@herbertgao/pi-extensions 2026.8.5 → 2026.8.7

package/node_modules/pi-lens/dist/clients/lsp/server.js

@@ -13,7 +13,7 @@ import path from "node:path";
 import { getGlobalPiLensDir, getProjectIgnoreGlobs, isPathIgnoredByProject, } from "../file-utils.js";
 import { STAGE_TMP_PATTERN } from "../atomic-write-staging.js";
 import { DOTNET_CSHARP_ROOT_MARKERS, DOTNET_FSHARP_ROOT_MARKERS, KIND_EXTENSIONS, } from "../file-kinds.js";
-import { direntsHaveMarkerGlobMatch, isAtOrAboveHomeDir, isFullyQualified, } from "../path-utils.js";
+import { direntsHaveMarkerGlobMatch, isAtOrAboveHomeDir, isFullyQualified, isWindowsPath, pathsEqual, } from "../path-utils.js";
 import { ensureTool, getToolEnvironment, getToolPath, } from "../installer/index.js";
 import { resolveOpengrepConfig } from "../opengrep-config.js";
 import { isZizmorAuditTarget, resolveZizmorGitHubToken } from "../zizmor-config.js";
@@ -78,17 +78,22 @@ const PROJECT_BOUNDARY_MARKERS = [
 // with FALLBACK_PROJECT_MARKERS, the shared fallback root-policy marker set.
 const loggedRootCeilingClamps = new Set();
 function isSameOrWithin(ancestor, candidate) {
-    const relative = path.relative(path.resolve(ancestor), path.resolve(candidate));
-    return relative === "" || (!relative.startsWith("..") && !path.isAbsolute(relative));
+    const windowsShaped = isWindowsPath(ancestor) || isWindowsPath(candidate);
+    const pathApi = windowsShaped ? path.win32 : path;
+    const relative = pathApi.relative(pathApi.resolve(ancestor), pathApi.resolve(candidate));
+    return (relative === "" ||
+        (!relative.startsWith("..") && !pathApi.isAbsolute(relative)));
 }
 /** Enforce the session cwd as the hard boundary for LSP client root selection. */
 export function enforceLspRootCeiling(root, sessionCwd, filePath) {
-    const resolvedRoot = path.resolve(root);
-    const resolvedCwd = path.resolve(sessionCwd);
+    const windowsShaped = isWindowsPath(root) || isWindowsPath(sessionCwd);
+    const pathApi = windowsShaped ? path.win32 : path;
+    const resolvedRoot = pathApi.resolve(root);
+    const resolvedCwd = pathApi.resolve(sessionCwd);
     // Callers may explicitly inspect an out-of-session file (notably isolated
     // tests and API consumers). The cwd ceiling governs roots for files that are
     // actually inside the declared session project.
-    if (filePath && !isSameOrWithin(resolvedCwd, path.resolve(filePath))) {
+    if (filePath && !isSameOrWithin(resolvedCwd, pathApi.resolve(filePath))) {
         return resolvedRoot;
     }
     if (isSameOrWithin(resolvedCwd, resolvedRoot))
@@ -187,6 +192,15 @@ function canInstall(allowInstall) {
 const DIRECT_LSP_NEGATIVE_TTL_MS = Math.max(30_000, Number.parseInt(process.env.PI_LENS_DIRECT_LSP_NEGATIVE_TTL_MS ?? "600000", 10) || 600_000);
 const directLspCommandUnavailableUntil = new Map();
 const directLspCommandSkipLoggedUntil = new Map();
+/** Re-arm direct-command availability for the next session. */
+export function resetDirectLspCommandAvailability() {
+    directLspCommandUnavailableUntil.clear();
+    directLspCommandSkipLoggedUntil.clear();
+}
+/** Test seam for seeding the real negative-cache path. */
+export function _markDirectLspCommandUnavailableForTests(command) {
+    markDirectLspCommandUnavailable(command);
+}
 function pruneExpiredDirectLspNegativeEntries(now = Date.now()) {
     for (const [command, until] of directLspCommandUnavailableUntil) {
         if (until <= now) {
@@ -707,7 +721,10 @@ async function markerExists(dir, pattern) {
  * NearestRoot(includePatterns, excludePatterns?) → RootFunction
  *
  * - includePatterns: file/dir names that signal the project root (e.g. ["package.json"])
- * - excludePatterns: if any of these exist in a directory, skip it (e.g. ["node_modules"])
+ * - excludePatterns: if any of these exist in a directory, SKIP that directory and
+ *   keep walking up toward stopDir — it does not abort resolution. A directory that
+ *   matches an exclude pattern is simply never returned as a root; the walk still
+ *   continues past it looking for an include-pattern hit higher up (#1671).
  * - stopDir: walk stops here (defaults to filesystem root; set to project cwd for safety)
  *
  * Equivalent to createRootDetector; exported under both names for clarity.
@@ -717,6 +734,12 @@ export function NearestRoot(includePatterns, excludePatterns, stopDir) {
     // different servers (e.g. TypeScript vs Go) with different marker sets never
     // share entries. vi.resetModules() in tests resets module state between cases.
     const cache = new Map();
+    // Only cache successful hits. Undefined results are NOT cached so that a
+    // newly-created root marker (e.g. package.json or tsconfig.json scaffolded
+    // mid-session by the agent) is detected on the next call — the absent →
+    // present transition must work without a process restart. The uncached
+    // re-walk cost for configless repos is a known trade-off; bounding the
+    // walk with stopDir for in-cwd files is the tracked optimization (#1412).
     const inFlight = new Map();
     return async (file) => {
         // Cache key is the resolved directory — all files in the same dir share a root.
@@ -774,9 +797,6 @@ export function NearestRoot(includePatterns, excludePatterns, stopDir) {
         inFlight.set(dirKey, promise);
         try {
             const result = await promise;
-            // Only cache successful hits. Undefined results are not cached so that
-            // a newly-created root marker (e.g. package.json added mid-session) is
-            // detected on the next call.
             if (result !== undefined)
                 cache.set(dirKey, result);
             return result;
@@ -829,44 +849,185 @@ export async function tryDotnetToolInstall(tool) {
     return !updateResult.error && updateResult.status === 0;
 }
 /**
- * Locate tsserver.js — tries local project, then pi-lens managed TypeScript.
- * Returns the path to tsserver.js, or undefined if not found.
+ * #1412 M1: walk up from `startDir` (inclusive) looking for a file at
+ * `startDir/<relativeSegments>`, `dirname(startDir)/<relativeSegments>`, and so
+ * on — the same ancestor walk `findNativeTypeScriptLsp` uses, bounded the same
+ * way (`isAtOrAboveHomeDir`). A nested config root (e.g. a `cypress/tsconfig.json`
+ * LSP root inside a repo whose `node_modules` only exists at the repo root) must
+ * still resolve tooling installed at an ancestor, not just directly under the
+ * LSP root — mirrors how node module resolution itself walks up.
  */
-async function findTsserverPath(root, allowInstall) {
+async function findAncestorFile(startDir, ...relativeSegments) {
+    return findAncestorFileAmong(startDir, [relativeSegments]);
+}
+/**
+ * Same ancestor walk as `findAncestorFile`, but checks every candidate
+ * relative-path in `candidateSegmentLists` AT EACH LEVEL before moving up —
+ * so the nearest ancestor wins regardless of which candidate name matched
+ * there, matching normal node_modules resolution priority (nearest install
+ * shadows a further one, never the reverse).
+ */
+async function findAncestorFileAmong(startDir, candidateSegmentLists) {
     const fs = await import("node:fs/promises");
-    const candidates = [
-        path.join(root, "node_modules", "typescript", "lib", "tsserver.js"),
-        path.join(process.cwd(), "node_modules", "typescript", "lib", "tsserver.js"),
+    let currentDir = path.resolve(startDir);
+    while (!isAtOrAboveHomeDir(currentDir)) {
+        for (const segments of candidateSegmentLists) {
+            const candidate = path.join(currentDir, ...segments);
+            try {
+                await fs.access(candidate);
+                return candidate;
+            }
+            catch {
+                /* not found at this level */
+            }
+        }
+        const parent = path.dirname(currentDir);
+        if (parent === currentDir)
+            break;
+        currentDir = parent;
+    }
+    return undefined;
+}
+/**
+ * A failed classic-compiler repair must not repeat within a session.
+ * `ensureTool` caches successful installs, so a repair that works
+ * short-circuits later calls on its own. A repair that fails leaves nothing
+ * behind, and `findTsserverPath` has three call sites (TypeScript, Vue,
+ * Svelte). Without this guard an offline or partial install re-runs a 120 s
+ * forced reinstall on every spawn.
+ *
+ * The guard is a plain module-level flag, so without an explicit re-arm it
+ * would latch for the whole extension-host process — a repair that failed
+ * once (transient registry hiccup) would stay unrepairable for every later
+ * session in that process. `resetClassicTsRepairGuard` re-arms it; callers
+ * wire that into `session_start` alongside the other per-session resets
+ * (#1570).
+ */
+let classicTsRepairAttempted = false;
+/** Re-arm the classic-repair guard so a new session gets its own attempt. */
+export function resetClassicTsRepairGuard() {
+    classicTsRepairAttempted = false;
+}
+/** Test hook — clears the per-process classic-repair guard. */
+export function _resetClassicTsRepairForTests() {
+    resetClassicTsRepairGuard();
+}
+/**
+ * Directories that may hold the TypeScript package next to a resolved `tsc`
+ * binary: `<bin>/../typescript` (npm-global layout) and
+ * `<bin>/../../typescript` (managed `node_modules/.bin` layout).
+ */
+function typescriptDirsForTsc(tscPath) {
+    const binDir = path.dirname(tscPath);
+    return [
+        path.join(binDir, "..", "typescript"),
+        path.join(binDir, "..", "..", "typescript"),
     ];
-    for (const p of candidates) {
+}
+/**
+ * Read the major version of the TypeScript package that backs a resolved
+ * `tsc` binary. Returns undefined when the version is unknowable: `ensureTool`
+ * returns the bare string `"tsc"` for a PATH hit, and `path.dirname("tsc")` is
+ * `"."`, so the candidates would go cwd-relative. Callers must not repair on
+ * an unknown version — a healthy global TypeScript 5.x would be reinstalled
+ * for nothing.
+ */
+async function typescriptVersionForTsc(tscPath) {
+    if (!path.isAbsolute(tscPath))
+        return undefined;
+    for (const dir of typescriptDirsForTsc(tscPath)) {
+        let manifest;
         try {
-            await fs.access(p);
-            return p;
+            manifest = await readFile(path.join(dir, "package.json"), "utf8");
         }
         catch {
-            /* not found */
+            continue;
         }
+        let version;
+        try {
+            const parsed = JSON.parse(manifest);
+            if (typeof parsed !== "object" ||
+                parsed === null ||
+                !("version" in parsed) ||
+                typeof parsed.version !== "string") {
+                return undefined;
+            }
+            version = parsed.version;
+        }
+        catch {
+            return undefined;
+        }
+        const majorText = version.split(".", 1)[0] ?? "";
+        const major = /^\d+$/.test(majorText) ? Number(majorText) : Number.NaN;
+        if (!Number.isFinite(major))
+            return undefined;
+        return { version, major };
     }
-    // Discover the typescript install (PATH / npm-global) even when install is
-    // disabled; only the download is gated by allowInstall.
-    const tscPath = await ensureTool("typescript", {
-        allowInstall: canInstall(allowInstall),
-    });
-    if (tscPath) {
-        for (const p of [
-            path.join(path.dirname(tscPath), "..", "typescript", "lib", "tsserver.js"),
-            path.join(path.dirname(tscPath), "..", "..", "typescript", "lib", "tsserver.js"),
-        ]) {
+    return undefined;
+}
+/**
+ * Locate tsserver.js — tries local project (walking up from root, #1412 M1),
+ * then process.cwd() as a last-resort fallback, then pi-lens managed
+ * TypeScript. Returns the path to tsserver.js, or undefined if not found.
+ */
+async function findTsserverPath(root, allowInstall) {
+    const fs = await import("node:fs/promises");
+    const ancestorHit = await findAncestorFile(root, "node_modules", "typescript", "lib", "tsserver.js");
+    if (ancestorHit)
+        return ancestorHit;
+    const cwdCandidate = path.join(process.cwd(), "node_modules", "typescript", "lib", "tsserver.js");
+    try {
+        await fs.access(cwdCandidate);
+        return cwdCandidate;
+    }
+    catch {
+        /* not found */
+    }
+    const tsserverForTsc = async (tscPath) => {
+        if (!tscPath)
+            return undefined;
+        for (const dir of typescriptDirsForTsc(tscPath)) {
+            const candidate = path.join(dir, "lib", "tsserver.js");
             try {
-                await fs.access(p);
-                return p;
+                await fs.access(candidate);
+                return candidate;
             }
             catch {
                 /* not found */
             }
         }
+        return undefined;
+    };
+    // Discover the TypeScript install (PATH / npm-global) even when installation
+    // is disabled; only the download is gated by allowInstall.
+    const installAllowed = canInstall(allowInstall);
+    const discoveredTsc = await ensureTool("typescript", {
+        allowInstall: installAllowed,
+    });
+    const discoveredTsserver = await tsserverForTsc(discoveredTsc);
+    if (discoveredTsserver ||
+        !discoveredTsc ||
+        !installAllowed ||
+        classicTsRepairAttempted) {
+        return discoveredTsserver;
     }
-    return undefined;
+    // Repair only a compiler we can prove is TypeScript 7+. TypeScript 7 dropped
+    // lib/tsserver.js, so the classic wrapper cannot start against it. Any other
+    // version — or a version we cannot read, such as a bare PATH `tsc` — is left
+    // alone rather than force-reinstalled.
+    const discoveredVersion = await typescriptVersionForTsc(discoveredTsc);
+    if (!discoveredVersion || discoveredVersion.major < 7)
+        return undefined;
+    // An older managed tree took `latest` before the registry pinned the classic
+    // compiler. Reinstall the pinned version once so that tree self-heals,
+    // without deleting user or project-local TypeScript installations.
+    classicTsRepairAttempted = true;
+    logSessionStart(`lsp typescript: managed compiler resolved to TypeScript ${discoveredVersion.version}, which ships no tsserver.js; reinstalling pinned classic fallback`);
+    const repairedTsc = await ensureTool("typescript", {
+        allowInstall: true,
+        forceReinstall: true,
+    });
+    return tsserverForTsc(repairedTsc);
 }
 /**
  * TypeScript 7+ ships the native typescript-go language server through the
@@ -1046,10 +1207,17 @@ export async function detectPythonVenv(root) {
 }
 // --- Server Definitions ---
 const JS_TS_LSP_EXTENSIONS = KIND_EXTENSIONS["jsts"].filter((ext) => ext !== ".svelte" && ext !== ".vue");
-// Marker set used for both the unbounded TypeScriptProjectRoot walk and the
-// extension-bounded walk below. Kept in one place so both code paths look
-// for the same project signals.
-const TS_PROJECT_MARKERS = [
+// TypeScript identity and tooling discovery deliberately use separate marker
+// families. A governing config wins even when a package directory supplies
+// hoisted binaries. Keep configs out of PROJECT_BOUNDARY_MARKERS: #1373 still
+// coalesces a config-only nested root when an ancestor client was hosted first
+// (nested-config-first remains intentionally open-order-sensitive). #1412
+// accepted risk (M2, not fixed here): honoring nested config roots at all
+// enlarges the population of directories that can independently coalesce or
+// diverge under #1373's open-order sensitivity — the same pre-existing
+// blast-radius, just triggered by more roots than before.
+const TS_CONFIG_MARKERS = ["tsconfig.json", "jsconfig.json"];
+const TS_TOOLING_MARKERS = [
     "package-lock.json",
     "bun.lockb",
     "bun.lock",
@@ -1057,21 +1225,71 @@ const TS_PROJECT_MARKERS = [
     "yarn.lock",
     "package.json",
 ];
-const TypeScriptProjectRoot = IgnoreHomeRoot(createRootDetector([...TS_PROJECT_MARKERS]));
+// #1412 M3: tsserver associates jsconfig.json with JS files only (its identity
+// probe reports a jsconfig-governed .ts file as unassociated) — so a TS-family
+// file under a jsconfig-only directory must NOT root there; keep walking up
+// for a real tsconfig.json. A JS-family file accepts either: tsconfig also
+// governs plain JS via `allowJs`, so accepting tsconfig for a .js file is
+// correct, and jsconfig obviously is too.
+const TS_FAMILY_EXTENSIONS = new Set([".ts", ".tsx", ".mts", ".cts"]);
+function isTsFamilyFile(file) {
+    return TS_FAMILY_EXTENSIONS.has(path.extname(file).toLowerCase());
+}
+function tsConfigMarkersForFile(file) {
+    return isTsFamilyFile(file) ? ["tsconfig.json"] : TS_CONFIG_MARKERS;
+}
+// Two detector instances (not one parameterized by file) so each keeps its own
+// per-directory NearestRoot cache valid for its fixed marker set — a shared
+// cache keyed only by directory would conflate the TS-only and either-config
+// answers for the same directory.
+const TypeScriptConfigRootTsOnly = IgnoreHomeRoot(createRootDetector(["tsconfig.json"]));
+const TypeScriptConfigRootEither = IgnoreHomeRoot(createRootDetector([...TS_CONFIG_MARKERS]));
+const TypeScriptToolingRoot = IgnoreHomeRoot(createRootDetector([...TS_TOOLING_MARKERS]));
+async function findTypeScriptProjectRoot(file) {
+    const configDetector = isTsFamilyFile(file)
+        ? TypeScriptConfigRootTsOnly
+        : TypeScriptConfigRootEither;
+    const [configRoot, toolingRoot] = await Promise.all([
+        configDetector(file),
+        TypeScriptToolingRoot(file),
+    ]);
+    if (!configRoot)
+        return toolingRoot;
+    if (!toolingRoot)
+        return configRoot;
+    // A config inside (or beside) the nearest package governs its files. A
+    // config above a nearer package must not erase that topology boundary.
+    return isSameOrWithin(toolingRoot, configRoot) ? configRoot : toolingRoot;
+}
 /**
- * Walk up from the file's directory looking for a TypeScript project marker,
- * but stop at `extensionRootKey` so we never escape the .pi/agent/extensions
- * boundary into a higher-up project (e.g. ~/.pi/agent/package.json which
- * would pull every extension in the directory into one LSP workspace).
+ * Walk up from the file's directory looking for a TypeScript project marker
+ * (a governing config first, per-directory, per #1412 M3's extension-family
+ * filter; else a tooling/lockfile marker), but stop at `extensionRootKey` so
+ * we never escape the .pi/agent/extensions boundary into a higher-up project
+ * (e.g. ~/.pi/agent/package.json which would pull every extension in the
+ * directory into one LSP workspace).
  *
- * Returns the nearest directory containing a marker, or undefined if none
- * is found between the file and the extensions root inclusive.
+ * #1412 L4: each directory returns immediately on its first match (config or
+ * tooling) — there is no cross-level "nearest tooling root" to carry forward,
+ * since a match always wins on the spot. Returns the nearest directory
+ * containing a marker, or undefined if none is found between the file and the
+ * extensions root inclusive.
  */
 async function findExtensionBoundedRoot(file, extensionRootKey) {
     const startDir = path.resolve(path.dirname(file));
     let currentDir = startDir;
+    const configMarkers = tsConfigMarkersForFile(file);
     while (true) {
-        for (const pattern of TS_PROJECT_MARKERS) {
+        for (const pattern of configMarkers) {
+            try {
+                await stat(path.join(currentDir, pattern));
+                return currentDir;
+            }
+            catch {
+                /* not found, try next marker */
+            }
+        }
+        for (const pattern of TS_TOOLING_MARKERS) {
             try {
                 await stat(path.join(currentDir, pattern));
                 return currentDir;
@@ -1102,7 +1320,7 @@ async function hasAgentLevelProjectMarker(extensionRootKey) {
     const agentDir = path.dirname(extensionRootKey);
     if (!agentDir || agentDir === extensionRootKey)
         return false;
-    for (const pattern of TS_PROJECT_MARKERS) {
+    for (const pattern of [...TS_CONFIG_MARKERS, ...TS_TOOLING_MARKERS]) {
         try {
             await stat(path.join(agentDir, pattern));
             return true;
@@ -1133,7 +1351,7 @@ const TypeScriptRoot = DenoExcludeRoot(async (file) => {
         // analyze a lone .ts file with no package.json above or below).
         return undefined;
     }
-    const projectRoot = await TypeScriptProjectRoot(file);
+    const projectRoot = await findTypeScriptProjectRoot(file);
     if (projectRoot)
         return projectRoot;
     return FileDirRoot(file);
@@ -1159,20 +1377,13 @@ export const TypeScriptServer = {
         let source = "direct";
         // TypeScript <=6 uses typescript-language-server + tsserver.js. Prefer a
         // project-local wrapper, then fall back to discovered/managed tooling.
-        let lspPath;
-        const localLsp = path.join(root, "node_modules", ".bin", "typescript-language-server");
-        const localLspCmd = path.join(root, "node_modules", ".bin", "typescript-language-server.cmd");
-        // Check for local version first (Windows .cmd first, then Unix)
-        for (const checkPath of [localLspCmd, localLsp]) {
-            try {
-                await fs.access(checkPath);
-                lspPath = checkPath;
-                break;
-            }
-            catch {
-                /* not found */
-            }
-        }
+        // #1412 M1: walk up from root (Windows .cmd first, then Unix at each
+        // level) — a nested config root's node_modules/.bin lives at an ancestor,
+        // not necessarily directly under the LSP root.
+        let lspPath = await findAncestorFileAmong(root, [
+            ["node_modules", ".bin", "typescript-language-server.cmd"],
+            ["node_modules", ".bin", "typescript-language-server"],
+        ]);
         // Fall back to a discovered or managed install. ensureTool() runs PATH /
         // npm-global discovery even when install is disabled (only the download is
         // gated by canInstall), so a globally-installed typescript-language-server
@@ -1372,15 +1583,120 @@ export const GoServer = {
         return { ...result, initialization: { ui: { semanticTokens: true } } };
     },
 };
-async function hasWorkspaceSection(cargoPath) {
+async function readTextFileOrUndefined(filePath) {
     try {
-        const { readFile } = await import("node:fs/promises");
-        const content = await readFile(cargoPath, "utf-8");
-        return /^\s*\[workspace\]/m.test(content);
+        return await readFile(filePath, "utf-8");
     }
     catch {
+        return undefined;
+    }
+}
+/**
+ * Slice out ONE top-level TOML table's raw body — from its `[name]` heading
+ * to the next top-level `[...]`/`[[...]]` heading or EOF. `members`/`exclude`
+ * must be read from the `[workspace]` table specifically: `[package]` has its
+ * OWN `exclude` key (the standard cargo-publish exclude list, conventionally
+ * written above `[workspace]` in a virtual-manifest-less root crate), and a
+ * whole-file regex would misread it as workspace membership (#1671 F4).
+ */
+function extractTomlTableSection(content, tableName) {
+    const heading = new RegExp(`^\\[${tableName}\\][ \\t]*(?:#.*)?$`, "m");
+    const match = heading.exec(content);
+    if (!match)
+        return "";
+    const rest = content.slice(match.index + match[0].length);
+    const nextHeading = rest.match(/^\[{1,2}[^\]]+\]{1,2}[ \t]*(?:#.*)?$/m);
+    return nextHeading?.index !== undefined ? rest.slice(0, nextHeading.index) : rest;
+}
+function parseTomlStringArray(content, key) {
+    const match = content.match(new RegExp(`^[ \\t]*${key}[ \\t]*=[ \\t]*\\[([\\s\\S]*?)\\]`, "m"));
+    if (!match)
+        return [];
+    return [...match[1].matchAll(/"([^"]*)"|'([^']*)'/g)].map((m) => (m[1] ?? m[2] ?? "").trim());
+}
+/** Turn one `/`-delimited glob SEGMENT into a regex source: `*` matches any
+ * run of characters within the segment, `?` matches exactly one character,
+ * everything else is escaped and literal. */
+function segmentGlobToRegExpSource(segment) {
+    let out = "";
+    for (const ch of segment) {
+        if (ch === "*")
+            out += "[^/]*";
+        else if (ch === "?")
+            out += "[^/]";
+        else
+            out += ch.replace(/[.+^${}()|[\]\\]/g, "\\$&");
+    }
+    return out;
+}
+/**
+ * A `members`/`exclude` entry names a path exactly, or globs it segment by
+ * segment: `*` and `?` inside a segment work at any depth — one wildcard
+ * segment (`crates/*`), a bare `*`, or several chained together for a
+ * deeper fixed-depth layout — matching cargo's own `glob`-crate semantics
+ * for a fixed number of path components.
+ *
+ * KNOWN LIMITATION (#1671 F6, documented rather than implemented): a
+ * recursive `**` segment (matching a variable number of path components) is
+ * NOT supported and never matches — cargo workspaces that rely on `**` to
+ * pull in an arbitrarily-nested crate tree will under-hoist (the crate stays
+ * independently rooted instead of joining the workspace). This is
+ * deliberately out of #1671's scope: the common, and the issue's fixture,
+ * shape is an explicit fixed-depth `members` list.
+ */
+function matchesCargoWorkspacePattern(pattern, relativePath) {
+    const normalized = pattern.replace(/\/+$/, "");
+    if (normalized.includes("**"))
+        return false;
+    const patternSegments = normalized.split("/");
+    const pathSegments = relativePath.split("/");
+    if (patternSegments.length !== pathSegments.length)
+        return false;
+    return patternSegments.every((segment, i) => new RegExp(`^${segmentGlobToRegExpSource(segment)}$`).test(pathSegments[i]));
+}
+/**
+ * Given an ancestor Cargo.toml's raw contents that already contains a
+ * `[workspace]` table, decide whether it actually claims `childDir` as a
+ * member. Cargo's own default is that a bare `[workspace]` with no `members`
+ * key claims only the manifest's own package — a nested crate is NOT
+ * implicitly swept in just because it sits underneath the workspace root on
+ * disk. Without this check any Cargo.toml with a `[workspace]` table would
+ * hoist every crate below it, including ones the workspace never declared
+ * (#1671) — the same defect shape as an undeclared Maven sibling module.
+ *
+ * KNOWN LIMITATION (#1671 F7, documented rather than implemented): cargo also
+ * treats a crate as an implicit workspace member when the workspace root's
+ * OWN `[package]` has a `path = "..."` dependency on it and no explicit
+ * `members` key is present at all. That dependency-graph inference is not
+ * evaluated here — a workspace relying on it alone (no `members` key) reads
+ * as claiming nothing, so its crates stay independently rooted rather than
+ * being (correctly, per cargo) swept in. An explicit `members` list — the
+ * common case and the one #1671's fixtures exercise — is unaffected.
+ */
+function cargoWorkspaceDeclaresMember(workspaceContent, parentDir, childDir) {
+    const relativePath = path.relative(parentDir, childDir).split(path.sep).join("/");
+    if (relativePath === "" || relativePath.startsWith(".."))
+        return false;
+    const workspaceSection = extractTomlTableSection(workspaceContent, "workspace");
+    const excluded = parseTomlStringArray(workspaceSection, "exclude");
+    if (excluded.some((pattern) => matchesCargoWorkspacePattern(pattern, relativePath))) {
         return false;
     }
+    const members = parseTomlStringArray(workspaceSection, "members");
+    return members.some((pattern) => matchesCargoWorkspacePattern(pattern, relativePath));
+}
+/**
+ * Bound a monorepo-hoist walk-up by the session ceiling: when `file` is inside
+ * the session cwd, the walk must stop AT the cwd rather than climb past it —
+ * matching enforceLspRootCeiling's clamp semantics but avoiding the wasted stat
+ * calls of walking past a boundary we would clamp back down anyway. When
+ * `file` is outside the session (isolated tests, out-of-session API callers),
+ * enforceLspRootCeiling is a no-op, so the walk is left unbounded (`undefined`).
+ */
+function sessionHoistCeiling(sessionCwd, file) {
+    return isSameOrWithin(path.resolve(sessionCwd), path.resolve(file))
+        ? path.resolve(sessionCwd)
+        : undefined;
 }
 function RustWorkspaceRoot() {
     const crateRoot = createRootDetector(["Cargo.toml", "Cargo.lock"]);
@@ -1388,21 +1704,131 @@ function RustWorkspaceRoot() {
         const root = await crateRoot(file);
         if (!root)
             return undefined;
+        const sessionCwd = process.cwd();
+        // The walk-up for an ancestor Cargo.toml with a [workspace] table stays
+        // bounded by the same session ceiling the crate-root lookup above already
+        // enforces (enforceLspRootCeiling) — a monorepo hoist must never cross the
+        // session boundary just because a workspace manifest happens to sit above
+        // it (#1671).
+        const stop = sessionHoistCeiling(sessionCwd, file);
         let current = root;
         const fsRoot = path.parse(current).root;
         while (true) {
+            if (stop !== undefined && current === stop)
+                break;
             const parent = path.dirname(current);
             if (parent === current || parent === fsRoot)
                 break;
-            const parentCargo = path.join(parent, "Cargo.toml");
-            if (await hasWorkspaceSection(parentCargo)) {
-                return parent;
+            const parentCargoPath = path.join(parent, "Cargo.toml");
+            const parentCargoContent = await readTextFileOrUndefined(parentCargoPath);
+            if (parentCargoContent !== undefined && /^\s*\[workspace\]/m.test(parentCargoContent)) {
+                // Test membership against the ORIGINAL crate dir (`root`), never the
+                // walk cursor (`current`, which may already have climbed through
+                // gap directories that have no Cargo.toml of their own) — a
+                // `members = ["crates/foo"]` or `["crates/*"]` entry is relative to
+                // the workspace root, spanning the whole gap in one hop (#1671 F1).
+                if (cargoWorkspaceDeclaresMember(parentCargoContent, parent, root)) {
+                    return enforceLspRootCeiling(parent, sessionCwd, file);
+                }
+                // A workspace root exists here but its `members`/`exclude` tables do
+                // not claim this crate — stop climbing; the crate stays independently
+                // rooted rather than being swept into a workspace it opted out of.
+                break;
             }
             current = parent;
         }
         return root;
     };
 }
+/**
+ * Resolve whether `parentPomPath`'s <modules> block declares `childDir` as one
+ * of its member modules. Maven multi-module hoisting must only chain through
+ * poms that actually declare the child (an undeclared sibling directory that
+ * merely happens to sit next to a parent pom stays independently rooted) —
+ * this is the "Maven module-chain verification" #1671 asks for, as opposed to
+ * rust-analyzer's simpler "any ancestor [workspace] wins" hoist.
+ */
+/**
+ * Strip XML comments to a fixed point rather than in one pass: a single
+ * `.replace()` can leave a residual `<!--` behind on adversarially-nested
+ * input (CodeQL flags this class as "incomplete multi-character
+ * sanitization" — the removal of one comment can expose a delimiter that
+ * was itself inside another). Looping until nothing changes closes that gap.
+ */
+function stripXmlComments(content) {
+    let result = content;
+    let previous;
+    do {
+        previous = result;
+        result = result.replace(/<!--[\s\S]*?-->/g, "");
+    } while (result !== previous);
+    return result;
+}
+async function declaresMavenModule(parentDir, parentPomPath, childDir) {
+    try {
+        const content = stripXmlComments(await readFile(parentPomPath, "utf-8"));
+        const modulesBlock = content.match(/<modules>([\s\S]*?)<\/modules>/);
+        if (!modulesBlock)
+            return false;
+        const resolvedChild = path.resolve(childDir);
+        for (const match of modulesBlock[1].matchAll(/<module>\s*([^<]+?)\s*<\/module>/g)) {
+            // Case-insensitive / realpath-aware compare (#1671 F8): a declared
+            // `<module>Foo</module>` must still match a directory actually named
+            // `foo` on a case-insensitive filesystem, the same class of check the
+            // rest of this codebase does via `pathsEqual` (#1139/#1150).
+            if (pathsEqual(path.resolve(parentDir, match[1]), resolvedChild))
+                return true;
+        }
+        return false;
+    }
+    catch {
+        return false;
+    }
+}
+function JavaWorkspaceRoot() {
+    const moduleRoot = createRootDetector(["pom.xml", "build.gradle", ".classpath"]);
+    return async (file) => {
+        const root = await moduleRoot(file);
+        if (!root)
+            return undefined;
+        // Only a Maven (pom.xml) module chain-hoists here — Gradle/.classpath module
+        // roots are returned as found; multi-module Gradle wiring (settings.gradle)
+        // is a different shape and out of scope for #1671.
+        if (!(await markerExists(root, "pom.xml")))
+            return root;
+        const sessionCwd = process.cwd();
+        const stop = sessionHoistCeiling(sessionCwd, file);
+        // `current` is the walk CURSOR — it climbs over gap directories (ones
+        // with no pom.xml of their own, e.g. a `<module>sub/dir</module>` entry
+        // spanning more than one filesystem level). `lastHop` is the last
+        // CONFIRMED module boundary; it is what the next ancestor pom's
+        // <modules> must declare, and it is what actually gets returned — never
+        // the cursor, which can land on a bare gap directory that is not itself
+        // a valid module root (#1671 F2).
+        let current = root;
+        let lastHop = root;
+        const fsRoot = path.parse(current).root;
+        while (true) {
+            if (stop !== undefined && current === stop)
+                break;
+            const parent = path.dirname(current);
+            if (parent === current || parent === fsRoot)
+                break;
+            if (await markerExists(parent, "pom.xml")) {
+                const parentPom = path.join(parent, "pom.xml");
+                if (!(await declaresMavenModule(parent, parentPom, lastHop)))
+                    break;
+                current = parent;
+                lastHop = parent;
+                continue;
+            }
+            // No pom.xml here — a gap directory, not a module boundary. Keep
+            // climbing without advancing `lastHop`.
+            current = parent;
+        }
+        return enforceLspRootCeiling(lastHop, sessionCwd, file);
+    };
+}
 export const RustServer = {
     id: "rust",
     name: "rust-analyzer",
@@ -1632,7 +2058,7 @@ export const JavaServer = createInteractiveServer({
     id: "java",
     name: "JDT Language Server",
     extensions: KIND_EXTENSIONS["java"],
-    root: RootWithFallback(createRootDetector(["pom.xml", "build.gradle", ".classpath"])),
+    root: RootWithFallback(JavaWorkspaceRoot()),
     language: "java",
     command: () => process.env.JDTLS_PATH || "jdtls",
     args: (root) => createLombokJdtlsArgs(root),
@@ -1837,6 +2263,20 @@ export const ClojureServer = {
         }, options?.allowInstall);
     },
 };
+export const CueServer = {
+    id: "cue",
+    name: "CUE Language Server",
+    extensions: KIND_EXTENSIONS["cue"],
+    root: RootWithFallback(createRootDetector(["cue.mod", ".git"])),
+    async spawn(root, options) {
+        return resolveAndLaunch({
+            candidates: ["cue"],
+            args: ["lsp", "serve"],
+            cwd: root,
+            managedToolId: "cue",
+        }, options?.allowInstall);
+    },
+};
 export const TerraformServer = {
     id: "terraform",
     name: "Terraform LSP",
@@ -2215,6 +2655,13 @@ export const AstGrepServer = {
     // (it falls back to napi when the ast-grep binary is absent — Gate B).
     root: RootWithFallback(createRootDetector(["sgconfig.yml", "sgconfig.yaml"]), RootWithFallback(NearestRoot([".git"]), async () => process.cwd())),
     availabilityKey: "ast-grep",
+    // #1714: the one auxiliary with a measured wedge ceiling. A `lens_diagnostics
+    // mode=full` sweep of 225 files drove this server into an unrecoverable stall
+    // twice in two exposures (writes outstanding 5.9 s and 9.4 s, then a forced
+    // shutdown that timed out both the request and the exit notify). It re-parses
+    // the whole file on every didOpen, so it absorbs a sweep more slowly than the
+    // other scanners — hold it to half the shared default.
+    notifyInflightLimit: 4,
     // First scan of a session compiles the rules.
     initializeTimeoutMs: 15000,
     async spawn(root, options) {
@@ -2377,6 +2824,7 @@ export const LSP_SERVERS = [
     MarksmanServer,
     OCamlServer,
     ClojureServer,
+    CueServer,
     TerraformServer,
     NixServer,
     BashServer,