@hienlh/ppm 0.20.10 → 0.21.0

package/scripts/third-party-notices.ts

@@ -0,0 +1,160 @@
+/**
+ * The one place `THIRD-PARTY-NOTICES.md` is written, and the reason it is not
+ * written by hand.
+ *
+ * PPM ships other people's artwork: 14 subset `.woff2` faces cut from Nerd
+ * Fonts, the vscode-icons drawings inlined as data URIs in a stylesheet, and
+ * the Fluent System Icons path data compiled into a module. All three arrive
+ * through a generator, none of them is recognisable as a third-party asset
+ * once it has, and `package.json` has no `files` field — so everything in the
+ * tree is in the tarball whether or not anybody remembered to say where it
+ * came from. A notice written by hand goes stale the first time a generator's
+ * source list is edited; one emitted by the generator cannot.
+ *
+ * Each generator owns its own section and rewrites only that section, because
+ * they run independently: `bun scripts/gen-file-icons.ts` on its own must not
+ * blank the font's notice. That is what the BEGIN/END markers are for.
+ */
+import { readFileSync, writeFileSync, existsSync } from "node:fs";
+import { resolve } from "node:path";
+
+export interface Notice {
+  /** The component, named the way its own project names it. */
+  name: string;
+  /** Where it came from, as a URL somebody can check. */
+  upstream: string;
+  /**
+   * An SPDX identifier where one exists, spelled out where it does not.
+   *
+   * Nerd Fonts' own source table records Font Logos as "unlicensed"; upstream
+   * it carries a verbatim copy of The Unlicense, which is a dedication to the
+   * public domain rather than an absence of terms. GitHub's licence API
+   * reports `Unlicense` for that repository, and the two readings are exact
+   * opposites, so this column follows the licence text rather than the table.
+   */
+  license: string;
+  /** The version vendored, where the source pins one. */
+  version?: string;
+  /**
+   * The upstream copyright line, without the sign.
+   *
+   * A column rather than prose because MIT, Apache-2.0 and the OFL all require
+   * the notice to travel with the work, and a table is the only shape that
+   * makes a missing one visible.
+   */
+  holder: string;
+  /** Anything a reader needs that the three columns cannot carry. */
+  note?: string;
+}
+
+const FILE = resolve(import.meta.dir, "../THIRD-PARTY-NOTICES.md");
+
+/**
+ * The order the file lists sections in, so that the result does not depend on
+ * which generator happened to run last.
+ */
+const SECTIONS = ["product-icons", "file-icons", "nerd-font"] as const;
+export type SectionId = (typeof SECTIONS)[number];
+
+const HEADER = `# Third-party notices
+
+PPM itself is licensed under the Elastic License 2.0 (see \`LICENSE\`). It also
+redistributes the components below, each under its own terms, which continue to
+apply to those components.
+
+Every section here is emitted by the generator that vendors the component —
+edit that generator, not this file. Re-run:
+
+\`\`\`
+bun scripts/gen-product-icons.ts
+bun scripts/gen-file-icons.ts
+bun scripts/gen-nerd-font.ts
+\`\`\`
+`;
+
+function begin(id: SectionId): string {
+  return `<!-- BEGIN ${id} -->`;
+}
+function end(id: SectionId): string {
+  return `<!-- END ${id} -->`;
+}
+
+/** `github.com/owner/repo` reads better in a table cell than the whole URL. */
+function short(url: string): string {
+  const u = new URL(url);
+  return `${u.host}${u.pathname.replace(/\/$/, "")}`;
+}
+
+function renderTable(notices: readonly Notice[]): string {
+  const rows = notices.map(
+    (n) =>
+      `| ${n.name} | [${short(n.upstream)}](${n.upstream}) | ${n.version ?? "—"} | ${licenseCell(n.license)} | \u00a9 ${n.holder} |`,
+  );
+  const notes = notices.filter((n) => n.note).map((n) => `- **${n.name}** — ${n.note}`);
+  return [
+    "| Component | Upstream | Version | Licence | Copyright |",
+    "| --- | --- | --- | --- | --- |",
+    ...rows,
+    ...(notes.length > 0 ? ["", ...notes] : []),
+  ].join("\n");
+}
+
+/**
+ * Every SPDX id in the column links to the text committed under `licenses/`.
+ *
+ * A link to spdx.org would not do: MIT, Apache-2.0 and the OFL each require the
+ * licence itself to be distributed with the work, so the copy has to be in the
+ * tarball. The cell may name two (Font Awesome licenses its icons and its fonts
+ * differently), so this rewrites ids wherever they appear rather than treating
+ * the whole cell as one.
+ */
+function licenseCell(license: string): string {
+  return license.replace(/[A-Za-z0-9.-]+/g, (word) =>
+    VENDORED.has(word) ? `[${word}](licenses/${word}.txt)` : word,
+  );
+}
+
+/** The texts committed under `licenses/`. */
+const VENDORED = new Set(["MIT", "Apache-2.0", "OFL-1.1", "CC-BY-4.0", "Unlicense"]);
+
+/**
+ * Replace one section of the notices file, leaving the others as they are.
+ *
+ * `intro` is prose the generator wants above its table — what was vendored and
+ * in what form, which is the part a licence column cannot say.
+ */
+export function writeNotices(
+  id: SectionId,
+  heading: string,
+  intro: string,
+  notices: readonly Notice[],
+): void {
+  const body = [
+    begin(id),
+    "",
+    `## ${heading}`,
+    "",
+    intro.trim(),
+    "",
+    renderTable(notices),
+    "",
+    end(id),
+  ].join("\n");
+
+  const existing = existsSync(FILE) ? readFileSync(FILE, "utf-8") : "";
+  const sections = new Map<SectionId, string>();
+  for (const other of SECTIONS) {
+    if (other === id) continue;
+    const from = existing.indexOf(begin(other));
+    const to = existing.indexOf(end(other));
+    if (from !== -1 && to > from) sections.set(other, existing.slice(from, to + end(other).length));
+  }
+  sections.set(id, body);
+
+  const out =
+    [HEADER.trim(), ...SECTIONS.filter((s) => sections.has(s)).map((s) => sections.get(s)!)].join(
+      "\n\n",
+    ) + "\n";
+  writeFileSync(FILE, out);
+  console.log(`notices    ${id}: ${notices.length} component${notices.length === 1 ? "" : "s"}`);
+}

package/scripts/vite-monaco-dev-assets.ts

@@ -0,0 +1,63 @@
+/**
+ * Monaco under `bun dev:web`.
+ *
+ * `monaco-adapter.ts` points the AMD loader at `/assets/monaco/vs`, and that path only exists
+ * after `bun run build` — `copy-monaco.ts` stages it into `dist/web`. In dev the request fell
+ * through to the SPA fallback, which answers `loader.js` with `index.html` as `text/html`; the
+ * browser's strict MIME check turns that into a SyntaxError, and every editor and diff tab then
+ * spins forever. It reads as a hung component rather than as a missing asset, which is what made
+ * it worth a plugin rather than a note in the README — and the jsdelivr default this replaced
+ * did work in dev, so it is a regression rather than a gap.
+ *
+ * The files come straight out of `node_modules` through the same exclusion list the build uses,
+ * so dev cannot succeed on a file production does not ship.
+ */
+import { createReadStream, statSync } from "node:fs";
+import { extname, resolve, sep } from "node:path";
+import type { Plugin } from "vite";
+import { MONACO_VS, isUnused } from "./monaco-staging.ts";
+
+/** Every file in the AMD build is one of these two; anything an upgrade adds is sent as bytes. */
+const CONTENT_TYPES: Record<string, string> = {
+  ".js": "text/javascript; charset=utf-8",
+  ".css": "text/css; charset=utf-8",
+};
+
+/**
+ * The file `pathname` asks for, relative to Monaco's `vs` directory, or null when there is
+ * nothing to serve — which leaves the request to Vite and its SPA fallback, exactly as before.
+ *
+ * Exported for its own test: the traversal guard is the kind of thing that is easy to write and
+ * impossible to notice the absence of, and this runs on a dev server that listens on the LAN
+ * (`server.host: true`).
+ */
+export function monacoDevAsset(pathname: string, root = MONACO_VS): { file: string; contentType: string } | null {
+  let decoded: string;
+  try {
+    decoded = decodeURIComponent(pathname.split("?")[0] ?? "");
+  } catch {
+    return null; // a malformed escape is not a path
+  }
+  if (decoded.includes("\0")) return null;
+  const file = resolve(root, `.${decoded.startsWith("/") ? decoded : `/${decoded}`}`);
+  if (!file.startsWith(root + sep)) return null;
+  if (isUnused(file)) return null;
+  if (!statSync(file, { throwIfNoEntry: false })?.isFile()) return null;
+  return { file, contentType: CONTENT_TYPES[extname(file)] ?? "application/octet-stream" };
+}
+
+export function monacoDevAssets(): Plugin {
+  return {
+    name: "ppm-monaco-dev-assets",
+    apply: "serve",
+    configureServer(server) {
+      // Connect strips the mounted prefix, so `req.url` here is the path inside `vs/`.
+      server.middlewares.use("/assets/monaco/vs", (req, res, next) => {
+        const asset = monacoDevAsset(req.url ?? "/");
+        if (!asset) return next();
+        res.setHeader("Content-Type", asset.contentType);
+        createReadStream(asset.file).on("error", next).pipe(res);
+      });
+    },
+  };
+}

package/src/providers/claude-agent-sdk.ts

@@ -564,9 +564,18 @@ export class ClaudeAgentSdkProvider implements AIProvider {
 
   async listSessionsByDir(dir?: string, opts?: { limit?: number; offset?: number }): Promise<SessionInfo[]> {
     try {
-      const limit = opts?.limit ?? 50;
       const offset = opts?.offset ?? 0;
-      const sdkSessions = await sdkListSessions({ dir, limit, offset });
+      // A dir-scoped call with no explicit limit means "every session in this
+      // project" — chat search and the search-index backfill both ask that way.
+      // It has to be answered by paging the SDK, not by taking its first page:
+      // everything past that page fell through to the recovery scan below,
+      // which can only reconstruct a title from the transcript's first 512
+      // bytes. So 165 of 228 sessions here were listed under their opening
+      // prompt ("/recap") instead of the name they had been given, and no
+      // search for that name could match them.
+      const sdkSessions = dir !== undefined && opts?.limit === undefined
+        ? await listAllSdkSessions(dir)
+        : await sdkListSessions({ dir, limit: opts?.limit ?? 50, offset });
       // Overlay DB titles (user-set) over SDK titles
       const ids = sdkSessions.map((s) => s.sessionId);
       const dbTitles = getSessionTitles(ids);
@@ -2167,6 +2176,27 @@ export class ClaudeAgentSdkProvider implements AIProvider {
   }
 }
 
+const SDK_SESSION_PAGE = 200;
+/** Hard stop so a pathological directory cannot spin here. */
+const SDK_SESSION_MAX_PAGES = 100;
+
+/** Every session the SDK can parse in `dir`, paged until exhausted. */
+async function listAllSdkSessions(
+  dir: string,
+): Promise<Awaited<ReturnType<typeof sdkListSessions>>> {
+  const all: Awaited<ReturnType<typeof sdkListSessions>> = [];
+  for (let page = 0; page < SDK_SESSION_MAX_PAGES; page++) {
+    const batch = await sdkListSessions({
+      dir,
+      limit: SDK_SESSION_PAGE,
+      offset: page * SDK_SESSION_PAGE,
+    });
+    all.push(...batch);
+    if (batch.length < SDK_SESSION_PAGE) break;
+  }
+  return all;
+}
+
 /**
  * Scan a JSONL project directory for sessions that the SDK's listSessions missed.
  * The SDK uses a 64KB head buffer; sessions with very large first messages

package/src/server/index.ts

@@ -31,6 +31,8 @@ import { extensionWebSocket } from "./ws/extensions.ts";
 import { globalWebSocket } from "./ws/global.ts";
 import { groupChatWebSocket } from "./ws/group-chat.ts";
 import { remoteDesktopWebSocket } from "./ws/remote-desktop.ts";
+import { lspWebSocket } from "./ws/lsp.ts";
+import { lspManager } from "../services/lsp/lsp-manager.ts";
 import { isRemoteDesktopEnabled } from "../services/remote-desktop/remote-desktop-flag.ts";
 import { ok, err } from "../types/api.ts";
 
@@ -912,6 +914,14 @@ if (process.argv.includes("__serve__")) {
           if (upgraded) return undefined;
           return new Response("WebSocket upgrade failed", { status: 400 });
         }
+
+        if (wsType === "lsp") {
+          const upgraded = server.upgrade(req, {
+            data: { type: "lsp", projectName },
+          });
+          if (upgraded) return undefined;
+          return new Response("WebSocket upgrade failed", { status: 400 });
+        }
       }
 
       return app.fetch(req, server);
@@ -928,6 +938,7 @@ if (process.argv.includes("__serve__")) {
         else if (t === "global") globalWebSocket.open(ws);
         else if (t === "remote-desktop") remoteDesktopWebSocket.open(ws);
         else if (t === "terminal") terminalWebSocket.open(ws);
+        else if (t === "lsp") lspWebSocket.open(ws);
         else ws.close(1008, "unknown socket type");
       },
       message(ws: any, msg: any) {
@@ -938,6 +949,7 @@ if (process.argv.includes("__serve__")) {
         else if (t === "global") globalWebSocket.message(ws, msg);
         else if (t === "remote-desktop") remoteDesktopWebSocket.message(ws, msg);
         else if (t === "terminal") terminalWebSocket.message(ws, msg);
+        else if (t === "lsp") lspWebSocket.message(ws, msg);
       },
       close(ws: any) {
         const t = ws.data?.type;
@@ -947,6 +959,7 @@ if (process.argv.includes("__serve__")) {
         else if (t === "global") globalWebSocket.close(ws);
         else if (t === "remote-desktop") remoteDesktopWebSocket.close(ws);
         else if (t === "terminal") terminalWebSocket.close(ws);
+        else if (t === "lsp") lspWebSocket.close(ws);
       },
     } as Parameters<typeof Bun.serve>[0] extends { websocket?: infer W } ? W : never,
   });
@@ -997,6 +1010,10 @@ if (process.argv.includes("__serve__")) {
   const gracefulShutdown = () => {
     try { schedulerStop?.(); } catch {}
     try { codexCleanupRef?.(); } catch {}
+    // Language servers are long-lived children; most exit on stdin EOF, but a
+    // resident rust-analyzer holding a crate graph is too expensive to leave
+    // to chance. Synchronous because process.exit follows immediately.
+    try { lspManager.killAllSync(); } catch {}
     try { server.stop(true); } catch {}
     process.exit(0);
   };

package/src/server/routes/chat.ts

@@ -28,6 +28,7 @@ import {
   search as chatSearchQuery,
   startBackfill as chatSearchStartBackfill,
   getIndexStatus as chatSearchGetIndexStatus,
+  getKnownSessionCount as chatSearchKnownCount,
 } from "../../services/chat-search.service.ts";
 import type { ChatSearchResult, ChatSearchResponse } from "../../types/chat.ts";
 import { ok, err } from "../../types/api.ts";
@@ -250,15 +251,24 @@ chatRoutes.get("/search", async (c) => {
     const rawQuery = c.req.query("q")?.trim() || "";
     const limit = Math.min(parseInt(c.req.query("limit") ?? "30", 10) || 30, 100);
 
+    // An empty query has nothing to match, so it must not pay to enumerate: a
+    // dir-scoped `listSessions` pages the SDK until exhausted, and all this
+    // answer carries is the indexing chip's two numbers, which the index knows
+    // by itself.
+    if (!rawQuery) {
+      const indexing = { total: chatSearchKnownCount(projectPath), ...chatSearchGetIndexStatus(projectPath) };
+      return c.json(ok({ results: [], indexing } satisfies ChatSearchResponse));
+    }
+
     // Enumerate sessions once (also drives title matches + metadata for content hits).
     const sessions = await chatService.listSessions(undefined, projectPath);
-    const total = sessions.length;
-    const indexing = { total, ...chatSearchGetIndexStatus(projectPath) };
-
-    if (!rawQuery) return c.json(ok({ results: [], indexing } satisfies ChatSearchResponse));
+    const indexing = { total: sessions.length, ...chatSearchGetIndexStatus(projectPath) };
 
-    // Lazy self-refresh; UI shows an indexing indicator while this runs.
-    chatSearchStartBackfill(projectPath);
+    // Lazy self-refresh; UI shows an indexing indicator while this runs. The
+    // sessions are handed over rather than enumerated again: a dir-scoped list
+    // with no limit pages the SDK until exhausted, and this route was paying
+    // for that twice on every search.
+    chatSearchStartBackfill(projectPath, sessions);
 
     const pinnedIds = getPinnedSessionIds();
     const tagMap = getSessionTags(sessions.map((s) => s.id));

package/src/server/routes/git.ts

@@ -1,13 +1,92 @@
 import { Hono } from "hono";
+import { resolve } from "node:path";
 import { gitService } from "../../services/git.service.ts";
 import { gitHunksService, type HunkRequest, type HunkScope } from "../../services/git-hunks/git-hunks.service.ts";
-import { gitBlameService } from "../../services/git-blame/git-blame.service.ts";
+import { assertSafeRev, gitBlameService } from "../../services/git-blame/git-blame.service.ts";
+import { discoverGitRepos, isGitRepo } from "../../services/git-repos/git-repo-discovery.ts";
+import { isInsideDir, realPathOrSelfSync } from "../../services/fs-ops/fs-real-path.ts";
 import { ok, err } from "../../types/api.ts";
 
 type Env = { Variables: { projectPath: string; projectName: string } };
 
 export const gitRoutes = new Hono<Env>();
 
+/**
+ * `?repo=` scopes every git route below to one repository inside the project.
+ *
+ * A workspace folder is often a container whose *children* are the
+ * repositories, so the project path and the git root are not the same
+ * directory. Rather than teach each of the twenty-odd handlers, the parameter
+ * is resolved once here and `projectPath` is replaced — every handler already
+ * reads that, and `git.service` already takes the directory to run in.
+ *
+ * It is validated, and a bad value is a 400 rather than a fallback to the
+ * project root. Falling back would run the command one directory up and answer
+ * with *a* history — the wrong one — which is indistinguishable from a working
+ * feature until someone acts on it.
+ *
+ * Both sides go through `realPathOrSelfSync` first. `resolve` is purely
+ * textual, so a symlink inside the project pointing anywhere on the host
+ * resolves to an in-project path, passes, and git runs in the link's target.
+ * Discovery refuses to *offer* such a path, but this parameter comes straight
+ * from the client and is not obliged to be one discovery returned.
+ *
+ * Containment is `isInsideDir`, which folds case on Windows: `c:\users\pc\ppm`
+ * and `C:\Users\PC\ppm` are one directory, and a case-sensitive prefix test
+ * answers 400 for the second — a path this server handed out itself.
+ */
+gitRoutes.use("*", async (c, next) => {
+  const repo = c.req.query("repo");
+  if (repo) {
+    const root = realPathOrSelfSync(resolve(c.get("projectPath")));
+    const target = realPathOrSelfSync(resolve(repo));
+    if (!isInsideDir(target, root)) {
+      return c.json(err("repo is outside the project"), 400);
+    }
+    if (!isGitRepo(target)) {
+      return c.json(err("repo is not a git repository"), 400);
+    }
+    c.set("projectPath", target);
+  }
+  await next();
+});
+
+/**
+ * The `ref`-ish query parameters, refused at the boundary rather than handed on.
+ *
+ * A revision reaches git as its own argv word, so the hazard is not a shell
+ * metacharacter but a value that changes what the command *is*: `?ref1=--output=/tmp/x`
+ * is an option, not a revision, and `git diff` honours it. `assertSafeRev` is
+ * the rule the blame path already states — no leading dash, no `..` range, none
+ * of what `check-ref-format` forbids — and `HEAD~1` and `main^` still pass,
+ * because those are what the diff viewer actually asks for.
+ */
+function invalidRev(...revs: Array<string | undefined>): string | null {
+  for (const rev of revs) {
+    if (rev === undefined) continue;
+    try {
+      assertSafeRev(rev);
+    } catch (e) {
+      return (e as Error).message;
+    }
+  }
+  return null;
+}
+
+/**
+ * GET /git/repos — the repositories under this project.
+ *
+ * Answers for a project whose root is not a repository, which is the case the
+ * git surfaces used to report as an error.
+ */
+gitRoutes.get("/repos", (c) => {
+  try {
+    return c.json(ok(discoverGitRepos(c.get("projectPath"))));
+  } catch (e) {
+    return c.json(err((e as Error).message), 500);
+  }
+});
+
 /** GET /git/status */
 gitRoutes.get("/status", async (c) => {
   try {
@@ -25,6 +104,8 @@ gitRoutes.get("/diff", async (c) => {
     const projectPath = c.get("projectPath");
     const ref1 = c.req.query("ref1") || undefined;
     const ref2 = c.req.query("ref2") || undefined;
+    const bad = invalidRev(ref1, ref2);
+    if (bad) return c.json(err(bad), 400);
     const diff = await gitService.diff(projectPath, ref1, ref2);
     return c.json(ok({ diff }));
   } catch (e) {
@@ -38,6 +119,8 @@ gitRoutes.get("/diff-stat", async (c) => {
     const projectPath = c.get("projectPath");
     const ref1 = c.req.query("ref1") || undefined;
     const ref2 = c.req.query("ref2") || undefined;
+    const bad = invalidRev(ref1, ref2);
+    if (bad) return c.json(err(bad), 400);
     const files = await gitService.diffStat(projectPath, ref1, ref2);
     return c.json(ok(files));
   } catch (e) {
@@ -52,6 +135,8 @@ gitRoutes.get("/file-diff", async (c) => {
     const file = c.req.query("file");
     if (!file) return c.json(err("Missing query: file"), 400);
     const ref = c.req.query("ref") || undefined;
+    const bad = invalidRev(ref);
+    if (bad) return c.json(err(bad), 400);
     const diff = await gitService.fileDiff(projectPath, file, ref);
     return c.json(ok({ diff }));
   } catch (e) {
@@ -69,6 +154,8 @@ gitRoutes.get("/file-full-diff", async (c) => {
     if (!file) return c.json(err("Missing query: file"), 400);
     const ref = c.req.query("ref") || "HEAD";
     const ref2 = c.req.query("ref2") || undefined;
+    const bad = invalidRev(ref, ref2);
+    if (bad) return c.json(err(bad), 400);
     const result = await gitService.fileFullDiff(projectPath, file, ref, ref2);
     return c.json(ok(result));
   } catch (e) {
@@ -185,6 +272,31 @@ gitRoutes.get("/blame", async (c) => {
   }
 });
 
+/**
+ * GET /git/commit-line?hash=&path=&line= — the commit message and the one-line
+ * diff behind a blamed line, for the editor's hover.
+ *
+ * `path` and `line` are the path and line number *at that commit*, which is
+ * what `git blame --porcelain` reports; the browser passes them straight back
+ * from the blame it already has.
+ */
+gitRoutes.get("/commit-line", async (c) => {
+  try {
+    const projectPath = c.get("projectPath");
+    const hash = c.req.query("hash");
+    const filePath = c.req.query("path");
+    const line = Number(c.req.query("line"));
+    if (!hash) return c.json(err("Missing: hash"), 400);
+    if (!filePath) return c.json(err("Missing: path"), 400);
+    if (!Number.isInteger(line) || line < 1) return c.json(err("Invalid: line"), 400);
+    const result = await gitBlameService.lineDetail(projectPath, hash, filePath, line);
+    // An unknown hash or a path git never had is "no hover", not an error.
+    return c.json(ok(result));
+  } catch (e) {
+    return c.json(err((e as Error).message), 500);
+  }
+});
+
 /** GET /git/hunks?path=&scope=worktree|index — the hunks the UI selects from */
 gitRoutes.get("/hunks", async (c) => {
   try {

package/src/server/routes/lsp.ts

@@ -0,0 +1,58 @@
+/**
+ * Language server status.
+ *
+ * This exists so "nothing is happening in the editor" has an answer. The
+ * common case for a fresh PPM install is that no language server is installed
+ * at all, which is indistinguishable from a broken feature unless something
+ * says so — hence the install hint travelling with the availability.
+ *
+ * Nothing here installs anything. A silent network install triggered by opening
+ * a file is not a thing an editor should do on the user's behalf.
+ */
+import { Hono } from "hono";
+import { sep } from "node:path";
+import { lspManager } from "../../services/lsp/lsp-manager.ts";
+import { lspLanguageForPath } from "../../services/lsp/server-registry.ts";
+import { ok, err } from "../../types/api.ts";
+
+type Env = { Variables: { projectPath: string; projectName: string } };
+
+/**
+ * Is `rootPath` this project, or inside it?
+ *
+ * A bare `startsWith` is not that question: a project at `/srv/app` matched every server
+ * rooted in `/srv/app2`, so the indicator reported a neighbour's server as this project's —
+ * including its `ready` state, which is what the editor draws the server's name from.
+ */
+export function isWithinProject(rootPath: string, projectPath: string): boolean {
+  return rootPath === projectPath || rootPath.startsWith(projectPath.endsWith(sep) ? projectPath : projectPath + sep);
+}
+
+export const lspRoutes = new Hono<Env>();
+
+/**
+ * GET /lsp/status — which servers this project can use, and what is running.
+ *
+ * `path` narrows it to the server that would serve one file, which is what the
+ * editor's indicator asks for.
+ */
+lspRoutes.get("/status", async (c) => {
+  try {
+    const projectPath = c.get("projectPath");
+    const available = await lspManager.availability(projectPath);
+    const running = lspManager.running().filter((entry) => isWithinProject(entry.rootPath, projectPath));
+
+    const filePath = c.req.query("path");
+    const language = filePath ? lspLanguageForPath(filePath) : null;
+
+    return c.json(ok({
+      language,
+      servers: language ? available.filter((s) => s.languages.includes(language)) : available,
+      running,
+    }));
+  } catch (e) {
+    return c.json(err((e as Error).message), 500);
+  }
+});
+
+export default lspRoutes;

package/src/server/routes/project-scoped.ts

@@ -3,6 +3,7 @@ import { resolveProjectPath } from "../helpers/resolve-project.ts";
 import { chatRoutes } from "./chat.ts";
 import { tagRoutes } from "./tag-routes.ts";
 import { gitRoutes } from "./git.ts";
+import { lspRoutes } from "./lsp.ts";
 import { fileRoutes } from "./files.ts";
 import { sqliteRoutes } from "./sqlite.ts";
 import { workspaceRoutes } from "./workspace.ts";
@@ -29,6 +30,7 @@ projectScopedRouter.use("*", async (c, next) => {
 projectScopedRouter.route("/chat", chatRoutes);
 projectScopedRouter.route("/tags", tagRoutes);
 projectScopedRouter.route("/git", gitRoutes);
+projectScopedRouter.route("/lsp", lspRoutes);
 projectScopedRouter.route("/files", fileRoutes);
 projectScopedRouter.route("/sqlite", sqliteRoutes);
 projectScopedRouter.route("/workspace", workspaceRoutes);

package/src/server/routes/static-encoding.ts

@@ -0,0 +1,73 @@
+/**
+ * Choosing which precompressed copy of an asset to send.
+ *
+ * `scripts/precompress-web.ts` writes `<file>.br` and `<file>.gz` beside each
+ * text asset at build time. This decides which one a given request gets, and
+ * deliberately treats a missing variant as "send the original" — so a build
+ * that skipped the compression step still serves a working site, just with the
+ * bytes PPM sent before any of this existed.
+ */
+
+export type ContentEncoding = "br" | "gzip";
+
+export interface ChosenVariant {
+  /** The file to send. The original when no variant applies. */
+  path: string;
+  /** What to declare in `Content-Encoding`, or null when sending the original. */
+  encoding: ContentEncoding | null;
+}
+
+/** Extension for each encoding, matching what the build writes. */
+const EXTENSION: Record<ContentEncoding, string> = { br: ".br", gzip: ".gz" };
+
+/**
+ * Which encodings a client will accept, best first.
+ *
+ * `q=0` means *refuses* rather than "no preference", so it has to be honoured —
+ * a client that sends `gzip;q=0` and receives gzip cannot read the response.
+ * Beyond that the order here is PPM's preference, not the client's: brotli is
+ * ~20% smaller than gzip on this bundle and every browser that sends `br`
+ * handles it.
+ */
+export function acceptedEncodings(header: string | undefined): ContentEncoding[] {
+  if (!header) return [];
+  const refused = new Set<string>();
+  const offered = new Set<string>();
+
+  for (const part of header.split(",")) {
+    const [rawToken, ...params] = part.split(";");
+    const token = rawToken?.trim().toLowerCase();
+    if (!token) continue;
+    const q = params.map((p) => p.trim().toLowerCase()).find((p) => p.startsWith("q="));
+    if (q && Number(q.slice(2)) === 0) refused.add(token);
+    else offered.add(token);
+  }
+
+  return (["br", "gzip"] as const).filter(
+    // `*` stands in for anything not named, which is how a client says "any".
+    (e) => !refused.has(e) && (offered.has(e) || (offered.has("*") && !refused.has("*"))),
+  );
+}
+
+/**
+ * The variant to send for `filePath`.
+ *
+ * `exists` is injected so this stays a pure decision — the caller owns the
+ * filesystem, and the tests do not need one.
+ */
+export function chooseVariant(
+  filePath: string,
+  acceptEncoding: string | undefined,
+  exists: (path: string) => boolean,
+): ChosenVariant {
+  // A request for the variant itself is not a request to encode it again.
+  if (filePath.endsWith(".br") || filePath.endsWith(".gz")) {
+    return { path: filePath, encoding: null };
+  }
+
+  for (const encoding of acceptedEncodings(acceptEncoding)) {
+    const candidate = filePath + EXTENSION[encoding];
+    if (exists(candidate)) return { path: candidate, encoding };
+  }
+  return { path: filePath, encoding: null };
+}