(0);

tests/acceptance/peImportsCli.test.ts

@@ -14,7 +14,7 @@ import {
 } from "../fixtures/binaryDiagnostics/peImports.js";
 import { createTestTempDirectory } from "../fixtures/temporaryDirectory.js";
 import { parseMcpToolError } from "../fixtures/mcpToolError.js";
-import { cliTest } from "../support/cli/cliFixture.js";
+import { cliTest, runFileCli } from "../support/cli/cliFixture.js";
 
 for (const bits of [32, 64] as const) {
   cliTest(
@@ -263,10 +263,9 @@ cliTest(
       const invocation = {
         arguments: ["inspect-pe-imports", path, "--json"],
       };
-      const result = await cli.run({
-        ...invocation,
-        freshProcess: rva === 0xffffffec,
-      });
+      const result = await (rva === 0xffffffec
+        ? cli.run(invocation)
+        : runFileCli(cli, invocation));
       expect(result.exitCode, result.stderr).toBe(0);
       const report = toolContract("inspect_pe_imports").outputSchema.parse(
         result.json,

tests/acceptance/providers/hopperStartupRecovery.test.ts

@@ -132,7 +132,6 @@ test.for(["target", "loader"] as const)(
       const result = await cli.run({
         arguments: ["analyze", target, "--provider", "hopper", "--json"],
         environment,
-        timeoutMs: 15_000,
       });
       expect(result.exitCode).toBe(1);
       expect(result.json).toMatchObject({
@@ -223,7 +222,6 @@ test("recovers a denied Hopper launch through the same stdio MCP session and CLI
   const deniedCli = await cli.run({
     arguments: ["analyze", target, "--provider", "hopper", "--json"],
     environment,
-    timeoutMs: 15_000,
   });
   expect(deniedCli.exitCode).toBe(1);
   expect(deniedCli.json).toMatchObject({

tests/acceptance/pyinstallerArchive.test.ts

@@ -160,7 +160,6 @@ cliTest(
     const result = await driver.run({
       arguments: ["inspect-artifact", path, "--json"],
       environment: process.env,
-      timeoutMs: 15_000,
     });
     expect(result.exitCode, result.stderr).toBe(0);
     const inspection = artifactInspectionResultSchema.parse(
@@ -328,7 +327,6 @@ cliTest(
     const result = await driver.run({
       arguments: ["extract-artifact", path, "--json"],
       environment: process.env,
-      timeoutMs: 15_000,
     });
     expect(result.exitCode, result.stderr).toBe(0);
     const extraction = artifactExtractionResultSchema.parse(
@@ -392,7 +390,6 @@ cliTest(
     const result = await driver.run({
       arguments: ["inspect-artifact", path, "--json"],
       environment: process.env,
-      timeoutMs: 15_000,
     });
     expect(result.exitCode, result.stderr).toBe(0);
     const inspection = artifactInspectionResultSchema.parse(
@@ -445,7 +442,6 @@ cliTest(
     const result = await driver.run({
       arguments: ["inspect-artifact", path, "--json"],
       environment: process.env,
-      timeoutMs: 15_000,
     });
     expect(result.exitCode, result.stderr).toBe(0);
     const inspection = artifactInspectionResultSchema.parse(
@@ -473,7 +469,6 @@ cliTest(
     const result = await driver.run({
       arguments: ["extract-artifact", path, "--json"],
       environment: process.env,
-      timeoutMs: 15_000,
     });
     expect(result.exitCode, result.stderr).toBe(0);
     const extracted = artifactExtractionResultSchema.parse(
@@ -536,7 +531,6 @@ cliTest(
     const inspectResult = await driver.run({
       arguments: ["inspect-artifact", path, "--json"],
       environment: process.env,
-      timeoutMs: 15_000,
     });
     expect(inspectResult.exitCode, inspectResult.stderr).toBe(0);
     const inspection = artifactInspectionResultSchema.parse(
@@ -610,7 +604,6 @@ cliTest(
     const extractResult = await driver.run({
       arguments: ["extract-artifact", path, "--json"],
       environment: process.env,
-      timeoutMs: 15_000,
     });
     expect(extractResult.exitCode, extractResult.stderr).toBe(0);
     const extracted = artifactExtractionResultSchema.parse(
@@ -645,7 +638,6 @@ cliTest(
     const result = await driver.run({
       arguments: ["inspect-artifact", path, "--json"],
       environment: process.env,
-      timeoutMs: 15_000,
     });
     expect(result.exitCode, result.stderr).toBe(0);
     const inspection = artifactInspectionResultSchema.parse(
@@ -688,7 +680,6 @@ cliTest.for([
     const result = await driver.run({
       arguments: ["inspect-artifact", path, "--json"],
       environment: process.env,
-      timeoutMs: 15_000,
     });
     expect(result.exitCode, result.stderr).toBe(0);
     const inspection = artifactInspectionResultSchema.parse(
@@ -752,7 +743,6 @@ cliTest.for([
     const result = await driver.run({
       arguments: ["inspect-artifact", path, "--json"],
       environment: process.env,
-      timeoutMs: 15_000,
     });
     expect(result.exitCode, result.stderr).toBe(0);
     const inspection = artifactInspectionResultSchema.parse(
@@ -800,7 +790,6 @@ cliTest(
     const result = await driver.run({
       arguments: ["inspect-artifact", path, "--json"],
       environment: process.env,
-      timeoutMs: 15_000,
     });
     expect(result.exitCode).toBe(1);
     expect(result.json).toMatchObject({

tests/acceptance/pythonPycCli.test.ts

@@ -10,7 +10,7 @@ import {
   pythonPycHeader,
 } from "../../src/python/PythonPyc.fixture.js";
 import { createTestTempDirectory } from "../fixtures/temporaryDirectory.js";
-import { cliTest } from "../support/cli/cliFixture.js";
+import { cliTest, runFileCli } from "../support/cli/cliFixture.js";
 
 const completePycEvidenceSchema = toolContract(
   "inspect_python_pyc",
@@ -57,7 +57,7 @@ cliTest(
           }),
         ]),
       );
-      const result = await cli.run({
+      const result = await runFileCli(cli, {
         arguments: ["inspect-python-pyc", path, "--json"],
       });
       expect(result.exitCode, result.stderr).toBe(0);
@@ -77,7 +77,7 @@ cliTest(
         }),
       ]),
     );
-    const ordinaryInt = await cli.run({
+    const ordinaryInt = await runFileCli(cli, {
       arguments: ["inspect-python-pyc", ordinaryIntPath, "--json"],
     });
     expect(ordinaryInt.exitCode, ordinaryInt.stderr).toBe(0);
@@ -95,7 +95,7 @@ cliTest(
         Buffer.alloc(7),
       ]),
     );
-    const truncated = await cli.run({
+    const truncated = await runFileCli(cli, {
       arguments: ["inspect-python-pyc", truncatedPath, "--json"],
     });
     expect(truncated.exitCode).toBe(1);
@@ -183,7 +183,7 @@ cliTest(
       const path = join(root, `inline-caches-${magic}.pyc`);
       await writeFile(path, pyc);
 
-      const result = await cli.run({
+      const result = await runFileCli(cli, {
         arguments: ["inspect-python-pyc", path, "--json"],
       });
       expect(
@@ -278,7 +278,7 @@ cliTest(
       header[2] = 0x0d;
       header[3] = 0x0a;
       await writeFile(path, Buffer.concat([header, marshal]));
-      const result = await cli.run({
+      const result = await runFileCli(cli, {
         arguments: ["inspect-python-pyc", path, "--json"],
       });
       expect(result.exitCode).toBe(1);
@@ -295,7 +295,7 @@ cliTest(
     for (const magic of [3392, 3394]) {
       const path = join(root, `${magic}.pyc`);
       await writeFile(path, Buffer.concat([pythonPycHeader(magic), marshal]));
-      const result = await cli.run({
+      const result = await runFileCli(cli, {
         arguments: ["inspect-python-pyc", path, "--json"],
       });
       expect(result.exitCode, result.stderr).toBe(0);
@@ -354,7 +354,7 @@ cliTest(
         path,
         Buffer.concat([pythonPycHeader(magic), marshalCode(layout, fields)]),
       );
-      const result = await cli.run({
+      const result = await runFileCli(cli, {
         arguments: ["inspect-python-pyc", path, "--json"],
       });
       expect(result.exitCode, result.stderr).toBe(0);
@@ -413,7 +413,7 @@ cliTest(
         path,
         Buffer.concat([pythonPycHeader(magic), marshalCode(layout, fields)]),
       );
-      const result = await cli.run({
+      const result = await runFileCli(cli, {
         arguments: ["inspect-python-pyc", path, "--json"],
       });
       expect(result.exitCode).toBe(1);
@@ -503,7 +503,7 @@ cliTest(
           }),
         ]),
       );
-      const result = await cli.run({
+      const result = await runFileCli(cli, {
         arguments: ["inspect-python-pyc", path, "--json"],
       });
       expect(result.exitCode, result.stderr).toBe(0);
@@ -553,7 +553,7 @@ cliTest(
           marshalCode(testCase.layout, { consts: [frozenSet, dict] }),
         ]),
       );
-      const result = await cli.run({
+      const result = await runFileCli(cli, {
         arguments: ["inspect-python-pyc", path, "--json"],
       });
       expect(result.exitCode, result.stderr).toBe(0);
@@ -631,7 +631,7 @@ cliTest(
           marshalCode(testCase.layout, { consts: [frozenSet, dict] }),
         ]),
       );
-      const result = await cli.run({
+      const result = await runFileCli(cli, {
         arguments: ["inspect-python-pyc", path, "--json"],
       });
       expect(result.exitCode, result.stderr).toBe(0);
@@ -662,7 +662,7 @@ cliTest(
           }),
         ]),
       );
-      const rawResult = await cli.run({
+      const rawResult = await runFileCli(cli, {
         arguments: ["inspect-python-pyc", rawPath, "--json"],
       });
       expect(rawResult.exitCode, rawResult.stderr).toBe(0);

tests/acceptance/rizinCommandRejection.test.ts

@@ -113,7 +113,7 @@ cliTest.skipIf(process.platform === "win32")(
     // Both adapters share the service's classification; the CLI checks one
     // refusal and one command diagnostic.
     for (const outcome of [outcomes[0]!, outcomes[5]!]) {
-      const response = await cli.run({
+      const response = await cli.sharedCliRun!({
         arguments: [
           "execute-rizin-command",
           artifact,

tests/acceptance/rustBinaryCli.test.ts

@@ -16,7 +16,7 @@ import {
   rustDependencyPayload,
 } from "../fixtures/rust/image.js";
 import { createTestTempDirectory } from "../fixtures/temporaryDirectory.js";
-import { cliTest } from "../support/cli/cliFixture.js";
+import { cliTest, runFileCli } from "../support/cli/cliFixture.js";
 import { connectLocalToolsMcp } from "../fixtures/localToolsMcp.js";
 import { expectCliMcpEvidenceParity } from "../fixtures/cliMcpEvidenceParity.js";
 import { parseMcpToolError } from "../fixtures/mcpToolError.js";
@@ -187,7 +187,7 @@ cliTest(
           }),
         );
         if (surface === "cli") {
-          const response = await cli.run({
+          const response = await runFileCli(cli, {
             arguments: ["inspect-rust-binary", path, "--json"],
           });
           expect(response.exitCode, response.stderr).toBe(0);
@@ -212,7 +212,7 @@ cliTest(
       }
 
       if (surface === "cli") {
-        const response = await cli.run({
+        const response = await runFileCli(cli, {
           arguments: ["inspect-rust-binary", malformedPath, "--json"],
         });
         expect(response.exitCode).toBe(1);
@@ -245,7 +245,7 @@ cliTest("returns null metadata when .dep-v0 is absent", async ({ cli }) => {
   const root = await createTestTempDirectory("rea-rust-cli-missing-");
   const path = join(root, "plain");
   await writeFile(path, createRustImage({ format: "elf", omitSection: true }));
-  const result = await cli.run({
+  const result = await runFileCli(cli, {
     arguments: ["inspect-rust-binary", path, "--json"],
   });
   expect(result.exitCode, result.stderr).toBe(0);
@@ -278,7 +278,7 @@ cliTest(
           fixture.type,
         ),
       );
-      const result = await cli.run({
+      const result = await runFileCli(cli, {
         arguments: ["inspect-rust-binary", path, "--json"],
       });
       expect(result.exitCode, result.stderr).toBe(0);
@@ -324,7 +324,7 @@ cliTest(
     bytes.writeUInt32LE(0x0200000c, 4);
     await writeFile(path, bytes);
 
-    const result = await cli.run({
+    const result = await runFileCli(cli, {
       arguments: ["inspect-rust-binary", path, "--json"],
     });
 
@@ -356,7 +356,7 @@ cliTest(
       ],
     });
     await writeFile(path, createRustImage({ format: "elf", payload }));
-    const result = await cli.run({
+    const result = await runFileCli(cli, {
       arguments: ["inspect-rust-binary", path, "--json"],
     });
     expect(result.exitCode, result.stderr).toBe(0);
@@ -385,7 +385,7 @@ cliTest("rejects malformed dependency JSON", async ({ cli }) => {
       includeRustc: false,
     }),
   );
-  const result = await cli.run({
+  const result = await runFileCli(cli, {
     arguments: ["inspect-rust-binary", path, "--json"],
   });
   expect(result.exitCode).toBe(1);
@@ -410,7 +410,7 @@ cliTest(
       }),
     );
 
-    const result = await cli.run({
+    const result = await runFileCli(cli, {
       arguments: ["inspect-rust-binary", path, "--json"],
     });
     expect(result.exitCode).toBe(1);
@@ -442,7 +442,7 @@ cliTest(
     bytes.writeUInt32LE(alignedSize, 264 + 16); // .dep-v0 SizeOfRawData
     await writeFile(path, bytes);
 
-    const result = await cli.run({
+    const result = await runFileCli(cli, {
       arguments: ["inspect-rust-binary", path, "--json"],
     });
     expect(result.exitCode, result.stderr).toBe(0);
@@ -519,7 +519,7 @@ cliTest(
         reported_limits: { maximum_bytes: compressed.length * 64 },
       },
     };
-    const result = await cli.run({
+    const result = await runFileCli(cli, {
       arguments: ["inspect-rust-binary", path, "--json"],
     });
     expect(result.exitCode).toBe(1);
@@ -625,7 +625,7 @@ cliTest(
       }
       const path = join(root, `mixed.${format}`);
       await writeFile(path, bytes);
-      const result = await cli.run({
+      const result = await runFileCli(cli, {
         arguments: ["inspect-rust-binary", path, "--json"],
       });
       expect(result.exitCode, result.stderr).toBe(0);
@@ -656,7 +656,7 @@ cliTest(
       const response = await call("inspect_rust_binary", { path });
       expect(response.isError, JSON.stringify(response)).not.toBe(true);
       expectCliMcpEvidenceParity(evidence, response.structuredContent, path);
-      const go = await cli.run({
+      const go = await runFileCli(cli, {
         arguments: ["inspect-go-binary", path, "--json"],
       });
       expect(go.exitCode).toBe(1);

tests/acceptance/rustUnnamedSections.test.ts

@@ -26,7 +26,7 @@ cliTest(
       if (name === "writable") bytes.writeBigUInt64LE(3n, 384 + 8);
       const path = join(root, `${name}.elf`);
       await writeFile(path, bytes);
-      const output = await cli.run({
+      const output = await cli.sharedCliRun!({
         arguments: ["inspect-rust-binary", path, "--json"],
       });
       expect(output.exitCode, output.stderr).toBe(0);

tests/acceptance/setup/dshClientSetup.test.ts

@@ -200,7 +200,6 @@ cliTest(
         arguments: [...args, "--json"],
         cwd: home,
         environment,
-        timeoutMs: 20_000,
       });
     const plan = await run(["setup", "--client", "dsh", "--dry-run"]);
     expect(plan.exitCode).toBe(0);

tests/acceptance/setup/hermesAliasedTableSetup.test.ts

@@ -50,7 +50,6 @@ for (const version of ["1.1", "1.2"] as const) {
           HERMES_HOME: profile,
           HOPPER_LAUNCHER_PATH: process.execPath,
         },
-        timeoutMs: 20_000,
       });
       expect(removed.exitCode).toBe(0);
       expect(await readFile(config, "utf8")).toBe(original);
@@ -84,7 +83,6 @@ for (const version of ["1.1", "1.2"] as const) {
               GHIDRA_INSTALL_DIR: ghidra,
               JAVA_HOME: java,
             },
-            timeoutMs: 20_000,
           });
         const setup = [
           "setup",
@@ -166,7 +164,6 @@ cliTest("Hermes still registers into an explicit table", async ({ cli }) => {
       HERMES_HOME: profile,
       HOPPER_LAUNCHER_PATH: process.execPath,
     },
-    timeoutMs: 20_000,
   });
   expect(applied.exitCode).toBe(0);
   expect(applied.json).toMatchObject({ status: "ready" });
@@ -209,7 +206,6 @@ for (const version of ["1.1", "1.2"] as const) {
           HERMES_HOME: profile,
           HOPPER_LAUNCHER_PATH: process.execPath,
         },
-        timeoutMs: 20_000,
       });
       expect(applied.exitCode).toBe(0);
       const configured = parse(await readFile(config, "utf8"), { version });
@@ -237,7 +233,6 @@ cliTest(
           HERMES_HOME: profile,
           HOPPER_LAUNCHER_PATH: process.execPath,
         },
-        timeoutMs: 20_000,
       });
     const [command, ...args] = currentClientRegistrationCommand({
       entrypointPath: resolve("scripts/rea.mjs"),
@@ -316,7 +311,6 @@ for (const original of [
           HERMES_HOME: profile,
           HOPPER_LAUNCHER_PATH: process.execPath,
         },
-        timeoutMs: 20_000,
       });
       expect(rejected.exitCode).not.toBe(0);
       expect(rejected.json).toMatchObject({

tests/acceptance/setup/hermesAnchoredEntrySetup.test.ts

@@ -23,7 +23,6 @@ const cliLifecycle = (cli: TestCli, home: string, profile: string) => {
       arguments: arguments_,
       cwd: home,
       environment: { HOME: home, USERPROFILE: home, HERMES_HOME: profile },
-      timeoutMs: 20_000,
     });
   const setup = [
     "setup",

tests/acceptance/setup/hermesClientSetup.test.ts

@@ -61,7 +61,6 @@ for (const [version, keyStyle] of [
           arguments: arguments_,
           cwd: home,
           environment: { USERPROFILE: home, HERMES_HOME: profile },
-          timeoutMs: 20_000,
         });
       const setup = [
         "setup",
@@ -141,7 +140,6 @@ cliTest(
         arguments: arguments_,
         cwd: home,
         environment: { USERPROFILE: home, HERMES_HOME: profile },
-        timeoutMs: 20_000,
       });
     const setup = ["setup", "--client", "hermes", "--skill=false", "--json"];
     const preview = await run([...setup, "--dry-run"]);
@@ -223,7 +221,6 @@ cliTest(
           REA_CLIENT_PROFILE_HOME: home,
           HERMES_HOME: " ${REA_CLIENT_PROFILE_HOME}/profile ",
         },
-        timeoutMs: 20_000,
       });
     const planned = await run([
       "setup",
@@ -333,7 +330,6 @@ for (const selection of ["default", "custom", "suffix", "explicit"] as const) {
                   ? root
                   : undefined,
           },
-          timeoutMs: 20_000,
         });
       const plan = await run([
         "setup",
@@ -468,7 +464,6 @@ for (const selection of [
           LOCALAPPDATA: join(home, "AppData", "Local"),
           HERMES_HOME: root,
         },
-        timeoutMs: 20_000,
       });
       if (selection === "missing") {
         expect(plan.exitCode).toBe(1);
@@ -573,7 +568,6 @@ for (const layout of ["symlinked-default", "escaping-prefix"] as const) {
             LOCALAPPDATA: join(home, "AppData", "Local"),
             HERMES_HOME: root,
           },
-          timeoutMs: 20_000,
         });
         expect(plan.exitCode, plan.stdout).toBe(0);
         expect(plan.json).toMatchObject({
@@ -650,7 +644,6 @@ for (const name of ["missing", "deleted", "ghost", "../escape", "root"]) {
           arguments: args,
           cwd: home,
           environment: { USERPROFILE: home, HERMES_HOME: root },
-          timeoutMs: 20_000,
         });
       const rejected = await run([
         "setup",
@@ -720,7 +713,6 @@ cliTest.skipIf(process.platform === "win32")(
           HERMES_HOME: "$REA_HERMES_PROFILE",
           REA_HERMES_PROFILE: override,
         },
-        timeoutMs: 20_000,
       });
     const planned = await run([
       "setup",
@@ -783,7 +775,6 @@ cliTest(
         arguments: arguments_,
         cwd: home,
         environment: { USERPROFILE: home, HERMES_HOME: override },
-        timeoutMs: 20_000,
       });
     const setup = await run(["setup", "--client", "hermes", "--yes", "--json"]);
     expect(setup.exitCode).not.toBe(0);

tests/acceptance/setup/launcherAliasesCli.test.ts

@@ -161,7 +161,6 @@ cliTest.skipIf(process.platform === "win32").for([
           XDG_CONFIG_HOME: join(home, ".config"),
           PATH: process.env.PATH ?? "",
         },
-        timeoutMs: 30_000,
       });
 
     const setup = await run(registered, [
@@ -296,7 +295,6 @@ cliTest.skipIf(process.platform === "win32")(
           XDG_CONFIG_HOME: join(home, ".config"),
           PATH: process.env.PATH ?? "",
         },
-        timeoutMs: 30_000,
       });
     const uninstall = await run(["uninstall", "--json"]);
     expect(uninstall.exitCode, uninstall.stderr).toBe(0);

tests/acceptance/setup/ompClientSetup.test.ts

@@ -34,7 +34,6 @@ for (const [variable, profile] of [
             PI_CODING_AGENT_DIR: agent,
             [variable]: profile,
           },
-          timeoutMs: 20_000,
         });
       for (const option of ["--dry-run", "--yes"]) {
         const rejected = await run(
@@ -101,7 +100,6 @@ cliTest(
         OMP_PROFILE: " ",
         PI_PROFILE: "Bad Name",
       },
-      timeoutMs: 20_000,
     });
     expect(result.exitCode).toBe(0);
     expect(result.json).toMatchObject({ status: "ready" });

tests/acceptance/setup/piClientSetup.test.ts

@@ -138,7 +138,6 @@ cliTest(
       arguments: arguments_,
       cwd: home,
       environment,
-      timeoutMs: 20_000,
     });
     expect(applied.exitCode).toBe(0);
     expect(applied.json).toMatchObject({
@@ -193,7 +192,6 @@ cliTest(
       arguments: arguments_,
       cwd: home,
       environment,
-      timeoutMs: 20_000,
     });
     expect(repeated.exitCode).toBe(0);
     expect(repeated.json).toMatchObject({
@@ -232,7 +230,6 @@ cliTest(
           PI_PROFILE: "legacy",
           PI_CONFIG_DIR: ".omp-other",
         },
-        timeoutMs: 20_000,
       });
 
     const planned = await run([
@@ -345,7 +342,6 @@ cliTest(
           HOPPER_LAUNCHER_PATH: join(home, "unconfigured-hopper"),
           PI_CODING_AGENT_DIR: "custom-agent",
         },
-        timeoutMs: 20_000,
       });
     const run = runIn(created);
     const setup = await run(["setup", "--client", "pi", "--yes", "--json"]);
@@ -456,7 +452,6 @@ cliTest(
           PI_CODING_AGENT_DIR: "file:///agent%2fdir",
           REA_DARWIN_MODULE_CACHE_PATH: moduleCache,
         },
-        timeoutMs: 20_000,
       });
     const plan = await run([
       "setup",

tests/acceptance/setup/updateAliasCli.test.ts

@@ -46,7 +46,6 @@ cliTest(
       cli.run({
         arguments: arguments_,
         cwd: home,
-        timeoutMs: 20_000,
         environment: {
           USERPROFILE: home,
           PATH: [

tests/acceptance/sqliteDatabaseCli.test.ts

@@ -33,7 +33,7 @@ import { createTestTempDirectory } from "../fixtures/temporaryDirectory.js";
 import {
   cliTest,
   createSharedMcpSession,
-  type TestCli,
+  runFileCli,
 } from "../support/cli/cliFixture.js";
 
 const digest = (bytes: Buffer): string =>
@@ -49,8 +49,11 @@ const parityMcp = createSharedMcpSession(async (registerCleanup, isClosed) => {
 afterAll(() => parityMcp.close());
 
 /** Run the offset page through the CLI so the option name is covered as well as the MCP input. */
-const pagedCliRows = async (cli: TestCli, path: string): Promise<unknown> => {
-  const result = await cli.run({
+const pagedCliRows = async (
+  cli: Parameters<typeof runFileCli>[0],
+  path: string,
+): Promise<unknown> => {
+  const result = await runFileCli(cli, {
     arguments: [
       "inspect-sqlite-database",
       path,
@@ -165,7 +168,7 @@ cliTest.runIf(SQLITE_NATIVE_LIMITS_AVAILABLE)(
       `${base}[0,1].value,${base}.1.value`,
       `${base}.1.value,${base}[0,1].value`,
     ]) {
-      const result = await cli.run({
+      const result = await runFileCli(cli, {
         arguments: [
           "inspect-sqlite-database",
           path,
@@ -184,7 +187,7 @@ cliTest.runIf(SQLITE_NATIVE_LIMITS_AVAILABLE)(
         },
       });
     }
-    const refused = await cli.run({
+    const refused = await runFileCli(cli, {
       arguments: [
         "inspect-sqlite-database",
         path,
@@ -217,7 +220,7 @@ cliTest.runIf(SQLITE_NATIVE_LIMITS_AVAILABLE)(
     } finally {
       database.close();
     }
-    const result = await cli.run({
+    const result = await runFileCli(cli, {
       arguments: [
         "inspect-sqlite-database",
         path,
@@ -503,7 +506,7 @@ cliTest.runIf(SQLITE_NATIVE_LIMITS_AVAILABLE)(
         },
       },
     });
-    const cliResult = await cli.run({
+    const cliResult = await runFileCli(cli, {
       arguments: [
         "inspect-sqlite-database",
         path,
@@ -669,7 +672,7 @@ cliTest.runIf(SQLITE_NATIVE_LIMITS_AVAILABLE)(
     }
     const { call } = await connectLocalToolsMcp();
     for (const limit of [1001, Number.MAX_SAFE_INTEGER]) {
-      const result = await cli.run({
+      const result = await runFileCli(cli, {
         arguments: [
           "inspect-sqlite-database",
           path,
@@ -893,7 +896,7 @@ cliTest.runIf(SQLITE_NATIVE_LIMITS_AVAILABLE)(
     const wal = before[1];
     expect(db).toBeDefined();
     expect(wal).toBeDefined();
-    const result = await cli.run({
+    const result = await runFileCli(cli, {
       arguments: [
         "inspect-sqlite-database",
         path,
@@ -959,7 +962,7 @@ cliTest.runIf(SQLITE_NATIVE_LIMITS_AVAILABLE)(
           ],
         },
       };
-      const corrupt = await cli.run({
+      const corrupt = await runFileCli(cli, {
         arguments: ["inspect-sqlite-database", selected, "--json"],
         environment: { REA_LOG_LEVEL: "silent" },
       });
@@ -995,7 +998,7 @@ cliTest.runIf(SQLITE_NATIVE_LIMITS_AVAILABLE)(
         },
       },
     });
-    const ambiguous = await cli.run({
+    const ambiguous = await runFileCli(cli, {
       arguments: [
         "inspect-sqlite-database",
         valid,
@@ -1015,7 +1018,7 @@ cliTest.runIf(SQLITE_NATIVE_LIMITS_AVAILABLE)(
         })
       ).isError,
     ).toBe(true);
-    const missing = await cli.run({
+    const missing = await runFileCli(cli, {
       arguments: [
         "inspect-sqlite-database",
         valid,
@@ -1065,7 +1068,7 @@ cliTest.runIf(SQLITE_NATIVE_LIMITS_AVAILABLE)(
       producer.close();
     }
     const before = await sourceState(path);
-    const control = await cli.run({
+    const control = await runFileCli(cli, {
       arguments: [
         "inspect-sqlite-database",
         path,
@@ -1095,7 +1098,7 @@ cliTest.runIf(SQLITE_NATIVE_LIMITS_AVAILABLE)(
     const columns = Array.from({ length: selectedColumns }, () => "value");
     // The framed fixture executes the compiled public CLI without the host's
     // process-argument ceiling rejecting this many repeated flags first.
-    const result = await cli.run({
+    const result = await runFileCli(cli, {
       arguments: [
         "inspect-sqlite-database",
         path,
@@ -1152,7 +1155,7 @@ cliTest.runIf(SQLITE_NATIVE_LIMITS_AVAILABLE)(
     const path = createSqliteApplicationCollationFixture(root);
     const before = await sourceState(path);
     const { call } = await connectLocalToolsMcp();
-    const schema = await cli.run({
+    const schema = await runFileCli(cli, {
       arguments: [
         "inspect-sqlite-database",
         path,
@@ -1191,7 +1194,7 @@ cliTest.runIf(SQLITE_NATIVE_LIMITS_AVAILABLE)(
     expect(schemaResponse.isError).not.toBe(true);
     expect(schemaResponse.structuredContent).toMatchObject(expectedSchema);
 
-    const result = await cli.run({
+    const result = await runFileCli(cli, {
       arguments: [
         "inspect-sqlite-database",
         path,
@@ -1266,7 +1269,7 @@ cliTest.runIf(SQLITE_NATIVE_LIMITS_AVAILABLE)(
       },
     };
     for (const columns of [["b", "a"], undefined]) {
-      const result = await cli.run({
+      const result = await runFileCli(cli, {
         arguments: [
           "inspect-sqlite-database",
           path,
@@ -1287,7 +1290,7 @@ cliTest.runIf(SQLITE_NATIVE_LIMITS_AVAILABLE)(
       });
       expect(parseMcpToolError(response).error).toMatchObject(expectedError);
     }
-    const base = await cli.run({
+    const base = await runFileCli(cli, {
       arguments: [
         "inspect-sqlite-database",
         path,
@@ -1344,7 +1347,7 @@ cliTest.runIf(SQLITE_NATIVE_LIMITS_AVAILABLE)(
       "selected_table",
       "database",
     ] as const) {
-      const result = await cli.run({
+      const result = await runFileCli(cli, {
         arguments: [
           "inspect-sqlite-database",
           path,
@@ -1397,7 +1400,7 @@ cliTest.runIf(SQLITE_NATIVE_LIMITS_AVAILABLE)(
       ["UTF-16be", "database"],
     ] as const) {
       const { path, names } = createSqliteLongNameFixture(root, encoding);
-      const response = await cli.run({
+      const response = await runFileCli(cli, {
         arguments: [
           "inspect-sqlite-database",
           path,
@@ -1489,7 +1492,7 @@ cliTest.runIf(SQLITE_NATIVE_LIMITS_AVAILABLE)(
       native.close();
     }
 
-    const cliResult = await cli.run({
+    const cliResult = await runFileCli(cli, {
       arguments: [
         "inspect-sqlite-database",
         path,
@@ -1568,7 +1571,7 @@ cliTest.runIf(SQLITE_NATIVE_LIMITS_AVAILABLE)(
         producer.close();
       }
       const original = await readFile(path);
-      const result = await cli.run({
+      const result = await runFileCli(cli, {
         arguments: ["inspect-sqlite-database", path, "--json"],
         environment: { REA_LOG_LEVEL: "silent" },
       });

tests/acceptance/tools/harBoundaryFacts.test.ts

@@ -9,7 +9,7 @@ import { historicalHar } from "../../fixtures/historicalHar.js";
 import { connectLocalToolsMcp } from "../../fixtures/localToolsMcp.js";
 import { parseMcpToolError } from "../../fixtures/mcpToolError.js";
 import { createTestTempDirectory } from "../../fixtures/temporaryDirectory.js";
-import { cliTest } from "../../support/cli/cliFixture.js";
+import { cliTest, runFileCli } from "../../support/cli/cliFixture.js";
 
 cliTest(
   "omits HAR extension payloads from capture previews while retaining complete records",
@@ -166,10 +166,10 @@ cliTest(
           "--json",
         ],
       };
-      const output = await cli.run({
-        ...invocation,
-        freshProcess: label === "null-timings",
-      });
+      const output =
+        label === "null-timings"
+          ? await cli.run(invocation)
+          : await runFileCli(cli, invocation);
       expect(output.exitCode).toBe(1);
       const expected = {
         code: "invalid_request",

tests/acceptance/tools/mobileGraphExamples.test.ts

@@ -12,7 +12,7 @@ import {
 import { createEvidence, parseEvidence } from "../../../src/domain/evidence.js";
 import { artifactInventoryResultSchema } from "../../../src/domain/artifactGraph.js";
 import { createTestTempDirectory } from "../../fixtures/temporaryDirectory.js";
-import { cliTest } from "../../support/cli/cliFixture.js";
+import { cliTest, runFileCli } from "../../support/cli/cliFixture.js";
 
 const graphExamples = [
   {
@@ -112,10 +112,10 @@ cliTest.for(graphExamples)(
       const invocation = {
         arguments: [command, JSON.stringify(input), "--json"],
       };
-      const result = await cli.run({
-        ...invocation,
-        freshProcess: code === "evidence_integrity_mismatch",
-      });
+      const result =
+        code === "evidence_integrity_mismatch"
+          ? await cli.run(invocation)
+          : await runFileCli(cli, invocation);
       expect(result.exitCode).toBe(1);
       expect(result.json).toMatchObject({
         code,

tests/acceptance/tools/nativeFunctionMatching.test.ts

@@ -3,7 +3,7 @@ import { join } from "node:path";
 import { expect } from "vitest";
 import {
   cliTest,
-  type CliInvocation,
+  runFileCli,
   type TestCli,
 } from "../../support/cli/cliFixture.js";
 import { createTestTempDirectory } from "../../fixtures/temporaryDirectory.js";
@@ -173,7 +173,7 @@ const verifyPortableCli = async (
   );
   const original = await readFile(bundlePath);
   await writeFile(inputPath, JSON.stringify({ ...input, detail: "complete" }));
-  const cliFull = await cli.run({
+  const cliFull = await runFileCli(cli, {
     arguments: [
       "match-native-functions",
       inputPath,
@@ -187,7 +187,7 @@ const verifyPortableCli = async (
   expect(cliFull.exitCode, cliFull.stderr).toBe(0);
   expect(parseEvidence(cliFull.json).evidence_id).toBe(evidenceId);
   await writeFile(inputPath, JSON.stringify(input));
-  const cliSummary = await cli.run({
+  const cliSummary = await runFileCli(cli, {
     arguments: [
       "match-native-functions",
       inputPath,
@@ -222,7 +222,7 @@ const verifyPortableCli = async (
   expect(ids.has(unrelated.evidence_id)).toBe(false);
   expect(ids.has(evidenceId)).toBe(true);
   expect(Buffer.compare(await readFile(bundlePath), original)).toBe(0);
-  const incomplete = await cli.run({
+  const incomplete = await runFileCli(cli, {
     arguments: [
       "match-native-functions",
       inputPath,
@@ -508,8 +508,8 @@ cliTest(
       "right_observations",
     ] as const) {
       // Keep fresh-process coverage for both source-admission routes on left.
-      const run = (invocation: CliInvocation) =>
-        cli.run({ ...invocation, freshProcess: field === "left" });
+      const run =
+        field === "left" ? cli.run.bind(cli) : runFileCli.bind(undefined, cli);
       const observation = field.endsWith("observations");
       const request = {
         left,
@@ -581,7 +581,7 @@ cliTest(
       detail: "complete",
     };
     await writeFile(requestPath, JSON.stringify(inlineRequest));
-    const inline = await cli.run({
+    const inline = await runFileCli(cli, {
       arguments: ["match-native-functions", requestPath, "--json"],
     });
     await writeFile(
@@ -589,7 +589,7 @@ cliTest(
       JSON.stringify(createEvidenceBundle([wrongRole, right])),
     );
     await writeFile(requestPath, JSON.stringify(portableRequest));
-    const portable = await cli.run({
+    const portable = await runFileCli(cli, {
       arguments: [
         "match-native-functions",
         requestPath,
@@ -611,7 +611,7 @@ cliTest(
 
     const corruptRequest = { left: badCoordinate, right, detail: "complete" };
     await writeFile(requestPath, JSON.stringify(corruptRequest));
-    const corruptInline = await cli.run({
+    const corruptInline = await runFileCli(cli, {
       arguments: ["match-native-functions", requestPath, "--json"],
     });
     const corruptPortableRequest = {
@@ -623,7 +623,7 @@ cliTest(
       detail: "complete",
     };
     await writeFile(requestPath, JSON.stringify(corruptPortableRequest));
-    const corruptPortable = await cli.run({
+    const corruptPortable = await runFileCli(cli, {
       arguments: [
         "match-native-functions",
         requestPath,
@@ -641,7 +641,7 @@ cliTest(
 
     const malformedBundlePath = join(root, "malformed-outer-frame.json");
     await writeFile(malformedBundlePath, JSON.stringify({ records: [left] }));
-    const malformedBundle = await cli.run({
+    const malformedBundle = await runFileCli(cli, {
       arguments: [
         "match-native-functions",
         requestPath,

tests/acceptance/tools/passiveCaptureCorrespondence.test.ts

@@ -17,7 +17,7 @@ import {
   withPassiveDroppedEvents,
 } from "../../fixtures/passiveNetworkCapture.js";
 import { createTestTempDirectory } from "../../fixtures/temporaryDirectory.js";
-import { cliTest } from "../../support/cli/cliFixture.js";
+import { cliTest, runFileCli } from "../../support/cli/cliFixture.js";
 
 type Capture = {
   inspection: CompareWebCapturesInput["before"]["inspection"];
@@ -516,10 +516,9 @@ cliTest.for(cases.filter(({ name }) => cliCaseNames.has(name)))(
       arguments: ["compare-web-captures", ...paths, "--json"],
       environment: { REA_LOG_LEVEL: "silent" },
     };
-    const response = await cli.run({
-      ...invocation,
-      freshProcess: scenario.name === "heterogeneous HTTP omission 0",
-    });
+    const response = await (scenario.name === "heterogeneous HTTP omission 0"
+      ? cli.run(invocation)
+      : runFileCli(cli, invocation));
     expect(response.exitCode, response.stderr).toBe(0);
     expectComparison(response.json, scenario);
   },

tests/acceptance/tools/passiveNetworkInventory.test.ts

@@ -10,7 +10,7 @@ import {
   withPassiveDroppedEvents,
 } from "../../fixtures/passiveNetworkCapture.js";
 import { createTestTempDirectory } from "../../fixtures/temporaryDirectory.js";
-import { cliTest } from "../../support/cli/cliFixture.js";
+import { cliTest, runFileCli } from "../../support/cli/cliFixture.js";
 
 const comparisonCases = () => {
   const before = passiveNetworkCapture();
@@ -191,10 +191,9 @@ cliTest.for(cases)(
       arguments: ["compare-web-captures", ...paths, "--json"],
       environment: { REA_LOG_LEVEL: "silent" },
     };
-    const response = await cli.run({
-      ...options,
-      freshProcess: name === "added" || name === "removed",
-    });
+    const response = await (name === "added" || name === "removed"
+      ? cli.run(options)
+      : runFileCli(cli, options));
     expect(response.exitCode, response.stderr).toBe(0);
     expectComparison(response.json, name, change);
     expect(

tests/acceptance/tools/protobufCapture.test.ts

@@ -9,7 +9,7 @@ import {
 } from "node:fs/promises";
 import { join } from "node:path";
 import { expect } from "vitest";
-import { cliTest } from "../../support/cli/cliFixture.js";
+import { cliTest, runFileCli } from "../../support/cli/cliFixture.js";
 import { createTestTempDirectory } from "../../fixtures/temporaryDirectory.js";
 import {
   protobufCaptureDescriptor,
@@ -649,10 +649,9 @@ captureTest.for(
         "--json",
       ],
     };
-    const response = await cli.run({
-      ...options,
-      freshProcess: name === "valid",
-    });
+    const response = await (name === "valid"
+      ? cli.run(options)
+      : runFileCli(cli, options));
     expect(response.exitCode, response.stdout + response.stderr).toBe(0);
     const evidence = parseEvidence(response.json);
     const report = webNetworkCaptureSchema.parse(evidence.normalized_result);

tests/acceptance/tools/protobufDescriptorFiles.test.ts

@@ -147,7 +147,7 @@ cliTest(
           },
         };
         if (change === "declarations") {
-          const output = await cli.run({
+          const output = await cli.sharedCliRun!({
             arguments: [
               "inspect-web-network-capture",
               capture,
@@ -254,7 +254,7 @@ cliTest(
       const bytes = writer.finish();
       const descriptor = join(root, `${mode}.pb`);
       await writeFile(descriptor, bytes);
-      const output = await cli.run({
+      const output = await cli.sharedCliRun!({
         arguments: [
           "inspect-web-network-capture",
           capture,

tests/acceptance/tools/protobufDescriptorIdentity.test.ts

@@ -132,7 +132,7 @@ cliTest.for([
     const descriptor = join(root, `${variant}.pb`);
     const bytes = toBinary(FileDescriptorSetSchema, definition);
     await writeFile(descriptor, bytes);
-    const output = await cli.run({
+    const output = await cli.sharedCliRun!({
       arguments: [
         "inspect-web-network-capture",
         capture,
@@ -222,7 +222,7 @@ cliTest(
     const definition = toBinary(FileDescriptorSetSchema, valid);
     await writeFile(capture, protobufHar(body, "application/x-protobuf"));
     await writeFile(descriptor, definition);
-    const output = await cli.run({
+    const output = await cli.sharedCliRun!({
       arguments: [
         "inspect-web-network-capture",
         capture,

tests/acceptance/tools/protobufMimeAdmission.test.ts

@@ -30,7 +30,7 @@ cliTest(
       const path = join(root, `${index}.har`);
       const original = protobufHar(body, mime);
       await writeFile(path, original);
-      const output = await cli.run({
+      const output = await cli.sharedCliRun!({
         arguments: [
           "inspect-web-network-capture",
           path,
@@ -109,7 +109,7 @@ cliTest(
     await writeFile(path, original);
     const call = await cli.sharedMcpCall!();
     for (const framing of ["auto", "raw"] as const) {
-      const output = await cli.run({
+      const output = await cli.sharedCliRun!({
         arguments: [
           "inspect-web-network-capture",
           path,
@@ -233,7 +233,7 @@ cliTest(
     const mime = 'application/protobuf;encoding="binary';
     const original = protobufHar(body, mime);
     await writeFile(path, original);
-    const output = await cli.run({
+    const output = await cli.sharedCliRun!({
       arguments: [
         "inspect-web-network-capture",
         path,

tests/acceptance/tools/protobufRegistryIdentity.test.ts

@@ -117,7 +117,7 @@ cliTest(
         // Both orders cross the actual CLI adapter; other geometries reuse
         // the production MCP session and the same application workflow.
         if (scope === "same-file") {
-          const output = await cli.run({
+          const output = await cli.sharedCliRun!({
             arguments: [
               "inspect-web-network-capture",
               capture,

tests/acceptance/tools/unavailableNativeCollectionViews.test.ts

@@ -124,7 +124,7 @@ cliTest(
       },
     ];
     const call = await cli.sharedMcpCall!();
-    const run = cli.run.bind(cli);
+    const run = cli.sharedCliRun!.bind(cli);
     for (const test of cases) {
       const request = {
         source: { kind: "inline", evidence: test.evidence },