test(0145): unit + integration + launcher + claudecode coverage

cmd/devicemesh-mcp/main_test.go (10 tests):
- TestInitialize: JSON-RPC initialize frame → serverInfo + capabilities.
- TestToolsList: tools/list → 16 user-mode entries, cada uno con name +
  inputSchema valido.
- TestToolsCallExec: tools/call name=exec → mock device-agent (httptest)
  recibe capability=shell.exec, MCP response content contiene "hi".
- TestToolsCallInvalidTool: name desconocido → isError o error envelope.
- TestNotificationsInitializedNoResponse: notification (sin id) → cero
  responses.
- TestUserModeFiltersPkgInstall: --mode user oculta pkg.install,
  --mode sudo la expone.
- TestToolsAllowedNarrows: --tools-allowed exec,fs.read → solo 2.
- TestSplitCSV, TestParseMode, TestIsCleanShutdown: helpers.

cmd/devicemesh-mcp/integration_test.go:
- TestIntegrationBinarySubprocess: build el binario en tmp + spawn como
  child via exec.Command + pipe real + secuencia initialize ->
  notifications/initialized -> tools/list -> tools/call. Valida el path
  identico al que usara claude.

devagents/mcp_bridge_test.go (9 tests):
- Disabled paths (nil DM, ExposeViaMCP=false, provider!=claude-code).
- Applied path: /tmp/<agent>-mcp-config.json JSON valido, mode 0600,
  mcpServers.devicemesh con command apuntando al binario fake.
- AllowedTools formato mcp__<server>__<tool>.
- DisableTools=true overrideado a false.
- URLEnv override gana sobre YAML.
- Binary missing → ok=false sin panico.
- BuildClaudeAllowedToolNames default server name.
- ResolveBridgedToolNames respeta mode + ToolsAllowed.
- ShouldExposeViaMCP cubre nil/disabled/default/explicit-true/false.

shell/llm/claudecode_test.go:
- TestBuildClaudeArgs_DisableTools actualizado: solo emite --tools "" cuando
  AllowedTools ESTA vacio. La regla nueva (issue 0145) da precedencia a
  AllowedTools.
- Anadido TestBuildClaudeArgs_DisableToolsButAllowedToolsWins.
- Anadido TestBuildClaudeArgs_MCPConfigPath.

bridge.go fix: cambio NewTool + WithRawInputSchema a NewToolWithRawSchema
porque NewTool inicializa ToolInputSchema.Type="object" por default, lo
cual entra en conflicto con RawInputSchema en MarshalJSON del SDK.

Suite completa pasa con -tags goolm -count=1.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

cmd/devicemesh-mcp/bridge.go

@@ -60,6 +60,11 @@ func RegisterToolBridge(srv *server.MCPServer, reg *devicemesh.ToolRegistry, log
 // buildMCPTool transforms a devicemesh.ToolSpec into an mcp.Tool with the
 // raw input schema attached. The description is augmented with the
 // capability marker so the model knows the tool is remote.
+//
+// We use mcp.NewToolWithRawSchema (not NewTool + WithRawInputSchema) because
+// NewTool initialises a default ToolInputSchema with Type="object", which
+// then conflicts at marshal time with our RawInputSchema (the SDK rejects
+// having both set — see mcp/tools.go ::Tool.MarshalJSON).
 func buildMCPTool(spec devicemesh.ToolSpec) (mcp.Tool, error) {
 	desc := spec.Description
 	if spec.Capability != "" {
@@ -69,15 +74,18 @@ func buildMCPTool(spec devicemesh.ToolSpec) (mcp.Tool, error) {
 		desc += " (approval required)"
 	}
 
-	opts := []mcp.ToolOption{mcp.WithDescription(desc)}
-	if spec.InputSchema != nil {
-		raw, err := json.Marshal(spec.InputSchema)
-		if err != nil {
-			return mcp.Tool{}, fmt.Errorf("marshal input schema: %w", err)
-		}
-		opts = append(opts, mcp.WithRawInputSchema(raw))
+	if spec.InputSchema == nil {
+		// Fall back to a minimal "no params" schema so the tool is still
+		// callable. Should not happen for the builtins (they all set
+		// InputSchema), but the adapter must not panic on third-party specs.
+		return mcp.NewToolWithRawSchema(spec.Name, desc,
+			json.RawMessage(`{"type":"object","properties":{}}`)), nil
 	}
-	return mcp.NewTool(spec.Name, opts...), nil
+	raw, err := json.Marshal(spec.InputSchema)
+	if err != nil {
+		return mcp.Tool{}, fmt.Errorf("marshal input schema: %w", err)
+	}
+	return mcp.NewToolWithRawSchema(spec.Name, desc, raw), nil
 }
 
 // makeHandler returns a server.ToolHandlerFunc bound to a single spec. The