diff --git a/src/from-python-serialization/SocketSerialization.ts b/src/from-python-serialization/SocketSerialization.ts
index 73e139ac..351a5f05 100644
--- a/src/from-python-serialization/SocketSerialization.ts
+++ b/src/from-python-serialization/SocketSerialization.ts
@@ -101,6 +101,7 @@ export async function serializePythonObjectUsingSocketServer(
     requestId,
     objectAsString,
     makeOptions(options),
+    socketServer.secretHex,
   );
   logDebug('Sending code to python: ', code);
   logDebug('Sending request to python with reqId ', requestId);
diff --git a/src/python-communication/BuildPythonCode.ts b/src/python-communication/BuildPythonCode.ts
index 92a452cc..1246bd47 100644
--- a/src/python-communication/BuildPythonCode.ts
+++ b/src/python-communication/BuildPythonCode.ts
@@ -240,6 +240,7 @@ export function constructOpenSendAndCloseCode(
   request_id: number,
   expression: string,
   options?: OpenSendAndCloseOptions,
+  secret?: string,
 ): EvalCodePython<Result<PythonObjectShape>> {
   function makeOptionsString(options: OpenSendAndCloseOptions): string {
     return `dict(${Object.entries(options)
@@ -248,8 +249,9 @@ export function constructOpenSendAndCloseCode(
       .join(', ')})`;
   }
   const optionsStr = options ? makeOptionsString(options) : '{}';
+  const secretArg = secret ? `, secret="${secret}"` : '';
   return convertExpressionIntoValueWrappedExpression(
-    `${OPEN_SEND_AND_CLOSE}(${port}, ${request_id}, ${expression}, ${optionsStr})`,
+    `${OPEN_SEND_AND_CLOSE}(${port}, ${request_id}, ${expression}, ${optionsStr}${secretArg})`,
   );
 }
 
diff --git a/src/python-communication/socket-based/Server.ts b/src/python-communication/socket-based/Server.ts
index 5ee9ab43..9206ec0a 100644
--- a/src/python-communication/socket-based/Server.ts
+++ b/src/python-communication/socket-based/Server.ts
@@ -1,10 +1,11 @@
 import type { MessageChunkHeader } from './protocol';
 import { Buffer } from 'node:buffer';
+import * as crypto from 'node:crypto';
 import * as net from 'node:net';
 import { Service } from 'typedi';
 import { logDebug, logInfo, logTrace } from '../../Logging';
 import { MessageChunks } from './MessageChunks';
-import { HEADER_LENGTH, MAX_MESSAGE_SIZE, splitHeaderContentRest } from './protocol';
+import { AUTH_SECRET_LENGTH, HEADER_LENGTH, MAX_MESSAGE_SIZE, splitHeaderContentRest } from './protocol';
 import { RequestsManager } from './RequestsManager';
 
 const EMPTY_BUFFER = Buffer.alloc(0);
@@ -19,6 +20,7 @@ export class SocketServer {
 
   private outgoingRequestsManager: RequestsManager = new RequestsManager();
   private chunksByMessageId: Map<number, MessageChunks> = new Map();
+  private readonly secret: Buffer = crypto.randomBytes(AUTH_SECRET_LENGTH);
 
   constructor() {
     const options: net.ServerOpts = {
@@ -65,6 +67,10 @@ export class SocketServer {
     return this.port;
   }
 
+  get secretHex(): string {
+    return this.secret.toString('hex');
+  }
+
   onClientConnected(socket: net.Socket): void {
     const outgoingRequestsManager = this.outgoingRequestsManager;
     const handleMessage = (header: MessageChunkHeader, data: Buffer) => {
@@ -133,6 +139,33 @@ export class SocketServer {
         }
       }
     };
+
+    // Authentication state per connection
+    let authenticated = false;
+    let authBuffer: Buffer = EMPTY_BUFFER;
+    const serverSecret = this.secret;
+
+    const handleAuth = (data: Buffer) => {
+      authBuffer = authBuffer.length > 0 ? Buffer.concat([authBuffer, data]) : data;
+      if (authBuffer.length < AUTH_SECRET_LENGTH) {
+        logTrace(`Auth: waiting for more bytes (${authBuffer.length}/${AUTH_SECRET_LENGTH})`);
+        return;
+      }
+      const token = authBuffer.subarray(0, AUTH_SECRET_LENGTH);
+      const rest = authBuffer.subarray(AUTH_SECRET_LENGTH);
+      authBuffer = EMPTY_BUFFER;
+      if (!crypto.timingSafeEqual(token, serverSecret)) {
+        logDebug('Socket auth failed: invalid secret');
+        socket.destroy();
+        return;
+      }
+      logTrace('Socket auth succeeded');
+      authenticated = true;
+      if (rest.length > 0) {
+        handleData(rest);
+      }
+    };
+
     const makeSafe = (fn: (...args: any[]) => void) => {
       return (...args: any[]) => {
         try {
@@ -145,7 +178,14 @@ export class SocketServer {
       };
     };
 
-    socket.on('data', makeSafe(handleData));
+    socket.on('data', makeSafe((data: Buffer) => {
+      if (!authenticated) {
+        handleAuth(data);
+      }
+      else {
+        handleData(data);
+      }
+    }));
     socket.on('close', () => {
       logTrace('Client closed connection');
     });
diff --git a/src/python-communication/socket-based/protocol.ts b/src/python-communication/socket-based/protocol.ts
index f96d2da3..7a0e99d1 100644
--- a/src/python-communication/socket-based/protocol.ts
+++ b/src/python-communication/socket-based/protocol.ts
@@ -58,6 +58,9 @@ export const HEADER_LENGTH = Object.entries(BytesPerKey).reduce(
 /** Maximum allowed message size (256 MB). Prevents unbounded memory allocation from malformed or malicious headers. */
 export const MAX_MESSAGE_SIZE = 256 * 1024 * 1024;
 
+/** Length of the authentication secret in bytes. */
+export const AUTH_SECRET_LENGTH = 32;
+
 export enum Sender {
   Server = 0x01,
   Python = 0x02,
diff --git a/src/python/socket_client.py b/src/python/socket_client.py
index 2e547fb5..04910834 100644
--- a/src/python/socket_client.py
+++ b/src/python/socket_client.py
@@ -538,10 +538,13 @@ def torch_to_numpy(tensor):
         return tensor.numpy()
 
 
-def open_send_and_close(port, request_id, obj, options=None):
+def open_send_and_close(port, request_id, obj, options=None, secret=None):
     with socket.socket(socket.AF_INET, socket.SOCK_STREAM) as s:
         s.connect(("localhost", port))
 
+        if secret is not None:
+            s.sendall(bytes.fromhex(secret))
+
         try:
             if _Internal.is_numpy_array(obj):
                 if _Internal.is_numpy_tensor(obj):
diff --git a/tests/unit/python/test_socket_auth.py b/tests/unit/python/test_socket_auth.py
new file mode 100644
index 00000000..8ab68e7d
--- /dev/null
+++ b/tests/unit/python/test_socket_auth.py
@@ -0,0 +1,111 @@
+"""Tests for socket_client.py secret authentication parameter."""
+import socket
+import struct
+import threading
+
+# Inline the relevant function signature from socket_client.py
+# We test that the secret parameter is sent as raw bytes before message data
+
+
+def test_secret_hex_to_bytes():
+    """bytes.fromhex converts hex secret to correct bytes."""
+    hex_secret = "aa" * 32  # 64 hex chars = 32 bytes
+    raw = bytes.fromhex(hex_secret)
+    assert len(raw) == 32
+    assert all(b == 0xAA for b in raw)
+
+
+def test_secret_roundtrip():
+    """Secret survives hex encode/decode roundtrip."""
+    import os
+    secret = os.urandom(32)
+    hex_str = secret.hex()
+    assert len(hex_str) == 64
+    recovered = bytes.fromhex(hex_str)
+    assert recovered == secret
+
+
+def test_secret_sent_before_data():
+    """When secret is provided, it is sent as the first 32 bytes on the socket."""
+    received_data = bytearray()
+    server_ready = threading.Event()
+
+    def server_thread(port_holder):
+        srv = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
+        srv.setsockopt(socket.SOL_SOCKET, socket.SO_REUSEADDR, 1)
+        srv.bind(("localhost", 0))
+        port_holder.append(srv.getsockname()[1])
+        srv.listen(1)
+        server_ready.set()
+        conn, _ = srv.accept()
+        while True:
+            chunk = conn.recv(4096)
+            if not chunk:
+                break
+            received_data.extend(chunk)
+        conn.close()
+        srv.close()
+
+    port_holder = []
+    t = threading.Thread(target=server_thread, args=(port_holder,))
+    t.daemon = True
+    t.start()
+    server_ready.wait(timeout=5)
+
+    port = port_holder[0]
+    secret_hex = "ab" * 32
+    expected_secret = bytes.fromhex(secret_hex)
+    test_payload = b"hello"
+
+    with socket.socket(socket.AF_INET, socket.SOCK_STREAM) as s:
+        s.connect(("localhost", port))
+        # Simulate what socket_client.py does: send secret then payload
+        s.sendall(expected_secret)
+        s.sendall(test_payload)
+        s.close()
+
+    t.join(timeout=5)
+
+    assert received_data[:32] == expected_secret, "First 32 bytes should be the secret"
+    assert received_data[32:] == test_payload, "Remaining bytes should be the payload"
+
+
+def test_no_secret_sends_no_prefix():
+    """When secret is None, no prefix bytes are sent."""
+    received_data = bytearray()
+    server_ready = threading.Event()
+
+    def server_thread(port_holder):
+        srv = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
+        srv.setsockopt(socket.SOL_SOCKET, socket.SO_REUSEADDR, 1)
+        srv.bind(("localhost", 0))
+        port_holder.append(srv.getsockname()[1])
+        srv.listen(1)
+        server_ready.set()
+        conn, _ = srv.accept()
+        while True:
+            chunk = conn.recv(4096)
+            if not chunk:
+                break
+            received_data.extend(chunk)
+        conn.close()
+        srv.close()
+
+    port_holder = []
+    t = threading.Thread(target=server_thread, args=(port_holder,))
+    t.daemon = True
+    t.start()
+    server_ready.wait(timeout=5)
+
+    port = port_holder[0]
+    test_payload = b"hello"
+
+    with socket.socket(socket.AF_INET, socket.SOCK_STREAM) as s:
+        s.connect(("localhost", port))
+        # No secret - just payload
+        s.sendall(test_payload)
+        s.close()
+
+    t.join(timeout=5)
+
+    assert received_data == test_payload, "All bytes should be payload when no secret"
diff --git a/tests/unit/ts/max-msg-size.test.ts b/tests/unit/ts/max-msg-size.test.ts
index 324df7f3..1499a4a6 100644
--- a/tests/unit/ts/max-msg-size.test.ts
+++ b/tests/unit/ts/max-msg-size.test.ts
@@ -1,6 +1,6 @@
 import { Buffer } from 'node:buffer';
 import * as net from 'node:net';
-import { afterEach, describe, expect, it } from 'vitest';
+import { afterEach, describe, expect, it, vi } from 'vitest';
 import {
   HEADER_LENGTH,
   MAX_MESSAGE_SIZE,
@@ -258,8 +258,10 @@ describe('socketServer integration — MAX_MESSAGE_SIZE rejection', () => {
       const client = new net.Socket();
       const timer = setTimeout(() => reject(new Error('timed out waiting for socket close')), 5000);
       client.connect(port, '127.0.0.1', () => {
+        // Send auth token first (required by socket server)
+        const secret = Buffer.from(serverInstance!.secretHex, 'hex');
         const buf = buildBuffer({ messageLength: MAX_MESSAGE_SIZE + 1 });
-        client.write(buf);
+        client.write(Buffer.concat([secret, buf]));
       });
       client.once('close', () => {
         clearTimeout(timer);
@@ -293,8 +295,10 @@ describe('socketServer integration — MAX_MESSAGE_SIZE rejection', () => {
       const client = new net.Socket();
       const timer = setTimeout(() => reject(new Error('timed out')), 5000);
       client.connect(port, '127.0.0.1', () => {
+        // Send auth token first (required by socket server)
+        const secret = Buffer.from(serverInstance!.secretHex, 'hex');
         const buf = buildBuffer({ messageLength: MAX_MESSAGE_SIZE + 1 });
-        client.write(buf);
+        client.write(Buffer.concat([secret, buf]));
       });
       client.once('close', () => {
         clearTimeout(timer);
@@ -323,10 +327,13 @@ describe('socketServer integration — MAX_MESSAGE_SIZE rejection', () => {
       const client = new net.Socket();
       const timer = setTimeout(() => reject(new Error('timed out')), 5000);
       client.connect(port, '127.0.0.1', () => {
+        // Send auth token first (required by socket server)
+        const secret = Buffer.from(serverInstance!.secretHex, 'hex');
         // Send the full header split into two writes: first 4 bytes (messageLength),
         // then the rest.  After the second write the server has >= HEADER_LENGTH
         // bytes and should detect the oversized messageLength and destroy the socket.
         const buf = buildBuffer({ messageLength: MAX_MESSAGE_SIZE + 1 });
+        client.write(secret);
         client.write(buf.subarray(0, 4), () => {
           client.write(buf.subarray(4));
         });
diff --git a/tests/unit/ts/response-timeout.test.ts b/tests/unit/ts/response-timeout.test.ts
index 4a5e6612..f09d7a2c 100644
--- a/tests/unit/ts/response-timeout.test.ts
+++ b/tests/unit/ts/response-timeout.test.ts
@@ -154,11 +154,16 @@ describe('socketServer.onResponse — integration (real server)', () => {
   const clients: net.Socket[] = [];
   const serverSideConnections = new Set<net.Socket>();
 
-  async function connectClient(port: number): Promise<net.Socket> {
+  async function connectClient(port: number, serverSecret: string): Promise<net.Socket> {
     const client = net.createConnection({ port });
     clients.push(client);
     await new Promise<void>((resolve, reject) => {
-      client.once('connect', resolve);
+      client.once('connect', () => {
+        // Send auth token first (required by socket server)
+        const secret = Buffer.from(serverSecret, 'hex');
+        client.write(secret);
+        resolve();
+      });
       client.once('error', reject);
     });
     return client;
@@ -207,7 +212,7 @@ describe('socketServer.onResponse — integration (real server)', () => {
       server.onResponse(requestId, (_header, data) => resolve(data));
     });
 
-    const client = await connectClient(server.portNumber);
+    const client = await connectClient(server.portNumber, server.secretHex);
     client.write(chunk);
 
     const received = await responsePromise;
diff --git a/tests/unit/ts/socket-auth.test.ts b/tests/unit/ts/socket-auth.test.ts
new file mode 100644
index 00000000..4aa6be20
--- /dev/null
+++ b/tests/unit/ts/socket-auth.test.ts
@@ -0,0 +1,167 @@
+import { Buffer } from 'node:buffer';
+import * as crypto from 'node:crypto';
+import * as net from 'node:net';
+import { afterEach, beforeEach, describe, expect, it, vi } from 'vitest';
+
+vi.mock('node:crypto', async (importOriginal) => {
+  const actual = await importOriginal<typeof import('node:crypto')>();
+  return {
+    ...actual,
+    timingSafeEqual: vi.fn(actual.timingSafeEqual) as typeof actual.timingSafeEqual,
+  };
+});
+
+vi.mock('typedi', () => ({
+  default: { set: vi.fn(), get: vi.fn(), has: vi.fn() },
+  Service: () => (c: unknown) => c,
+  Inject: () => () => {},
+}));
+
+vi.mock('vscode-extensions-json-generator/utils', () => ({
+  configUtils: {
+    ConfigurationGetter: () => () => ({}),
+  },
+}));
+
+const { SocketServer } = await import('../../../src/python-communication/socket-based/Server');
+const { AUTH_SECRET_LENGTH } = await import('../../../src/python-communication/socket-based/protocol');
+
+describe('socketServer — shared secret authentication (S4)', () => {
+  describe('secretHex property', () => {
+    it('is a non-empty string', () => {
+      const server = new SocketServer();
+      expect(server.secretHex).toBeTruthy();
+      expect(typeof server.secretHex).toBe('string');
+    });
+
+    it('has length AUTH_SECRET_LENGTH * 2', () => {
+      const server = new SocketServer();
+      expect(server.secretHex).toHaveLength(AUTH_SECRET_LENGTH * 2);
+    });
+
+    it('contains only valid lowercase hex characters', () => {
+      const server = new SocketServer();
+      expect(server.secretHex).toMatch(/^[0-9a-f]+$/);
+    });
+
+    it('different SocketServer instances have different secrets', () => {
+      const a = new SocketServer();
+      const b = new SocketServer();
+      expect(a.secretHex).not.toBe(b.secretHex);
+    });
+
+    it('returns the same secretHex on repeated accesses', () => {
+      const s = new SocketServer();
+      expect(s.secretHex).toBe(s.secretHex);
+    });
+  });
+
+  describe('integration — connection auth', () => {
+    let server: InstanceType<typeof SocketServer>;
+
+    beforeEach(async () => {
+      server = new SocketServer();
+      await server.start();
+    });
+
+    afterEach(() => {
+      server.server.close();
+    });
+
+    it('rejects connection with wrong secret (socket is destroyed)', async () => {
+      const wrongSecret = Buffer.alloc(AUTH_SECRET_LENGTH, 0xAB);
+      const correctSecret = Buffer.from(server.secretHex, 'hex');
+      // Confirm they differ
+      expect(wrongSecret.equals(correctSecret)).toBe(false);
+
+      await new Promise<void>((resolve, reject) => {
+        const client = net.connect(server.portNumber, 'localhost', () => {
+          client.write(wrongSecret);
+        });
+        const timeout = setTimeout(() => {
+          client.destroy();
+          reject(new Error('Timeout: socket was not closed after bad auth'));
+        }, 3000);
+        client.on('close', () => {
+          clearTimeout(timeout);
+          resolve();
+        });
+        client.on('error', () => {
+          clearTimeout(timeout);
+          resolve(); // destroyed = error or close, both count
+        });
+      });
+    });
+
+    it('accepts connection with correct secret', async () => {
+      const secret = Buffer.from(server.secretHex, 'hex');
+
+      await new Promise<void>((resolve, reject) => {
+        const client = net.connect(server.portNumber, 'localhost', () => {
+          client.write(secret);
+          // Give the server a moment to process auth, then verify socket is still open
+          const timeoutId = setTimeout(() => {
+            if (!client.destroyed) {
+              client.destroy();
+              resolve();
+            }
+            else {
+              reject(new Error('Socket was destroyed after correct secret'));
+            }
+          }, 200);
+        });
+        client.on('error', (err) => {
+          clearTimeout(timeoutId);
+          reject(err);
+        });
+      });
+    });
+
+    it('accepts connection when secret arrives in two fragments', async () => {
+      const secret = Buffer.from(server.secretHex, 'hex');
+      const firstHalf = secret.subarray(0, 16);
+      const secondHalf = secret.subarray(16);
+
+      await new Promise<void>((resolve, reject) => {
+        let timeoutId: ReturnType<typeof setTimeout>;
+        const client = net.connect(server.portNumber, 'localhost', () => {
+          client.write(firstHalf);
+          setTimeout(() => client.write(secondHalf), 20);
+          timeoutId = setTimeout(() => {
+            if (!client.destroyed) {
+              client.destroy();
+              resolve();
+            }
+            else {
+              reject(new Error('Socket destroyed after fragmented correct secret'));
+            }
+          }, 300);
+        });
+        client.on('error', (err) => {
+          clearTimeout(timeoutId);
+          reject(err);
+        });
+      });
+    }, 5000);
+
+    it('uses crypto.timingSafeEqual for comparison', async () => {
+      vi.mocked(crypto.timingSafeEqual).mockClear();
+      const secret = Buffer.from(server.secretHex, 'hex');
+
+      await new Promise<void>((resolve, reject) => {
+        const client = net.connect(server.portNumber, 'localhost', () => {
+          client.write(secret, () => {
+            // Give server time to process
+            setTimeout(() => {
+              client.destroy();
+              resolve();
+            }, 100);
+          });
+        });
+        client.on('error', reject);
+      });
+
+      expect(vi.mocked(crypto.timingSafeEqual)).toHaveBeenCalled();
+    }, 5000);
+  });
+});
diff --git a/ts-unit.xml b/ts-unit.xml
new file mode 100644
index 00000000..b4ba99c4
--- /dev/null
+++ b/ts-unit.xml
@@ -0,0 +1,275 @@
+<?xml version="1.0" encoding="UTF-8" ?>
+<testsuites name="vitest tests" tests="104" failures="4" errors="0" time="50.866190686">
+    <testsuite name="tests/unit/ts/as-python-value.test.ts" timestamp="2026-03-10T22:04:37.076Z" hostname="runnervm0kj6c" tests="11" failures="0" errors="0" skipped="0" time="0.004879938">
+        <testcase classname="tests/unit/ts/as-python-value.test.ts" name="asPythonValue &gt; wraps a plain string in single quotes" time="0.001100803">
+        </testcase>
+        <testcase classname="tests/unit/ts/as-python-value.test.ts" name="asPythonValue &gt; escapes a single quote inside a string" time="0.000295378">
+        </testcase>
+        <testcase classname="tests/unit/ts/as-python-value.test.ts" name="asPythonValue &gt; escapes a backslash inside a string" time="0.000152874">
+        </testcase>
+        <testcase classname="tests/unit/ts/as-python-value.test.ts" name="asPythonValue &gt; escapes backslash before single quote (both present)" time="0.000283917">
+        </testcase>
+        <testcase classname="tests/unit/ts/as-python-value.test.ts" name="asPythonValue &gt; escapes newlines" time="0.000171619">
+        </testcase>
+        <testcase classname="tests/unit/ts/as-python-value.test.ts" name="asPythonValue &gt; escapes carriage returns" time="0.000152973">
+        </testcase>
+        <testcase classname="tests/unit/ts/as-python-value.test.ts" name="asPythonValue &gt; handles an empty string" time="0.000185856">
+        </testcase>
+        <testcase classname="tests/unit/ts/as-python-value.test.ts" name="asPythonValue &gt; handles numbers as bare numeric literals" time="0.000235867">
+        </testcase>
+        <testcase classname="tests/unit/ts/as-python-value.test.ts" name="asPythonValue &gt; handles booleans as Python True/False" time="0.000319383">
+        </testcase>
+        <testcase classname="tests/unit/ts/as-python-value.test.ts" name="asPythonValue &gt; handles null as Python None" time="0.000180475">
+        </testcase>
+        <testcase classname="tests/unit/ts/as-python-value.test.ts" name="asPythonValue &gt; produces output that contains no unmatched single quotes" time="0.000376529">
+        </testcase>
+    </testsuite>
+    <testsuite name="tests/unit/ts/await-server-start.test.ts" timestamp="2026-03-10T22:04:37.079Z" hostname="runnervm0kj6c" tests="3" failures="0" errors="0" skipped="0" time="0.013373707">
+        <testcase classname="tests/unit/ts/await-server-start.test.ts" name="socketServer.start() await semantics &gt; fire-and-forget swallows synchronous errors (demonstrates the bug)" time="0.011532739">
+        </testcase>
+        <testcase classname="tests/unit/ts/await-server-start.test.ts" name="socketServer.start() await semantics &gt; awaited start propagates errors (demonstrates the fix)" time="0.000320495">
+        </testcase>
+        <testcase classname="tests/unit/ts/await-server-start.test.ts" name="socketServer.start() await semantics &gt; awaited start resolves on success" time="0.000158424">
+        </testcase>
+    </testsuite>
+    <testsuite name="tests/unit/ts/chunks.test.ts" timestamp="2026-03-10T22:04:37.080Z" hostname="runnervm0kj6c" tests="16" failures="0" errors="0" skipped="0" time="0.012574583">
+        <testcase classname="tests/unit/ts/chunks.test.ts" name="messageChunks &gt; isComplete() returns false on a new instance" time="0.001203754">
+        </testcase>
+        <testcase classname="tests/unit/ts/chunks.test.ts" name="messageChunks &gt; single chunk messages &gt; isComplete() returns true after adding the single chunk" time="0.000434316">
+        </testcase>
+        <testcase classname="tests/unit/ts/chunks.test.ts" name="messageChunks &gt; single chunk messages &gt; fullMessage() returns exact buffer that was added" time="0.00104492">
+        </testcase>
+        <testcase classname="tests/unit/ts/chunks.test.ts" name="messageChunks &gt; multi-chunk messages (ordered) &gt; is not complete until all chunks are received" time="0.000526277">
+        </testcase>
+        <testcase classname="tests/unit/ts/chunks.test.ts" name="messageChunks &gt; multi-chunk messages (ordered) &gt; is complete after all chunks arrive in order" time="0.000384534">
+        </testcase>
+        <testcase classname="tests/unit/ts/chunks.test.ts" name="messageChunks &gt; multi-chunk messages (ordered) &gt; fullMessage() returns correct concatenation" time="0.000642532">
+        </testcase>
+        <testcase classname="tests/unit/ts/chunks.test.ts" name="messageChunks &gt; multi-chunk messages (out-of-order) &gt; is complete even when chunks arrive out of order" time="0.000487104">
+        </testcase>
+        <testcase classname="tests/unit/ts/chunks.test.ts" name="messageChunks &gt; multi-chunk messages (out-of-order) &gt; fullMessage() assembles in chunk-number order, not receive order" time="0.000626994">
+        </testcase>
+        <testcase classname="tests/unit/ts/chunks.test.ts" name="messageChunks &gt; validation (error cases) &gt; throws when adding a duplicate chunk with different header fields" time="0.001483323">
+        </testcase>
+        <testcase classname="tests/unit/ts/chunks.test.ts" name="messageChunks &gt; validation (error cases) &gt; throws when header chunkCount does not match constructor" time="0.00044164">
+        </testcase>
+        <testcase classname="tests/unit/ts/chunks.test.ts" name="messageChunks &gt; validation (error cases) &gt; throws when header messageLength does not match constructor" time="0.000336585">
+        </testcase>
+        <testcase classname="tests/unit/ts/chunks.test.ts" name="messageChunks &gt; validation (error cases) &gt; throws when declared chunkLength does not match buffer size" time="0.000351853">
+        </testcase>
+        <testcase classname="tests/unit/ts/chunks.test.ts" name="messageChunks &gt; validation (error cases) &gt; throws when chunk number is out of valid range" time="0.000323421">
+        </testcase>
+        <testcase classname="tests/unit/ts/chunks.test.ts" name="messageChunks &gt; fullMessage() and idempotency &gt; fullMessage() throws if called before all chunks are received" time="0.000358345">
+        </testcase>
+        <testcase classname="tests/unit/ts/chunks.test.ts" name="messageChunks &gt; fullMessage() and idempotency &gt; adding the same chunk twice is idempotent" time="0.000642683">
+        </testcase>
+        <testcase classname="tests/unit/ts/chunks.test.ts" name="messageChunks &gt; integration: roundtrip &gt; reassembles original payload split into multiple chunks" time="0.000762436">
+        </testcase>
+    </testsuite>
+    <testsuite name="tests/unit/ts/deactivate.test.ts" timestamp="2026-03-10T22:04:37.084Z" hostname="runnervm0kj6c" tests="4" failures="0" errors="0" skipped="0" time="0.097316296">
+        <testcase classname="tests/unit/ts/deactivate.test.ts" name="socketServer.close() &gt; server starts and listens" time="0.013005674">
+        </testcase>
+        <testcase classname="tests/unit/ts/deactivate.test.ts" name="socketServer.close() &gt; close() stops listening" time="0.060910464">
+        </testcase>
+        <testcase classname="tests/unit/ts/deactivate.test.ts" name="socketServer.close() &gt; close() is idempotent" time="0.011383943">
+        </testcase>
+        <testcase classname="tests/unit/ts/deactivate.test.ts" name="socketServer.close() &gt; close() on never-started server is safe" time="0.010701967">
+        </testcase>
+    </testsuite>
+    <testsuite name="tests/unit/ts/max-msg-size.test.ts" timestamp="2026-03-10T22:04:37.085Z" hostname="runnervm0kj6c" tests="17" failures="3" errors="0" skipped="0" time="45.050854479">
+        <testcase classname="tests/unit/ts/max-msg-size.test.ts" name="protocol constants &gt; constant HEADER_LENGTH equals 26 bytes" time="0.001327905">
+        </testcase>
+        <testcase classname="tests/unit/ts/max-msg-size.test.ts" name="protocol constants &gt; constant MAX_MESSAGE_SIZE equals 256 MB" time="0.000314433">
+        </testcase>
+        <testcase classname="tests/unit/ts/max-msg-size.test.ts" name="protocol constants &gt; hEADER_LENGTH is less than MAX_MESSAGE_SIZE" time="0.000231981">
+        </testcase>
+        <testcase classname="tests/unit/ts/max-msg-size.test.ts" name="splitHeaderContentRest &gt; buffer too small for header &gt; returns Err when buffer is empty" time="0.008145752">
+        </testcase>
+        <testcase classname="tests/unit/ts/max-msg-size.test.ts" name="splitHeaderContentRest &gt; buffer too small for header &gt; returns Err when buffer is shorter than HEADER_LENGTH" time="0.001828839">
+        </testcase>
+        <testcase classname="tests/unit/ts/max-msg-size.test.ts" name="splitHeaderContentRest &gt; buffer too small for header &gt; error message mentions buffer and header lengths" time="0.000752157">
+        </testcase>
+        <testcase classname="tests/unit/ts/max-msg-size.test.ts" name="splitHeaderContentRest &gt; valid header — field round-trip &gt; parses a header-only message (chunkLength = 0) correctly" time="0.000965041">
+        </testcase>
+        <testcase classname="tests/unit/ts/max-msg-size.test.ts" name="splitHeaderContentRest &gt; valid header — field round-trip &gt; parses a message with chunk data and returns it in content" time="0.001165022">
+        </testcase>
+        <testcase classname="tests/unit/ts/max-msg-size.test.ts" name="splitHeaderContentRest &gt; valid header — field round-trip &gt; returns trailing bytes as rest when buffer contains more than one message" time="0.000559329">
+        </testcase>
+        <testcase classname="tests/unit/ts/max-msg-size.test.ts" name="splitHeaderContentRest &gt; valid header — field round-trip &gt; all custom field values round-trip through the header" time="0.000358375">
+        </testcase>
+        <testcase classname="tests/unit/ts/max-msg-size.test.ts" name="splitHeaderContentRest &gt; message size fields — server-side validation surface &gt; parses a header where messageLength exceeds MAX_MESSAGE_SIZE (server must reject it)" time="0.000434607">
+        </testcase>
+        <testcase classname="tests/unit/ts/max-msg-size.test.ts" name="splitHeaderContentRest &gt; message size fields — server-side validation surface &gt; parses a header where messageLength is exactly MAX_MESSAGE_SIZE" time="0.000273297">
+        </testcase>
+        <testcase classname="tests/unit/ts/max-msg-size.test.ts" name="splitHeaderContentRest &gt; message size fields — server-side validation surface &gt; parses a header where messageLength equals HEADER_LENGTH (minimal valid)" time="0.000185264">
+        </testcase>
+        <testcase classname="tests/unit/ts/max-msg-size.test.ts" name="splitHeaderContentRest &gt; partial payload — full header but insufficient chunk data &gt; returns Err when header declares chunkLength=16 but only 4 bytes of payload follow" time="0.000622445">
+        </testcase>
+        <testcase classname="tests/unit/ts/max-msg-size.test.ts" name="socketServer integration — MAX_MESSAGE_SIZE rejection &gt; destroys the client socket when messageLength exceeds MAX_MESSAGE_SIZE" time="15.009279189">
+            <failure message="Test timed out in 5000ms.
+If this is a long-running test, pass a timeout value as the last argument or configure it globally with &quot;testTimeout&quot;." type="Error">
+Error: Test timed out in 5000ms.
+If this is a long-running test, pass a timeout value as the last argument or configure it globally with &quot;testTimeout&quot;.
+ ❯ tests/unit/ts/max-msg-size.test.ts:252:3
+            </failure>
+            <failure message="Hook timed out in 10000ms.
+If this is a long-running hook, pass a timeout value as the last argument or configure it globally with &quot;hookTimeout&quot;." type="Error">
+Error: Hook timed out in 10000ms.
+If this is a long-running hook, pass a timeout value as the last argument or configure it globally with &quot;hookTimeout&quot;.
+ ❯ tests/unit/ts/max-msg-size.test.ts:242:3
+            </failure>
+        </testcase>
+        <testcase classname="tests/unit/ts/max-msg-size.test.ts" name="socketServer integration — MAX_MESSAGE_SIZE rejection &gt; does not invoke the message handler when messageLength exceeds MAX_MESSAGE_SIZE" time="15.016593161">
+            <failure message="Test timed out in 5000ms.
+If this is a long-running test, pass a timeout value as the last argument or configure it globally with &quot;testTimeout&quot;." type="Error">
+Error: Test timed out in 5000ms.
+If this is a long-running test, pass a timeout value as the last argument or configure it globally with &quot;testTimeout&quot;.
+ ❯ tests/unit/ts/max-msg-size.test.ts:281:3
+            </failure>
+            <failure message="Hook timed out in 10000ms.
+If this is a long-running hook, pass a timeout value as the last argument or configure it globally with &quot;hookTimeout&quot;." type="Error">
+Error: Hook timed out in 10000ms.
+If this is a long-running hook, pass a timeout value as the last argument or configure it globally with &quot;hookTimeout&quot;.
+ ❯ tests/unit/ts/max-msg-size.test.ts:242:3
+            </failure>
+        </testcase>
+        <testcase classname="tests/unit/ts/max-msg-size.test.ts" name="socketServer integration — MAX_MESSAGE_SIZE rejection &gt; sends oversized header in two chunks — still rejected once full header arrives" time="15.005103704">
+            <failure message="Test timed out in 5000ms.
+If this is a long-running test, pass a timeout value as the last argument or configure it globally with &quot;testTimeout&quot;." type="Error">
+Error: Test timed out in 5000ms.
+If this is a long-running test, pass a timeout value as the last argument or configure it globally with &quot;testTimeout&quot;.
+ ❯ tests/unit/ts/max-msg-size.test.ts:317:3
+            </failure>
+            <failure message="Hook timed out in 10000ms.
+If this is a long-running hook, pass a timeout value as the last argument or configure it globally with &quot;hookTimeout&quot;." type="Error">
+Error: Hook timed out in 10000ms.
+If this is a long-running hook, pass a timeout value as the last argument or configure it globally with &quot;hookTimeout&quot;.
+ ❯ tests/unit/ts/max-msg-size.test.ts:242:3
+            </failure>
+        </testcase>
+    </testsuite>
+    <testsuite name="tests/unit/ts/parser-escape.test.ts" timestamp="2026-03-10T22:04:37.092Z" hostname="runnervm0kj6c" tests="10" failures="0" errors="0" skipped="0" time="0.012944219">
+        <testcase classname="tests/unit/ts/parser-escape.test.ts" name="parsePythonResult — escaped strings &gt; parses a plain single-quoted string" time="0.003528781">
+        </testcase>
+        <testcase classname="tests/unit/ts/parser-escape.test.ts" name="parsePythonResult — escaped strings &gt; parses a string containing escaped double quotes (bug fix)" time="0.000732299">
+        </testcase>
+        <testcase classname="tests/unit/ts/parser-escape.test.ts" name="parsePythonResult — escaped strings &gt; parses a string with an escaped backslash" time="0.000467819">
+        </testcase>
+        <testcase classname="tests/unit/ts/parser-escape.test.ts" name="parsePythonResult — escaped strings &gt; parses a string with multiple escaped double quotes" time="0.000590908">
+        </testcase>
+        <testcase classname="tests/unit/ts/parser-escape.test.ts" name="parsePythonResult — escaped strings &gt; parses a string with both backslash and double quote" time="0.000390636">
+        </testcase>
+        <testcase classname="tests/unit/ts/parser-escape.test.ts" name="parsePythonResult — escaped strings &gt; still parses a plain string without escapes correctly" time="0.000309073">
+        </testcase>
+        <testcase classname="tests/unit/ts/parser-escape.test.ts" name="parsePythonResult — escaped strings &gt; stripReprQuoting: outer Python repr-quoting is stripped &gt; strips outer single quotes and parses the inner expression" time="0.001092709">
+        </testcase>
+        <testcase classname="tests/unit/ts/parser-escape.test.ts" name="parsePythonResult — escaped strings &gt; stripReprQuoting: outer Python repr-quoting is stripped &gt; strips outer double quotes and parses inner single-quoted string" time="0.000244995">
+        </testcase>
+        <testcase classname="tests/unit/ts/parser-escape.test.ts" name="parsePythonResult — escaped strings &gt; integration: roundtrip with Python sanitize output &gt; parses an empty string" time="0.000385466">
+        </testcase>
+        <testcase classname="tests/unit/ts/parser-escape.test.ts" name="parsePythonResult — escaped strings &gt; integration: roundtrip with Python sanitize output &gt; parses an Error response" time="0.002955636">
+        </testcase>
+    </testsuite>
+    <testsuite name="tests/unit/ts/path-traversal.test.ts" timestamp="2026-03-10T22:04:37.094Z" hostname="runnervm0kj6c" tests="14" failures="0" errors="0" skipped="0" time="0.026364433">
+        <testcase classname="tests/unit/ts/path-traversal.test.ts" name="savePathHelper — path traversal prevention (S7) &gt; sanitization — variable names &gt; preserves a normal variable name unchanged" time="0.020448851">
+        </testcase>
+        <testcase classname="tests/unit/ts/path-traversal.test.ts" name="savePathHelper — path traversal prevention (S7) &gt; sanitization — variable names &gt; preserves a short simple name" time="0.000307751">
+        </testcase>
+        <testcase classname="tests/unit/ts/path-traversal.test.ts" name="savePathHelper — path traversal prevention (S7) &gt; sanitization — variable names &gt; preserves alphanumeric names with underscores and digits" time="0.000257107">
+        </testcase>
+        <testcase classname="tests/unit/ts/path-traversal.test.ts" name="savePathHelper — path traversal prevention (S7) &gt; path traversal — unix separators &gt; blocks ../ traversal (stays inside saveDir)" time="0.000399081">
+        </testcase>
+        <testcase classname="tests/unit/ts/path-traversal.test.ts" name="savePathHelper — path traversal prevention (S7) &gt; path traversal — unix separators &gt; blocks ../../ traversal (stays inside saveDir)" time="0.000250114">
+        </testcase>
+        <testcase classname="tests/unit/ts/path-traversal.test.ts" name="savePathHelper — path traversal prevention (S7) &gt; path traversal — unix separators &gt; does not contain /etc/passwd after sanitizing ../../etc/passwd" time="0.00034465">
+        </testcase>
+        <testcase classname="tests/unit/ts/path-traversal.test.ts" name="savePathHelper — path traversal prevention (S7) &gt; path traversal — windows backslash separators &gt; blocks ..\  traversal (stays inside saveDir)" time="0.000277054">
+        </testcase>
+        <testcase classname="tests/unit/ts/path-traversal.test.ts" name="savePathHelper — path traversal prevention (S7) &gt; path traversal — windows backslash separators &gt; blocks ..\..\ traversal (stays inside saveDir)" time="0.000215931">
+        </testcase>
+        <testcase classname="tests/unit/ts/path-traversal.test.ts" name="savePathHelper — path traversal prevention (S7) &gt; path traversal — bare dot sequences &gt; blocks bare &quot;..&quot; variable (single-level traversal)" time="0.000447471">
+        </testcase>
+        <testcase classname="tests/unit/ts/path-traversal.test.ts" name="savePathHelper — path traversal prevention (S7) &gt; path traversal — bare dot sequences &gt; blocks single &quot;.&quot; variable" time="0.000317039">
+        </testcase>
+        <testcase classname="tests/unit/ts/path-traversal.test.ts" name="savePathHelper — path traversal prevention (S7) &gt; null byte injection &gt; strips null bytes from variable names" time="0.000247509">
+        </testcase>
+        <testcase classname="tests/unit/ts/path-traversal.test.ts" name="savePathHelper — path traversal prevention (S7) &gt; integration — savePathFor with variable &gt; normal variable name produces path.join(saveDir, name)" time="0.000240146">
+        </testcase>
+        <testcase classname="tests/unit/ts/path-traversal.test.ts" name="savePathHelper — path traversal prevention (S7) &gt; integration — savePathFor with variable &gt; traversal variable does not escape saveDir" time="0.00019401">
+        </testcase>
+        <testcase classname="tests/unit/ts/path-traversal.test.ts" name="savePathHelper — path traversal prevention (S7) &gt; integration — savePathFor with variable &gt; expression objects use a short random id (not variable-based)" time="0.000334491">
+        </testcase>
+    </testsuite>
+    <testsuite name="tests/unit/ts/response-timeout.test.ts" timestamp="2026-03-10T22:04:37.097Z" hostname="runnervm0kj6c" tests="8" failures="1" errors="0" skipped="0" time="5.016781574">
+        <testcase classname="tests/unit/ts/response-timeout.test.ts" name="socketServer.onResponse — timeout (unit, fake timers) &gt; starts with zero pending responses" time="0.003483567">
+        </testcase>
+        <testcase classname="tests/unit/ts/response-timeout.test.ts" name="socketServer.onResponse — timeout (unit, fake timers) &gt; registers one pending response after onResponse is called" time="0.00122783">
+        </testcase>
+        <testcase classname="tests/unit/ts/response-timeout.test.ts" name="socketServer.onResponse — timeout (unit, fake timers) &gt; fires onTimeout and cleans up the callback after timeout" time="0.00178321">
+        </testcase>
+        <testcase classname="tests/unit/ts/response-timeout.test.ts" name="socketServer.onResponse — timeout (unit, fake timers) &gt; does not fire onTimeout when response arrives before timeout" time="0.001487702">
+        </testcase>
+        <testcase classname="tests/unit/ts/response-timeout.test.ts" name="socketServer.onResponse — timeout (unit, fake timers) &gt; cleans up pending callback after successful response (no memory leak)" time="0.000909619">
+        </testcase>
+        <testcase classname="tests/unit/ts/response-timeout.test.ts" name="socketServer.onResponse — timeout (unit, fake timers) &gt; callback is not called after timeout fires" time="0.000709748">
+        </testcase>
+        <testcase classname="tests/unit/ts/response-timeout.test.ts" name="socketServer.onResponse — integration (real server) &gt; resolves callback when Python sends a real response over the socket" time="5.004785786">
+            <failure message="Test timed out in 5000ms.
+If this is a long-running test, pass a timeout value as the last argument or configure it globally with &quot;testTimeout&quot;." type="Error">
+Error: Test timed out in 5000ms.
+If this is a long-running test, pass a timeout value as the last argument or configure it globally with &quot;testTimeout&quot;.
+ ❯ tests/unit/ts/response-timeout.test.ts:193:3
+            </failure>
+        </testcase>
+        <testcase classname="tests/unit/ts/response-timeout.test.ts" name="socketServer.onResponse — integration (real server) &gt; starts with zero pending responses" time="0.000487064">
+        </testcase>
+    </testsuite>
+    <testsuite name="tests/unit/ts/smoke.test.ts" timestamp="2026-03-10T22:04:37.099Z" hostname="runnervm0kj6c" tests="2" failures="0" errors="0" skipped="0" time="0.002495182">
+        <testcase classname="tests/unit/ts/smoke.test.ts" name="smoke &gt; framework is operational" time="0.001057593">
+        </testcase>
+        <testcase classname="tests/unit/ts/smoke.test.ts" name="smoke &gt; typescript types work" time="0.000254532">
+        </testcase>
+    </testsuite>
+    <testsuite name="tests/unit/ts/socket-auth.test.ts" timestamp="2026-03-10T22:04:37.100Z" hostname="runnervm0kj6c" tests="9" failures="0" errors="0" skipped="0" time="0.624230191">
+        <testcase classname="tests/unit/ts/socket-auth.test.ts" name="socketServer — shared secret authentication (S4) &gt; secretHex property &gt; is a non-empty string" time="0.001574022">
+        </testcase>
+        <testcase classname="tests/unit/ts/socket-auth.test.ts" name="socketServer — shared secret authentication (S4) &gt; secretHex property &gt; has length AUTH_SECRET_LENGTH * 2" time="0.000925267">
+        </testcase>
+        <testcase classname="tests/unit/ts/socket-auth.test.ts" name="socketServer — shared secret authentication (S4) &gt; secretHex property &gt; contains only valid lowercase hex characters" time="0.000277334">
+        </testcase>
+        <testcase classname="tests/unit/ts/socket-auth.test.ts" name="socketServer — shared secret authentication (S4) &gt; secretHex property &gt; different SocketServer instances have different secrets" time="0.000850038">
+        </testcase>
+        <testcase classname="tests/unit/ts/socket-auth.test.ts" name="socketServer — shared secret authentication (S4) &gt; secretHex property &gt; returns the same secretHex on repeated accesses" time="0.000219497">
+        </testcase>
+        <testcase classname="tests/unit/ts/socket-auth.test.ts" name="socketServer — shared secret authentication (S4) &gt; integration — connection auth &gt; rejects connection with wrong secret (socket is destroyed)" time="0.012259028">
+        </testcase>
+        <testcase classname="tests/unit/ts/socket-auth.test.ts" name="socketServer — shared secret authentication (S4) &gt; integration — connection auth &gt; accepts connection with correct secret" time="0.203288231">
+        </testcase>
+        <testcase classname="tests/unit/ts/socket-auth.test.ts" name="socketServer — shared secret authentication (S4) &gt; integration — connection auth &gt; accepts connection when secret arrives in two fragments" time="0.301755985">
+        </testcase>
+        <testcase classname="tests/unit/ts/socket-auth.test.ts" name="socketServer — shared secret authentication (S4) &gt; integration — connection auth &gt; uses crypto.timingSafeEqual for comparison" time="0.101544526">
+        </testcase>
+    </testsuite>
+    <testsuite name="tests/unit/ts/triple-quote-guard.test.ts" timestamp="2026-03-10T22:04:37.102Z" hostname="runnervm0kj6c" tests="10" failures="0" errors="0" skipped="0" time="0.004376084">
+        <testcase classname="tests/unit/ts/triple-quote-guard.test.ts" name="assertNoTripleQuotes (triple-quote injection guard) &gt; detects triple single quotes at start of string" time="0.001107856">
+        </testcase>
+        <testcase classname="tests/unit/ts/triple-quote-guard.test.ts" name="assertNoTripleQuotes (triple-quote injection guard) &gt; detects triple single quotes in the middle" time="0.000248211">
+        </testcase>
+        <testcase classname="tests/unit/ts/triple-quote-guard.test.ts" name="assertNoTripleQuotes (triple-quote injection guard) &gt; detects triple single quotes at end" time="0.000146652">
+        </testcase>
+        <testcase classname="tests/unit/ts/triple-quote-guard.test.ts" name="assertNoTripleQuotes (triple-quote injection guard) &gt; does not flag safe Python code" time="0.000277065">
+        </testcase>
+        <testcase classname="tests/unit/ts/triple-quote-guard.test.ts" name="assertNoTripleQuotes (triple-quote injection guard) &gt; does not flag content with only double quotes" time="0.000172109">
+        </testcase>
+        <testcase classname="tests/unit/ts/triple-quote-guard.test.ts" name="assertNoTripleQuotes (triple-quote injection guard) &gt; does not flag one single quote" time="0.000109924">
+        </testcase>
+        <testcase classname="tests/unit/ts/triple-quote-guard.test.ts" name="assertNoTripleQuotes (triple-quote injection guard) &gt; does not flag two consecutive single quotes" time="0.000168984">
+        </testcase>
+        <testcase classname="tests/unit/ts/triple-quote-guard.test.ts" name="assertNoTripleQuotes (triple-quote injection guard) &gt; does not flag mixed double and single quotes" time="0.000123159">
+        </testcase>
+        <testcase classname="tests/unit/ts/triple-quote-guard.test.ts" name="assertNoTripleQuotes (triple-quote injection guard) &gt; injection risk examples &gt; attacker input that would break exec(&apos;&apos;&apos;...&apos;&apos;&apos;)" time="0.000358777">
+        </testcase>
+        <testcase classname="tests/unit/ts/triple-quote-guard.test.ts" name="assertNoTripleQuotes (triple-quote injection guard) &gt; injection risk examples &gt; safe variable name is clean" time="0.000152733">
+        </testcase>
+    </testsuite>
+</testsuites>