@ttsc/lint 0.30.4 → 0.31.0

package/linthost/lookup_rule_returns_registered_implementation_or_nil_test.go

@@ -0,0 +1,49 @@
+package linthost
+
+import (
+  "testing"
+
+  shimast "github.com/microsoft/typescript-go/shim/ast"
+)
+
+type lookupSentinelRule struct{ name string }
+
+func (r *lookupSentinelRule) Name() string                  { return r.name }
+func (r *lookupSentinelRule) Visits() []shimast.Kind        { return nil }
+func (r *lookupSentinelRule) Check(*Context, *shimast.Node) {}
+
+// TestLookupRuleReturnsRegisteredImplementationOrNil verifies LookupRule returns
+// the exact implementation registered under a name and nil for a name that was
+// never registered.
+//
+// The hit uses a sentinel the test registers itself, so the expectation is the
+// pointer the test supplied rather than a production rule name.
+//
+//  1. Register a pointer-typed sentinel rule under a fresh name.
+//  2. Look the name up and require the identical pointer.
+//  3. Look up a second, never-registered name and require nil.
+//
+// @evidence contracts/testing.md#behavioral-verification LookupRule returns the identical pointer that Register stored for the sentinel name, and returns a nil Rule for an adjacent never-registered name instead of a placeholder.
+// @evidence contracts/testing.md#independent-expectations The expected hit is the pointer the test constructed and registered; the expected miss is nil by the registry contract. Neither is derived from the production rule set or from LookupRule output.
+// @evidence contracts/testing.md#distinguishing-cases One registered name and one unregistered neighbor distinguish a registry that returns anything for every name from one that returns nothing; duplicate registration and complete enumeration are owned by the duplicate-name and enumeration tests.
+// @evidence contracts/testing.md#execution-ownership Unit entry TestLookupRuleReturnsRegisteredImplementationOrNil calls Register and LookupRule in the shared linthost test process with a private stub and removes the sentinel on cleanup; it checks no repository arrangement and starts no host.
+func TestLookupRuleReturnsRegisteredImplementationOrNil(t *testing.T) {
+  const hit = "test/lookup-sentinel"
+  const miss = "test/lookup-never-registered"
+  if LookupRule(hit) != nil || LookupRule(miss) != nil {
+    t.Fatalf("sentinel names are already registered: %q, %q", hit, miss)
+  }
+  registeredRule := &lookupSentinelRule{name: hit}
+  Register(registeredRule)
+  t.Cleanup(func() {
+    delete(registered.rules, hit)
+    invalidateRuntimeRuleCodes()
+  })
+
+  if got := LookupRule(hit); got != Rule(registeredRule) {
+    t.Fatalf("LookupRule(%q) = %v, want the registered pointer", hit, got)
+  }
+  if got := LookupRule(miss); got != nil {
+    t.Fatalf("LookupRule(%q) = %v, want nil", miss, got)
+  }
+}

package/linthost/lsp.go

@@ -19,6 +19,7 @@ import (
   shimast "github.com/microsoft/typescript-go/shim/ast"
   shimcore "github.com/microsoft/typescript-go/shim/core"
   shimparser "github.com/microsoft/typescript-go/shim/parser"
+  shimscanner "github.com/microsoft/typescript-go/shim/scanner"
 
   publicrule "github.com/samchon/ttsc/packages/lint/rule"
 )
@@ -168,16 +169,50 @@ func lspCodeActionKinds() []string {
 }
 
 // RunLSPCommandIDs prints the workspace/executeCommand ids owned by @ttsc/lint.
+// It acquires no project. Serialization failures return 2 and output failures
+// return 3; the caller owns the standard streams.
+//
+// @evidence contracts/common.md#principled-implementation The shared lint command registry supplies the exact advertised identifiers, and the ordinary JSON writer preserves serialization/output failures as nonzero exit status.
+// @evidence contracts/common.md#clear-and-simple-design This verb exposes registry data only; command dispatch and project evaluation remain separate responsibilities.
+// @evidence contracts/common.md#prohibited-implementation-shortcuts Command names are the lint sidecar protocol, not fixture answers or patched language-server registrations.
+// @evidence contracts/common.md#meaningful-documentation Native prose explains the registry boundary, absence of project acquisition and output failure codes under documentation-skill guidance.
+// @evidenceExclude contracts/portability.md#os-neutral-implementation This verb serializes protocol identifiers without native path, filesystem identity or child-process selection.
+// @evidenceExclude contracts/performance.md#efficient-algorithms The verb emits a fixed registry rather than choosing a project processing strategy.
+// @evidenceExclude contracts/performance.md#reuse-equivalent-work The fixed command list requires no reusable compilation or request coordination.
+// @evidenceExclude contracts/performance.md#bound-retention-and-release-resources The caller owns stdout; this verb acquires no handle or retained project state.
 func RunLSPCommandIDs([]string) int {
   return writeJSON(lspCommandIDs())
 }
 
 // RunLSPCodeActionKinds prints the CodeActionKind values @ttsc/lint may return.
+// These are advertised kinds, not evidence that an action applies to a document.
+// It loads no project; JSON/output failures use the shared writer's exit codes.
+//
+// @evidence contracts/common.md#principled-implementation The same supported action categories used by code-action filtering are published as JSON; availability remains a document query rather than a fabricated capability result.
+// @evidence contracts/common.md#clear-and-simple-design Registry publication is separate from per-document rule evaluation and action construction.
+// @evidence contracts/common.md#prohibited-implementation-shortcuts The categories encode the supported quick-fix, fix-all and formatting protocol without consumer-specific or test-only kinds.
+// @evidence contracts/common.md#meaningful-documentation Native prose distinguishes advertised kinds from applicable actions and states acquisition/failure behavior under documentation-skill guidance.
+// @evidenceExclude contracts/portability.md#os-neutral-implementation Protocol category serialization chooses no native path or process capability.
+// @evidenceExclude contracts/performance.md#efficient-algorithms This fixed registry publication chooses no project processing algorithm.
+// @evidenceExclude contracts/performance.md#reuse-equivalent-work It coordinates no compiler work or cache consumers.
+// @evidenceExclude contracts/performance.md#bound-retention-and-release-resources It retains no project or historical state and acquires no owned stream handle.
 func RunLSPCodeActionKinds([]string) int {
   return writeJSON(lspCodeActionKinds())
 }
 
 // RunLSPDiagnostics prints lint diagnostics for one file URI as LSP JSON.
+// The document uses saved project state. Parse diagnostics remain upstream's
+// responsibility; lint results may also carry a separate project publication.
+// Acquisition/evaluation errors return 2, and output write errors return 3.
+//
+// @evidence contracts/common.md#principled-implementation The native lint engine supplies saved-project findings, filtered to the physical document identity; compiler source bytes determine UTF-16 primary/related ranges, severity and supported diagnostic tags. Upstream retains ownership of parse diagnostics.
+// @evidence contracts/common.md#clear-and-simple-design The verb parses options, evaluates through the shared findings path and serializes one result. Project publications and document findings remain separate payload fields.
+// @evidence contracts/common.md#prohibited-implementation-shortcuts Real rule findings supply diagnostics; no source-pattern imitation, consumer exception or foreign server mutation replaces the engine.
+// @evidence contracts/common.md#meaningful-documentation Native prose explains saved-state ownership, upstream parse diagnostics, optional project results and error codes under documentation-skill guidance; wire helpers state UTF-16 units and omission behavior.
+// @evidence contracts/portability.md#os-neutral-implementation File URLs are decoded to native paths and physical project identity filters the result. Path construction uses filepath operations; source coordinates use compiler line semantics rather than platform newline guesses.
+// @evidence contracts/performance.md#efficient-algorithms The owning command includes option/config/Program acquisition and one lint/project cycle before filtering findings. Each finding path can require physical-resolution and name-byte work; each primary/related endpoint uses the shared source-file line map, binary-searches its line and counts UTF-16 units from that line start to the endpoint, so long same-line prefixes can be rescanned. Related items/tags and JSON payload bytes add conversion/storage work; no globally linear diagnostic-byte bound or omitted engine/checker cost is claimed.
+// @evidence contracts/performance.md#reuse-equivalent-work The shared Program acquisition boundary permits the resident host to reuse its valid current Program under that owner's update/invalidation premises. The document loader obtains current rule policy through its config evaluator dependency cache; project-cycle reset belongs to the Program/request owner. This verb adds no response cache keyed only by URI, and equal document text alone does not validate project/rule results.
+// @evidence contracts/performance.md#bound-retention-and-release-resources The computation defers the acquisition-release callback when returned by the shared findings path; a one-shot callback drops the standalone checker while a resident host keeps its warm Program. Diagnostic arrays/range values and JSON buffers are response-local, with message string backing potentially shared with findings and the latest project-cycle memo retained by the Program. Config/Program caches retain separate state; this entry sets no finding/output-byte cap, cache eviction or caller deadline.
 func RunLSPDiagnostics(args []string) int {
   opts, ok := parseLSPCommandOptions("lsp-diagnostics", args)
   if !ok {
@@ -192,6 +227,18 @@ func RunLSPDiagnostics(args []string) int {
 
 // RunLSPProjectDiagnostics prints the current project-rule publication without
 // requiring an open TypeScript document.
+// Disabled project rules yield an empty publication that clears older results.
+// A project parse failure yields null instead, retaining the host's last good
+// publication. Acquisition/evaluation errors return 2; output failures return 3.
+//
+// @evidence contracts/common.md#principled-implementation Only project rules run, and the logical config URI anchors their publication. An evaluated empty set differs from a project that could not parse, so null does not erase the host's last good answer.
+// @evidence contracts/common.md#clear-and-simple-design Project-only evaluation has its own payload boundary while sharing rule loading and Program acquisition with document commands.
+// @evidence contracts/common.md#prohibited-implementation-shortcuts Actual rule evaluation determines the publication; a failed parse is not converted to a fabricated successful empty result.
+// @evidence contracts/common.md#meaningful-documentation Native paragraphs explain no-document usage, disabled/parse-failed distinctions and exit codes under the documentation skill's absence and failure guidance.
+// @evidence contracts/portability.md#os-neutral-implementation Project anchors are native driver inputs while the published config identity is encoded as a file URL; native path construction remains with filepath and the project identity owner.
+// @evidence contracts/performance.md#efficient-algorithms The owning command parses options and loads rule policy/Program before evaluating one project cycle without a document lint pass. Finalization and each rule add their own sorting/evaluation work; each finding, related location and tag is converted and JSON-encoded. UTF-16 endpoints reuse line maps but scan their line prefixes, so repeated long-line endpoints can revisit bytes. Cost includes acquisition, rule/finding/position/output dimensions rather than only the final conversion loop.
+// @evidence contracts/performance.md#reuse-equivalent-work Program acquisition shares the resident host's current state when authorized; the one-shot publication does not introduce an independent stale project-result cache.
+// @evidence contracts/performance.md#bound-retention-and-release-resources The computation defers the returned acquisition callback before handling later failures. One-shot close drops the standalone checker; resident Program ownership remains with its host. Publication arrays and JSON buffers are temporary, while findings/message backing and the latest project-cycle memo can remain reachable from the current Program; delegated config caches have separate historical retention. There is no finding/output-byte cap, independent project-history cache or caller deadline here.
 func RunLSPProjectDiagnostics(args []string) int {
   opts, ok := parseLSPCommandOptions("lsp-project-diagnostics", args)
   if !ok {
@@ -221,6 +268,7 @@ func computeLSPProjectDiagnostics(opts *lspCommandOptions) (*lspProjectDiagnosti
     fmt.Fprintln(os.Stderr, err)
     return nil, 2
   }
+  engine.SetCurrentDirectory(opts.cwd)
   prog, _, closeProgram, err := acquireProgram(opts, engine.NeedsTypeChecker())
   if closeProgram != nil {
     defer closeProgram()
@@ -274,6 +322,18 @@ func computeLSPDiagnostics(opts *lspCommandOptions) (lspDiagnosticsResult, int)
 }
 
 // RunLSPCodeActions prints code actions available for one file URI/range.
+// Suggestions are range-limited and capture source/content fingerprints for
+// later validation. Fix-all and format actions remain document-wide. Excluded
+// or outside-project targets yield no actions; evaluation failures return 2.
+//
+// @evidence contracts/common.md#principled-implementation Context kind filters select supported action categories, valid ranges delimit suggestions, and actual fixable findings determine availability. Suggestion commands retain source hashes and exact finding/edit fingerprints so execution can reject stale choices.
+// @evidence contracts/common.md#clear-and-simple-design Shared findings feed separate suggestion, fix-all and format constructors; request filtering occurs before project work when no supported kind can apply.
+// @evidence contracts/common.md#prohibited-implementation-shortcuts Actions are based on current rule findings rather than canned fixes. node_modules and physical project containment preserve the real edit boundary instead of relying on document spelling alone.
+// @evidence contracts/common.md#meaningful-documentation Native paragraphs distinguish range-limited suggestions from document-wide actions and describe excluded/error outcomes; helper comments explain fingerprint purpose under documentation-skill guidance.
+// @evidence contracts/portability.md#os-neutral-implementation URI decoding and native project containment use filepath and resolved physical anchors; commands retain the editor URI separately for returned edits. No filename is interpolated into shell text.
+// @evidence contracts/performance.md#efficient-algorithms Context/range JSON and native target guards are processed before the irrelevant/excluded early return. Otherwise owning config/Program acquisition and one lint cycle precede finding/filter passes, physical-path resolution and suggestion construction. Each immutable SourceFile content hash is shared within the response, but range endpoints still scan UTF-16 line prefixes and every emitted suggestion hashes its finding/edit payload and serializes URI/selection bytes. Work and temporary space include all source, finding, suggestion/edit and final JSON dimensions; no complete linear-byte or fixed-command bound is claimed.
+// @evidence contracts/performance.md#reuse-equivalent-work Within one response, suggestions from the same immutable SourceFile share its content hash and line map. Resident acquisition remains the owning Program reuse boundary; an action's hash does not authorize stale execution.
+// @evidence contracts/performance.md#bound-retention-and-release-resources The computation defers the returned acquisition callback; one-shot close drops the standalone checker while resident Program ownership stays with its host. Source-hash maps and action/serialized-selection buffers are response-local. Returned commands carry plain selection data, not AST or compiler lease pointers, although titles/messages can share string backing with findings. The current Program can retain its latest project-cycle memo, and delegated caches retain separate state; no suggestion/output-byte cap, independent response-history cache or caller deadline is introduced.
 func RunLSPCodeActions(args []string) int {
   opts, ok := parseLSPCommandOptions("lsp-code-actions", args)
   if !ok {
@@ -349,6 +409,27 @@ func computeLSPCodeActions(opts *lspCommandOptions) ([]lspCodeAction, int) {
 }
 
 // RunLSPExecuteCommand returns a WorkspaceEdit for a lint-owned command.
+// It never writes the original project. Suggestions are revalidated against
+// current source and findings; stale selections yield no edit. Format can use
+// the live buffer from stdin. Checker-dependent operations edit a temporary
+// project and return a change for the editor to apply.
+//
+// Live-buffer AST/source formatting rejects parser-reported ordinary and JS/JSX
+// errors. Checker-backed live-buffer formatting also rejects Program syntactic
+// diagnostics under the project's compiler options. Unchanged documents yield
+// no edit. Cascades must converge within the shared pass limits; acquisition
+// and usage failures, including temporary setup/seed failures, return 2. Edit
+// application and JSON output write failures return 3. Input and project-copy
+// sizes have no independent byte cap; temporary cleanup is best effort.
+//
+// @evidence contracts/common.md#principled-implementation Supported command IDs dispatch to current-source suggestion validation or atomic finding-group fixes. Live formatting uses the supplied buffer; checker-dependent fixes use a copied project and preserve original-project ownership until the editor applies the returned WorkspaceEdit.
+// @evidence contracts/common.md#clear-and-simple-design One command boundary owns option/URI validation, then focused helpers own suggestion selection, lightweight buffer formatting and checker-backed temporary cascades. Shared edit selection/application keeps overlap policy consistent with CLI fixes.
+// @evidence contracts/common.md#prohibited-implementation-shortcuts Content/finding/edit fingerprints reject stale suggestions rather than forcing a prior answer onto changed text. Temporary projects serve the actual checker requirement; live-buffer AST/source formatting rejects parser-diagnosed buffers and checker-backed live-buffer formatting rejects Program syntactic diagnostics, rather than receiving compensating partial edits or foreign editor mutations.
+// @evidence contracts/common.md#meaningful-documentation Native paragraphs state original-project protection, live/disk paths, stale/no-op behavior, convergence and cleanup/size limits under documentation-skill guidance; helper prose explains logical copy spelling versus physical containment.
+// @evidence contracts/portability.md#os-neutral-implementation URI and native paths remain distinct. Physical containment guards the original target, while logical project paths locate copied aliases/junctions. Native filepath operations build temporary destinations; compiler parser inputs use the required protocol slash spelling.
+// @evidence contracts/performance.md#efficient-algorithms When the active Engine requires no checker, live formatting parses one supplied file per pass and avoids a project copy; a conservative checker requirement selects the seeded project path instead. Disk/seeded commands read and materialize copied project bytes, including separately materialized sibling aliases, then acquire fresh Programs for at most ten passes. Suggestion execution includes repeated current-source hashes, finding/edit fingerprints, edit sorting and per-endpoint UTF-16 line-prefix scans. Edit rendering copies gaps/replacements once after selection, but complete cost also includes config/Program/rule work, copy/parse/selection dimensions and full-document/JSON output bytes. No globally linear command or dominant-stage bound is claimed.
+// @evidence contracts/performance.md#reuse-equivalent-work All edits in a pass share one rule/Program generation. Changed text requires another parse/check; a prior finding cannot be reused solely because its URI matches. Existing rule/descriptor acquisition caches retain their own validated-input boundaries.
+// @evidence contracts/performance.md#bound-retention-and-release-resources Temporary creation paths clean up on setup failure and defer removal after transfer. Per-pass close drops standalone checkers; ordinary Program references and selection/edit buffers become reclaimable when released. Suggestion acquisition defers its returned callback, preserving resident ownership where applicable. Copied project, uncapped stdin, original/transformed strings, endpoint/output buffers and shared publisher/cache state retain their respective owners; removal errors are best effort and caches have separate historical policies. The command adds no byte or evaluator-runtime bound or caller cancellation deadline.
 func RunLSPExecuteCommand(args []string) int {
   opts, ok := parseLSPCommandOptions("lsp-execute-command", args)
   if !ok {
@@ -373,9 +454,9 @@ func RunLSPExecuteCommand(args []string) int {
     }
     return writeJSON(edit)
   }
-  // --content-stdin selects the lightweight in-memory format path: the full
-  // document buffer is read from stdin and formatted with AST+source rules
-  // only, with no temp-workspace copy and no tsgo Program. It applies to
+  // --content-stdin supplies the live document buffer for formatting. AST/source
+  // rule sets use a single-file parse; checker-dependent contributors use a
+  // temporary project seeded with that buffer. This applies to
   // ttsc.format.document; ttsc.lint.fixAll under --content-stdin is out of
   // scope (lint-class fixes can require a type checker), so it falls back to
   // the disk-based path below.
@@ -465,6 +546,7 @@ func lspFindings(opts *lspCommandOptions, includeFormatDefaults bool) ([]*Findin
     fmt.Fprintln(os.Stderr, err)
     return nil, nil, nil, 2
   }
+  engine.SetCurrentDirectory(opts.cwd)
   prog, parseDiags, closeProgram, err := acquireProgram(opts, engine.NeedsTypeChecker())
   if err != nil {
     fmt.Fprintf(os.Stderr, "@ttsc/lint: %v\n", err)
@@ -549,7 +631,6 @@ func lspRelatedInformationForFinding(finding *Finding) []lspRelatedInformation {
   if finding == nil || len(finding.RelatedInformation) == 0 || finding.File == nil {
     return nil
   }
-  text := finding.File.Text()
   uri := fileURL(finding.File.FileName())
   out := make([]lspRelatedInformation, 0, len(finding.RelatedInformation))
   for _, item := range finding.RelatedInformation {
@@ -557,8 +638,8 @@ func lspRelatedInformationForFinding(finding *Finding) []lspRelatedInformation {
       Location: lspLocation{
         URI: uri,
         Range: lspRange{
-          Start: byteOffsetToLSPPosition(text, item.Pos),
-          End:   byteOffsetToLSPPosition(text, item.End),
+          Start: sourceFileLSPPosition(finding.File, item.Pos),
+          End:   sourceFileLSPPosition(finding.File, item.End),
         },
       },
       Message: item.Message,
@@ -589,13 +670,9 @@ func lspDiagnosticTags(tags []publicrule.DiagnosticTag) []int {
 }
 
 func lspRangeForFinding(finding *Finding) lspRange {
-  text := ""
-  if finding != nil && finding.File != nil {
-    text = finding.File.Text()
-  }
   return lspRange{
-    Start: byteOffsetToLSPPosition(text, finding.Pos),
-    End:   byteOffsetToLSPPosition(text, finding.End),
+    Start: sourceFileLSPPosition(finding.File, finding.Pos),
+    End:   sourceFileLSPPosition(finding.File, finding.End),
   }
 }
 
@@ -827,8 +904,8 @@ func lspWorkspaceEditForSuggestion(opts *lspCommandOptions) (*lspWorkspaceEdit,
     for _, edit := range selected {
       edits = append(edits, lspTextEdit{
         Range: lspRange{
-          Start: byteOffsetToLSPPosition(source, edit.Pos),
-          End:   byteOffsetToLSPPosition(source, edit.End),
+          Start: sourceFileLSPPosition(finding.File, edit.Pos),
+          End:   sourceFileLSPPosition(finding.File, edit.End),
         },
         NewText: edit.Text,
       })
@@ -904,16 +981,29 @@ func lspWorkspaceEditForSeededCommand(
   original string,
   sourceOverlay *string,
 ) (*lspWorkspaceEdit, int) {
+  // These private transitions observe the existing operations, including
+  // cleanup. They do not add a deadline or replace the command's response.
+  observation := newLintTraceInvocation()
+  observation.record("lsp-command-workspace-started", map[string]any{
+    "command": opts.command, "cwd": opts.cwd, "tsconfig": opts.tsconfig, "target": target,
+  })
   // Pass the LOGICAL cwd/target so the temp workspace is indexed by the
   // project's logical layout (a project-internal symlink or junction keeps its
   // logical name). Physical resolution stays inside prepareLSPCommandWorkspace
   // for the copy source and inside tempPathFor's boundary-alias fallback.
   tempRoot, tempTarget, tempTsconfig, cleanup, err := prepareLSPCommandWorkspace(opts.cwd, opts.tsconfig, target)
+  observation.record("lsp-command-workspace-returned", map[string]any{
+    "tempRoot": tempRoot, "target": tempTarget, "tsconfig": tempTsconfig, "error": fmt.Sprint(err),
+  })
   if err != nil {
     fmt.Fprintln(os.Stderr, err)
     return nil, 2
   }
-  defer cleanup()
+  defer func() {
+    observation.record("lsp-command-cleanup-started", map[string]any{"tempRoot": tempRoot})
+    cleanup()
+    observation.record("lsp-command-cleanup-returned", map[string]any{"tempRoot": tempRoot})
+  }()
 
   if sourceOverlay != nil {
     if err := os.MkdirAll(filepath.Dir(tempTarget), 0o755); err != nil {
@@ -927,6 +1017,7 @@ func lspWorkspaceEditForSeededCommand(
   }
 
   pluginsJSON := remapLSPPluginsJSONForTempWorkspace(opts.pluginsJSON, opts.cwd, tempRoot)
+  observation.record("lsp-command-rules-started", map[string]any{"tempRoot": tempRoot})
   rules, err := loadLSPCommandRules(
     pluginsJSON,
     tempRoot,
@@ -934,6 +1025,7 @@ func lspWorkspaceEditForSeededCommand(
     target,
     opts.command == commandFormatDocument,
   )
+  observation.record("lsp-command-rules-returned", map[string]any{"error": fmt.Sprint(err)})
   if err != nil {
     fmt.Fprintln(os.Stderr, err)
     return nil, 2
@@ -943,6 +1035,8 @@ func lspWorkspaceEditForSeededCommand(
     fmt.Fprintln(os.Stderr, err)
     return nil, 2
   }
+  // The seeded command's Program opens in the temporary workspace.
+  engine.SetCurrentDirectory(tempRoot)
   needsRuleChecker := engine.NeedsTypeChecker()
   maxPasses := maxFixPasses
   if opts.command == commandFormatDocument {
@@ -950,11 +1044,13 @@ func lspWorkspaceEditForSeededCommand(
   }
   converged := false
   for pass := 0; pass < maxPasses; pass++ {
+    observation.record("lsp-command-program-started", map[string]any{"pass": pass, "needsRuleChecker": needsRuleChecker})
     prog, parseDiags, err := loadProgram(tempRoot, tempTsconfig, loadProgramOptions{
       forceNoEmit:      true,
       needsRuleChecker: needsRuleChecker,
       projectIdentity:  opts.projectIdentity,
     })
+    observation.record("lsp-command-program-returned", map[string]any{"pass": pass, "parseDiagnostics": len(parseDiags), "error": fmt.Sprint(err)})
     if err != nil {
       fmt.Fprintf(os.Stderr, "@ttsc/lint: %v\n", err)
       return nil, 2
@@ -983,18 +1079,22 @@ func lspWorkspaceEditForSeededCommand(
       prog.close()
       return nil, 0
     }
-    // This command edits a document, so it walks the project's own sources the
-    // way `format` does. Reading the imported TypeScript the lint cycle covers
-    // would widen nothing here: the edit is bounded to one target below, and a
-    // read-scope widening must not open a write the project never had.
-    findings := filterFindingsForPath(prog.runWriteScopedCycle(engine), tempTarget)
+    // Keep full project-rule/checker authority, but do not execute file rules
+    // for sibling documents whose findings this command cannot return or edit.
+    // CLI format still owns its project-wide file walk.
+    observation.record("lsp-command-cycle-started", map[string]any{"pass": pass})
+    findings := filterFindingsForPath(prog.runDocumentWriteScopedCycle(engine, targetFile), tempTarget)
+    observation.record("lsp-command-cycle-returned", map[string]any{"pass": pass, "findings": len(findings)})
+    observation.record("lsp-command-program-close-started", map[string]any{"pass": pass})
     prog.close()
+    observation.record("lsp-command-program-close-returned", map[string]any{"pass": pass})
     if opts.command == commandFormatDocument {
       findings = filterFormatFindings(findings)
     } else {
       findings = filterLintFindings(findings)
     }
     fixed, err := applyFindingFixes(tempRoot, findings)
+    observation.record("lsp-command-fixes-returned", map[string]any{"pass": pass, "fixed": fixed, "error": fmt.Sprint(err)})
     if err != nil {
       fmt.Fprintln(os.Stderr, err)
       return nil, 3
@@ -1064,6 +1164,7 @@ func lspFormatBuffer(content string, opts *lspCommandOptions) (*lspWorkspaceEdit
     fmt.Fprintln(os.Stderr, err)
     return nil, 2
   }
+  engine.SetCurrentDirectory(opts.cwd)
   if engine.NeedsTypeChecker() {
     // Contributor format rules conservatively require a checker. Seed the
     // dirty text into the temporary project so the checker, findings, fix
@@ -1089,9 +1190,9 @@ func lspFormatBuffer(content string, opts *lspCommandOptions) (*lspWorkspaceEdit
   parseName := filepath.ToSlash(target)
   for pass := 0; pass < maxFormatPasses; pass++ {
     file := shimparser.ParseSourceFile(shimast.SourceFileParseOptions{FileName: parseName}, text, scriptKind)
-    if file == nil {
-      // Match the disk path: a buffer we can't parse is a benign no-op, not a
-      // hard error — don't fight the editor's own diagnostics on a dirty buffer.
+    if file == nil || len(file.Diagnostics()) > 0 || len(file.JSDiagnostics()) > 0 {
+      // Reject both parser diagnostic arrays before applying AST/source rules.
+      // Compiler-option-dependent diagnostics belong to the Program path.
       return nil, 0
     }
     findings := filterFormatFindings(engine.Run([]*shimast.SourceFile{file}, nil))
@@ -1112,8 +1213,8 @@ func lspFormatBuffer(content string, opts *lspCommandOptions) (*lspWorkspaceEdit
 }
 
 // scriptKindForPath maps a file extension to the tsgo ScriptKind the parser
-// needs so TS/JSX-only syntax is recognized. Mirrors the test helpers'
-// ScriptKind selection (helpers_test.go parseTSFile/parseTSXFile).
+// needs so JSX syntax is enabled only for .jsx/.tsx, JavaScript extensions use
+// JavaScript grammar, and TypeScript remains the default for other inputs.
 func scriptKindForPath(path string) shimcore.ScriptKind {
   switch strings.ToLower(filepath.Ext(path)) {
   case ".tsx":
@@ -1130,7 +1231,7 @@ func scriptKindForPath(path string) shimcore.ScriptKind {
 // applyFindingFixesToText is the in-memory counterpart of
 // applyFindingFixes/applyTextEditsToFile (fix.go): it groups every fixable
 // finding's edits, selects a non-overlapping, per-finding-atomic set with the
-// same selectTextEditGroups logic, applies them right-to-left to `text`, and
+// same selectTextEditGroups logic, copies source spans and replacements once, and
 // returns the new string plus the number of edits applied. It never writes to
 // disk and never reloads a Program. Findings carry byte offsets into the same
 // `text` that was just parsed, so no per-file grouping is needed — but each
@@ -1148,11 +1249,7 @@ func applyFindingFixesToText(text string, findings []*Finding) (string, int) {
   if len(selected) == 0 {
     return text, 0
   }
-  next := text
-  for i := len(selected) - 1; i >= 0; i-- {
-    edit := selected[i]
-    next = next[:edit.Pos] + edit.Text + next[edit.End:]
-  }
+  next := applySelectedTextEdits(text, selected)
   if next == text {
     return text, 0
   }
@@ -1218,6 +1315,20 @@ func copyLSPCommandWorkspace(src string, dst string) error {
       return err
     }
     if shouldSkipLSPCommandWorkspaceDir(entry.Name()) {
+      if entry.Name() == "node_modules" && filepath.Dir(current) != src {
+        // A nested dependency scope belongs to that copied package, not the
+        // command's root. Preserve its actual imports and ambient types by
+        // linking the original scope, without copying or modifying modules.
+        info, err := os.Stat(current)
+        if err != nil {
+          return err
+        }
+        if info.IsDir() {
+          if err := linkNearestNodeModules(filepath.Dir(filepath.Join(dst, rel)), filepath.Dir(current)); err != nil {
+            return err
+          }
+        }
+      }
       if entry.IsDir() {
         return filepath.SkipDir
       }
@@ -1280,6 +1391,11 @@ func copyLSPCommandWorkspaceEntry(src string, dst string, seenDirs map[string]st
     }
     for _, entry := range entries {
       if shouldSkipLSPCommandWorkspaceDir(entry.Name()) {
+        if entry.Name() == "node_modules" {
+          if err := linkNearestNodeModules(dst, src); err != nil {
+            return err
+          }
+        }
         continue
       }
       if err := copyLSPCommandWorkspaceEntry(
@@ -1420,6 +1536,21 @@ func projectRelativePath(cwd string, file string) (string, bool) {
   if err != nil || rel == "." || rel == ".." || strings.HasPrefix(rel, ".."+string(filepath.Separator)) || filepath.IsAbs(rel) {
     return "", false
   }
+  if filepath.Clean(filepath.Join(cwd, rel)) != filepath.Clean(file) {
+    // Windows filepath.Rel folds case regardless of a directory's actual
+    // case-sensitivity. Confirm a differently spelled prefix names this root,
+    // rather than accepting a distinct case-sensitive sibling as its child.
+    // Only the root must exist; an editor target may not have been saved yet.
+    candidateRoot := filepath.Clean(file)
+    for range strings.Split(rel, string(filepath.Separator)) {
+      candidateRoot = filepath.Dir(candidateRoot)
+    }
+    rootInfo, rootErr := os.Stat(cwd)
+    candidateInfo, candidateErr := os.Stat(candidateRoot)
+    if rootErr != nil || candidateErr != nil || !os.SameFile(rootInfo, candidateInfo) {
+      return "", false
+    }
+  }
   return rel, true
 }
 
@@ -1450,7 +1581,8 @@ func filePathFromURI(raw string) (string, error) {
     return "", fmt.Errorf("@ttsc/lint: expected file URI, got %q", raw)
   }
   path := parsed.Path
-  if parsed.Host != "" {
+  // RFC 8089 gives localhost the same local meaning as an absent authority.
+  if parsed.Host != "" && !strings.EqualFold(parsed.Host, "localhost") {
     path = "//" + parsed.Host + path
   }
   if path == "" {
@@ -1502,7 +1634,7 @@ func byteOffsetToLSPPosition(text string, offset int) lspPosition {
         i++
       }
       continue
-    case '\n':
+    case '\n', '\u2028', '\u2029':
       line++
       character = 0
     default:
@@ -1517,12 +1649,31 @@ func byteOffsetToLSPPosition(text string, offset int) lspPosition {
   return lspPosition{Line: line, Character: character}
 }
 
+// sourceFileLSPPosition reuses the compiler's immutable line map across a
+// finding's primary/related ranges and suggestion edits. Nil source identity
+// keeps the existing project-wide zero position.
+func sourceFileLSPPosition(file *shimast.SourceFile, offset int) lspPosition {
+  if file == nil {
+    return lspPosition{}
+  }
+  if offset < 0 {
+    offset = 0
+  } else if offset > len(file.Text()) {
+    offset = len(file.Text())
+  }
+  line, character := shimscanner.GetECMALineAndUTF16CharacterOfPosition(file, offset)
+  return lspPosition{Line: line, Character: int(character)}
+}
+
 func writeJSON(value any) int {
   data, err := json.Marshal(value)
   if err != nil {
     fmt.Fprintln(os.Stderr, err)
     return 2
   }
-  fmt.Fprintln(os.Stdout, string(data))
+  if _, err := fmt.Fprintln(os.Stdout, string(data)); err != nil {
+    fmt.Fprintf(os.Stderr, "@ttsc/lint: write JSON output: %v\n", err)
+    return 3
+  }
   return 0
 }

package/linthost/lsp_apply_suggestion_rejects_stale_source_test.go

@@ -0,0 +1,49 @@
+package linthost
+
+import (
+  "path/filepath"
+  "strings"
+  "testing"
+)
+
+// TestLSPApplySuggestionRejectsStaleSource verifies an old quick fix cannot be
+// rebound to a newly generated finding after the document changes.
+//
+//  1. Capture a command-backed switch suggestion and its source fingerprint.
+//  2. Change an unrelated same-width character and save the document.
+//  3. Execute the old action and require a null WorkspaceEdit.
+//
+// @evidence contracts/testing.md#behavioral-verification A captured switch action is executed after an unrelated same-width source edit and must return no WorkspaceEdit, rejecting selection rebinding to changed content.
+// @evidence contracts/testing.md#independent-expectations The authored old action and explicit changed source determine the stale fingerprint boundary. A nil edit follows the fail-closed contract, independently of any newly generated action.
+// @evidence contracts/testing.md#distinguishing-cases The command-backed action is captured against the original source and executed after one unrelated string character changes without shifting offsets. This distinguishes stale-content rejection from shifted-position rejection. The switch-exhaustiveness suggestion test covers successful execution of the same command path on its separate authored inputs; this entry does not positively execute its captured action before the change.
+// @evidence contracts/testing.md#execution-ownership Calls run lsp-code-actions and lsp-execute-command in process through the shared helpers on a temporary project and rewrites the source file between the two calls; no editor or built host is started.
+func TestLSPApplySuggestionRejectsStaleSource(t *testing.T) {
+  source := `const marker = "a";
+declare const value: "left" | "right";
+switch (value) {
+  case "left":
+    break;
+}
+void marker;
+`
+  root := seedLintProject(t, source)
+  seedLintRules(t, root, map[string]string{switchExhaustivenessCheckRuleName: "error"})
+  uri := lintTestFileURI(t, filepath.Join(root, "src", "main.ts"))
+  action := switchExhaustivenessSuggestionActionForTest(t, root, uri, 2)
+
+  changed := strings.Replace(source, `marker = "a"`, `marker = "b"`, 1)
+  if changed == source || len(changed) != len(source) {
+    t.Fatal("stale-source fixture must change without shifting offsets")
+  }
+  writeFile(t, filepath.Join(root, "src", "main.ts"), changed)
+  edit := executeLSPCommandEditWithArgumentsForTest(
+    t,
+    root,
+    action.Command.Command,
+    action.Command.Arguments,
+    lintManifest(t),
+  )
+  if edit != nil {
+    t.Fatalf("stale suggestion returned an edit: %#v", edit)
+  }
+}

package/linthost/lsp_apply_suggestion_resolves_junction_project_link_test.go

@@ -0,0 +1,33 @@
+//go:build windows
+
+package linthost
+
+import (
+  "os/exec"
+  "testing"
+)
+
+// TestLSPApplySuggestionResolvesJunctionProjectLink verifies the logical editor
+// URI survives the Windows NTFS junction boundary through suggestion discovery
+// and execution.
+//
+// A junction can resolve to a physical cwd while the editor retains a different
+// URI. The admission guards must resolve that alias without hiding outside-cwd
+// or node_modules targets behind other junctions.
+//
+//  1. Create the project, outside-source and dependency aliases with mklink /J.
+//  2. Discover and execute the authored prefer-as-const suggestion.
+//  3. Require logical URI edits, unchanged physical bytes and both guard results.
+//
+// @evidence contracts/testing.md#behavioral-verification The shared scenario returns the literal prefer-as-const rewrite under the junction URI, preserves physical bytes, rejects the junction to an outside source with status 2 and returns null for the dependency junction.
+// @evidence contracts/testing.md#independent-expectations The authored rewritten/original source strings and explicit logical URI establish edit content and identity independently of path resolution; literal error/null expectations define the two protected boundaries.
+// @evidence contracts/testing.md#distinguishing-cases Project, outside-root and node_modules junctions distinguish allowed alias resolution from accidental guard bypass. The portable sibling runs the same assertions with filesystem symlinks.
+// @evidence contracts/testing.md#execution-ownership This Windows-constrained Go unit directly invokes the maintained package operation in the owning linthost process over disposable filesystem inputs. Windows supplies aliases and junction fixtures; no installed SDK, source overlay, product build or product host child is required. Fixture-only mklink preparation does not execute the behavior under test.
+func TestLSPApplySuggestionResolvesJunctionProjectLink(t *testing.T) {
+  assertLSPLogicalProjectLink(t, func(t *testing.T, target string, link string) {
+    t.Helper()
+    if output, err := exec.Command("cmd", "/c", "mklink", "/J", link, target).CombinedOutput(); err != nil {
+      t.Fatalf("create directory junction: %v: %s", err, output)
+    }
+  })
+}

package/linthost/lsp_apply_suggestion_resolves_logical_project_link_test.go

@@ -0,0 +1,35 @@
+package linthost
+
+import (
+  "os"
+  "testing"
+)
+
+// TestLSPApplySuggestionResolvesLogicalProjectLink verifies suggestion
+// discovery and execution use the same physical project boundary while the
+// returned WorkspaceEdit keeps the editor's logical document URI.
+//
+// NativePluginSource runs the lint sidecar from PhysicalProjectRoot but keeps
+// the logical URI supplied by an editor that opened a symlink or junction.
+// Code-action discovery and execution must resolve both paths consistently
+// without rejecting the action, reading a different file, or relaxing the
+// outside-project and node_modules guards.
+//
+//  1. Expose one physical project through a logical directory link.
+//  2. Discover and execute a manual suggestion for the logical URI.
+//  3. Assert the edit is keyed by that URI and leaves the physical file alone.
+//  4. Reuse the captured selection with outside and node_modules URIs and assert
+//     both command boundaries still fail closed.
+//
+// @evidence contracts/testing.md#behavioral-verification Suggestion discovery and execution must return the authored rewrite under the logical URI, leave the physical source intact and reject outside/dependency URIs.
+// @evidence contracts/testing.md#independent-expectations The literal prefer-as-const declaration rewrite and original disk bytes are independent answer keys; the editor URI is supplied by the fixture rather than derived from the resolved path.
+// @evidence contracts/testing.md#distinguishing-cases A symlinked directory (the shared helper also serves a junction variant owned elsewhere) exposes the project under a logical URI. The suggestion must be keyed by that logical URI and not the physical one; a link to a directory outside the project must be refused with status two and an outside-cwd message, and a link to a node_modules directory must return null, so link resolution cannot widen either boundary. The test skips where a directory symlink cannot be created, which includes Windows accounts without the symlink privilege.
+// @evidence contracts/testing.md#execution-ownership Creates a real directory symlink and calls run lsp-code-actions and lsp-execute-command in process through the shared link helper, plus lspProjectTargetOutsideCwd and lspProjectTargetHasSegment directly; no editor or built host is started, and the Windows junction variant is TestLSPApplySuggestionResolvesJunctionProjectLink.
+func TestLSPApplySuggestionResolvesLogicalProjectLink(t *testing.T) {
+  assertLSPLogicalProjectLink(t, func(t *testing.T, target string, link string) {
+    t.Helper()
+    if err := os.Symlink(target, link); err != nil {
+      t.Skipf("directory symlink unavailable: %v", err)
+    }
+  })
+}