@akira-tl/forgerelay 0.8.9 → 0.8.10

package/CHANGELOG.md

@@ -4,6 +4,26 @@ All notable ForgeRelay changes are documented here.
 
 ## [Unreleased]
 
+## [0.8.10] - 2026-09-03
+
+### Added
+
+- Added user-controlled managed Language Server installation for TypeScript/JavaScript code intelligence, including private TypeScript SDK wiring, live runtime refresh, and post-mutation diagnostics without restarting ForgeRelay.
+- Added explicit setup flows for local/SSH-only use versus network-exposed ForgeRelay deployments.
+
+### Changed
+
+- Workspace instructions and Skills now stream bounded live deltas after a Workspace is opened, while Agents are prompted to maintain `workspace.tasks` proactively for long-running work instead of querying Tasks mechanically on every open.
+- Agent Bash execution now uses an isolated non-interactive shell environment, and SSH-assisted authentication no longer sources the user's interactive shell configuration.
+- Retired the bundled `subagent-delegation` Skill; required delegation behavior remains in the Subagent capability contract and guide.
+
+### Fixed
+
+- Increased the default foreground process wait and stabilized cancellation/concurrency behavior around Language Server diagnostics.
+- Fixed Windows `.cmd`/`.bat` Language Server launchers and kept ordinary external LSP interoperability independent of ForgeRelay's managed-LSP config directory.
+- Preserved Windows `cmd.exe` command quoting for isolated Agent Bash execution, including commands whose executable path is already quoted.
+- Hardened release verification with pinned publishing tooling and dedicated per-version release notes.
+
 ## [0.8.9] - 2026-09-02
 
 ### Changed

package/capabilities/code-intelligence/GUIDE.md

@@ -1,8 +1,10 @@
 # Code Intelligence
 
-Use the `code.intelligence` Capability for read-only semantic code navigation backed by Language servers that are already installed on the user's machine or explicitly configured for the project.
+Use the `code.intelligence` Capability for semantic code navigation, diagnostics, and optional ForgeRelay-managed Language Server installation.
 
-ForgeRelay does not install Language servers. It discovers supported executables when available and accepts explicit definitions from the global ForgeRelay config or `<workspace>/.forgerelay/language-servers.json`. Project definitions override global definitions, and global definitions override built-in discovery. An explicit definition may disable discovery with `enabled: false`.
+ForgeRelay discovers supported executables from project/global configuration, its private managed Language Server directory, and the inherited process `PATH`. Project definitions override global definitions, while built-in discovery can use ForgeRelay-managed executables before falling back to `PATH`. An explicit definition may disable discovery with `enabled: false`.
+
+`managed.status` reports which ForgeRelay-managed servers are supported and currently installed. `managed.install` can install `typescript` or `pyright` into ForgeRelay's private config directory, but only when the user has explicitly enabled Agent-managed installation during `forgerelay init`. Installation is persistent and network-active, so it is disabled by default. A successful install requires no ForgeRelay restart: the next semantic request resolves executables again, and any changed Language-service command/fingerprint replaces the prior idle service automatically.
 
 ForgeRelay 0.4 LSP v1 exposes `definition`, `hover`, `references`, `documentSymbols`, `workspaceSymbols`, and `diagnostics`. Position-based operations accept a workspace-relative source `path` plus 1-based `line` and `column` values. `documentSymbols` needs only `path` and an optional bounded `limit`. `workspaceSymbols` uses `path` to select the Language project/service and accepts a `query` plus optional `limit`; it does not merge multiple nested Language services. `diagnostics` uses `path` plus an optional bounded `limit`. Columns are Unicode code-point positions; ForgeRelay converts them to the position encoding negotiated with the Language server.
 
@@ -12,6 +14,8 @@ Document symbols preserve hierarchical server responses as a tree and keep flat
 
 Diagnostics use the same normalized result contract for push and pull providers. When a Language server advertises LSP pull diagnostics, ForgeRelay prefers pull, supplies the previous `resultId` when available, and treats an `unchanged` report as a refresh of the same bounded snapshot for the newly synchronized filesystem version. Otherwise ForgeRelay uses traditional `publishDiagnostics` snapshots. Push diagnostics retain only the latest snapshot for each synchronized document: no diagnostic history is accumulated. A result reports `provider`, bounded normalized diagnostics, `returned`/`truncated`/`total`, and `freshness`. `freshness.state` distinguishes fresh, stale, missing, and unknown snapshots; filesystem changes advance ForgeRelay's synchronized document version, making an older push snapshot detectably stale until the Language server publishes a replacement. Pull and push state are bounded independently so a mixed-capability server cannot overwrite pull `resultId` state with an asynchronous push. All diagnostic state is released with the Language service.
 
+Successful `write`, `edit`, `rename`, and Codex `apply_patch` mutations automatically request diagnostics for the affected code files and append non-empty results to the same mutation response. This post-mutation validation does not create a second Activity. Files with no matching Language Server are skipped silently; a Language Server validation failure never rolls back an already-successful file mutation, but ForgeRelay appends a bounded validation warning so the Agent can react instead of forgetting to check.
+
 Semantic locations may identify External code locations outside the Workspace, but that does not expand ForgeRelay's allowed roots or grant the file tools permission to read those paths.
 
 Language-server definitions use structured process configuration rather than shell command strings. A project configuration entry may contain `command`, `args`, `env`, `languages`, `extensions`, `languageIdByExtension`, `projectMarkers`, and `enabled` fields. Use `languageIdByExtension` when one server definition covers multiple language IDs whose extensions do not map one-to-one by array position. The server command is launched directly without a shell.
@@ -22,4 +26,4 @@ An unexpected Language-server process exit fails its pending JSON-RPC work immed
 
 Language services are shared by physical Language project identity rather than logical Workspace id, so multiple conversations over the same checkout do not multiply server processes. Idle services are reclaimed after a bounded TTL, and the global service cap evicts the least-recently-used truly idle service; a request that has returned to the Host but whose server ignored cancellation still counts as active until the underlying LSP request settles. Managed-worktree finalization releases idle Language services rooted in that worktree before removing it and refuses finalization while semantic work is still active. Debug runtime telemetry reports only aggregate service/process/request/document/diagnostic/stderr counts and never source contents.
 
-The built-in discovery candidates are `typescript-language-server`, `pyright-langserver`, `rust-analyzer`, `gopls`, and `clangd`. Contributors can run `npm run lsp:interop` to exercise any of those executables that are already present on `PATH`; each detected server is tested through built-in discovery and real stdio LSP, while absent servers are reported as explicit skips. The interoperability check never downloads or installs a Language server.
+The built-in discovery candidates are `typescript-language-server`, `pyright-langserver`, `rust-analyzer`, `gopls`, and `clangd`. `forgerelay init` can install TypeScript/JavaScript (`typescript-language-server` plus TypeScript) and Python (Pyright) into the ForgeRelay config directory without modifying global npm. Rust Analyzer, `gopls`, and `clangd` remain external toolchain/system installations. Contributors can run `npm run lsp:interop` to exercise detected executables through real stdio LSP; the interoperability check itself never downloads or installs a Language server.

package/capabilities/subagents/GUIDE.md

@@ -2,6 +2,15 @@
 
 当任务需要委派给另一个本地 coding agent、获取第二意见、并行调查，或用户明确点名 Subagent/provider 时读取本指南。
 
+## 委派策略与透明性
+
+- 只在用户明确要求委派、点名 Subagent/provider、要求第二意见或并行调查，或任务本身明确需要另一个独立 coding agent 时使用 Subagent；不要因为 profile 存在就静默委派普通工作。
+- 使用 Subagent 时应让用户知道正在委派给哪个 profile/provider；不要隐藏 Subagent 的参与。
+- 不要通过 `bash` 直接启动 `codex`、`claude`、`opencode`、`pi`、`cursor-agent` 或 `copilot` 来绕过 ForgeRelay 的 Session ownership、审计与结果交付。正常 Host 委派使用 `subagent.session`。
+- delegated prompt 必须自包含：说明目标、相关 Workspace/文件、关键约束与验收标准。Subagent 不会自动继承主 Agent 未显式传递的隐含上下文。
+- `reviewer` 适合第二意见/风险/测试缺口，`explorer` 适合只读调查，`implementer` 只在用户允许委派写入工作时使用。
+- Subagent 返回值不是已经验证的最终答案。主 Agent 必须核对关键事实；写入任务检查真实 diff 并运行相关测试，只读调查核对关键路径/符号证据。最终向用户说明使用的 profile/provider、结论、已做验证与剩余风险。
+
 ## 当前接口
 
 启用 Subagent 后，`open_workspace` 会在 `capabilityCatalog` 中公开 `subagent.session`，同时返回紧凑的 provider/profile 元数据。不要为 Subagent 寻找或假设额外的 Core MCP tool；长期可见 Core tool surface 保持不变。

package/capabilities/workspace/workspace-tasks/GUIDE.md

@@ -10,6 +10,12 @@
 - Task 状态只有 `pending`、`in_progress`、`completed`。`content` 保存继续工作真正需要的要求、阻塞点、结论或下一步，而不是日志或对话转录。
 - Task/List ID 创建后保持稳定。完成 Task 不会删除它；删除必须显式执行。
 
+## 主动维护
+
+把 `workspace.tasks` 当作需要跨多个步骤、较长工作过程或跨会话续接时的轻量工作记忆：当存在值得保留的下一步、阻塞点或当前进展时，主动创建或更新 Task；完成后及时标记 `completed`。不要因为刚执行了 `open_workspace` 就机械查询 Task。
+
+需要续接相关未完成工作时，再从 summary 开始渐进读取；只有 summary 表明确有相关未完成 Task，才继续读取 headers/detail。
+
 ## 渐进式读取
 
 Task 读取默认使用渐进式披露，不会一次返回所有 `content`：

package/dist/cli/init.js

@@ -0,0 +1,180 @@
+import { resolve } from "node:path";
+import * as prompts from "@clack/prompts";
+import { publicEndpointUrl } from "../mcp/oauth/public-url.js";
+import { expandHomePath } from "../mcp/filesystem/roots.js";
+import { installManagedLanguageServers, installedManagedLanguageServers, managedLanguageServerOptions, } from "../lsp/runtime/managed-language-servers.js";
+import { generateInstanceId, generateOwnerToken, loadForgeRelayFiles, resolveSubagentsFlag, writeForgeRelayAuth, writeForgeRelayConfig, } from "../runtime/config/user-config.js";
+import { classifyClientFacingBaseUrl, compactPublicBaseUrlConfig, hasInsecureLanBaseUrl, isLoopbackBindAddress, normalizePublicBaseUrlsInput, SetupCancelledError, textPrompt, validateBindAddress, validateClientFacingBaseUrls, validatePort, } from "./setup-support.js";
+export async function runInit({ force }) {
+    const files = loadForgeRelayFiles();
+    if (!force && files.configExists && files.authExists) {
+        prompts.log.info(`ForgeRelay is already configured at ${files.dir}`);
+        prompts.log.info("Run `forgerelay init --force` to update it.");
+        return;
+    }
+    try {
+        prompts.intro("ForgeRelay setup");
+        const defaultRoots = files.config.allowedRoots?.join(", ") || process.cwd();
+        const rootsAnswer = await textPrompt({
+            message: `Where are your projects located? Press Enter to use ${defaultRoots}`,
+            placeholder: defaultRoots,
+            defaultValue: defaultRoots,
+            validate: (value) => value?.trim() ? undefined : "Enter at least one project root.",
+        });
+        const allowedRoots = rootsAnswer
+            .split(",")
+            .map((root) => resolve(expandHomePath(root.trim())))
+            .filter(Boolean);
+        const defaultPort = String(files.config.port ?? 7676);
+        const portAnswer = await textPrompt({
+            message: `Which local port should ForgeRelay use? Press Enter to use ${defaultPort}`,
+            placeholder: defaultPort,
+            defaultValue: defaultPort,
+            validate: validatePort,
+        });
+        const port = Number(portAnswer);
+        const existingPublicBaseUrls = Array.isArray(files.config.publicBaseUrl)
+            ? files.config.publicBaseUrl
+            : files.config.publicBaseUrl ? [files.config.publicBaseUrl] : [];
+        const defaultNetworkMode = !isLoopbackBindAddress(files.config.host ?? "127.0.0.1") || existingPublicBaseUrls.length > 0
+            ? "network"
+            : "local";
+        const selectedMode = await prompts.select({
+            message: "How should clients reach this ForgeRelay instance?",
+            initialValue: defaultNetworkMode,
+            options: [
+                {
+                    value: "local",
+                    label: "Local only",
+                    hint: "Bind to loopback; local clients only. Client-facing URL is derived automatically.",
+                },
+                {
+                    value: "ssh",
+                    label: "SSH relay",
+                    hint: "Bind to loopback; another ForgeRelay reaches it through an SSH tunnel.",
+                },
+                {
+                    value: "network",
+                    label: "LAN / HTTPS proxy",
+                    hint: "Expose through a LAN address or an HTTPS reverse proxy/tunnel.",
+                },
+            ],
+        });
+        if (prompts.isCancel(selectedMode))
+            throw new SetupCancelledError();
+        const networkMode = selectedMode;
+        let host = "127.0.0.1";
+        let publicBaseUrl = null;
+        let clientFacingBaseUrls = [`http://127.0.0.1:${port}`];
+        if (networkMode === "network") {
+            const defaultHost = files.config.host && !isLoopbackBindAddress(files.config.host)
+                ? files.config.host
+                : "0.0.0.0";
+            host = await textPrompt({
+                message: "Which address should ForgeRelay bind to? Use 0.0.0.0 for direct LAN, or 127.0.0.1 behind a local reverse proxy.",
+                placeholder: defaultHost,
+                defaultValue: defaultHost,
+                validate: validateBindAddress,
+            });
+            const defaultClientFacing = existingPublicBaseUrls.join(", ");
+            clientFacingBaseUrls = normalizePublicBaseUrlsInput(await textPrompt({
+                message: defaultClientFacing
+                    ? `What client-facing base URLs should clients use? Press Enter to keep ${defaultClientFacing}`
+                    : "What client-facing base URL should clients use?",
+                placeholder: defaultClientFacing || `http://192.168.1.20:${port} or https://forge.example.com`,
+                defaultValue: defaultClientFacing,
+                validate: validateClientFacingBaseUrls,
+            }));
+            for (const baseUrl of clientFacingBaseUrls)
+                classifyClientFacingBaseUrl(baseUrl);
+            if (hasInsecureLanBaseUrl(clientFacingBaseUrls)) {
+                prompts.note([
+                    "Plain HTTP does not encrypt the ForgeRelay Owner approval flow or MCP bearer tokens.",
+                    "Use this only on a trusted private LAN. Prefer SSH relay or HTTPS when the network is not fully trusted.",
+                ].join("\n"), "Unencrypted LAN access");
+                const approved = await prompts.confirm({
+                    message: "Allow unencrypted HTTP access on this private network?",
+                    initialValue: false,
+                });
+                if (prompts.isCancel(approved) || approved !== true)
+                    throw new SetupCancelledError();
+            }
+            publicBaseUrl = compactPublicBaseUrlConfig(clientFacingBaseUrls);
+        }
+        const installedManaged = installedManagedLanguageServers(files.dir);
+        const selectedManaged = await prompts.multiselect({
+            message: "Which Language Servers should ForgeRelay manage with npm?",
+            options: managedLanguageServerOptions(),
+            initialValues: installedManaged,
+            required: false,
+        });
+        if (prompts.isCancel(selectedManaged))
+            throw new SetupCancelledError();
+        const managedIds = selectedManaged;
+        const allowAgentInstallAnswer = await prompts.confirm({
+            message: "Allow Agents to install or update ForgeRelay-managed Language Servers on demand?",
+            initialValue: files.config.allowAgentLanguageServerInstall === true,
+        });
+        if (prompts.isCancel(allowAgentInstallAnswer))
+            throw new SetupCancelledError();
+        const allowAgentLanguageServerInstall = allowAgentInstallAnswer === true;
+        if (managedIds.length > 0) {
+            prompts.note([
+                "ForgeRelay installs these optional Language Servers into its private config directory, not global npm.",
+                "Rust Analyzer, gopls, and clangd remain external toolchain/system installations and are auto-detected when available.",
+            ].join("\n"), "Managed Language Servers");
+            const spinner = prompts.spinner();
+            spinner.start("Installing managed Language Servers with npm");
+            try {
+                const installed = await installManagedLanguageServers(managedIds, files.dir);
+                spinner.stop(`Installed ${installed.installed.join(", ")} under ${installed.root}`);
+            }
+            catch (error) {
+                spinner.stop("Managed Language Server installation failed");
+                throw error;
+            }
+        }
+        const config = {
+            host,
+            port,
+            allowedRoots,
+            publicBaseUrl,
+            allowedHosts: files.config.allowedHosts,
+            workflowInstructions: files.config.workflowInstructions,
+            appendInstructions: files.config.appendInstructions,
+            subagents: resolveSubagentsFlag(files.config),
+            languageServers: files.config.languageServers,
+            allowAgentLanguageServerInstall,
+        };
+        const auth = {
+            ...files.auth,
+            ownerToken: files.auth.ownerToken ?? generateOwnerToken(),
+            instanceId: files.auth.instanceId ?? generateInstanceId(),
+        };
+        const configPath = writeForgeRelayConfig(config);
+        const authPath = await writeForgeRelayAuth(auth);
+        const lines = [
+            `Config: ${configPath}`,
+            `Auth: ${authPath}`,
+            `Bind: http://${config.host}:${config.port}`,
+            ...clientFacingBaseUrls.map((baseUrl, index) => `${index === 0 ? "Client-facing MCP URL" : "Client-facing MCP alias"}: ${publicEndpointUrl(baseUrl, "mcp").toString()}`),
+        ];
+        if (networkMode === "ssh") {
+            lines.push(`SSH relay: forgerelay auth -J <ssh-host> 127.0.0.1:${port} --ssh-auth`);
+        }
+        prompts.note(lines.join("\n"), "ForgeRelay configured");
+        prompts.note([
+            `Owner password: ${auth.ownerToken}`,
+            "Use this when ChatGPT or Claude asks you to approve ForgeRelay access.",
+            `Stored at: ${authPath}`,
+        ].join("\n"), "Owner password");
+        prompts.outro("Run `forgerelay serve` to start the MCP server.");
+    }
+    catch (error) {
+        if (error instanceof SetupCancelledError) {
+            prompts.cancel("Setup cancelled");
+            return;
+        }
+        throw error;
+    }
+}

package/dist/cli/setup-support.js

@@ -1,3 +1,4 @@
+import { isIP } from "node:net";
 import { createRequire } from "node:module";
 import * as prompts from "@clack/prompts";
 import { satisfies } from "semver";
@@ -33,6 +34,57 @@ export function normalizePublicBaseUrl(value) {
     parsed.pathname = parsed.pathname.replace(/\/+$/, "");
     return parsed.toString().replace(/\/$/, "");
 }
+export function classifyClientFacingBaseUrl(value) {
+    const parsed = new URL(normalizePublicBaseUrl(value));
+    if (parsed.protocol === "https:")
+        return "secure";
+    if (parsed.protocol !== "http:") {
+        throw new Error("Client-facing base URLs must use http:// or https://.");
+    }
+    if (!isPrivateNetworkHost(parsed.hostname)) {
+        throw new Error("Plain HTTP is allowed only for local/LAN addresses. Use HTTPS for public addresses.");
+    }
+    return "insecure-lan";
+}
+export function validateClientFacingBaseUrls(value) {
+    const trimmed = value?.trim() ?? "";
+    if (!trimmed)
+        return "Enter at least one client-facing base URL.";
+    try {
+        for (const baseUrl of normalizePublicBaseUrlsInput(trimmed))
+            classifyClientFacingBaseUrl(baseUrl);
+        return undefined;
+    }
+    catch (error) {
+        return error instanceof Error ? error.message : String(error);
+    }
+}
+export function hasInsecureLanBaseUrl(baseUrls) {
+    return baseUrls.some((baseUrl) => classifyClientFacingBaseUrl(baseUrl) === "insecure-lan");
+}
+function isPrivateNetworkHost(hostname) {
+    const host = hostname.toLowerCase().replace(/^\[|\]$/g, "");
+    if (host === "localhost" || !host.includes(".") || host.endsWith(".local") || host.endsWith(".lan") || host.endsWith(".home.arpa")) {
+        return true;
+    }
+    const family = isIP(host);
+    if (family === 4) {
+        const [a, b] = host.split(".").map(Number);
+        return a === 10
+            || a === 127
+            || (a === 172 && b >= 16 && b <= 31)
+            || (a === 192 && b === 168)
+            || (a === 169 && b === 254)
+            || (a === 100 && b >= 64 && b <= 127);
+    }
+    if (family === 6) {
+        return host === "::1"
+            || host.startsWith("fc")
+            || host.startsWith("fd")
+            || /^fe[89ab]/.test(host);
+    }
+    return false;
+}
 export async function textPrompt(options) {
     const result = await prompts.text({
         ...options,
@@ -49,6 +101,19 @@ export function validatePort(value) {
         ? undefined
         : "Enter a port between 1 and 65535.";
 }
+export function isLoopbackBindAddress(value) {
+    const host = value.trim().toLowerCase();
+    return host === "127.0.0.1" || host === "localhost" || host === "::1";
+}
+export function validateBindAddress(value) {
+    const host = value?.trim() ?? "";
+    if (!host)
+        return "Enter a bind address.";
+    if (/\s|:\/\//.test(host) || host.includes("/")) {
+        return "Enter only a host or IP address, not a URL.";
+    }
+    return undefined;
+}
 export function validateRequiredPublicBaseUrls(value) {
     const trimmed = value?.trim() ?? "";
     if (!trimmed)

package/dist/cli.js

@@ -9,19 +9,19 @@ import { join, resolve } from "node:path";
 import { fileURLToPath } from "node:url";
 import * as prompts from "@clack/prompts";
 import { loadConfig } from "./runtime/config/config.js";
+import { runInit } from "./cli/init.js";
 import { runHooksCommand } from "./mcp/hooks/hook-cli.js";
 import { executeSubagentSession } from "./subagents/sessions/execution.js";
 import { SubagentDeliveryMailbox } from "./subagents/sessions/delivery-mailbox.js";
 import { SubagentSessionManager } from "./subagents/sessions/manager.js";
 import { formatSubagentProviderAvailabilitySummary } from "./subagents/providers/availability.js";
 import { parseSubagentRunArgs } from "./subagents/cli-target.js";
-import { ensureForgeRelayInstanceId, generateInstanceId, generateOwnerToken, loadForgeRelayFiles, removeForgeRelayRemote, renameForgeRelayRemote, resolveSubagentsFlag, writeForgeRelayAuth, writeForgeRelayConfig, writeForgeRelayRemote, } from "./runtime/config/user-config.js";
-import { expandHomePath } from "./mcp/filesystem/roots.js";
+import { ensureForgeRelayInstanceId, loadForgeRelayFiles, removeForgeRelayRemote, renameForgeRelayRemote, writeForgeRelayConfig, writeForgeRelayRemote, } from "./runtime/config/user-config.js";
 import { shutdownHttpServer } from "./mcp/server/transport/server-shutdown.js";
 import { publicEndpointUrl } from "./mcp/oauth/public-url.js";
 import { authenticateRemote, defaultRemoteAlias, isRemoteMcpUnauthorized, normalizeRemoteServiceTarget, refreshRemoteAuthentication, verifyRemoteMcp, } from "./workspaces/relay/auth/remote-auth.js";
 import { defaultSshRouteAlias, parseSshRoute, readRemoteOwnerToken, withRemoteServiceEndpoint, } from "./workspaces/relay/transport/remote-transport.js";
-import { normalizeOptionalPublicBaseUrl, normalizePublicBaseUrlsInput, compactPublicBaseUrlConfig, textPrompt, validatePort, validateRequiredPublicBaseUrls, assertSupportedNode, nodeVersionStatus, SetupCancelledError, checkSqliteNative, checkGitAvailable, checkBashShell } from "./cli/setup-support.js";
+import { assertSupportedNode, checkBashShell, checkGitAvailable, checkSqliteNative, nodeVersionStatus, normalizeOptionalPublicBaseUrl, } from "./cli/setup-support.js";
 const require = createRequire(import.meta.url);
 async function main(argv) {
     assertSupportedNode();
@@ -91,92 +91,6 @@ async function ensureConfigured() {
     }
     await runInit({ force: false });
 }
-async function runInit({ force }) {
-    const files = loadForgeRelayFiles();
-    if (!force && files.configExists && files.authExists) {
-        prompts.log.info(`ForgeRelay is already configured at ${files.dir}`);
-        prompts.log.info("Run `forgerelay init --force` to update it.");
-        return;
-    }
-    try {
-        prompts.intro("ForgeRelay setup");
-        const defaultRoots = files.config.allowedRoots?.join(", ") || process.cwd();
-        const rootsAnswer = await textPrompt({
-            message: `Where are your projects located? Press Enter to use ${defaultRoots}`,
-            placeholder: defaultRoots,
-            defaultValue: defaultRoots,
-            validate: (value) => value?.trim() ? undefined : "Enter at least one project root.",
-        });
-        const allowedRoots = rootsAnswer
-            .split(",")
-            .map((root) => resolve(expandHomePath(root.trim())))
-            .filter(Boolean);
-        const defaultPort = String(files.config.port ?? 7676);
-        const portAnswer = await textPrompt({
-            message: `Which local port should ForgeRelay use? Press Enter to use ${defaultPort}`,
-            placeholder: defaultPort,
-            defaultValue: defaultPort,
-            validate: validatePort,
-        });
-        const port = Number(portAnswer);
-        prompts.note([
-            "ForgeRelay needs one or more public base URLs so ChatGPT or Claude can reach this MCP server.",
-            "Create a tunnel or reverse proxy with Cloudflare Tunnel, ngrok, Pinggy, Tailscale Funnel, or your own HTTPS proxy.",
-            "Each URL may include its own route prefix. Separate multiple URLs with commas; the first is canonical.",
-            "",
-            "Example: https://forge.example.com/forgerelay/main, https://alias.example.com/relay",
-        ].join("\n"), "Public URL required");
-        const defaultPublicBaseUrls = Array.isArray(files.config.publicBaseUrl)
-            ? files.config.publicBaseUrl.join(", ")
-            : files.config.publicBaseUrl ?? "";
-        const publicBaseUrls = normalizePublicBaseUrlsInput(await textPrompt({
-            message: defaultPublicBaseUrls
-                ? `What are the public base URLs? Press Enter to keep ${defaultPublicBaseUrls}`
-                : "What are the public base URLs?",
-            placeholder: defaultPublicBaseUrls || "https://your-tunnel-host.example.com",
-            defaultValue: defaultPublicBaseUrls,
-            validate: validateRequiredPublicBaseUrls,
-        }));
-        const publicBaseUrl = compactPublicBaseUrlConfig(publicBaseUrls);
-        const config = {
-            host: files.config.host ?? "127.0.0.1",
-            port,
-            allowedRoots,
-            publicBaseUrl,
-            allowedHosts: files.config.allowedHosts,
-            workflowInstructions: files.config.workflowInstructions,
-            appendInstructions: files.config.appendInstructions,
-            subagents: resolveSubagentsFlag(files.config),
-        };
-        const auth = {
-            ...files.auth,
-            ownerToken: files.auth.ownerToken ?? generateOwnerToken(),
-            instanceId: files.auth.instanceId ?? generateInstanceId(),
-        };
-        const configPath = writeForgeRelayConfig(config);
-        const authPath = await writeForgeRelayAuth(auth);
-        const lines = [
-            `Config: ${configPath}`,
-            `Auth: ${authPath}`,
-            `Local MCP URL: http://${config.host}:${config.port}/mcp`,
-            ...publicBaseUrls.map((baseUrl, index) => `${index === 0 ? "Public MCP URL" : "Public MCP alias"}: ${publicEndpointUrl(baseUrl, "mcp").toString()}`),
-        ];
-        prompts.note(lines.join("\n"), "ForgeRelay configured");
-        prompts.note([
-            `Owner password: ${auth.ownerToken}`,
-            "Use this when ChatGPT or Claude asks you to approve ForgeRelay access.",
-            `Stored at: ${authPath}`,
-        ].join("\n"), "Owner password");
-        prompts.outro("Run `forgerelay serve` to start the MCP server.");
-    }
-    catch (error) {
-        if (error instanceof SetupCancelledError) {
-            prompts.cancel("Setup cancelled");
-            return;
-        }
-        throw error;
-    }
-}
 async function serve() {
     const sqliteStatus = checkSqliteNative();
     if (sqliteStatus !== "ok") {
@@ -193,7 +107,7 @@ async function serve() {
     const { app, close, subagentProviders } = createServer(config);
     const httpServer = app.listen(config.port, config.host, () => {
         console.log(`forgerelay listening on http://${config.host}:${config.port}/mcp`);
-        console.log(`public base url: ${config.publicBaseUrl}`);
+        console.log(`client-facing base url: ${config.publicBaseUrl}`);
         console.log(`allowed roots: ${config.allowedRoots.join(", ")}`);
         console.log(`allowed hosts: ${config.allowedHosts.join(", ")}`);
         if (config.allowedHosts.includes("*")) {
@@ -394,16 +308,17 @@ async function runDoctor() {
     console.log(`SQLite native dependency: ${checkSqliteNative()}`);
     try {
         const config = loadConfig();
-        console.log(`Local MCP URL: http://${config.host}:${config.port}/mcp`);
-        console.log(`Public base URLs: ${config.publicBaseUrls.join(", ")}`);
-        console.log(`Public base URL: ${config.publicBaseUrl}`);
-        console.log(`Public MCP URL: ${publicEndpointUrl(config.publicBaseUrl, "mcp").toString()}`);
+        console.log(`Bind MCP URL: http://${config.host}:${config.port}/mcp`);
+        console.log(`Client-facing base URLs: ${config.publicBaseUrls.join(", ")}`);
+        console.log(`Client-facing base URL: ${config.publicBaseUrl}`);
+        console.log(`Client-facing MCP URL: ${publicEndpointUrl(config.publicBaseUrl, "mcp").toString()}`);
         console.log(`Tool mode: ${config.toolMode}`);
         console.log(`Widgets: ${config.widgets}`);
         console.log(`Trust proxy: ${config.logging.trustProxy ? "one hop" : "off"}`);
         console.log(`Artifacts: ${config.artifactsEnabled ? "enabled" : "disabled"}`);
         console.log(`Subagents: ${config.subagents ? "enabled" : "disabled"}`);
         console.log(`Skills: ${config.skillsEnabled ? "enabled" : "disabled"}`);
+        console.log(`Agent-managed Language Server install: ${config.allowAgentLanguageServerInstall ? "enabled" : "disabled"}`);
         console.log(`Allowed roots: ${config.allowedRoots.join(", ")}`);
         console.log(`Allowed hosts: ${config.allowedHosts.join(", ")}`);
     }

package/dist/lsp/code-intelligence.js

@@ -3,7 +3,7 @@ import { readFile, realpath } from "node:fs/promises";
 import { basename, resolve } from "node:path";
 import { pathToFileURL } from "node:url";
 import { createMessageConnection } from "vscode-jsonrpc/node";
-import { DefinitionRequest, DocumentDiagnosticReportKind, DocumentDiagnosticRequest, DocumentSymbolRequest, ExitNotification, HoverRequest, InitializeRequest, ReferencesRequest, InitializedNotification, MarkupKind, PositionEncodingKind, PublishDiagnosticsNotification, ShutdownRequest, WorkspaceSymbolRequest, } from "vscode-languageserver-protocol";
+import { DefinitionRequest, DiagnosticTag, DocumentDiagnosticReportKind, DocumentDiagnosticRequest, DocumentSymbolRequest, ExitNotification, HoverRequest, InitializeRequest, ReferencesRequest, InitializedNotification, MarkupKind, PositionEncodingKind, PublishDiagnosticsNotification, ShutdownRequest, WorkspaceSymbolRequest, } from "vscode-languageserver-protocol";
 import { LanguageServerConfigurationError, } from "./language-server-config.js";
 import { terminateProcessTree } from "../mcp/process/process-platform.js";
 import { CodeIntelligenceError } from "./code-intelligence-error.js";
@@ -14,9 +14,11 @@ import { isWithin, locationEntries, normalizeLocations, workspaceDisplayPath, }
 import { lspPositionFromUser, rangeFromLsp } from "./position-encoding.js";
 import { DiagnosticSnapshotStore } from "./runtime/diagnostic-snapshots.js";
 import { DocumentSynchronizer } from "./runtime/document-synchronizer.js";
+import { languageServerCommandRequiresShell } from "./runtime/process-launch.js";
 import { SemanticRequestCoordinator } from "./runtime/semantic-requests.js";
 export { CodeIntelligenceError } from "./code-intelligence-error.js";
 const STDERR_TAIL_BYTES = 64 * 1024;
+const PUSH_DIAGNOSTIC_WAIT_MS = 1_000;
 export class LanguageService {
     workspaceRoot;
     project;
@@ -258,7 +260,10 @@ export class LanguageService {
                     ...this.diagnosticSnapshots.readPull(document, limit),
                 };
             }
-            const snapshot = this.diagnosticSnapshots.readPush(document, limit);
+            const snapshot = await this.diagnosticSnapshots.waitForFreshPush(document, limit, Math.min(PUSH_DIAGNOSTIC_WAIT_MS, this.policy.requestTimeoutMs), signal);
+            if (signal?.aborted) {
+                throw new CodeIntelligenceError("code.request_cancelled", `Diagnostic request for ${input.path} was cancelled by the Host.`);
+            }
             if (snapshot.freshness.state === "missing" && !this.diagnosticSnapshots.hasObservedPushDiagnostics()) {
                 throw new CodeIntelligenceError("code.operation_unsupported", `Language server ${this.project.definition.id} does not provide pull diagnostics and has not published push diagnostics.`);
             }
@@ -336,7 +341,7 @@ export class LanguageService {
                 stdio: "pipe",
                 windowsHide: true,
                 detached,
-                shell: false,
+                shell: languageServerCommandRequiresShell(definition.command),
             });
         }
         catch (error) {
@@ -370,6 +375,9 @@ export class LanguageService {
             clientInfo: { name: "forgerelay" },
             rootUri,
             workspaceFolders: [{ uri: rootUri, name: basename(this.project.projectRoot) }],
+            ...(definition.initializationOptions === undefined
+                ? {}
+                : { initializationOptions: definition.initializationOptions }),
             capabilities: {
                 general: {
                     positionEncodings: [
@@ -405,6 +413,12 @@ export class LanguageService {
                         dynamicRegistration: false,
                         hierarchicalDocumentSymbolSupport: true,
                     },
+                    publishDiagnostics: {
+                        relatedInformation: true,
+                        tagSupport: {
+                            valueSet: [DiagnosticTag.Unnecessary, DiagnosticTag.Deprecated],
+                        },
+                    },
                     diagnostic: {
                         dynamicRegistration: false,
                         relatedDocumentSupport: false,