@herbertgao/pi-extensions 2026.9.0 → 2026.9.1

package/node_modules/pi-lens/dist/clients/lsp/server.js

@@ -11,10 +11,14 @@ import { access, readFile, readdir, stat } from "node:fs/promises";
 import os from "node:os";
 import path from "node:path";
 import { getGlobalPiLensDir, getProjectIgnoreGlobs, isPathIgnoredByProject, } from "../file-utils.js";
+import { augmentPythonEnvironment, detectPythonEnvironment, detectPythonVenv, pythonEnvironmentToolCandidates, } from "../python-environment.js";
+export { detectPythonVenv };
 import { STAGE_TMP_PATTERN } from "../atomic-write-staging.js";
 import { DOTNET_CSHARP_ROOT_MARKERS, DOTNET_FSHARP_ROOT_MARKERS, KIND_EXTENSIONS, } from "../file-kinds.js";
-import { direntsHaveMarkerGlobMatch, isAtOrAboveHomeDir, isFullyQualified, isWindowsPath, pathsEqual, } from "../path-utils.js";
+import { CARGO_WORKSPACE_MEMBER_DIALECT, direntsHaveMarkerGlobMatch, isAtOrAboveHomeDir, isFullyQualified, isWindowsPath, matchesWorkspaceMemberPattern, pathsEqual, } from "../path-utils.js";
 import { ensureTool, findManagedToolBinary, getToolEnvironment, getToolPath, } from "../installer/index.js";
+import * as installer from "../installer/index.js";
+import { classifyProbeFailure, describeInstallAttempt, logAvailabilityDecision, } from "../dispatch/runners/utils/availability-policy.js";
 import { resolveOpengrepConfig } from "../opengrep-config.js";
 import { isZizmorAuditTarget, resolveZizmorGitHubToken, } from "../zizmor-config.js";
 import { logLatency } from "../latency-logger.js";
@@ -22,6 +26,7 @@ import { logSessionStart } from "../sessionstart-logger.js";
 import { findLocalSgconfig, resolveBaselineSgconfig } from "../sgconfig.js";
 import { findLocalTyposConfig } from "../typos-config.js";
 import { resolvePackagePath } from "../package-root.js";
+import { hasCargoWorkspaceTable, readCargoWorkspaceExclude, readCargoWorkspaceMembers, readTextFileOrUndefined, } from "../cargo-manifest.js";
 import { resolveAstGrepNativeExe } from "./wait-policy/index.js";
 import { hasSpawnFailureKind, isCommandAvailableAsync, safeSpawnAsync, } from "../safe-spawn.js";
 import { launchLSP } from "./launch.js";
@@ -30,6 +35,7 @@ import { resolveJavaRuntimeEnv } from "./jvm-runtime.js";
 import { normalizeMapKey } from "./path-utils.js";
 import { getRubyVersionDirNamesSync } from "./ruby-drive-dirs.js";
 import { getProcessSingleton } from "../process-singletons.js";
+import { createGenerationSource, } from "../generation-guard.js";
 const FIXTURE_ROOT_SEGMENTS = new Set(["__fixtures__", "testdata"]);
 const FALLBACK_PROJECT_MARKERS = [
     ".git",
@@ -252,6 +258,49 @@ function canInstall(allowInstall) {
 const DIRECT_LSP_NEGATIVE_TTL_MS = Math.max(30_000, Number.parseInt(process.env.PI_LENS_DIRECT_LSP_NEGATIVE_TTL_MS ?? "600000", 10) || 600_000);
 const directLspCommandUnavailableUntil = new Map();
 const directLspCommandSkipLoggedUntil = new Map();
+// Availability rows are emitted from the same async launch path that owns the
+// live LSP generation. A session reset can retire that generation while a
+// managed lookup, install, or launch is still awaiting; stale work must not
+// publish into the replacement session (#2351, shape 22).
+const lspLaunchAvailabilityGeneration = createGenerationSource("lsp-launch-availability");
+export function resetLspLaunchAvailabilityGeneration() {
+    lspLaunchAvailabilityGeneration.bump();
+}
+function staleLaunch(generation, subject, proc) {
+    if (generation.isCurrent())
+        return false;
+    try {
+        proc?.process?.kill();
+    }
+    catch {
+        // Best-effort cleanup for a process returned after service retirement.
+    }
+    generation.guardedWrite(subject, () => undefined);
+    return true;
+}
+async function installEvidenceForLaunch(toolId, installed, attempt) {
+    const evidence = describeInstallAttempt(attempt);
+    const confirmedManagedPath = await findManagedToolBinary(toolId);
+    return {
+        ...evidence,
+        binary: path.basename(installed),
+        ...(confirmedManagedPath !== undefined &&
+            pathsEqual(confirmedManagedPath, installed) && {
+            source: "managed-dir",
+        }),
+    };
+}
+function captureInstallAttempt(toolId) {
+    try {
+        // Capture synchronously after ensureTool resolves. Reading this later, after
+        // launch/evidence awaits, can observe another concurrent ensure's outcome.
+        return installer.getInstallAttempt?.(toolId);
+    }
+    catch {
+        // Older test doubles do not expose this production export.
+    }
+    return undefined;
+}
 /** Re-arm direct-command availability for the next session. */
 export function resetDirectLspCommandAvailability() {
     directLspCommandUnavailableUntil.clear();
@@ -301,6 +350,7 @@ function markDirectLspCommandUnavailable(command) {
 }
 const PI_LENS_BIN_DIR = path.join(getGlobalPiLensDir(), "bin");
 export async function resolveAndLaunch(spec, allowInstall) {
+    const generation = lspLaunchAvailabilityGeneration.capture();
     const toolLabel = spec.managedToolId ??
         spec.candidates[spec.candidates.length - 1] ??
         "unknown";
@@ -323,9 +373,13 @@ export async function resolveAndLaunch(spec, allowInstall) {
     // `findManagedNodeToolBinary`'s npm-managed fast path (runner-helpers.ts)
     // and `SecurityScanClient.probeVersion`'s equivalent fix for the CLI-scan
     // half of this same issue (#2140, landed in PR #2148/#2137).
+    const managedProbeStartedAt = Date.now();
     const managedCandidate = spec.managedToolId
         ? await findManagedToolBinary(spec.managedToolId)
         : undefined;
+    if (staleLaunch(generation, `${toolLabel}:findManagedToolBinary`)) {
+        return undefined;
+    }
     const candidates = managedCandidate && !spec.candidates.includes(managedCandidate)
         ? [managedCandidate, ...spec.candidates]
         : spec.candidates;
@@ -356,6 +410,9 @@ export async function resolveAndLaunch(spec, allowInstall) {
                 cwd: spec.cwd,
                 env: spec.env,
             });
+            if (staleLaunch(generation, `${toolLabel}:launchLSP:${command}`, proc)) {
+                return undefined;
+            }
             logLatency({
                 type: "phase",
                 phase: "lsp_launch_candidate_success",
@@ -369,9 +426,36 @@ export async function resolveAndLaunch(spec, allowInstall) {
                 },
             });
             logSessionStart(`lsp launch candidate success tool=${toolLabel} idx=${index} command=${command} source=direct`);
+            // The managed-dir fast path (#2140) IS the availability probe for a
+            // release-managed tool: a real spawn just confirmed the binary
+            // findManagedToolBinary resolved actually launches. Gated on the exact
+            // managed candidate (never a later bare-PATH fallback), so a session
+            // start with the binary present emits exactly one decision and a
+            // developer-PATH-resolved copy (no managed binary at all) emits none —
+            // unchanged from before this fix.
+            if (managedCandidate !== undefined && command === managedCandidate) {
+                logAvailabilityDecision({
+                    tool: toolLabel,
+                    verdict: "available",
+                    outcome: "success",
+                    cause: "ok",
+                    elapsedMs: Date.now() - managedProbeStartedAt,
+                    latched: false,
+                    producer: "lsp-launch",
+                    classifiedBy: "probe",
+                    evidence: {
+                        binary: path.basename(managedCandidate),
+                        source: "managed-dir",
+                        correctsLatchedRow: false,
+                    },
+                });
+            }
             return { process: proc, source: "direct" };
         }
         catch (err) {
+            if (staleLaunch(generation, `${toolLabel}:launchLSP:${command}`)) {
+                return undefined;
+            }
             const message = err instanceof Error ? err.message : String(err);
             // Defer logging: only a failure if no later candidate/install succeeds.
             candidateFailures.push({ index, command, message, err });
@@ -419,8 +503,40 @@ export async function resolveAndLaunch(spec, allowInstall) {
     }
     // Step 3 — managed install via installer registry
     if (spec.managedToolId) {
+        // Neither the managed-dir stat (#2140) nor any bare-PATH candidate
+        // resolved this tool — the negative counterpart to the fast-path
+        // "available" decision above, mirroring `SecurityScanClient.probeVersion`'s
+        // failure record so the negative case is visible in latency.log rather
+        // than swallowed by going straight to the install attempt.
+        const failedCandidate = candidateFailures.at(-1);
+        const classifiedFailure = classifyProbeFailure({
+            error: failedCandidate?.err instanceof Error
+                ? failedCandidate.err
+                : undefined,
+            spawnFailure: {
+                kind: hasSpawnFailureKind(failedCandidate?.err, "tool-not-found")
+                    ? "tool-not-found"
+                    : undefined,
+            },
+        }, { command: failedCandidate?.command });
+        logAvailabilityDecision({
+            tool: spec.managedToolId,
+            verdict: "unavailable",
+            outcome: classifiedFailure.outcome,
+            cause: classifiedFailure.cause,
+            elapsedMs: Date.now() - managedProbeStartedAt,
+            latched: false,
+            classifiedBy: "probe",
+            producer: "lsp-launch",
+            evidence: classifiedFailure.evidence,
+        });
         logSessionStart(`lsp launch ensure-tool start tool=${spec.managedToolId} cwd=${spec.cwd}`);
+        const installStartedAt = Date.now();
         const installed = await ensureTool(spec.managedToolId);
+        const installAttempt = captureInstallAttempt(spec.managedToolId);
+        if (staleLaunch(generation, `${toolLabel}:ensureTool`)) {
+            return undefined;
+        }
         logSessionStart(`lsp launch ensure-tool result tool=${spec.managedToolId} installed=${installed ? "yes" : "no"} path=${installed ?? ""}`);
         logLatency({
             type: "phase",
@@ -439,6 +555,9 @@ export async function resolveAndLaunch(spec, allowInstall) {
                     cwd: spec.cwd,
                     env: spec.env,
                 });
+                if (staleLaunch(generation, `${toolLabel}:launchLSP:managed`, proc)) {
+                    return undefined;
+                }
                 logSessionStart(`lsp launch managed success tool=${spec.managedToolId} command=${installed} source=managed`);
                 logLatency({
                     type: "phase",
@@ -450,9 +569,37 @@ export async function resolveAndLaunch(spec, allowInstall) {
                         command: installed,
                     },
                 });
+                // Compensating row for the "unavailable" decision logged above (#1606
+                // shape): the install fixed exactly what the fast path found missing,
+                // so the durable record must not be left saying the tool is off.
+                // `source` is only asserted when a fresh managed-dir lookup confirms
+                // the install actually landed in ~/.pi-lens/bin (github/maven/archive
+                // strategies) rather than an npm/pip/gem install elsewhere, so the
+                // evidence never claims a resolution this call didn't derive.
+                const evidence = await installEvidenceForLaunch(spec.managedToolId, installed, installAttempt);
+                if (staleLaunch(generation, `${toolLabel}:managed-evidence`, proc)) {
+                    return undefined;
+                }
+                logAvailabilityDecision({
+                    tool: spec.managedToolId,
+                    verdict: "available",
+                    outcome: "success",
+                    cause: "ok",
+                    elapsedMs: Date.now() - installStartedAt,
+                    latched: false,
+                    classifiedBy: "caller",
+                    producer: "lsp-launch",
+                    evidence: {
+                        ...evidence,
+                        correctsLatchedRow: false,
+                    },
+                });
                 return { process: proc, source: "managed" };
             }
             catch (err) {
+                if (staleLaunch(generation, `${toolLabel}:launchLSP:managed-rejection`)) {
+                    return undefined;
+                }
                 const message = err instanceof Error ? err.message : String(err);
                 logSessionStart(`lsp launch managed failed tool=${spec.managedToolId} command=${installed} error=${message}`);
                 logLatency({
@@ -476,12 +623,19 @@ export async function resolveAndLaunch(spec, allowInstall) {
                     const reinstalled = await ensureTool(spec.managedToolId, {
                         forceReinstall: true,
                     });
+                    const reinstallAttempt = captureInstallAttempt(spec.managedToolId);
+                    if (staleLaunch(generation, `${toolLabel}:forceReinstall`)) {
+                        return undefined;
+                    }
                     if (reinstalled) {
                         try {
                             const proc = await launchLSP(reinstalled, spec.args, {
                                 cwd: spec.cwd,
                                 env: spec.env,
                             });
+                            if (staleLaunch(generation, `${toolLabel}:launchLSP:forceReinstall`, proc)) {
+                                return undefined;
+                            }
                             logSessionStart(`lsp launch managed force-reinstall success tool=${spec.managedToolId} command=${reinstalled}`);
                             logLatency({
                                 type: "phase",
@@ -493,6 +647,24 @@ export async function resolveAndLaunch(spec, allowInstall) {
                                     command: reinstalled,
                                 },
                             });
+                            const evidence = await installEvidenceForLaunch(spec.managedToolId, reinstalled, reinstallAttempt);
+                            if (staleLaunch(generation, `${toolLabel}:forceReinstall-evidence`, proc)) {
+                                return undefined;
+                            }
+                            logAvailabilityDecision({
+                                tool: spec.managedToolId,
+                                verdict: "available",
+                                outcome: "success",
+                                cause: "ok",
+                                elapsedMs: Date.now() - installStartedAt,
+                                latched: false,
+                                classifiedBy: "caller",
+                                producer: "lsp-launch",
+                                evidence: {
+                                    ...evidence,
+                                    correctsLatchedRow: false,
+                                },
+                            });
                             return { process: proc, source: "managed" };
                         }
                         catch (retryErr) {
@@ -505,20 +677,35 @@ export async function resolveAndLaunch(spec, allowInstall) {
         }
     }
     // Step 4 — language-native runtime install (go install, gem install, …)
-    if (spec.runtimeInstall &&
-        (await isOnPath(spec.runtimeInstall.runtimeCommand))) {
-        const ok = await spec.runtimeInstall.install();
+    const runtimeInstall = spec.runtimeInstall;
+    const runtimeAvailable = runtimeInstall
+        ? await isOnPath(runtimeInstall.runtimeCommand)
+        : false;
+    if (staleLaunch(generation, `${toolLabel}:runtimeAvailability`)) {
+        return undefined;
+    }
+    if (runtimeInstall && runtimeAvailable) {
+        const ok = await runtimeInstall.install();
+        if (staleLaunch(generation, `${toolLabel}:runtimeInstall`)) {
+            return undefined;
+        }
         if (ok) {
-            const retry = spec.runtimeInstall.retryCandidates ?? spec.candidates;
+            const retry = runtimeInstall.retryCandidates ?? spec.candidates;
             for (const command of retry) {
                 try {
                     const proc = await launchLSP(command, spec.args, {
                         cwd: spec.cwd,
                         env: spec.env,
                     });
+                    if (staleLaunch(generation, `${toolLabel}:launchLSP:runtime`, proc)) {
+                        return undefined;
+                    }
                     return { process: proc, source: "managed" };
                 }
                 catch (err) {
+                    if (staleLaunch(generation, `${toolLabel}:launchLSP:runtime`)) {
+                        return undefined;
+                    }
                     trackRuntimeFailure(err);
                     // try next
                 }
@@ -629,12 +816,15 @@ async function resolveAndLaunchTreeBinary(spec, allowInstall) {
         return undefined;
     }
 }
-function nodeBinCandidates(root, baseName) {
+function nodeBinLocalCandidates(root, baseName) {
     const localBase = path.join(root, "node_modules", ".bin", baseName);
     if (process.platform === "win32") {
-        return [`${localBase}.cmd`, `${localBase}.exe`, baseName];
+        return [`${localBase}.cmd`, `${localBase}.exe`];
     }
-    return [localBase, baseName];
+    return [localBase];
+}
+function nodeBinCandidates(root, baseName) {
+    return [...nodeBinLocalCandidates(root, baseName), baseName];
 }
 function normalizeSlashKey(value) {
     const normalized = path.resolve(value).replace(/\\/g, "/");
@@ -689,6 +879,7 @@ function createInteractiveServer(spec) {
         name: spec.name,
         extensions: spec.extensions,
         root: spec.root,
+        fallbackFor: spec.fallbackFor,
         availabilityKey: typeof spec.command === "string" && isSimpleCommand(spec.command)
             ? spec.command
             : undefined,
@@ -1260,33 +1451,6 @@ export function DenoExcludeRoot(primary) {
         return primary(file);
     };
 }
-/**
- * Find the active Python interpreter inside the nearest virtual environment.
- * Search order: VIRTUAL_ENV → CONDA_PREFIX → .venv → venv (all under root).
- * Returns undefined when no venv python binary is found.
- */
-export async function detectPythonVenv(root) {
-    const isWin = process.platform === "win32";
-    const candidates = [
-        process.env.VIRTUAL_ENV,
-        process.env.CONDA_PREFIX,
-        path.join(root, ".venv"),
-        path.join(root, "venv"),
-    ].filter((v) => Boolean(v));
-    for (const venv of candidates) {
-        const pythonPath = isWin
-            ? path.join(venv, "Scripts", "python.exe")
-            : path.join(venv, "bin", "python");
-        try {
-            await access(pythonPath);
-            return pythonPath;
-        }
-        catch {
-            // not found — try next candidate
-        }
-    }
-    return undefined;
-}
 // --- Server Definitions ---
 const JS_TS_LSP_EXTENSIONS = KIND_EXTENSIONS["jsts"].filter((ext) => ext !== ".svelte" && ext !== ".vue");
 // TypeScript identity and tooling discovery deliberately use separate marker
@@ -1518,6 +1682,7 @@ export const TypeScriptServer = {
 export const DenoServer = {
     id: "deno",
     name: "Deno Language Server",
+    fallbackFor: "typescript",
     extensions: JS_TS_LSP_EXTENSIONS,
     autoPropagateDiagnostics: true,
     root: createRootDetector(["deno.json", "deno.jsonc"]),
@@ -1544,7 +1709,8 @@ export const PythonServer = {
         "poetry.lock",
     ])),
     async spawn(root, options) {
-        const env = await getToolEnvironment();
+        const pythonEnvironment = await detectPythonEnvironment(root);
+        const env = augmentPythonEnvironment(await getToolEnvironment(), pythonEnvironment);
         let source = "direct";
         // openFilesOnly: true — analyse only open files rather than the full workspace.
         // Avoids the 5–14 s cold-start on large projects caused by workspace-wide
@@ -1554,36 +1720,65 @@ export const PythonServer = {
             ...(pythonPath ? { pythonPath } : {}),
             openFilesOnly: true,
         });
-        // Prefer pyright-langserver; basedpyright-langserver is a drop-in fork with
-        // the same --stdio protocol and additional rules (e.g. reportUnusedExpression).
-        const localCandidates = [
-            ...nodeBinCandidates(root, "pyright-langserver"),
-            ...nodeBinCandidates(root, "basedpyright-langserver"),
-        ];
-        const direct = await resolveAndLaunch({ candidates: localCandidates, args: ["--stdio"], cwd: root, env }, false);
-        if (direct) {
-            const pythonPath = await detectPythonVenv(root);
+        // Project ownership outranks checker preference: exhaust explicit project
+        // candidates before a bare command can resolve to pi-lens's managed bin or
+        // the host PATH. Within the project tier, preserve the established
+        // pyright → basedpyright → ty preference.
+        const projectPyright = await resolveAndLaunch({
+            candidates: [
+                ...pythonEnvironmentToolCandidates(pythonEnvironment, "pyright-langserver"),
+                ...nodeBinLocalCandidates(root, "pyright-langserver"),
+                ...pythonEnvironmentToolCandidates(pythonEnvironment, "basedpyright-langserver"),
+                ...nodeBinLocalCandidates(root, "basedpyright-langserver"),
+            ],
+            args: ["--stdio"],
+            cwd: root,
+            env,
+        }, false);
+        if (projectPyright) {
             return {
-                process: direct.process,
-                source: direct.source,
-                initialization: pyrightInit(pythonPath),
+                process: projectPyright.process,
+                source: projectPyright.source,
+                initialization: pyrightInit(pythonEnvironment?.pythonPath),
             };
         }
-        // ty (astral-sh/ty, #717) — an alternative Python checker/language server,
-        // tried ONLY when neither pyright nor basedpyright was found locally, and
-        // ONLY on PATH (allowInstall: false below — no managed/auto-install, unlike
-        // pyright's fallback right after this block). That keeps ty strictly
-        // opt-in: it never displaces an already-installed pyright/basedpyright,
-        // and it's never silently auto-installed as a default — a user only gets
-        // it by having installed `ty` themselves (e.g. `uv tool install ty` /
-        // `pip install ty`). Unlike pyright-langserver's `--stdio` flag, ty's CLI
-        // launches its language server via the `server` subcommand; it has no
-        // stable initializationOptions equivalent to pyright's `pythonPath` yet
-        // (astral-sh/ty#2032) — it auto-discovers `.venv`/`VIRTUAL_ENV` from cwd,
-        // so no `initialization` payload is sent.
-        const ty = await resolveAndLaunch({ candidates: ["ty"], args: ["server"], cwd: root, env }, false);
-        if (ty) {
-            return { process: ty.process, source: ty.source };
+        // ty uses `ty server`, so it needs a separate launch phase from the
+        // Pyright-compatible servers. It has no stable initializationOptions
+        // equivalent to pyright's `pythonPath` (astral-sh/ty#2032); the child
+        // environment and cwd provide interpreter discovery instead.
+        const projectTy = await resolveAndLaunch({
+            candidates: pythonEnvironmentToolCandidates(pythonEnvironment, "ty"),
+            args: ["server"],
+            cwd: root,
+            env,
+        }, false);
+        if (projectTy) {
+            return { process: projectTy.process, source: projectTy.source };
+        }
+        // With no project-owned checker, retain the existing PATH preference and
+        // keep ty opt-in: pyright, then basedpyright, then ty. The augmented child
+        // PATH includes pi-lens-managed bins before the inherited global PATH.
+        const pathPyright = await resolveAndLaunch({
+            candidates: ["pyright-langserver", "basedpyright-langserver"],
+            args: ["--stdio"],
+            cwd: root,
+            env,
+        }, false);
+        if (pathPyright) {
+            return {
+                process: pathPyright.process,
+                source: pathPyright.source,
+                initialization: pyrightInit(pythonEnvironment?.pythonPath),
+            };
+        }
+        const pathTy = await resolveAndLaunch({
+            candidates: ["ty"],
+            args: ["server"],
+            cwd: root,
+            env,
+        }, false);
+        if (pathTy) {
+            return { process: pathTy.process, source: pathTy.source };
         }
         // Discover a globally-installed pyright even when install is disabled;
         // only the download is gated by canInstall.
@@ -1605,17 +1800,17 @@ export const PythonServer = {
         const resolved = await resolveAndLaunch({ candidates: managedCandidates, args: ["--stdio"], cwd: root, env }, false);
         if (!resolved)
             return undefined;
-        const pythonPath = await detectPythonVenv(root);
         return {
             process: resolved.process,
             source,
-            initialization: pyrightInit(pythonPath),
+            initialization: pyrightInit(pythonEnvironment?.pythonPath),
         };
     },
 };
 export const PythonJediServer = {
     id: "python-jedi",
     name: "Jedi Language Server",
+    fallbackFor: "python",
     extensions: KIND_EXTENSIONS["python"],
     root: RootWithFallback(createRootDetector([
         ".git",
@@ -1667,79 +1862,6 @@ export const GoServer = {
         return { ...result, initialization: { ui: { semanticTokens: true } } };
     },
 };
-async function readTextFileOrUndefined(filePath) {
-    try {
-        return await readFile(filePath, "utf-8");
-    }
-    catch {
-        return undefined;
-    }
-}
-/**
- * Slice out ONE top-level TOML table's raw body — from its `[name]` heading
- * to the next top-level `[...]`/`[[...]]` heading or EOF. `members`/`exclude`
- * must be read from the `[workspace]` table specifically: `[package]` has its
- * OWN `exclude` key (the standard cargo-publish exclude list, conventionally
- * written above `[workspace]` in a virtual-manifest-less root crate), and a
- * whole-file regex would misread it as workspace membership (#1671 F4).
- */
-function extractTomlTableSection(content, tableName) {
-    const heading = new RegExp(`^\\[${tableName}\\][ \\t]*(?:#.*)?$`, "m");
-    const match = heading.exec(content);
-    if (!match)
-        return "";
-    const rest = content.slice(match.index + match[0].length);
-    const nextHeading = rest.match(/^\[{1,2}[^\]]+\]{1,2}[ \t]*(?:#.*)?$/m);
-    return nextHeading?.index !== undefined
-        ? rest.slice(0, nextHeading.index)
-        : rest;
-}
-function parseTomlStringArray(content, key) {
-    const match = content.match(new RegExp(`^[ \\t]*${key}[ \\t]*=[ \\t]*\\[([\\s\\S]*?)\\]`, "m"));
-    if (!match)
-        return [];
-    return [...match[1].matchAll(/"([^"]*)"|'([^']*)'/g)].map((m) => (m[1] ?? m[2] ?? "").trim());
-}
-/** Turn one `/`-delimited glob SEGMENT into a regex source: `*` matches any
- * run of characters within the segment, `?` matches exactly one character,
- * everything else is escaped and literal. */
-function segmentGlobToRegExpSource(segment) {
-    let out = "";
-    for (const ch of segment) {
-        if (ch === "*")
-            out += "[^/]*";
-        else if (ch === "?")
-            out += "[^/]";
-        else
-            out += ch.replace(/[.+^${}()|[\]\\]/g, "\\$&");
-    }
-    return out;
-}
-/**
- * A `members`/`exclude` entry names a path exactly, or globs it segment by
- * segment: `*` and `?` inside a segment work at any depth — one wildcard
- * segment (`crates/*`), a bare `*`, or several chained together for a
- * deeper fixed-depth layout — matching cargo's own `glob`-crate semantics
- * for a fixed number of path components.
- *
- * KNOWN LIMITATION (#1671 F6, documented rather than implemented): a
- * recursive `**` segment (matching a variable number of path components) is
- * NOT supported and never matches — cargo workspaces that rely on `**` to
- * pull in an arbitrarily-nested crate tree will under-hoist (the crate stays
- * independently rooted instead of joining the workspace). This is
- * deliberately out of #1671's scope: the common, and the issue's fixture,
- * shape is an explicit fixed-depth `members` list.
- */
-function matchesCargoWorkspacePattern(pattern, relativePath) {
-    const normalized = pattern.replace(/\/+$/, "");
-    if (normalized.includes("**"))
-        return false;
-    const patternSegments = normalized.split("/");
-    const pathSegments = relativePath.split("/");
-    if (patternSegments.length !== pathSegments.length)
-        return false;
-    return patternSegments.every((segment, i) => new RegExp(`^${segmentGlobToRegExpSource(segment)}$`).test(pathSegments[i]));
-}
 /**
  * Given an ancestor Cargo.toml's raw contents that already contains a
  * `[workspace]` table, decide whether it actually claims `childDir` as a
@@ -1766,13 +1888,21 @@ function cargoWorkspaceDeclaresMember(workspaceContent, parentDir, childDir) {
         .join("/");
     if (relativePath === "" || relativePath.startsWith(".."))
         return false;
-    const workspaceSection = extractTomlTableSection(workspaceContent, "workspace");
-    const excluded = parseTomlStringArray(workspaceSection, "exclude");
-    if (excluded.some((pattern) => matchesCargoWorkspacePattern(pattern, relativePath))) {
+    // Reuse the shared, `[workspace]`-scoped readers (review round 2, F4)
+    // instead of hand-composing `extractTomlTableSection` +
+    // `parseTomlStringArray` here — that hand-composition duplicated exactly
+    // what `readCargoWorkspaceMembers`/`readCargoWorkspaceExclude` do, the
+    // single-source-of-truth violation #2473 was filed to close for the OTHER
+    // two Cargo.toml readers. Pattern matching goes through the ONE
+    // workspace-member matcher for the same reason (#2591); cargo's dialect —
+    // `**` never matches (#1671 F6), wildcards confined to one component, so
+    // pattern and path must have the same component count — is
+    // `CARGO_WORKSPACE_MEMBER_DIALECT`, not a private compiler here.
+    const matches = (pattern) => matchesWorkspaceMemberPattern(pattern, relativePath, CARGO_WORKSPACE_MEMBER_DIALECT);
+    const excluded = readCargoWorkspaceExclude(workspaceContent);
+    if (excluded.some(matches))
         return false;
-    }
-    const members = parseTomlStringArray(workspaceSection, "members");
-    return members.some((pattern) => matchesCargoWorkspacePattern(pattern, relativePath));
+    return readCargoWorkspaceMembers(workspaceContent).some(matches);
 }
 /**
  * Bound a monorepo-hoist walk-up by the session ceiling: when `file` is inside
@@ -1811,7 +1941,7 @@ function RustWorkspaceRoot() {
             const parentCargoPath = path.join(parent, "Cargo.toml");
             const parentCargoContent = await readTextFileOrUndefined(parentCargoPath);
             if (parentCargoContent !== undefined &&
-                /^\s*\[workspace\]/m.test(parentCargoContent)) {
+                hasCargoWorkspaceTable(parentCargoContent)) {
                 // Test membership against the ORIGINAL crate dir (`root`), never the
                 // walk cursor (`current`, which may already have climbed through
                 // gap directories that have no Cargo.toml of their own) — a
@@ -2119,6 +2249,7 @@ export const CSharpServer = {
 export const OmniSharpServer = createInteractiveServer({
     id: "omnisharp",
     name: "OmniSharp",
+    fallbackFor: "csharp",
     extensions: KIND_EXTENSIONS["csharp"],
     root: createRootDetector([...DOTNET_CSHARP_ROOT_MARKERS]),
     language: "csharp",
@@ -2285,6 +2416,7 @@ export const ElixirServer = createInteractiveServer({
 export const ElixirExpertServer = {
     id: "expert",
     name: "Expert",
+    fallbackFor: "elixir",
     extensions: KIND_EXTENSIONS["elixir"],
     root: RootWithFallback(createRootDetector(["mix.exs"])),
     availabilityKey: "expert",
@@ -2758,7 +2890,13 @@ export const OpengrepServer = {
 // Gate B). NOTE: the napi runner is NOT a subset — it delegates to napi's native
 // engine via root.findAll({rule}) (#206), the SAME Rust core as this LSP and the
 // ast-grep CLI, so rule semantics are identical across all three. The LSP's edge
-// is engine-driven codeAction fixes, not faithfulness of matching.
+// is engine-driven codeAction fixes, not faithfulness of matching. #2347 closed
+// the one known divergence under Gate B: the LSP/CLI resolve embedded `<script>`
+// bodies in HTML and run `language: JavaScript` rules inside them, and the napi
+// fallback now mirrors that (each script body is reparsed as JS and findings are
+// translated back to file coordinates). A future ast-grep embedded-content
+// surface (for example `<style>` bodies, which 0.45.1 does NOT inject) must land
+// on both routes together or be recorded here as an accepted divergence.
 const AST_GREP_KINDS = [
     "csharp",
     "cxx",
@@ -2779,7 +2917,6 @@ const AST_GREP_KINDS = [
     "rust",
     "scala",
     "shell",
-    "solidity",
     "swift",
     "yaml",
 ];