opencode-agent-skill 14.4.0 → 15.1.0

package/lib/workspace-root.mjs

@@ -0,0 +1,49 @@
+import { spawnSync } from "node:child_process"
+import path from "node:path"
+
+function runGit(cwd, args) {
+  return spawnSync("git", ["-C", cwd, ...args], {
+    encoding: "utf8",
+    windowsHide: true,
+    shell: false,
+  })
+}
+
+export function resolveGitWorkspaceRoot(start = process.cwd()) {
+  const requested = path.resolve(String(start || process.cwd()))
+  const inside = runGit(requested, ["rev-parse", "--is-inside-work-tree"])
+  if (inside.status !== 0 || String(inside.stdout || "").trim() !== "true") {
+    return {
+      ok: false,
+      requested,
+      root: null,
+      error: String(inside.stderr || inside.stdout || "not a git worktree").trim(),
+    }
+  }
+
+  const top = runGit(requested, ["rev-parse", "--show-toplevel"])
+  if (top.status !== 0) {
+    return {
+      ok: false,
+      requested,
+      root: null,
+      error: String(top.stderr || top.stdout || "could not resolve git root").trim(),
+    }
+  }
+
+  const root = path.resolve(String(top.stdout || "").trim())
+  return { ok: true, requested, root, error: null }
+}
+
+export function requireGitWorkspaceRoot(start = process.cwd(), purpose = "UES") {
+  const resolved = resolveGitWorkspaceRoot(start)
+  if (resolved.ok) return resolved.root
+
+  const detail = resolved.error ? ": " + resolved.error : ""
+  throw new Error(
+    purpose +
+      " requires Pi to be opened inside a Git repository. Refusing to create UES runtime artifacts in " +
+      resolved.requested +
+      detail,
+  )
+}

package/lib/worktree-sandbox.mjs

@@ -1,8 +1,9 @@
 import { existsSync } from "node:fs"
 import { createHash } from "node:crypto"
-import { copyFile, mkdir, readFile, rm, unlink, writeFile } from "node:fs/promises"
+import { copyFile, mkdir, readFile, readdir, rm, unlink, writeFile } from "node:fs/promises"
 import { spawnSync } from "node:child_process"
 import path from "node:path"
+import { isUesRuntimeArtifactPath, sourceFacingPaths, sourceGitPathspecs } from "./runtime-artifacts.mjs"
 
 function git(root, args, options = {}) {
   return spawnSync("git", args, {
@@ -22,6 +23,51 @@ function statusFiles(root) {
     .map((line) => line.slice(3).trim())
     .map((value) => value.includes(" -> ") ? value.split(" -> ").at(-1) : value)
     .map((value) => value.replaceAll("\\", "/"))
+    .filter((value) => !isUesRuntimeArtifactPath(value))
+}
+
+function sourceIntentBatches(values, options = {}) {
+  const maxItems = Math.max(1, Math.min(256, Number(options.maxItems || 64)))
+  const maxChars = Math.max(1024, Math.min(24_000, Number(options.maxChars || 12_000)))
+  const batches = []
+  let batch = []
+  let chars = 0
+
+  for (const value of sourceFacingPaths(values)) {
+    const cost = value.length + 3
+    if (batch.length && (batch.length >= maxItems || chars + cost > maxChars)) {
+      batches.push(batch)
+      batch = []
+      chars = 0
+    }
+    batch.push(value)
+    chars += cost
+  }
+  if (batch.length) batches.push(batch)
+  return batches
+}
+
+function intentToAddSourceFiles(root) {
+  const untracked = git(root, [
+    "ls-files",
+    "--others",
+    "--exclude-standard",
+    "-z",
+    "--",
+    ...sourceGitPathspecs(),
+  ])
+  if (untracked.status !== 0) {
+    throw new Error((untracked.stderr || untracked.stdout || "git ls-files for intent-to-add failed").trim())
+  }
+
+  const candidates = sourceFacingPaths(untracked.stdout.split("\0").filter(Boolean))
+  for (const batch of sourceIntentBatches(candidates)) {
+    const addIntent = git(root, ["add", "-N", "--", ...batch])
+    if (addIntent.status !== 0) {
+      throw new Error((addIntent.stderr || addIntent.stdout || "git add -N failed").trim())
+    }
+  }
+  return candidates
 }
 
 function safeName(value) {
@@ -40,13 +86,19 @@ async function readSandboxMetadata(dir) {
   }
 }
 
+export async function taskSandboxOwnerRoot(dir) {
+  const metadata = await readSandboxMetadata(path.resolve(dir)).catch(() => null)
+  const root = metadata?.root ? path.resolve(String(metadata.root)) : null
+  return root || null
+}
+
 async function writeSandboxMetadata(dir, value) {
   await writeFile(metadataFile(dir), JSON.stringify(value, null, 2) + "\n", "utf8")
 }
 
 async function inheritDirtySnapshot(root, dir) {
   const inheritedUntrackedHashes = {}
-  const diff = git(root, ["diff", "--binary", "--no-ext-diff", "HEAD", "--"])
+  const diff = git(root, ["diff", "--binary", "--no-ext-diff", "HEAD", "--", ...sourceGitPathspecs()])
   if (diff.status !== 0) throw new Error((diff.stderr || diff.stdout || "git diff HEAD failed").trim())
   if (diff.stdout) {
     const applied = git(dir, ["apply", "--whitespace=nowarn", "-"], { input: diff.stdout })
@@ -56,10 +108,12 @@ async function inheritDirtySnapshot(root, dir) {
   const untracked = git(root, ["ls-files", "--others", "--exclude-standard", "-z"])
   if (untracked.status !== 0) throw new Error((untracked.stderr || untracked.stdout || "git ls-files failed").trim())
   for (const relative of untracked.stdout.split("\0").filter(Boolean)) {
+    const normalizedRelative = relative.replaceAll("\\", "/")
+    if (isUesRuntimeArtifactPath(normalizedRelative)) continue
     const source = path.join(root, relative)
     const target = path.join(dir, relative)
     const bytes = await readFile(source)
-    inheritedUntrackedHashes[relative.replaceAll("\\", "/")] = createHash("sha256").update(bytes).digest("hex")
+    inheritedUntrackedHashes[normalizedRelative] = createHash("sha256").update(bytes).digest("hex")
     await mkdir(path.dirname(target), { recursive: true })
     await copyFile(source, target)
   }
@@ -87,9 +141,7 @@ async function inheritDirtySnapshot(root, dir) {
 
 export async function createTaskSandbox(root, slug, taskID, options = {}) {
   root = path.resolve(root)
-  const status = git(root, ["status", "--porcelain=v1", "--untracked-files=all"])
-  if (status.status !== 0) throw new Error((status.stderr || status.stdout || "git status failed").trim())
-  const rootDirty = Boolean(status.stdout.trim())
+  const rootDirty = statusFiles(root).length > 0
   if (rootDirty && options.allowDirtyRoot !== true && options.inheritDirtyRoot !== true) {
     throw new Error("sandbox creation requires a clean root working tree so the isolated executor cannot miss existing uncommitted changes")
   }
@@ -129,6 +181,7 @@ export async function createTaskSandbox(root, slug, taskID, options = {}) {
     inheritedDirtyRoot,
     inheritedUntrackedHashes,
     createdAt: new Date().toISOString(),
+    ownerPid: process.pid,
   }
   await writeSandboxMetadata(dir, metadata)
   return metadata
@@ -155,11 +208,12 @@ export async function integrateTaskSandbox(root, dir, options = {}) {
     baseSha = base.stdout.trim()
   }
 
-  // Intent-to-add exposes untracked files in a binary diff without committing them.
-  const addIntent = git(dir, ["add", "-N", "."])
-  if (addIntent.status !== 0) throw new Error((addIntent.stderr || addIntent.stdout || "git add -N failed").trim())
+  // Intent-to-add only the non-ignored untracked source files. A root-wide
+  // `git add -N -- .` fails when an ignored UES runtime directory such as
+  // .ues-cache exists, even when an exclude pathspec is also present.
+  intentToAddSourceFiles(dir)
 
-  const changedRun = git(dir, ["diff", "--name-only", baseSha, "--"])
+  const changedRun = git(dir, ["diff", "--name-only", baseSha, "--", ...sourceGitPathspecs()])
   if (changedRun.status !== 0) throw new Error((changedRun.stderr || changedRun.stdout || "git diff --name-only failed").trim())
   const changed = changedRun.stdout.split(/\r?\n/).filter(Boolean).map((value) => value.replaceAll("\\", "/"))
   if (changed.length === 0) {
@@ -195,7 +249,7 @@ export async function integrateTaskSandbox(root, dir, options = {}) {
     throw new Error("sandbox integration conflicts with existing root changes: " + unsafeOverlap.join(", "))
   }
 
-  const patch = git(dir, ["diff", "--binary", "--no-ext-diff", baseSha, "--"])
+  const patch = git(dir, ["diff", "--binary", "--no-ext-diff", baseSha, "--", ...sourceGitPathspecs()])
   if (patch.status !== 0) throw new Error((patch.stderr || patch.stdout || "git diff failed").trim())
   const applied = git(root, ["apply", "--whitespace=nowarn", "-"], { input: patch.stdout })
   if (applied.status !== 0) {
@@ -206,6 +260,175 @@ export async function integrateTaskSandbox(root, dir, options = {}) {
   return { integrated: true, changed, base: baseSha, empty: false }
 }
 
+function processAlive(pid) {
+  const value = Number(pid)
+  if (!Number.isInteger(value) || value <= 0) return false
+  try {
+    process.kill(value, 0)
+    return true
+  } catch {
+    return false
+  }
+}
+
+export async function pruneOrphanTaskSandboxes(root, options = {}) {
+  root = path.resolve(root)
+  const now = Date.now()
+  const minAgeMs = Math.max(60_000, Number(options.minAgeMs || 5 * 60_000))
+  const legacyMinAgeMs = Math.max(minAgeMs, Number(options.legacyMinAgeMs || 30 * 60_000))
+  const ownedMinAgeMs = Math.max(0, Number(options.ownedMinAgeMs ?? 60_000))
+  const reclaimOwnerPid = Number(options.reclaimOwnerPid || 0)
+  const protectedDirs = new Set(
+    (options.protectedDirs || []).map((value) => path.resolve(String(value))),
+  )
+  const expectedBase = path.resolve(
+    options.baseDir || path.join(path.dirname(root), "." + path.basename(root) + ".ues-sandboxes"),
+  )
+  const removed = []
+  const skipped = []
+  const sidecarsRemoved = []
+
+  for (const item of listTaskSandboxes(root)) {
+    const branch = String(item.branch || "").replace(/^refs\/heads\//, "")
+    const dir = path.resolve(String(item.path || ""))
+    if (!branch.startsWith("ues/")) continue
+    if (path.dirname(dir) !== expectedBase) continue
+    if (protectedDirs.has(dir)) {
+      skipped.push({ dir, reason: "protected-active" })
+      continue
+    }
+
+    const metadata = await readSandboxMetadata(dir)
+    if (!metadata || path.resolve(String(metadata.root || "")) !== root) {
+      skipped.push({ dir, reason: "metadata-missing-or-root-mismatch" })
+      continue
+    }
+
+    const createdAt = Date.parse(String(metadata.createdAt || ""))
+    const ageMs = Number.isFinite(createdAt) ? Math.max(0, now - createdAt) : Infinity
+    const ownerPid = Number(metadata.ownerPid || 0)
+    const reclaimOwned = reclaimOwnerPid > 0 && ownerPid === reclaimOwnerPid
+
+    if (ownerPid > 0 && processAlive(ownerPid) && !reclaimOwned) {
+      skipped.push({ dir, reason: "owner-alive", ownerPid })
+      continue
+    }
+
+    const requiredAge = reclaimOwned
+      ? ownedMinAgeMs
+      : ownerPid > 0
+        ? minAgeMs
+        : legacyMinAgeMs
+    if (ageMs < requiredAge) {
+      skipped.push({ dir, reason: "too-recent", ageMs, ownerPid: ownerPid || null })
+      continue
+    }
+
+    try {
+      const result = await removeTaskSandbox(root, dir, {
+        force: true,
+        deleteBranch: true,
+        branch,
+      })
+      removed.push({ ...result, ageMs, ownerPid: ownerPid || null, reclaimOwned })
+    } catch (error) {
+      skipped.push({
+        dir,
+        reason: "remove-failed",
+        error: error instanceof Error ? error.message : String(error),
+      })
+    }
+  }
+
+  // Clean detached physical sandbox directories left after Git forgot the
+  // worktree registration (for example after a crash/manual prune). Only remove
+  // directories with UES metadata bound to this exact root repository.
+  try {
+    const registered = new Set(
+      listTaskSandboxes(root).map((item) => path.resolve(String(item.path || ""))),
+    )
+    const entries = await readdir(expectedBase, { withFileTypes: true })
+    for (const entry of entries) {
+      if (!entry.isDirectory()) continue
+      const dir = path.resolve(expectedBase, entry.name)
+      if (registered.has(dir) || protectedDirs.has(dir)) continue
+
+      const metadata = await readSandboxMetadata(dir)
+      if (!metadata || path.resolve(String(metadata.root || "")) !== root) continue
+
+      const createdAt = Date.parse(String(metadata.createdAt || ""))
+      const ageMs = Number.isFinite(createdAt) ? Math.max(0, now - createdAt) : Infinity
+      const ownerPid = Number(metadata.ownerPid || 0)
+      const reclaimOwned = reclaimOwnerPid > 0 && ownerPid === reclaimOwnerPid
+
+      if (ownerPid > 0 && processAlive(ownerPid) && !reclaimOwned) {
+        skipped.push({ dir, reason: "detached-owner-alive", ownerPid })
+        continue
+      }
+
+      const requiredAge = reclaimOwned
+        ? ownedMinAgeMs
+        : ownerPid > 0
+          ? minAgeMs
+          : legacyMinAgeMs
+      if (ageMs < requiredAge) {
+        skipped.push({ dir, reason: "detached-too-recent", ageMs, ownerPid: ownerPid || null })
+        continue
+      }
+
+      try {
+        await rm(dir, { recursive: true, force: true })
+        await unlink(metadataFile(dir)).catch(() => {})
+        const branch = String(metadata.branch || "")
+        if (branch.startsWith("ues/")) git(root, ["branch", "-D", branch])
+        removed.push({
+          removed: !existsSync(dir),
+          dir,
+          branch: branch || null,
+          ageMs,
+          ownerPid: ownerPid || null,
+          reclaimOwned,
+          detached: true,
+        })
+      } catch (error) {
+        skipped.push({
+          dir,
+          reason: "detached-remove-failed",
+          error: error instanceof Error ? error.message : String(error),
+        })
+      }
+    }
+  } catch {}
+
+  // Clean metadata sidecars left after a crash or manual worktree removal.
+  try {
+    const entries = await readdir(expectedBase, { withFileTypes: true })
+    for (const entry of entries) {
+      if (!entry.isFile() || !entry.name.endsWith(".ues-meta.json")) continue
+      const sidecar = path.join(expectedBase, entry.name)
+      const dir = sidecar.slice(0, -".ues-meta.json".length)
+      if (existsSync(dir)) continue
+      try {
+        const metadata = JSON.parse(await readFile(sidecar, "utf8"))
+        if (path.resolve(String(metadata.root || "")) !== root) continue
+        const createdAt = Date.parse(String(metadata.createdAt || ""))
+        const ageMs = Number.isFinite(createdAt) ? Math.max(0, now - createdAt) : Infinity
+        if (ageMs < minAgeMs) continue
+        await unlink(sidecar)
+        sidecarsRemoved.push(sidecar)
+      } catch {}
+    }
+
+    const remaining = await readdir(expectedBase)
+    if (remaining.length === 0) {
+      await rm(expectedBase, { recursive: false, force: true })
+    }
+  } catch {}
+
+  git(root, ["worktree", "prune"])
+  return { removed, skipped, sidecarsRemoved, baseRemoved: !existsSync(expectedBase) }
+}
+
 export async function removeTaskSandbox(root, dir, options = {}) {
   root = path.resolve(root)
   dir = path.resolve(dir)

package/package.json

@@ -1,11 +1,11 @@
 {
   "name": "opencode-agent-skill",
-  "version": "14.4.0",
-  "description": "Pi Agent engineering runtime with code intelligence, hash-anchored editing, verified persistent memory, health-aware capability routing, reversible context, and evidence-gated completion",
+  "version": "15.1.0",
+  "description": "Pi-native UES coding-agent runtime with adaptive stability, Turbo Fast Path, durable verification, managed services, and weak-model orchestration",
   "type": "module",
   "bin": {
-    "ues": "bin/ocskill.mjs",
-    "ocskill": "bin/ocskill.mjs"
+    "ocskill": "bin/ocskill.mjs",
+    "ues": "bin/ocskill.mjs"
   },
   "files": [
     "bin/ocskill.mjs",
@@ -21,6 +21,7 @@
     "docs/V14-CONTEXT-MEMORY-FABRIC.md",
     "docs/V14.1-QUALITY-PERFORMANCE-FABRIC.md",
     "docs/V14.2-TURBO-WEAK-MODEL-RUNTIME.md",
+    "docs/V15-MANAGED-RUNTIME.md",
     "docs/PI-COMPAT.md",
     "docs/OPENCODE-COMPAT.md",
     "README.md",
@@ -40,7 +41,9 @@
     "smoke:packed": "node scripts/smoke-packed-install.mjs",
     "eval:v14": "node --test test/capability-fabric-v14.test.mjs test/hierarchical-context-v14.test.mjs test/memory-engine-v14.test.mjs test/context-engine-v14.test.mjs test/task-engine-v14-context.test.mjs test/cli-v14.test.mjs test/v14-contract.test.mjs test/performance-fabric-v14.test.mjs test/browser-mcp-routing-v14.test.mjs test/process-hang-detector-v14.test.mjs test/v14.2-runtime.test.mjs test/benchmark-confidence.test.mjs test/v14.3-intelligence.test.mjs",
     "integrity": "node scripts/check-source-integrity.mjs",
-    "runtime:exports": "node scripts/check-runtime-exports.mjs"
+    "runtime:exports": "node scripts/check-runtime-exports.mjs",
+    "eval:v15": "node --test test/v15-runtime.test.mjs test/trajectory.test.mjs test/evidence-store-v11.test.mjs test/runtime-events.test.mjs test/v14.3-intelligence.test.mjs test/v14.2-runtime.test.mjs test/pi-package.test.mjs test/execution-contract.test.mjs",
+    "release:verify": "npm run ci && npm run eval:v15"
   },
   "keywords": [
     "pi-package",

package/pi/extensions/ues-child-runtime.ts

@@ -6,6 +6,7 @@ import { getEvidenceSelected } from "../../lib/evidence-store.mjs";
 import { recordVerification } from "../../lib/verification-broker.mjs";
 import { runtimeWorkspaceFingerprint } from "../../lib/workspace-fingerprint.mjs";
 import { destructiveShellRisk } from "../../lib/safety.mjs";
+import { crossToolTempPathRisk, isLocalEnvPath, localEnvWriteRisk } from "../../lib/execution-contract.mjs";
 import {
   canonicalVerificationCommand,
   looksLikeVerificationCommand,
@@ -13,12 +14,23 @@ import {
 import {
   applyAnchoredFileEdits,
   diagnoseCode,
+  lspOperation,
   probeCodeIntelligence,
   readAnchoredCode,
   searchCodeIntelligence,
 } from "../../lib/code-intelligence/index.mjs";
 import { ingestDocument } from "../../lib/document-ingestion.mjs";
 import { compactContext, expandContext, searchContext } from "../../lib/reversible-context.mjs";
+import {
+  looksLikeLongRunningServiceCommand,
+  restartService,
+  serviceLogs,
+  serviceStatus,
+  startService,
+  stopAllServices,
+  stopService,
+  waitForService,
+} from "../../lib/service-manager.mjs";
 
 const toolExecutionState = new Map<string, {
   startedAt: number;
@@ -81,15 +93,67 @@ async function capturedText(event: any, fallback: string) {
 }
 
 export default function (pi: ExtensionAPI) {
+  // Internal-only extension: the package host may discover this file alongside
+  // ues.ts, but only specialist child Pi processes should register its tools.
+  // Parent launch paths set UES_CHILD_PROCESS=1 for both CLI and RPC workers.
+  if (process.env.UES_CHILD_PROCESS !== "1") return;
+
   const clearExecutionState = () => toolExecutionState.clear();
   pi.on("session_start", clearExecutionState);
-  pi.on("session_shutdown", clearExecutionState);
+  pi.on("session_shutdown", async (_event, ctx) => {
+    clearExecutionState();
+    await stopAllServices(ctx.cwd).catch(() => []);
+  });
 
   pi.on("tool_call", async (event, ctx) => {
     const toolName = String(event.toolName || "");
+    const input: any = event.input || {};
+    const localEnvAllowed = String(process.env.UES_CHILD_ALLOW_LOCAL_ENV_WRITE || "") === "1";
+    const writeTool = ["edit", "write", "write_file", "apply_patch", "ues_code_edit"].includes(toolName);
+    const fileTool = ["read", "edit", "write", "write_file", "apply_patch", "ues_code", "ues_code_edit"].includes(toolName);
+    const fileCandidate = String(input.file || input.path || input.filePath || input.target || "");
+    const tempPathRisk = crossToolTempPathRisk(fileCandidate);
+    if (fileTool && tempPathRisk.risky) {
+      toolExecutionState.delete(String(event.toolCallId || ""));
+      return {
+        block: true,
+        reason:
+          "UES portable temp-path guard blocked " + fileCandidate +
+          ". On Windows, /tmp and /var/tmp may resolve differently between Pi file tools and bash/MSYS. " +
+          "For transient transforms, keep creation/read in one shell pipeline; for cross-tool scratch use a repository-local ignored UES path such as .ues-cache/tmp after creating it.",
+      };
+    }
+    if (writeTool && isLocalEnvPath(fileCandidate) && !localEnvAllowed) {
+      toolExecutionState.delete(String(event.toolCallId || ""));
+      return {
+        block: true,
+        reason:
+          "UES local-env guard blocked a write to " + fileCandidate +
+          ". .env/.env.* are local runtime inputs; update an example/template or report NEEDS_USER_ENV unless the user explicitly authorized this local env mutation.",
+      };
+    }
+
     if (!["bash", "powershell"].includes(toolName)) return undefined;
 
-    const command = String((event.input as any)?.command || "");
+    const command = String(input.command || "");
+    const envRisk = localEnvWriteRisk(command);
+    if (envRisk.risky && !localEnvAllowed) {
+      toolExecutionState.delete(String(event.toolCallId || ""));
+      return {
+        block: true,
+        reason:
+          "UES local-env guard blocked a shell write to .env/.env.*. Use .env.example/sample/template or report NEEDS_USER_ENV unless explicitly authorized.",
+      };
+    }
+    if (looksLikeLongRunningServiceCommand(command)) {
+      toolExecutionState.delete(String(event.toolCallId || ""));
+      return {
+        block: true,
+        reason:
+          "UES detected a likely long-running foreground service command. " +
+          "Use the ues_service tool (start -> wait-ready/logs -> stop) instead of bash/powershell so the agent does not stall.",
+      };
+    }
     const risk = destructiveShellRisk(command);
     if (risk.risky) {
       toolExecutionState.delete(String(event.toolCallId || ""));
@@ -209,13 +273,20 @@ export default function (pi: ExtensionAPI) {
     name: "ues_code",
     label: "UES Code Intelligence",
     description:
-      "Bounded code/document/context intelligence for weak models: semantic/AST search, hash-anchored reads, optional LSP diagnostics, optional MarkItDown ingestion, and reversible context recovery.",
+      "Bounded code/document/context intelligence for weak models: semantic/AST search, hash-anchored reads, deterministic LSP definition/references/symbols/hover/rename-preview/call hierarchy, diagnostics, optional MarkItDown ingestion, and reversible context recovery.",
     parameters: Type.Object({
       action: Type.Union([
         Type.Literal("status"),
         Type.Literal("search"),
         Type.Literal("read"),
         Type.Literal("diagnostics"),
+        Type.Literal("definition"),
+        Type.Literal("references"),
+        Type.Literal("symbols"),
+        Type.Literal("hover"),
+        Type.Literal("rename-preview"),
+        Type.Literal("incoming-calls"),
+        Type.Literal("outgoing-calls"),
         Type.Literal("document"),
         Type.Literal("context-expand"),
         Type.Literal("context-search"),
@@ -226,6 +297,10 @@ export default function (pi: ExtensionAPI) {
       language: Type.Optional(Type.String()),
       startLine: Type.Optional(Type.Number({ minimum: 1 })),
       endLine: Type.Optional(Type.Number({ minimum: 1 })),
+      line: Type.Optional(Type.Number({ minimum: 1, description: "1-based source line for LSP operations" })),
+      character: Type.Optional(Type.Number({ minimum: 1, description: "1-based source character for LSP operations" })),
+      newName: Type.Optional(Type.String({ minLength: 1, maxLength: 512 })),
+      includeDeclaration: Type.Optional(Type.Boolean()),
       ref: Type.Optional(Type.String()),
       maxBytes: Type.Optional(Type.Number({ minimum: 1, maximum: 128000 })),
     }),
@@ -257,7 +332,18 @@ export default function (pi: ExtensionAPI) {
           };
         } else if (params.action === "diagnostics") {
           if (!params.file) throw new Error("ues_code diagnostics requires file");
-          result = await diagnoseCode(ctx.cwd, params.file, { timeoutMs: 3000, maxDiagnostics: 40 });
+          result = await diagnoseCode(ctx.cwd, params.file, { timeoutMs: 5000, maxResults: 80 });
+        } else if (["definition", "references", "symbols", "hover", "rename-preview", "incoming-calls", "outgoing-calls"].includes(params.action)) {
+          if (!params.file) throw new Error(`ues_code ${params.action} requires file`);
+          if (params.action === "rename-preview" && !params.newName) throw new Error("ues_code rename-preview requires newName");
+          result = await lspOperation(ctx.cwd, params.file, params.action, {
+            line: params.line || 1,
+            character: params.character || 1,
+            newName: params.newName,
+            includeDeclaration: params.includeDeclaration,
+            timeoutMs: 7000,
+            maxResults: 120,
+          });
         } else if (params.action === "document") {
           if (!params.file) throw new Error("ues_code document requires file");
           const document = await ingestDocument(ctx.cwd, params.file, { maxBytes: Math.min(Number(params.maxBytes || 4 * 1024 * 1024), 4 * 1024 * 1024) });
@@ -345,6 +431,86 @@ export default function (pi: ExtensionAPI) {
     },
   });
 
+  pi.registerTool({
+    name: "ues_service",
+    label: "UES Managed Service",
+    description:
+      "Manage long-running development servers/watchers without blocking the agent. Use start, wait-ready, status, logs, stop, or restart. For start/restart, command is the executable only (for example node or npm); put every argument in args. Services are bounded to the current workspace/runtime and are cleaned up on session shutdown.",
+    parameters: Type.Object({
+      action: Type.Union([
+        Type.Literal("start"),
+        Type.Literal("wait-ready"),
+        Type.Literal("status"),
+        Type.Literal("logs"),
+        Type.Literal("stop"),
+        Type.Literal("restart"),
+      ]),
+      name: Type.String({ minLength: 1, maxLength: 64 }),
+      command: Type.Optional(Type.String({ minLength: 1 })),
+      args: Type.Optional(Type.Array(Type.String(), { maxItems: 128 })),
+      cwd: Type.Optional(Type.String()),
+      readyPort: Type.Optional(Type.Number({ minimum: 1, maximum: 65535 })),
+      readyHost: Type.Optional(Type.String({ maxLength: 255 })),
+      readyLog: Type.Optional(Type.String({ maxLength: 512 })),
+      timeoutMs: Type.Optional(Type.Number({ minimum: 100, maximum: 600000 })),
+      lifetimeMs: Type.Optional(Type.Number({ minimum: 10000, maximum: 7200000 })),
+      idleTimeoutMs: Type.Optional(Type.Number({ minimum: 5000, maximum: 3600000 })),
+      maxChars: Type.Optional(Type.Number({ minimum: 256, maximum: 128000 })),
+    }),
+    async execute(_toolCallId, params, _signal, _onUpdate, ctx) {
+      try {
+        let result: any;
+        if (params.action === "start") {
+          if (!params.command) throw new Error("ues_service start requires command");
+          const riskText = [params.command, ...(params.args || [])].join(" ");
+          const risk = destructiveShellRisk(riskText);
+          if (risk.risky) throw new Error(`UES service safety blocked ${risk.id || "destructive"} command`);
+          result = await startService(ctx.cwd, {
+            name: params.name,
+            command: params.command,
+            args: params.args || [],
+            cwd: params.cwd,
+            readyPort: params.readyPort,
+            readyHost: params.readyHost,
+            readyLog: params.readyLog,
+            timeoutMs: params.timeoutMs,
+            lifetimeMs: params.lifetimeMs,
+            idleTimeoutMs: params.idleTimeoutMs,
+          });
+        } else if (params.action === "wait-ready") {
+          result = await waitForService(ctx.cwd, params.name, { timeoutMs: params.timeoutMs });
+        } else if (params.action === "status") {
+          result = await serviceStatus(ctx.cwd, params.name);
+        } else if (params.action === "logs") {
+          result = await serviceLogs(ctx.cwd, params.name, { maxChars: params.maxChars, evidence: true });
+        } else if (params.action === "stop") {
+          result = await stopService(ctx.cwd, params.name, { timeoutMs: params.timeoutMs });
+        } else if (params.action === "restart") {
+          result = await restartService(ctx.cwd, params.name, {
+            timeoutMs: params.timeoutMs,
+            lifetimeMs: params.lifetimeMs,
+            idleTimeoutMs: params.idleTimeoutMs,
+          });
+        } else {
+          throw new Error("Unknown ues_service action");
+        }
+        const failed =
+          (params.action === "start" || params.action === "wait-ready") && result?.ready !== true;
+        return {
+          content: [{ type: "text", text: JSON.stringify(result, null, 2) }],
+          details: result,
+          isError: failed,
+        };
+      } catch (error) {
+        return {
+          content: [{ type: "text", text: error instanceof Error ? error.message : String(error) }],
+          details: { action: params.action, name: params.name },
+          isError: true,
+        };
+      }
+    },
+  });
+
   pi.registerTool({
     name: "ues_evidence_get",
     label: "UES Evidence Get",