pi-lens 4.4.0 → 4.4.2

package/dist/{chunk-B3I2UUT4.js → chunk-ESBQHFMJ.js}

@@ -4,13 +4,15 @@ import {
   detectPythonEnvironment,
   detectPythonVenv,
   pythonEnvironmentToolCandidates
-} from "./chunk-DIULIWKU.js";
+} from "./chunk-34WSVGEM.js";
 import {
   resolveOpengrepConfig
-} from "./chunk-VDBPVIKD.js";
+} from "./chunk-VWCXW2E7.js";
 import {
-  extensionsForLanguage
-} from "./chunk-TGPXLY2J.js";
+  extensionsForLanguage,
+  getUserRuleRoot,
+  ruleCorpusFingerprintForCycle
+} from "./chunk-724UL2TJ.js";
 import {
   load,
   resolvePackagePath
@@ -20,11 +22,11 @@ import {
   readCargoWorkspaceExclude,
   readCargoWorkspaceMembers,
   readTextFileOrUndefined
-} from "./chunk-PAK6IDME.js";
+} from "./chunk-P7266HLM.js";
 import {
   HOOK_WALL_BUDGET_MS,
   bounded
-} from "./chunk-GUOGVTCQ.js";
+} from "./chunk-52FUZI6K.js";
 import {
   ensureTool,
   findManagedToolBinary,
@@ -34,20 +36,21 @@ import {
   isZizmorAuditTarget,
   logSessionStart,
   resolveZizmorGitHubToken
-} from "./chunk-OQGFCZJ4.js";
+} from "./chunk-66VMUL7Q.js";
 import {
   resolveToolCwd
-} from "./chunk-RUOG5D2C.js";
+} from "./chunk-Q7DUK4LX.js";
 import {
-  findGlobalBinary
-} from "./chunk-U3VGR4VU.js";
+  findGlobalBinary,
+  isProjectLocalBinPath
+} from "./chunk-AW7R2GWG.js";
 import {
   classifyProbeFailure,
   createAvailabilityLatch,
   describeInstallAttempt,
   logAvailabilityDecision,
   startHostStallSampler
-} from "./chunk-WONERJTP.js";
+} from "./chunk-VRZP76YM.js";
 import {
   OWNER_TAG_ENV,
   SpawnFailureError,
@@ -61,21 +64,25 @@ import {
   isCommandAvailableAsync,
   isPathIgnoredByProject,
   ownerTagForChildren,
+  resolveWindowsCommandForEnvironment,
   safeSpawnAsync
-} from "./chunk-VN2AXLEX.js";
+} from "./chunk-C34ZXZ7O.js";
 import {
   DOTNET_CSHARP_ROOT_MARKERS,
   DOTNET_FSHARP_ROOT_MARKERS,
-  KIND_EXTENSIONS
-} from "./chunk-5ZEJHV35.js";
+  KIND_EXTENSIONS,
+  LEAN_ROOT_MARKERS
+} from "./chunk-PHDMFAKM.js";
 import {
+  isRepoTier,
   lspSectionOf,
   migrationSubject,
+  provenanceFor,
   reportConfigReadFailure,
   reportPiLensConfigRecords,
   resolvePiLensConfig,
   summarizeConfigResolution
-} from "./chunk-DQ2NZ7C4.js";
+} from "./chunk-2BBLFX75.js";
 import {
   FRESHNESS_CADENCE_MS,
   LSP_NAMESPACE_KEY,
@@ -83,23 +90,30 @@ import {
   dirMtimesStillFreshAsync,
   getPiLensGlobalConfigPath,
   unknownDirMtimeRecords
-} from "./chunk-VNMT7C64.js";
+} from "./chunk-XVF2VVXP.js";
 import {
+  getProjectTrustState
+} from "./chunk-ZANLILYD.js";
+import {
+  getDegradationLedgerGeneration,
   incrementDegradationCount,
   recordDegradationOnce
-} from "./chunk-N3YQJI6O.js";
+} from "./chunk-JAU72XNY.js";
+import {
+  logExtension
+} from "./chunk-XTMJ7XDT.js";
 import {
   claimPhaseOncePerSession,
   currentSessionRecordId,
   logLatency,
   releasePhaseClaim
-} from "./chunk-5THXD6X5.js";
+} from "./chunk-QQNQ7SJW.js";
 import {
   getGlobalPiLensLogDir,
   getProcessSingleton,
   isTestMode,
   redactSecrets
-} from "./chunk-UK3CMEAL.js";
+} from "./chunk-AOHZU2BM.js";
 import {
   STAGE_TMP_PATTERN
 } from "./chunk-LJDODBBZ.js";
@@ -113,6 +127,7 @@ import {
   findLocalToolConfig,
   isAtOrAboveHomeDir,
   isFullyQualified,
+  isUnderDir,
   isWindowsPath,
   matchesWorkspaceMemberPattern,
   normalizeEphemeralMapKey,
@@ -120,7 +135,7 @@ import {
   normalizeMapKey,
   pathsEqual,
   toPosix
-} from "./chunk-Q5U6FMDI.js";
+} from "./chunk-N2H3ZPZY.js";
 import {
   __require
 } from "./chunk-NXL4FFQQ.js";
@@ -129,7 +144,7 @@ import {
 import { existsSync as existsSync3, mkdirSync as mkdirSync2, statSync as statSync3 } from "node:fs";
 import { access, readFile, readdir, stat } from "node:fs/promises";
 import os6 from "node:os";
-import path7 from "node:path";
+import path6 from "node:path";
 
 // dist/clients/sgconfig.js
 import { createHash } from "node:crypto";
@@ -162,6 +177,18 @@ function getAstGrepRuleSources(projectRoot = process.cwd()) {
       tier: "secondary"
     });
   }
+  const userRoot = getUserRuleRoot();
+  if (canonicalDir(userRoot) !== canonicalDir(root)) {
+    candidates.push({
+      dir: path.join(userRoot, "ast-grep-rules", "rules"),
+      origin: "user",
+      tier: "primary"
+    }, {
+      dir: path.join(userRoot, "ast-grep-rules", "coderabbit", "rules"),
+      origin: "user",
+      tier: "secondary"
+    });
+  }
   candidates.push({
     dir: path.join(packageRoot, "rules", "ast-grep-rules", "rules"),
     origin: "bundled",
@@ -246,7 +273,15 @@ function snapshotRuleSource(source) {
     }
     hash.update(content);
     hash.update("\0");
-    files.push({ file, relativePath, documents: parseRuleDocuments(content) });
+    const documents = parseRuleDocuments(content);
+    if (source.origin === "user" && documents.some((document) => !document.id)) {
+      recordDegradationOnce({
+        kind: "ast-grep-rule-invalid",
+        subject: file,
+        reason: "user ast-grep rule has no valid rule id"
+      });
+    }
+    files.push({ file, relativePath, documents });
   }
   const snapshot = { ...source, files, digest: hash.digest("hex") };
   if (source.origin === "bundled")
@@ -267,6 +302,10 @@ function sourceFingerprint(sources) {
   }
   return hash.digest("hex");
 }
+function getAstGrepRuleFingerprint(projectRoot = process.cwd(), options = {}) {
+  const root = path.resolve(projectRoot || process.cwd());
+  return ruleCorpusFingerprintForCycle("ast-grep", root, (fingerprintRoot) => sourceFingerprint(getAstGrepRuleSources(fingerprintRoot).map(snapshotRuleSource)), options.force);
+}
 function materializeMergedRuleDir(sources, mergedDir) {
   fs.rmSync(mergedDir, { recursive: true, force: true });
   fs.mkdirSync(mergedDir, { recursive: true });
@@ -302,14 +341,14 @@ function rootArtifactKey(root) {
 }
 function resolveBaselineSgconfig(projectRoot = process.cwd()) {
   const root = canonicalDir(path.resolve(projectRoot || process.cwd()));
-  const sources = getAstGrepRuleSources(root).map(snapshotRuleSource);
-  if (sources.length === 0)
-    return void 0;
-  const fingerprint = sourceFingerprint(sources);
+  const fingerprint = getAstGrepRuleFingerprint(root, { force: true });
   const cached = cachedBaselines.get(root);
   if (cached?.fingerprint === fingerprint && fs.existsSync(cached.path) && fs.existsSync(cached.mergedDir)) {
     return cached.path;
   }
+  const sources = getAstGrepRuleSources(root).map(snapshotRuleSource);
+  if (sources.length === 0)
+    return void 0;
   const dir = path.join(os.tmpdir(), "pi-lens-ast-grep");
   fs.mkdirSync(dir, { recursive: true });
   const artifactKey = rootArtifactKey(root);
@@ -417,9 +456,44 @@ function findLocalTyposConfig(startDir) {
   return findLocalToolConfig(startDir, LOCAL_TYPOS_CONFIG_NAMES);
 }
 
+// dist/clients/lsp/server-traits.js
+var ROLE_MEMBERS = {
+  language: "language",
+  auxiliary: "auxiliary"
+};
+var DEFAULT_LSP_SERVER_ROLE = "language";
+function isAuxiliary(bearer) {
+  const declared = bearer?.role;
+  const role = typeof declared === "string" && Object.hasOwn(ROLE_MEMBERS, declared) ? ROLE_MEMBERS[declared] : DEFAULT_LSP_SERVER_ROLE;
+  switch (role) {
+    case "auxiliary":
+      return true;
+    case "language":
+      return false;
+  }
+}
+var DEFAULT_NOTIFY_INFLIGHT_LIMIT = 8;
+var DEFAULT_REPLY_ORDERING = "unmeasured";
+function serverTraits(declaration) {
+  const declaredLimit = declaration.notifyInflightLimit;
+  if (typeof declaredLimit === "number" && Number.isFinite(declaredLimit) && declaredLimit > 0) {
+    return {
+      role: declaration.role,
+      notifyInflightLimit: Math.floor(declaredLimit),
+      replyOrdering: declaration.replyOrdering ?? DEFAULT_REPLY_ORDERING
+    };
+  }
+  const envLimit = Number(process.env.PI_LENS_LSP_AUX_NOTIFY_INFLIGHT);
+  return {
+    role: declaration.role,
+    notifyInflightLimit: Number.isFinite(envLimit) && envLimit > 0 ? Math.floor(envLimit) : DEFAULT_NOTIFY_INFLIGHT_LIMIT,
+    replyOrdering: declaration.replyOrdering ?? DEFAULT_REPLY_ORDERING
+  };
+}
+
 // dist/clients/lsp/config.js
 import * as os3 from "node:os";
-import path4 from "node:path";
+import path3 from "node:path";
 
 // dist/clients/dispatch/known-runner-ids.js
 var knownRunnerIds = /* @__PURE__ */ new Set();
@@ -434,6 +508,7 @@ function isKnownRunnerId(id) {
 }
 
 // dist/clients/lsp/launch.js
+import { AsyncLocalStorage } from "node:async_hooks";
 import { execFileSync, spawn as nodeSpawn } from "node:child_process";
 import fs3 from "node:fs";
 import os2 from "node:os";
@@ -628,6 +703,16 @@ function isCmdShimValid(cmdPath) {
     return true;
   }
 }
+function isMissingWindowsStartupCommand(command, spawnCommand, cwd, env) {
+  if (!isWindows)
+    return false;
+  if (/\.(cmd|bat)$/i.test(spawnCommand) && !isCmdShimValid(spawnCommand)) {
+    return true;
+  }
+  if (spawnCommand !== command)
+    return false;
+  return resolveWindowsCommandForEnvironment(command, cwd, env) === null;
+}
 function bypassPs1OnWindows(ps1Path, args) {
   const cmdPath = `${ps1Path.slice(0, -4)}.cmd`;
   if (fs3.existsSync(cmdPath)) {
@@ -675,6 +760,65 @@ function findBinaryOnPath(command, env) {
   }
   return void 0;
 }
+var lspProjectCodePermission = new AsyncLocalStorage();
+function withLspProjectCodePermission(allowed, spawn) {
+  return lspProjectCodePermission.run(allowed, spawn);
+}
+var unknownProjectLocalNoticeGeneration = -1;
+function recordUntrustedLspExecution(request, trust) {
+  const generation = getDegradationLedgerGeneration();
+  const subject = request.kind === "project-code-server" ? `project-code-server:g${generation}:${request.serverId}:${request.root}` : `project-local-binary:g${generation}:${path2.basename(request.command)}`;
+  const metadata = request.kind === "project-code-server" ? {
+    field: request.kind,
+    serverId: request.serverId,
+    root: request.root,
+    trust
+  } : {
+    field: request.kind,
+    trust
+  };
+  recordDegradationOnce({
+    kind: "lsp-registry-decision",
+    subject,
+    reason: (request.kind === "project-local-binary" ? request.reason : void 0) ?? `LSP execution refused: ${request.kind} and project trust is ${trust}`,
+    metadata
+  });
+  if (unknownProjectLocalNoticeGeneration !== generation) {
+    unknownProjectLocalNoticeGeneration = generation;
+    const label = request.kind === "project-code-server" ? "project-code LSP server" : "project-local LSP binary";
+    logExtension({
+      subsystem: "lsp-registry",
+      level: "warn",
+      message: `${label} refused: mark the project trusted in pi or upgrade pi`,
+      metadata: { field: request.kind }
+    });
+  }
+}
+function refuseUntrustedLspExecution(request) {
+  const trust = getProjectTrustState();
+  const needsTrust = request.kind === "project-code-server" ? trust !== "trusted" : !admitProjectSuppliedTsserver(request.resolvedCommand, request.cwd, true);
+  if (!needsTrust)
+    return;
+  if (request.kind === "project-code-server")
+    recordUntrustedLspExecution(request, trust);
+  throw new SpawnFailureError("spawn-failed", `LSP ${request.kind === "project-code-server" ? "project-code server" : "project-local binary"} refused: project trust is ${trust}`, new Error(`project trust is ${trust}`));
+}
+function admitProjectSuppliedTsserver(tsserverPath, cwd, projectSupplied, projectCodeAllowed = lspProjectCodePermission.getStore() ?? false) {
+  const trust = getProjectTrustState();
+  if (tsserverPath && (!projectSupplied || projectCodeAllowed && trust === "trusted"))
+    return tsserverPath;
+  recordUntrustedLspExecution({
+    kind: "project-local-binary",
+    command: tsserverPath ?? "tsserver.js",
+    resolvedCommand: tsserverPath ?? "tsserver.js",
+    cwd,
+    reason: tsserverPath ? "LSP execution refused: project compiler requires trusted session ownership" : "LSP execution refused: no admitted absolute TypeScript compiler"
+  }, trust);
+  return void 0;
+}
+function isProjectLocalLspBinary(resolvedCommand, cwd) {
+  return isProjectLocalBinPath(resolvedCommand, cwd);
+}
 function trySpawn(command, args, cwd, env, needsShell) {
   let proc;
   if (needsShell) {
@@ -703,9 +847,6 @@ function trySpawn(command, args, cwd, env, needsShell) {
   if (!proc.stdin || !proc.stdout || !proc.stderr) {
     throw new Error(`Failed to spawn LSP server: ${command}`);
   }
-  if (proc.exitCode !== null || proc.killed) {
-    throw new Error(`LSP server ${command} exited immediately (code: ${proc.exitCode}). The binary may be missing or corrupted.`);
-  }
   holdOwnChildPid(proc.pid, "lsp-spawn");
   return proc;
 }
@@ -781,6 +922,14 @@ async function launchLSP(command, args = [], options = {}) {
       needsShell = computeNeedsShell(spawnCommand);
     }
   }
+  if (isProjectLocalLspBinary(spawnCommand, cwd)) {
+    refuseUntrustedLspExecution({
+      kind: "project-local-binary",
+      command,
+      resolvedCommand: spawnCommand,
+      cwd
+    });
+  }
   if (isWindows && /\.(cmd|bat)$/i.test(spawnCommand) && !isCmdShimValid(spawnCommand)) {
     logSessionStart2(`lsp cmd-shim-invalid: ${spawnCommand} target missing \u2014 skipping candidate`);
     const cause = Object.assign(new Error(`LSP .cmd shim target not found: ${spawnCommand}`), { code: "ENOENT" });
@@ -817,7 +966,12 @@ async function launchLSP(command, args = [], options = {}) {
     throw new Error(`Failed to spawn LSP server: ${command}`);
   }
   if (proc.exitCode !== null || proc.killed) {
-    throw new Error(`LSP server ${command} exited immediately (code: ${proc.exitCode}). The binary may be missing or corrupted.`);
+    const message = `LSP server ${command} exited immediately (code: ${proc.exitCode}). The binary may be missing or corrupted.`;
+    const failure = new Error(message);
+    if (proc.exitCode === 1 && isMissingWindowsStartupCommand(command, spawnCommand, cwd, env)) {
+      throw new SpawnFailureError("tool-not-found", message, failure);
+    }
+    throw failure;
   }
   logSessionStart2(`lsp launch: command=${command} resolved=${spawnCommand} args=${JSON.stringify(args)} cwd=${cwd} shell=${needsShell ? "true" : "false"} pid=${proc.pid ?? 0}`);
   const formatStartupStderr = (stderr) => {
@@ -850,7 +1004,13 @@ async function launchLSP(command, args = [], options = {}) {
           settled = true;
           const isWindowsCmd = isWindows && command.endsWith(".cmd");
           const errorMsg = isWindowsCmd && code === 1 ? `npm .cmd shim failed (underlying binary not installed). Run 'npm install' in this project or use a global installation.` : `The binary may be missing or corrupted.`;
-          reject(new Error(`LSP server ${command} exited immediately with code ${code}. ${errorMsg}${formatStartupStderr(startupStderr)}`));
+          const message = `LSP server ${command} exited immediately with code ${code}. ${errorMsg}${formatStartupStderr(startupStderr)}`;
+          const failure = new Error(message);
+          if (code === 1 && isMissingWindowsStartupCommand(command, spawnCommand, cwd, env)) {
+            reject(new SpawnFailureError("tool-not-found", message, failure));
+            return;
+          }
+          reject(failure);
         }
       });
       const startupFailureWindowMs = (() => {
@@ -890,61 +1050,13 @@ async function launchLSP(command, args = [], options = {}) {
   };
 }
 
-// dist/clients/lsp/session-roots.js
-import path3 from "node:path";
-var SESSION_ROOT_CAP = 128;
-var sessionRoots = new BoundedFifoMap(SESSION_ROOT_CAP);
-function noteEvictedRoots(evicted) {
-  const roots = evicted.map(([root]) => root);
-  if (roots.length > 0) {
-    incrementDegradationCount({
-      kind: "lsp-session-root-evicted",
-      subject: `cap=${SESSION_ROOT_CAP}`,
-      reason: `session root registry at capacity; will load the dropped root again on the next session start or tool call naming it (dropped: ${roots[0]})`
-    });
-  }
-  return roots;
-}
-function registerSessionRoot(cwd) {
-  const root = path3.resolve(cwd);
-  if (sessionRoots.has(root))
-    return [];
-  return noteEvictedRoots(sessionRoots.set(root, void 0));
-}
-function setSessionRootConfig(cwd, config) {
-  return noteEvictedRoots(sessionRoots.set(path3.resolve(cwd), config));
-}
-function sessionRootConfigEntries() {
-  return sessionRoots;
-}
-function isSessionRootRegistered(cwd) {
-  return sessionRoots.has(path3.resolve(cwd));
-}
-function shouldInitializeSessionRoot(cwd, readyRoots) {
-  const normalized = path3.resolve(cwd);
-  return !readyRoots.has(normalized) || !isSessionRootRegistered(normalized);
-}
-function isOutsideAllSessionRoots(filePath) {
-  if (sessionRoots.size === 0)
-    return false;
-  const resolved = path3.resolve(filePath);
-  for (const root of sessionRoots.keys()) {
-    if (isSameOrWithin(root, resolved))
-      return false;
-  }
-  return true;
-}
-function getSessionRootsForTelemetry(limit = 4) {
-  return [...sessionRoots.keys()].sort((a, b) => Number(a > b) - Number(a < b)).slice(0, limit);
-}
-
 // dist/clients/lsp/config.js
 function asRecord(value) {
   return value && typeof value === "object" && !Array.isArray(value) ? value : void 0;
 }
 var CONFIG_RESOLVED_PHASE = "config_resolved";
 function configResolutionKey(cwd) {
-  return normalizeFilePath(path4.resolve(normalizeFilePath(cwd)));
+  return normalizeFilePath(path3.resolve(normalizeFilePath(cwd)));
 }
 function publishConfigResolutionPending(cwd) {
   logSessionStart(`session_start config_resolution_pending session=${currentSessionRecordId()} root=${configResolutionKey(cwd)}`);
@@ -1000,6 +1112,10 @@ async function loadLSPConfig(cwd, homeDir = os3.homedir(), options = {}) {
   });
   const coversProblems = newCoversClaimProblems();
   const config = lspConfigOf(resolution.value, coversProblems);
+  Object.defineProperty(config, "__provenance", {
+    value: resolution.provenance,
+    enumerable: false
+  });
   if (reporting) {
     reportPiLensConfigRecords([
       ...resolution.records,
@@ -1097,7 +1213,7 @@ function customServerSpecsOf(value) {
   const servers = asRecord(lspSectionOf(value).servers);
   return servers ? coversValidatedServers(servers) : {};
 }
-function lspConfigOf(value, problems) {
+function lspConfigOf(value, problems, provenance) {
   const section = lspSectionOf(value);
   const config = {};
   const servers = asRecord(section.servers);
@@ -1113,6 +1229,12 @@ function lspConfigOf(value, problems) {
   if (Array.isArray(section.warmFiles)) {
     config.warmFiles = section.warmFiles;
   }
+  if (provenance) {
+    Object.defineProperty(config, "__provenance", {
+      value: provenance,
+      enumerable: false
+    });
+  }
   return config;
 }
 function createCustomServer(config, id) {
@@ -1125,6 +1247,14 @@ function createCustomServer(config, id) {
     // be probeable before the claim can defer a CLI runner.
     command: config.command,
     extensions: config.extensions,
+    // A config-declared server is a language server. The public
+    // `lsp.servers.<id>.role` field is validated and projected by
+    // `ResolvedLspConfig` (clients/lsp/resolved-config.ts) but stays
+    // RESERVED and inert here: honouring it would change which servers a
+    // file selects as primary, and that is the catalog slice's call, not
+    // this loader's (#2416 slice 1). The stated default is applied rather
+    // than left absent (#1488).
+    role: DEFAULT_LSP_SERVER_ROLE,
     idleEviction: "unmeasured",
     // The config-declared covers channel (#3968): the claim the loader
     // validated (`lspConfigOf`'s projection drops unknown runner ids) rides
@@ -1140,26 +1270,74 @@ function createCustomServer(config, id) {
         cwd: root,
         env: config.env ? { ...process.env, ...config.env } : process.env
       });
-      return { process: proc };
+      return {
+        process: proc,
+        ...config.initializationOptions ? { initialization: config.initializationOptions } : {}
+      };
     }
   };
 }
 var EMPTY_CONFIG = {
   customServers: [],
+  // Avoid reading LSP_SERVERS during the config/server module cycle. The
+  // selection helper falls back to the live builtin table after evaluation.
+  registeredServers: [],
   disabledServerIds: /* @__PURE__ */ new Set(),
   serverOverrides: /* @__PURE__ */ new Map()
 };
 var configInFlight = /* @__PURE__ */ new Map();
 function normalizeWorkspacePath(cwd) {
-  return path4.resolve(cwd);
+  return path3.resolve(cwd);
+}
+var unknownTrustNoticeGeneration = -1;
+function sourceFor(provenance, key) {
+  const direct = provenanceFor({ value: void 0, provenance }, key);
+  if (direct)
+    return direct;
+  let fallback;
+  for (const [candidate, entry] of provenance) {
+    if (!candidate.startsWith(`${key}/`))
+      continue;
+    if (isRepoTier(entry.tier))
+      return entry;
+    fallback ??= entry;
+  }
+  return fallback;
+}
+function executableAllowed(provenance, trust) {
+  return !provenance || !isRepoTier(provenance.tier) || trust === "trusted";
+}
+function registryDecision(id, field, provenance, trust, allowed) {
+  if (allowed || !provenance || !isRepoTier(provenance.tier))
+    return;
+  const subject = `${id}:${field}:${provenance.tier}`;
+  const reason = `project LSP ${field} refused for ${id}: pi project trust is ${trust}`;
+  recordDegradationOnce({
+    kind: "lsp-registry-decision",
+    subject,
+    reason,
+    metadata: { serverId: id, field, tier: provenance.tier, trust }
+  });
+  if (trust === "unknown") {
+    const generation = getDegradationLedgerGeneration();
+    if (unknownTrustNoticeGeneration !== generation) {
+      unknownTrustNoticeGeneration = generation;
+      logExtension({
+        subsystem: "lsp-registry",
+        level: "warn",
+        message: "project LSP executables refused: mark the project trusted in pi or upgrade pi",
+        metadata: { serverId: id, field }
+      });
+    }
+  }
 }
 function isSameOrChildPath(filePath, candidateRoot) {
   if (filePath === candidateRoot)
     return true;
-  return filePath.startsWith(`${candidateRoot}${path4.sep}`);
+  return filePath.startsWith(`${candidateRoot}${path3.sep}`);
 }
 function getConfigForFile(filePath) {
-  const resolvedFilePath = path4.resolve(filePath);
+  const resolvedFilePath = path3.resolve(filePath);
   let bestMatch;
   for (const [root, config] of sessionRootConfigEntries()) {
     if (config === void 0)
@@ -1173,13 +1351,33 @@ function getConfigForFile(filePath) {
   return bestMatch?.config ?? EMPTY_CONFIG;
 }
 function registerLSPConfig(config) {
+  return compileLspRegistry(config, config.__provenance);
+}
+function compileLspRegistry(config, provenance = /* @__PURE__ */ new Map()) {
+  const trust = getProjectTrustState();
   const customServers = [];
   const disabledServerIds = new Set(config.disabledServers ?? []);
   if (config.servers) {
     for (const [id, serverConfig] of Object.entries(config.servers)) {
+      const commandSource = sourceFor(provenance, `/lsp/servers/${id}/command`);
+      const commandAllowed = executableAllowed(commandSource, trust);
+      registryDecision(id, "command", commandSource, trust, commandAllowed);
+      if (!commandAllowed)
+        continue;
+      const envSource = sourceFor(provenance, `/lsp/servers/${id}/env`);
+      const initSource = sourceFor(provenance, `/lsp/servers/${id}/initializationOptions`);
+      const envAllowed = executableAllowed(envSource, trust);
+      const initAllowed = executableAllowed(initSource, trust);
+      registryDecision(id, "env", envSource, trust, envAllowed);
+      registryDecision(id, "initializationOptions", initSource, trust, initAllowed);
+      const admitted = { ...serverConfig };
+      if (!envAllowed)
+        delete admitted.env;
+      if (!initAllowed)
+        delete admitted.initializationOptions;
       try {
-        const server = createCustomServer(serverConfig, id);
-        customServers.push(server);
+        const server = createCustomServer(admitted, id);
+        customServers.push({ ...server, trustAllowed: true });
       } catch {
       }
     }
@@ -1189,15 +1387,53 @@ function registerLSPConfig(config) {
     for (const [id, entry] of Object.entries(config.serverOverrides)) {
       if (entry && typeof entry === "object" && !Array.isArray(entry)) {
         const initOpts = entry.initializationOptions;
-        if (initOpts !== void 0 && typeof initOpts === "object" && initOpts !== null && !Array.isArray(initOpts)) {
+        const command = entry.command;
+        const commandSource = sourceFor(provenance, `/lsp/serverOverrides/${id}/command`);
+        const envSource = sourceFor(provenance, `/lsp/serverOverrides/${id}/env`);
+        const initSource = sourceFor(provenance, `/lsp/serverOverrides/${id}/initializationOptions`);
+        const commandAllowed = executableAllowed(commandSource, trust);
+        const envAllowed = executableAllowed(envSource, trust);
+        const overrideInitAllowed = executableAllowed(initSource, trust);
+        registryDecision(id, "command override", commandSource, trust, commandAllowed);
+        registryDecision(id, "env override", envSource, trust, envAllowed);
+        registryDecision(id, "initializationOptions", initSource, trust, overrideInitAllowed);
+        if (command !== void 0 || entry.env !== void 0 || initOpts !== void 0 && typeof initOpts === "object" && initOpts !== null && !Array.isArray(initOpts)) {
           serverOverrides.set(id, {
-            initializationOptions: initOpts
+            ...overrideInitAllowed && initOpts !== void 0 ? { initializationOptions: initOpts } : {},
+            ...commandAllowed && command !== void 0 ? { command } : {},
+            ...envAllowed && entry.env ? { env: entry.env } : {}
           });
         }
       }
     }
   }
-  return { customServers, disabledServerIds, serverOverrides };
+  const overriddenBuiltins = LSP_SERVERS.map((server) => {
+    const override = serverOverrides.get(server.id);
+    if (!override?.command)
+      return { ...server };
+    const argv = Array.isArray(override.command) ? override.command : [override.command, "--stdio"];
+    return {
+      ...server,
+      trustAllowed: true,
+      async spawn(root, options) {
+        void options;
+        const program = argv[0];
+        if (!program)
+          throw new Error(`empty command override for ${server.id}`);
+        const proc = await launchLSP(program, argv.slice(1), {
+          cwd: root,
+          env: override.env ? { ...process.env, ...override.env } : process.env
+        });
+        return { process: proc };
+      }
+    };
+  });
+  return {
+    customServers,
+    registeredServers: overriddenBuiltins,
+    disabledServerIds,
+    serverOverrides
+  };
 }
 function forgetConfigResolvedClaims(evictedRoots) {
   for (const root of evictedRoots) {
@@ -1224,7 +1460,8 @@ async function initLSPConfig(cwd) {
   }
 }
 function registeredServers(config) {
-  return [...LSP_SERVERS, ...config.customServers];
+  const builtins = config.registeredServers.length ? config.registeredServers : LSP_SERVERS;
+  return [...builtins, ...config.customServers];
 }
 function selectionReason(server, config, filePath, ext, base) {
   if (config.disabledServerIds.has(server.id))
@@ -1244,8 +1481,8 @@ function selectionReason(server, config, filePath, ext, base) {
   return "selected";
 }
 function explainServersForFile(filePath, config = getConfigForFile(filePath)) {
-  const ext = path4.extname(filePath).toLowerCase();
-  const base = path4.basename(filePath).toLowerCase();
+  const ext = path3.extname(filePath).toLowerCase();
+  const base = path3.basename(filePath).toLowerCase();
   return registeredServers(config).map((server) => {
     const reason = selectionReason(server, config, filePath, ext, base);
     return { server, selected: reason === "selected", reason };
@@ -1253,12 +1490,12 @@ function explainServersForFile(filePath, config = getConfigForFile(filePath)) {
 }
 function getServersForFileWithConfig(filePath) {
   const config = getConfigForFile(filePath);
-  const ext = path4.extname(filePath).toLowerCase();
-  const base = path4.basename(filePath).toLowerCase();
+  const ext = path3.extname(filePath).toLowerCase();
+  const base = path3.basename(filePath).toLowerCase();
   return registeredServers(config).filter((server) => selectionReason(server, config, filePath, ext, base) === "selected");
 }
 function primaryServerEntry(filePath) {
-  return getServersForFileWithConfig(filePath).find((s) => s.role !== "auxiliary");
+  return getServersForFileWithConfig(filePath).find((s) => !isAuxiliary(s));
 }
 function primaryServerId(filePath) {
   return primaryServerEntry(filePath)?.id;
@@ -1315,11 +1552,15 @@ function resolveAstGrepNativeExe(platform = process.platform, arch = process.arc
 }
 var SERVER_DIAGNOSTIC_STRATEGIES = {
   typescript: {
-    seedFirstPush: true,
+    seedFirstPush: false,
     pullRetryBudgetMs: 0,
     debounceMs: 50,
     aggregateWaitMs: 1e3,
     expectSemanticSecondPush: false,
+    // #3310 / nightly run 37930006227: the clean TypeScript fixture
+    // published an empty pre-index result before its settled result.
+    // Hold that first publish so it cannot resolve a push wait as clean.
+    emptyFirstPublish: "indexing",
     // Tier 3 (#458): typescript-language-server publishes nothing on a
     // clean→clean edit (docs/lsp-capability-matrix.md, re-confirmed
     // 2026-07-12). It's the lone core-set tier-3 server, which is exactly
@@ -1701,7 +1942,7 @@ function classifyServerWaitTier(serverId, snapshot) {
   return "tier3-silent";
 }
 function resolvePrimaryServerForWaitPolicy(filePath, snapshots) {
-  const servers = getServersForFileWithConfig(filePath).filter((s) => s.role !== "auxiliary");
+  const servers = getServersForFileWithConfig(filePath).filter((s) => !isAuxiliary(s));
   const primary = servers[0];
   if (!primary)
     return void 0;
@@ -1721,14 +1962,14 @@ function classifyCascadeWaitTier(lspService, filePath, snapshots) {
 // dist/clients/lsp/lombok.js
 import * as fs4 from "node:fs";
 import * as os4 from "node:os";
-import * as path5 from "node:path";
+import * as path4 from "node:path";
 var LOMBOK_ENV_KEYS = ["PI_LENS_LOMBOK_JAR", "LOMBOK_JAR"];
 var LOMBOK_PROJECT_FILES = [
   "lombok.config",
   "pom.xml",
   "build.gradle",
   "build.gradle.kts",
-  path5.join("gradle", "libs.versions.toml")
+  path4.join("gradle", "libs.versions.toml")
 ];
 function fileExists(filePath) {
   if (!filePath)
@@ -1753,13 +1994,13 @@ function containsLombokDependency(text) {
   return /\borg\.projectlombok\b/i.test(text) || /<artifactId>\s*lombok\s*<\/artifactId>/i.test(text) || /\b(annotationProcessor|compileOnly|testCompileOnly|testAnnotationProcessor)\b[^\n]*\blombok\b/i.test(text);
 }
 function hasLombokProject(root) {
-  const lombokConfig = path5.join(root, "lombok.config");
+  const lombokConfig = path4.join(root, "lombok.config");
   if (fileExists(lombokConfig))
     return true;
   for (const name of LOMBOK_PROJECT_FILES) {
     if (name === "lombok.config")
       continue;
-    const text = readTextIfSmall(path5.join(root, name));
+    const text = readTextIfSmall(path4.join(root, name));
     if (text && containsLombokDependency(text))
       return true;
   }
@@ -1769,16 +2010,16 @@ function envJarCandidate(env) {
   for (const key of LOMBOK_ENV_KEYS) {
     const value = env[key]?.trim();
     if (fileExists(value))
-      return path5.resolve(value);
+      return path4.resolve(value);
   }
   return void 0;
 }
 function localJarCandidates(root) {
   return [
-    path5.join(root, "lombok.jar"),
-    path5.join(root, ".lombok", "lombok.jar"),
-    path5.join(root, "lib", "lombok.jar"),
-    path5.join(root, "libs", "lombok.jar")
+    path4.join(root, "lombok.jar"),
+    path4.join(root, ".lombok", "lombok.jar"),
+    path4.join(root, "lib", "lombok.jar"),
+    path4.join(root, "libs", "lombok.jar")
   ];
 }
 function newestExistingJar(candidates) {
@@ -1797,17 +2038,17 @@ function newestExistingJar(candidates) {
   return best?.filePath;
 }
 function mavenLocalLombokJar(home = os4.homedir()) {
-  const base = path5.join(home, ".m2", "repository", "org", "projectlombok", "lombok");
+  const base = path4.join(home, ".m2", "repository", "org", "projectlombok", "lombok");
   let versions = [];
   try {
     versions = fs4.readdirSync(base);
   } catch {
     return void 0;
   }
-  return newestExistingJar(versions.map((version) => path5.join(base, version, `lombok-${version}.jar`)));
+  return newestExistingJar(versions.map((version) => path4.join(base, version, `lombok-${version}.jar`)));
 }
 function gradleCacheLombokJar(home = os4.homedir()) {
-  const base = path5.join(home, ".gradle", "caches", "modules-2", "files-2.1", "org.projectlombok", "lombok");
+  const base = path4.join(home, ".gradle", "caches", "modules-2", "files-2.1", "org.projectlombok", "lombok");
   const candidates = [];
   let versions = [];
   try {
@@ -1816,7 +2057,7 @@ function gradleCacheLombokJar(home = os4.homedir()) {
     return void 0;
   }
   for (const version of versions) {
-    const versionDir = path5.join(base, version);
+    const versionDir = path4.join(base, version);
     let hashes = [];
     try {
       hashes = fs4.readdirSync(versionDir);
@@ -1824,7 +2065,7 @@ function gradleCacheLombokJar(home = os4.homedir()) {
       continue;
     }
     for (const hash of hashes) {
-      candidates.push(path5.join(versionDir, hash, `lombok-${version}.jar`));
+      candidates.push(path4.join(versionDir, hash, `lombok-${version}.jar`));
     }
   }
   return newestExistingJar(candidates);
@@ -1857,15 +2098,15 @@ function createLombokJdtlsArgs(root, baseEnv = process.env) {
 // dist/clients/lsp/jvm-runtime.js
 import { existsSync as existsSync2, readdirSync as readdirSync4 } from "node:fs";
 import os5 from "node:os";
-import path6 from "node:path";
+import path5 from "node:path";
 var JAVA_EXE = process.platform === "win32" ? "java.exe" : "java";
 var JAVA_PROBE_TIMEOUT_MS = 5e3;
 var MIN_JAVA_MAJOR = 17;
 function jdkHomeFrom(dir) {
-  if (existsSync2(path6.join(dir, "bin", JAVA_EXE)))
+  if (existsSync2(path5.join(dir, "bin", JAVA_EXE)))
     return dir;
-  const macHome = path6.join(dir, "Contents", "Home");
-  if (existsSync2(path6.join(macHome, "bin", JAVA_EXE)))
+  const macHome = path5.join(dir, "Contents", "Home");
+  if (existsSync2(path5.join(macHome, "bin", JAVA_EXE)))
     return macHome;
   return void 0;
 }
@@ -1878,7 +2119,7 @@ function parseMajorVersion(name) {
 }
 function childDirs(base) {
   try {
-    return readdirSync4(base, { withFileTypes: true }).filter((e) => e.isDirectory() || e.isSymbolicLink()).map((e) => path6.join(base, e.name));
+    return readdirSync4(base, { withFileTypes: true }).filter((e) => e.isDirectory() || e.isSymbolicLink()).map((e) => path5.join(base, e.name));
   } catch {
     return [];
   }
@@ -1886,26 +2127,26 @@ function childDirs(base) {
 function candidateRoots() {
   const home = os5.homedir();
   const roots = [];
-  roots.push(path6.join(home, ".jdks"));
-  roots.push(path6.join(getGlobalPiLensDir(), "tools"));
+  roots.push(path5.join(home, ".jdks"));
+  roots.push(path5.join(getGlobalPiLensDir(), "tools"));
   if (process.platform === "win32") {
     const progFiles = [
       process.env.ProgramFiles,
       process.env["ProgramFiles(x86)"],
       process.env.ProgramW6432,
-      path6.join(process.env.LOCALAPPDATA ?? path6.join(home, "AppData", "Local"), "Programs")
+      path5.join(process.env.LOCALAPPDATA ?? path5.join(home, "AppData", "Local"), "Programs")
     ].filter((p) => Boolean(p));
     for (const base of progFiles) {
-      roots.push(path6.join(base, "Eclipse Adoptium"));
-      roots.push(path6.join(base, "Java"));
-      roots.push(path6.join(base, "Microsoft"));
-      roots.push(path6.join(base, "Zulu"));
-      roots.push(path6.join(base, "Amazon Corretto"));
-      roots.push(path6.join(base, "BellSoft"));
+      roots.push(path5.join(base, "Eclipse Adoptium"));
+      roots.push(path5.join(base, "Java"));
+      roots.push(path5.join(base, "Microsoft"));
+      roots.push(path5.join(base, "Zulu"));
+      roots.push(path5.join(base, "Amazon Corretto"));
+      roots.push(path5.join(base, "BellSoft"));
     }
   } else if (process.platform === "darwin") {
     roots.push("/Library/Java/JavaVirtualMachines");
-    roots.push(path6.join(home, "Library", "Java", "JavaVirtualMachines"));
+    roots.push(path5.join(home, "Library", "Java", "JavaVirtualMachines"));
     roots.push("/opt/homebrew/opt");
     roots.push("/usr/local/opt");
   } else {
@@ -1929,7 +2170,7 @@ function discoverJdkHome(roots = candidateRoots(), javaHome = process.env.JAVA_H
         continue;
       found.push({
         home: resolved,
-        major: parseMajorVersion(path6.basename(dir))
+        major: parseMajorVersion(path5.basename(dir))
       });
     }
   }
@@ -2028,12 +2269,12 @@ async function resolveJavaRuntimeEnv() {
   }
   const home = discoverJdkHome();
   if (home) {
-    const binDir = path6.join(home, "bin");
+    const binDir = path5.join(home, "bin");
     const currentPath = process.env.PATH ?? process.env.Path ?? "";
     _cachedEnv = {
       value: {
         JAVA_HOME: home,
-        PATH: binDir + path6.delimiter + currentPath
+        PATH: binDir + path5.delimiter + currentPath
       }
     };
     return _cachedEnv.value;
@@ -2089,7 +2330,7 @@ async function resolveLspServerCwd(server, filePath, sessionCwd, onRootFailure,
     rootFailed = true;
     onRootFailure?.(reason);
   }
-  const isFileDirFallback = serverRoot !== void 0 && rootMarkers?.length && path7.resolve(serverRoot) === path7.resolve(path7.dirname(filePath));
+  const isFileDirFallback = serverRoot !== void 0 && rootMarkers?.length && path6.resolve(serverRoot) === path6.resolve(path6.dirname(filePath));
   if (!serverRoot || isFileDirFallback) {
     const probedMarker = onRootFallback && !rootFailed && rootMarkers?.length ? resolveToolCwd("lsp", server.id, filePath, {
       cwd: sessionCwd,
@@ -2098,7 +2339,7 @@ async function resolveLspServerCwd(server, filePath, sessionCwd, onRootFailure,
     }).marker : void 0;
     const refusedMarker = probedMarker !== void 0 && rootMarkers?.includes(probedMarker) ? probedMarker : void 0;
     const fallbackCwd = rootMarkers?.length ? resolveToolCwd("lsp", server.id, filePath, {
-      cwd: path7.dirname(path7.resolve(filePath)),
+      cwd: path6.dirname(path6.resolve(filePath)),
       rootMarkers
     }) : void 0;
     if (!serverRoot) {
@@ -2168,17 +2409,17 @@ var PROJECT_BOUNDARY_MARKERS = [
 var loggedRootCeilingClamps = /* @__PURE__ */ new Set();
 var posixCaseInsensitiveByPath = /* @__PURE__ */ new Map();
 function posixFilesystemIsCaseInsensitive(root) {
-  const resolved = path7.resolve(root);
+  const resolved = path6.resolve(root);
   const cached = posixCaseInsensitiveByPath.get(resolved);
   if (cached !== void 0)
     return cached;
   if (!existsSync3(resolved)) {
     return false;
   }
-  const name = path7.basename(resolved);
+  const name = path6.basename(resolved);
   const alternate = name.toLowerCase() === name ? name.toUpperCase() : name.toLowerCase();
   let insensitive = false;
-  const alternatePath = path7.join(path7.dirname(resolved), alternate);
+  const alternatePath = path6.join(path6.dirname(resolved), alternate);
   if (alternate !== name && existsSync3(alternatePath)) {
     try {
       const actual = statSync3(resolved);
@@ -2196,7 +2437,7 @@ function resetLSPCaseSensitivityState() {
 }
 function isSameOrWithin(ancestor, candidate, deps = {}) {
   const windowsShaped = isWindowsPath(ancestor) || isWindowsPath(candidate);
-  const pathApi = windowsShaped ? path7.win32 : path7;
+  const pathApi = windowsShaped ? path6.win32 : path6;
   const resolvedAncestor = pathApi.resolve(ancestor);
   const resolvedCandidate = pathApi.resolve(candidate);
   let caseInsensitive = false;
@@ -2216,7 +2457,7 @@ function isSameOrWithin(ancestor, candidate, deps = {}) {
 }
 function enforceLspRootCeiling(root, sessionCwd, filePath) {
   const windowsShaped = isWindowsPath(root) || isWindowsPath(sessionCwd);
-  const pathApi = windowsShaped ? path7.win32 : path7;
+  const pathApi = windowsShaped ? path6.win32 : path6;
   const resolvedRoot = pathApi.resolve(root);
   const resolvedCwd = pathApi.resolve(sessionCwd);
   if (filePath && !isSameOrWithin(resolvedCwd, pathApi.resolve(filePath))) {
@@ -2241,8 +2482,8 @@ async function hasProjectBoundaryMarker(dir) {
   return false;
 }
 function pathSegments(dir) {
-  const parsed = path7.parse(path7.resolve(dir));
-  return path7.relative(parsed.root, path7.resolve(dir)).split(path7.sep).filter(Boolean).map((segment) => segment.toLowerCase());
+  const parsed = path6.parse(path6.resolve(dir));
+  return path6.relative(parsed.root, path6.resolve(dir)).split(path6.sep).filter(Boolean).map((segment) => segment.toLowerCase());
 }
 function hasFixtureConvention(dir) {
   const segments = pathSegments(dir);
@@ -2254,18 +2495,18 @@ function hasAtomicStageSegment(dir) {
   return pathSegments(dir).some((segment) => STAGE_TMP_PATTERN.test(segment));
 }
 async function findGitBoundary(dir) {
-  let current = path7.resolve(dir);
-  const fsRoot = path7.parse(current).root;
+  let current = path6.resolve(dir);
+  const fsRoot = path6.parse(current).root;
   while (true) {
     if (await markerExists(current, ".git"))
       return current;
     if (current === fsRoot)
       return void 0;
-    current = path7.dirname(current);
+    current = path6.dirname(current);
   }
 }
 async function isExcludedLspRoot(dir) {
-  const candidate = path7.resolve(dir);
+  const candidate = path6.resolve(dir);
   if (hasFixtureConvention(candidate) || hasAtomicStageSegment(candidate))
     return true;
   const gitRoot = await findGitBoundary(candidate);
@@ -2277,9 +2518,9 @@ async function isExcludedLspRoot(dir) {
 }
 async function nearestNonExcludedFallbackRoot(candidate) {
   if (!await isExcludedLspRoot(candidate))
-    return path7.resolve(candidate);
-  let current = path7.dirname(path7.resolve(candidate));
-  const fsRoot = path7.parse(current).root;
+    return path6.resolve(candidate);
+  let current = path6.dirname(path6.resolve(candidate));
+  const fsRoot = path6.parse(current).root;
   let nearestAllowed;
   while (true) {
     if (!await isExcludedLspRoot(current)) {
@@ -2291,7 +2532,7 @@ async function nearestNonExcludedFallbackRoot(candidate) {
     }
     if (current === fsRoot)
       break;
-    current = path7.dirname(current);
+    current = path6.dirname(current);
   }
   return nearestAllowed ?? fsRoot;
 }
@@ -2332,7 +2573,7 @@ async function installEvidenceForLaunch(toolId, installed, attempt) {
   const confirmedManagedPath = await findManagedToolBinary(toolId);
   return {
     ...evidence,
-    binary: path7.basename(installed),
+    binary: path6.basename(installed),
     ...confirmedManagedPath !== void 0 && pathsEqual(confirmedManagedPath, installed) && {
       source: "managed-dir"
     }
@@ -2385,7 +2626,7 @@ function markDirectLspCommandUnavailable(command) {
   directLspCommandUnavailableUntil.set(command, Date.now() + DIRECT_LSP_NEGATIVE_TTL_MS);
   directLspCommandSkipLoggedUntil.delete(command);
 }
-var PI_LENS_BIN_DIR2 = path7.join(getGlobalPiLensDir(), "bin");
+var PI_LENS_BIN_DIR2 = path6.join(getGlobalPiLensDir(), "bin");
 async function resolveAndLaunch(spec, allowInstall) {
   const generation = lspLaunchAvailabilityGeneration.capture();
   const toolLabel = spec.managedToolId ?? spec.candidates[spec.candidates.length - 1] ?? "unknown";
@@ -2450,7 +2691,7 @@ async function resolveAndLaunch(spec, allowInstall) {
           producer: "lsp-launch",
           classifiedBy: "probe",
           evidence: {
-            binary: path7.basename(managedCandidate),
+            binary: path6.basename(managedCandidate),
             source: "managed-dir",
             correctsLatchedRow: false
           }
@@ -2743,7 +2984,7 @@ async function resolveAndLaunchTreeBinary(spec, allowInstall) {
     return void 0;
   }
   const suffix = process.platform === "win32" ? ".exe" : "";
-  const binPath = path7.join(bundleDir, ...spec.binRelPath.split("/")) + suffix;
+  const binPath = path6.join(bundleDir, ...spec.binRelPath.split("/")) + suffix;
   try {
     const proc = await launchLSP(binPath, spec.args, {
       cwd: spec.cwd,
@@ -2758,7 +2999,7 @@ async function resolveAndLaunchTreeBinary(spec, allowInstall) {
   }
 }
 function nodeBinLocalCandidates(root, baseName) {
-  const localBase = path7.join(root, "node_modules", ".bin", baseName);
+  const localBase = path6.join(root, "node_modules", ".bin", baseName);
   if (process.platform === "win32") {
     return [`${localBase}.cmd`, `${localBase}.exe`];
   }
@@ -2768,7 +3009,7 @@ function nodeBinCandidates(root, baseName) {
   return [...nodeBinLocalCandidates(root, baseName), baseName];
 }
 function piAgentExtensionsRootKey(file) {
-  const dirKey = normalizeEphemeralMapKey(path7.dirname(path7.resolve(file)));
+  const dirKey = normalizeEphemeralMapKey(path6.dirname(path6.resolve(file)));
   const marker = "/.pi/agent/extensions";
   const index = dirKey.indexOf(marker);
   if (index === -1)
@@ -2776,12 +3017,12 @@ function piAgentExtensionsRootKey(file) {
   return dirKey.slice(0, index + marker.length);
 }
 function IgnoreHomeRoot(primary) {
-  const homeKey = normalizeEphemeralMapKey(path7.resolve(os6.homedir()));
+  const homeKey = normalizeEphemeralMapKey(path6.resolve(os6.homedir()));
   return withRootMarkers(async (file) => {
     const root = await primary(file);
     if (!root)
       return void 0;
-    return normalizeEphemeralMapKey(path7.resolve(root)) === homeKey ? void 0 : root;
+    return normalizeEphemeralMapKey(path6.resolve(root)) === homeKey ? void 0 : root;
   }, primary.rootMarkers ?? []);
 }
 function rubyBinCandidates(baseName) {
@@ -2789,13 +3030,13 @@ function rubyBinCandidates(baseName) {
   const home = os6.homedir();
   const isWin = process.platform === "win32";
   const ext = isWin ? ".bat" : "";
-  candidates.push(path7.join(home, ".local", "share", "mise", "installs", "ruby", "bin", `${baseName}${ext}`));
-  candidates.push(path7.join(home, ".asdf", "installs", "ruby", "bin", `${baseName}${ext}`));
+  candidates.push(path6.join(home, ".local", "share", "mise", "installs", "ruby", "bin", `${baseName}${ext}`));
+  candidates.push(path6.join(home, ".asdf", "installs", "ruby", "bin", `${baseName}${ext}`));
   if (isWin) {
-    const driveRoot = path7.parse(home).root;
+    const driveRoot = path6.parse(home).root;
     for (const entry of getRubyVersionDirNamesSync(driveRoot)) {
-      candidates.push(path7.join(driveRoot, entry, "bin", `${baseName}.bat`));
-      candidates.push(path7.join(driveRoot, entry, "bin", baseName));
+      candidates.push(path6.join(driveRoot, entry, "bin", `${baseName}.bat`));
+      candidates.push(path6.join(driveRoot, entry, "bin", baseName));
     }
   }
   return candidates;
@@ -2806,10 +3047,16 @@ function createInteractiveServer(spec) {
     name: spec.name,
     extensions: spec.extensions,
     idleEviction: "unmeasured",
+    // `InteractiveServerSpec` declares no role, so the factory applies the
+    // stated default rather than leaving `role` absent for each consumer to
+    // read by negation (#1488). An auxiliary would declare its role on a
+    // row of its own, the way the four scanner rows do.
+    role: DEFAULT_LSP_SERVER_ROLE,
     root: spec.root,
     rootMarkers: spec.root.rootMarkers,
     fallbackFor: spec.fallbackFor,
     requiresProjectRoot: spec.requiresProjectRoot,
+    executesProjectCode: spec.executesProjectCode,
     availabilityKey: typeof spec.command === "string" && isSimpleCommand(spec.command) ? spec.command : void 0,
     async spawn(root) {
       const command = typeof spec.command === "function" ? spec.command(root) : spec.command;
@@ -2846,7 +3093,7 @@ function PriorityRoot(markerGroups, excludePatterns, stopDir) {
   }, markerGroups.flat());
 }
 var FileDirRoot = async (file) => {
-  const candidate = path7.resolve(path7.dirname(file));
+  const candidate = path6.resolve(path6.dirname(file));
   return nearestNonExcludedFallbackRoot(candidate);
 };
 function RootWithFallback(primary, fallback = FileDirRoot) {
@@ -2868,16 +3115,16 @@ function markerProbeDir(dir, pattern) {
   const normalized = toPosix(pattern);
   const slash = normalized.lastIndexOf("/");
   const parentPattern = slash >= 0 ? normalized.slice(0, slash) : "";
-  return parentPattern ? path7.join(dir, ...parentPattern.split("/").filter(Boolean)) : dir;
+  return parentPattern ? path6.join(dir, ...parentPattern.split("/").filter(Boolean)) : dir;
 }
 async function markerExists(dir, pattern) {
   if (!pattern.includes("*")) {
     try {
-      await stat(path7.join(dir, pattern));
+      await stat(path6.join(dir, pattern));
       return true;
     } catch (err) {
       if (isPermissionFsError(err)) {
-        logSessionStart(`lsp root marker skipped: permission error stat ${path7.join(dir, pattern)}`);
+        logSessionStart(`lsp root marker skipped: permission error stat ${path6.join(dir, pattern)}`);
       }
       return false;
     }
@@ -2913,7 +3160,7 @@ function NearestRoot(includePatterns, excludePatterns, stopDir) {
       subdirPatterns.push(pattern);
   }
   return withRootMarkers(async (file) => {
-    const startDir = path7.resolve(path7.dirname(file));
+    const startDir = path6.resolve(path6.dirname(file));
     const dirKey = normalizeMapKey(startDir);
     const cached = cache.get(dirKey);
     if (cached !== void 0 && Date.now() - cached.walkedAt < FRESHNESS_CADENCE_MS && await bounded(dirMtimesStillFreshAsync(cached.probedDirs), rootMtimeBound("lsp-root-memo-freshness")) === true)
@@ -2925,10 +3172,10 @@ function NearestRoot(includePatterns, excludePatterns, stopDir) {
     const walkedAt = Date.now();
     const promise = (async () => {
       let currentDir = startDir;
-      const fsRoot = path7.parse(currentDir).root;
-      const stop = stopDir ? path7.resolve(stopDir) : fsRoot;
+      const fsRoot = path6.parse(currentDir).root;
+      const stop = stopDir ? path6.resolve(stopDir) : fsRoot;
       while (true) {
-        if (stop !== fsRoot && currentDir.startsWith(stop + path7.sep) === false && currentDir !== stop) {
+        if (stop !== fsRoot && currentDir.startsWith(stop + path6.sep) === false && currentDir !== stop) {
           break;
         }
         const stepDirs = [
@@ -2946,7 +3193,7 @@ function NearestRoot(includePatterns, excludePatterns, stopDir) {
             }
           }
           if (excluded) {
-            currentDir = path7.dirname(currentDir);
+            currentDir = path6.dirname(currentDir);
             continue;
           }
         }
@@ -2958,7 +3205,7 @@ function NearestRoot(includePatterns, excludePatterns, stopDir) {
         if (currentDir === stop || currentDir === fsRoot) {
           break;
         }
-        currentDir = path7.dirname(currentDir);
+        currentDir = path6.dirname(currentDir);
       }
       return void 0;
     })();
@@ -3000,17 +3247,17 @@ async function findAncestorFile(startDir, ...relativeSegments) {
 }
 async function findAncestorFileAmong(startDir, candidateSegmentLists) {
   const fs5 = await import("node:fs/promises");
-  let currentDir = path7.resolve(startDir);
+  let currentDir = path6.resolve(startDir);
   while (!isAtOrAboveHomeDir(currentDir)) {
     for (const segments of candidateSegmentLists) {
-      const candidate = path7.join(currentDir, ...segments);
+      const candidate = path6.join(currentDir, ...segments);
       try {
         await fs5.access(candidate);
         return candidate;
       } catch {
       }
     }
-    const parent = path7.dirname(currentDir);
+    const parent = path6.dirname(currentDir);
     if (parent === currentDir)
       break;
     currentDir = parent;
@@ -3026,19 +3273,19 @@ function resetClassicTsRepairGuard() {
   classicTsRepairState().attempted = false;
 }
 function typescriptDirsForTsc(tscPath) {
-  const binDir = path7.dirname(tscPath);
+  const binDir = path6.dirname(tscPath);
   return [
-    path7.join(binDir, "..", "typescript"),
-    path7.join(binDir, "..", "..", "typescript")
+    path6.join(binDir, "..", "typescript"),
+    path6.join(binDir, "..", "..", "typescript")
   ];
 }
 async function typescriptVersionForTsc(tscPath) {
-  if (!path7.isAbsolute(tscPath))
+  if (!path6.isAbsolute(tscPath))
     return void 0;
   for (const dir of typescriptDirsForTsc(tscPath)) {
     let manifest;
     try {
-      manifest = await readFile(path7.join(dir, "package.json"), "utf8");
+      manifest = await readFile(path6.join(dir, "package.json"), "utf8");
     } catch {
       continue;
     }
@@ -3060,25 +3307,45 @@ async function typescriptVersionForTsc(tscPath) {
   }
   return void 0;
 }
-async function findTsserverPath(root, allowInstall) {
+async function findTsserverPath(root, allowInstall, options) {
   const fs5 = await import("node:fs/promises");
+  const projectRoots = await Promise.all([root, options?.sessionRoot ?? process.cwd(), process.cwd()].map((dir) => fs5.realpath(dir).catch(() => path6.resolve(dir))));
+  const admitCandidate = async (candidate, projectSupplied) => {
+    try {
+      const real = await fs5.realpath(candidate);
+      if (path6.basename(real) !== "tsserver.js" || !(await fs5.stat(real)).isFile())
+        return void 0;
+      const manifest = JSON.parse(await fs5.readFile(path6.join(path6.dirname(real), "..", "package.json"), "utf8"));
+      if (typeof manifest?.version !== "string" || !manifest.version)
+        return void 0;
+      return admitProjectSuppliedTsserver(real, options?.sessionRoot ?? process.cwd(), projectSupplied || projectRoots.some((dir) => isUnderDir(real, dir)), options?.projectCodeAllowed);
+    } catch {
+      return void 0;
+    }
+  };
   const ancestorHit = await findAncestorFile(root, "node_modules", "typescript", "lib", "tsserver.js");
-  if (ancestorHit)
-    return ancestorHit;
-  const cwdCandidate = path7.join(process.cwd(), "node_modules", "typescript", "lib", "tsserver.js");
+  if (ancestorHit) {
+    const admittedAncestor = await admitCandidate(ancestorHit, true);
+    if (admittedAncestor)
+      return admittedAncestor;
+  }
+  const cwdCandidate = path6.join(process.cwd(), "node_modules", "typescript", "lib", "tsserver.js");
   try {
     await fs5.access(cwdCandidate);
-    return cwdCandidate;
+    const admittedCwd = await admitCandidate(cwdCandidate, false);
+    if (admittedCwd)
+      return admittedCwd;
   } catch {
   }
   const tsserverForTsc = async (tscPath) => {
-    if (!tscPath)
+    if (!tscPath || !path6.isAbsolute(tscPath))
       return void 0;
     for (const dir of typescriptDirsForTsc(tscPath)) {
-      const candidate = path7.join(dir, "lib", "tsserver.js");
+      const candidate = path6.join(dir, "lib", "tsserver.js");
       try {
-        await fs5.access(candidate);
-        return candidate;
+        const admitted = await admitCandidate(candidate, false);
+        if (admitted)
+          return admitted;
       } catch {
       }
     }
@@ -3104,10 +3371,10 @@ async function findTsserverPath(root, allowInstall) {
   return tsserverForTsc(repairedTsc);
 }
 async function findNativeTypeScriptLsp(root) {
-  let currentDir = path7.resolve(root);
+  let currentDir = path6.resolve(root);
   while (!isAtOrAboveHomeDir(currentDir)) {
-    const typescriptDir = path7.join(currentDir, "node_modules", "typescript");
-    const packageJsonPath = path7.join(typescriptDir, "package.json");
+    const typescriptDir = path6.join(currentDir, "node_modules", "typescript");
+    const packageJsonPath = path6.join(typescriptDir, "package.json");
     let packageJsonText;
     try {
       packageJsonText = await readFile(packageJsonPath, "utf8");
@@ -3121,7 +3388,7 @@ async function findNativeTypeScriptLsp(root) {
           return void 0;
       } catch {
       }
-      const parent = path7.dirname(currentDir);
+      const parent = path6.dirname(currentDir);
       if (parent === currentDir)
         return void 0;
       currentDir = parent;
@@ -3141,7 +3408,7 @@ async function findNativeTypeScriptLsp(root) {
     const major = /^\d+$/.test(majorText) ? Number(majorText) : Number.NaN;
     if (!Number.isFinite(major) || major < 7)
       return void 0;
-    const localTsc = path7.join(currentDir, "node_modules", ".bin", "tsc");
+    const localTsc = path6.join(currentDir, "node_modules", ".bin", "tsc");
     const candidates = process.platform === "win32" ? [`${localTsc}.cmd`, `${localTsc}.exe`, localTsc] : [localTsc];
     for (const command of candidates) {
       try {
@@ -3157,23 +3424,23 @@ async function findNativeTypeScriptLsp(root) {
 function dotnetToolCandidates(tool) {
   const home = os6.homedir();
   return [
-    path7.join(PI_LENS_BIN_DIR2, `${tool}.exe`),
-    path7.join(PI_LENS_BIN_DIR2, tool),
-    path7.join(home, ".dotnet", "tools", `${tool}.exe`),
-    path7.join(home, ".dotnet", "tools", tool),
+    path6.join(PI_LENS_BIN_DIR2, `${tool}.exe`),
+    path6.join(PI_LENS_BIN_DIR2, tool),
+    path6.join(home, ".dotnet", "tools", `${tool}.exe`),
+    path6.join(home, ".dotnet", "tools", tool),
     tool
   ].filter(Boolean);
 }
 function binExeVariants(dir, tool) {
-  return process.platform === "win32" ? [path7.join(dir, `${tool}.exe`), path7.join(dir, tool)] : [path7.join(dir, tool)];
+  return process.platform === "win32" ? [path6.join(dir, `${tool}.exe`), path6.join(dir, tool)] : [path6.join(dir, tool)];
 }
 function goBinCandidates(tool) {
-  const gopath = process.env.GOPATH?.split(path7.delimiter)[0] || path7.join(os6.homedir(), "go");
-  return [tool, ...binExeVariants(path7.join(gopath, "bin"), tool)];
+  const gopath = process.env.GOPATH?.split(path6.delimiter)[0] || path6.join(os6.homedir(), "go");
+  return [tool, ...binExeVariants(path6.join(gopath, "bin"), tool)];
 }
 function cargoBinCandidates(tool) {
-  const cargoHome = process.env.CARGO_HOME || path7.join(os6.homedir(), ".cargo");
-  return [tool, ...binExeVariants(path7.join(cargoHome, "bin"), tool)];
+  const cargoHome = process.env.CARGO_HOME || path6.join(os6.homedir(), ".cargo");
+  return [tool, ...binExeVariants(path6.join(cargoHome, "bin"), tool)];
 }
 async function tryGemInstall(gem) {
   const { join: join3 } = await import("node:path");
@@ -3211,7 +3478,7 @@ var TS_TOOLING_MARKERS = [
 ];
 var TS_FAMILY_EXTENSIONS = /* @__PURE__ */ new Set([".ts", ".tsx", ".mts", ".cts"]);
 function isTsFamilyFile(file) {
-  return TS_FAMILY_EXTENSIONS.has(path7.extname(file).toLowerCase());
+  return TS_FAMILY_EXTENSIONS.has(path6.extname(file).toLowerCase());
 }
 function tsConfigMarkersForFile(file) {
   return isTsFamilyFile(file) ? ["tsconfig.json"] : TS_CONFIG_MARKERS;
@@ -3232,40 +3499,40 @@ async function findTypeScriptProjectRoot(file) {
   return isSameOrWithin(toolingRoot, configRoot) ? configRoot : toolingRoot;
 }
 async function findExtensionBoundedRoot(file, extensionRootKey) {
-  const startDir = path7.resolve(path7.dirname(file));
+  const startDir = path6.resolve(path6.dirname(file));
   let currentDir = startDir;
   const configMarkers = tsConfigMarkersForFile(file);
   while (true) {
     for (const pattern of configMarkers) {
       try {
-        await stat(path7.join(currentDir, pattern));
+        await stat(path6.join(currentDir, pattern));
         return currentDir;
       } catch {
       }
     }
     for (const pattern of TS_TOOLING_MARKERS) {
       try {
-        await stat(path7.join(currentDir, pattern));
+        await stat(path6.join(currentDir, pattern));
         return currentDir;
       } catch {
       }
     }
-    const currentKey = normalizeEphemeralMapKey(path7.resolve(currentDir));
+    const currentKey = normalizeEphemeralMapKey(path6.resolve(currentDir));
     if (currentKey === extensionRootKey)
       return void 0;
-    const parent = path7.dirname(currentDir);
+    const parent = path6.dirname(currentDir);
     if (parent === currentDir)
       return void 0;
     currentDir = parent;
   }
 }
 async function hasAgentLevelProjectMarker(extensionRootKey) {
-  const agentDir = path7.dirname(extensionRootKey);
+  const agentDir = path6.dirname(extensionRootKey);
   if (!agentDir || agentDir === extensionRootKey)
     return false;
   for (const pattern of [...TS_CONFIG_MARKERS, ...TS_TOOLING_MARKERS]) {
     try {
-      await stat(path7.join(agentDir, pattern));
+      await stat(path6.join(agentDir, pattern));
       return true;
     } catch {
     }
@@ -3291,15 +3558,16 @@ var TypeScriptRoot = withRootMarkers(DenoExcludeRoot(async (file) => {
 var TypeScriptServer = {
   id: "typescript",
   idleEviction: "transparent",
+  role: "language",
   name: "TypeScript Language Server",
+  projectLocalCommand: "typescript-language-server",
   extensions: JS_TS_LSP_EXTENSIONS,
   autoPropagateDiagnostics: true,
   root: TypeScriptRoot,
   rootMarkers: TypeScriptRoot.rootMarkers,
   async spawn(root, options) {
-    const fs5 = await import("node:fs/promises");
     const nativeLsp = await findNativeTypeScriptLsp(root);
-    if (nativeLsp) {
+    if (nativeLsp && admitProjectSuppliedTsserver(nativeLsp.command, root, true, options?.projectCodeAllowed)) {
       const env2 = await getToolEnvironment();
       logSessionStart(`lsp typescript-native: version=${nativeLsp.version} command=${nativeLsp.command}`);
       const proc2 = await launchLSP(nativeLsp.command, ["--lsp", "--stdio"], {
@@ -3323,14 +3591,10 @@ var TypeScriptServer = {
         return void 0;
       }
     }
-    let tsserverPath = await findTsserverPath(root, options?.allowInstall);
+    const tsserverPath = await findTsserverPath(root, options?.allowInstall, options);
     if (!tsserverPath) {
-      const localCandidate = path7.join(path7.dirname(lspPath), "..", "typescript", "lib", "tsserver.js");
-      try {
-        await fs5.access(localCandidate);
-        tsserverPath = localCandidate;
-      } catch {
-      }
+      admitProjectSuppliedTsserver(void 0, root, true, options?.projectCodeAllowed);
+      return void 0;
     }
     if (tsserverPath)
       source = "managed";
@@ -3353,6 +3617,7 @@ var TypeScriptServer = {
 var DenoServer = {
   id: "deno",
   idleEviction: "transparent",
+  role: "language",
   name: "Deno Language Server",
   fallbackFor: "typescript",
   extensions: JS_TS_LSP_EXTENSIONS,
@@ -3370,6 +3635,7 @@ var DenoServer = {
 var PythonServer = {
   id: "python",
   idleEviction: "transparent",
+  role: "language",
   name: "Pyright Language Server",
   extensions: KIND_EXTENSIONS["python"],
   root: RootWithFallback(createRootDetector([
@@ -3444,13 +3710,13 @@ var PythonServer = {
     if (!pyrightPath)
       return void 0;
     source = "managed";
-    const binDir = path7.dirname(pyrightPath);
+    const binDir = path6.dirname(pyrightPath);
     const isWindows2 = process.platform === "win32";
     const managedCandidates = isWindows2 ? [
-      path7.join(binDir, "pyright-langserver.cmd"),
-      path7.join(binDir, "pyright-langserver"),
+      path6.join(binDir, "pyright-langserver.cmd"),
+      path6.join(binDir, "pyright-langserver"),
       "pyright-langserver"
-    ] : [path7.join(binDir, "pyright-langserver"), "pyright-langserver"];
+    ] : [path6.join(binDir, "pyright-langserver"), "pyright-langserver"];
     const resolved = await resolveAndLaunch({ candidates: managedCandidates, args: ["--stdio"], cwd: root, env }, false);
     if (!resolved)
       return void 0;
@@ -3463,7 +3729,8 @@ var PythonServer = {
 };
 var PythonJediServer = {
   id: "python-jedi",
-  idleEviction: "unmeasured",
+  idleEviction: "transparent",
+  role: "language",
   name: "Jedi Language Server",
   fallbackFor: "python",
   extensions: KIND_EXTENSIONS["python"],
@@ -3495,6 +3762,7 @@ var PythonJediServer = {
 var GoServer = {
   id: "go",
   idleEviction: "unmeasured",
+  role: "language",
   name: "gopls",
   extensions: KIND_EXTENSIONS["go"],
   root: RootWithFallback(WorkspacePriorityRoot([["go.work"], ["go.mod", "go.sum"], [".git"]])),
@@ -3517,7 +3785,7 @@ var GoServer = {
   }
 };
 function cargoWorkspaceDeclaresMember(workspaceContent, parentDir, childDir) {
-  const relativePath = path7.relative(parentDir, childDir).split(path7.sep).join("/");
+  const relativePath = path6.relative(parentDir, childDir).split(path6.sep).join("/");
   if (relativePath === "" || relativePath.startsWith(".."))
     return false;
   const matches = (pattern) => matchesWorkspaceMemberPattern(pattern, relativePath, CARGO_WORKSPACE_MEMBER_DIALECT, () => recordDegradationOnce({
@@ -3531,7 +3799,7 @@ function cargoWorkspaceDeclaresMember(workspaceContent, parentDir, childDir) {
   return readCargoWorkspaceMembers(workspaceContent).some(matches);
 }
 function sessionHoistCeiling(sessionCwd, file) {
-  return isSameOrWithin(path7.resolve(sessionCwd), path7.resolve(file)) ? path7.resolve(sessionCwd) : void 0;
+  return isSameOrWithin(path6.resolve(sessionCwd), path6.resolve(file)) ? path6.resolve(sessionCwd) : void 0;
 }
 function RustWorkspaceRoot() {
   const crateRoot = createRootDetector(["Cargo.toml", "Cargo.lock"]);
@@ -3542,14 +3810,14 @@ function RustWorkspaceRoot() {
     const sessionCwd = process.cwd();
     const stop = sessionHoistCeiling(sessionCwd, file);
     let current = root;
-    const fsRoot = path7.parse(current).root;
+    const fsRoot = path6.parse(current).root;
     while (true) {
       if (stop !== void 0 && current === stop)
         break;
-      const parent = path7.dirname(current);
+      const parent = path6.dirname(current);
       if (parent === current || parent === fsRoot)
         break;
-      const parentCargoPath = path7.join(parent, "Cargo.toml");
+      const parentCargoPath = path6.join(parent, "Cargo.toml");
       const parentCargoContent = await readTextFileOrUndefined(parentCargoPath);
       if (parentCargoContent !== void 0 && hasCargoWorkspaceTable(parentCargoContent)) {
         if (cargoWorkspaceDeclaresMember(parentCargoContent, parent, root)) {
@@ -3577,9 +3845,9 @@ async function declaresMavenModule(parentDir, parentPomPath, childDir) {
     const modulesBlock = content.match(/<modules>([\s\S]*?)<\/modules>/);
     if (!modulesBlock)
       return false;
-    const resolvedChild = path7.resolve(childDir);
+    const resolvedChild = path6.resolve(childDir);
     for (const match of modulesBlock[1].matchAll(/<module>\s*([^<]+?)\s*<\/module>/g)) {
-      if (pathsEqual(path7.resolve(parentDir, match[1]), resolvedChild))
+      if (pathsEqual(path6.resolve(parentDir, match[1]), resolvedChild))
         return true;
     }
     return false;
@@ -3603,15 +3871,15 @@ function JavaWorkspaceRoot() {
     const stop = sessionHoistCeiling(sessionCwd, file);
     let current = root;
     let lastHop = root;
-    const fsRoot = path7.parse(current).root;
+    const fsRoot = path6.parse(current).root;
     while (true) {
       if (stop !== void 0 && current === stop)
         break;
-      const parent = path7.dirname(current);
+      const parent = path6.dirname(current);
       if (parent === current || parent === fsRoot)
         break;
       if (await markerExists(parent, "pom.xml")) {
-        const parentPom = path7.join(parent, "pom.xml");
+        const parentPom = path6.join(parent, "pom.xml");
         if (!await declaresMavenModule(parent, parentPom, lastHop))
           break;
         current = parent;
@@ -3626,9 +3894,11 @@ function JavaWorkspaceRoot() {
 var RustServer = {
   id: "rust",
   idleEviction: "unmeasured",
+  role: "language",
   // Measured (#3750): rust-analyzer answers an empty result for a detached file.
   requiresProjectRoot: true,
   name: "rust-analyzer",
+  executesProjectCode: true,
   extensions: KIND_EXTENSIONS["rust"],
   // No FileDirRoot fallback (#201): rust-analyzer is a heavy workspace server
   // that is useless without a Cargo manifest. With the fallback, every .rs file
@@ -3660,7 +3930,9 @@ var RustServer = {
 var RubyServer = {
   id: "ruby",
   idleEviction: "unmeasured",
+  role: "language",
   name: "Ruby LSP",
+  executesProjectCode: true,
   extensions: KIND_EXTENSIONS["ruby"],
   root: RootWithFallback(PriorityRoot([["Gemfile", ".ruby-version"], [".git"]])),
   // Ruby LSP may need extra time to finish composed-bundle setup before it can
@@ -3697,6 +3969,7 @@ var RubyServer = {
 var PHPServer = {
   id: "php",
   idleEviction: "transparent",
+  role: "language",
   name: "Intelephense",
   extensions: KIND_EXTENSIONS["php"],
   root: RootWithFallback(createRootDetector(["composer.json", "composer.lock"])),
@@ -3712,17 +3985,17 @@ var PHPServer = {
     return {
       ...result,
       initialization: {
-        storagePath: path7.join(getGlobalPiLensDir(), "intelephense")
+        storagePath: path6.join(getGlobalPiLensDir(), "intelephense")
       }
     };
   }
 };
 function buildPsesArgs(bundleDir) {
-  const script = path7.join(bundleDir, "PowerShellEditorServices", "Start-EditorServices.ps1");
-  const sessionDir = path7.join(getGlobalPiLensDir(), "pses", `${process.pid}-${Date.now()}`);
+  const script = path6.join(bundleDir, "PowerShellEditorServices", "Start-EditorServices.ps1");
+  const sessionDir = path6.join(getGlobalPiLensDir(), "pses", `${process.pid}-${Date.now()}`);
   mkdirSync2(sessionDir, { recursive: true });
-  const logPath = path7.join(sessionDir, "pses.log");
-  const sessionDetailsPath = path7.join(sessionDir, "session.json");
+  const logPath = path6.join(sessionDir, "pses.log");
+  const sessionDetailsPath = path6.join(sessionDir, "session.json");
   return [
     "-NoLogo",
     "-NoProfile",
@@ -3754,7 +4027,9 @@ function buildPsesArgs(bundleDir) {
 var PowerShellServer = {
   id: "powershell",
   idleEviction: "unmeasured",
+  role: "language",
   name: "PowerShell Editor Services",
+  executesProjectCode: true,
   extensions: KIND_EXTENSIONS["powershell"],
   // Index at the workspace (script modules reference siblings); fall back to the
   // file dir.
@@ -3771,9 +4046,11 @@ var PowerShellServer = {
 var CSharpServer = {
   id: "csharp",
   idleEviction: "unmeasured",
+  role: "language",
   // Documented (#3750): csharp-ls needs a solution or project.
   requiresProjectRoot: true,
   name: "csharp-ls",
+  executesProjectCode: true,
   extensions: KIND_EXTENSIONS["csharp"],
   // No FileDirRoot fallback (#201): csharp-ls is a workspace server and should
   // not spawn once per source directory before a .sln/.csproj exists. Glob root
@@ -3797,6 +4074,7 @@ var CSharpServer = {
 var OmniSharpServer = createInteractiveServer({
   id: "omnisharp",
   name: "OmniSharp",
+  executesProjectCode: true,
   // Documented (#3750): OmniSharp needs a solution or project.
   requiresProjectRoot: true,
   fallbackFor: "csharp",
@@ -3809,9 +4087,11 @@ var OmniSharpServer = createInteractiveServer({
 var FSharpServer = {
   id: "fsharp",
   idleEviction: "unmeasured",
+  role: "language",
   // Documented (#3750): FSAutocomplete needs a project.
   requiresProjectRoot: true,
   name: "FSAutocomplete",
+  executesProjectCode: true,
   extensions: KIND_EXTENSIONS["fsharp"],
   root: createRootDetector([...DOTNET_FSHARP_ROOT_MARKERS]),
   async spawn(root, options) {
@@ -3831,6 +4111,7 @@ var FSharpServer = {
 var JavaServer = createInteractiveServer({
   id: "java",
   name: "JDT Language Server",
+  executesProjectCode: true,
   extensions: KIND_EXTENSIONS["java"],
   root: RootWithFallback(JavaWorkspaceRoot()),
   language: "java",
@@ -3841,7 +4122,9 @@ var JavaServer = createInteractiveServer({
 var KotlinServer = {
   id: "kotlin",
   idleEviction: "unmeasured",
+  role: "language",
   name: "Kotlin Language Server",
+  executesProjectCode: true,
   extensions: KIND_EXTENSIONS["kotlin"],
   root: RootWithFallback(createRootDetector(["build.gradle.kts", "build.gradle", "pom.xml"])),
   async spawn(root, options) {
@@ -3857,9 +4140,26 @@ var KotlinServer = {
     }, options?.allowInstall);
   }
 };
+var LeanServer = createInteractiveServer({
+  id: "lean",
+  name: "Lean 4 Language Server",
+  extensions: KIND_EXTENSIONS.lean,
+  root: RootWithFallback(createRootDetector([...LEAN_ROOT_MARKERS])),
+  language: "lean",
+  // Documented (#3750): `lake serve` analyses a file only when a Lake project
+  // roots it; a root-fallback empty answer is unconfirmed, not clean.
+  requiresProjectRoot: true,
+  // `lake serve` loads and interprets the project's `lakefile.lean` and its
+  // imported build scripts, so it executes project-owned code: refuse it until
+  // the host grants project trust (#4269).
+  executesProjectCode: true,
+  command: "lake",
+  args: ["serve"]
+});
 var SwiftServer = createInteractiveServer({
   id: "swift",
   name: "SourceKit-LSP",
+  executesProjectCode: true,
   extensions: KIND_EXTENSIONS["swift"],
   root: createRootDetector(["Package.swift"]),
   language: "swift",
@@ -3867,6 +4167,7 @@ var SwiftServer = createInteractiveServer({
 });
 var DartServer = createInteractiveServer({
   id: "dart",
+  executesProjectCode: true,
   name: "Dart Analysis Server",
   extensions: KIND_EXTENSIONS["dart"],
   root: RootWithFallback(createRootDetector(["pubspec.yaml"])),
@@ -3880,6 +4181,9 @@ function createTreeBinaryServer(spec) {
     name: spec.name,
     extensions: spec.extensions,
     idleEviction: spec.idleEviction ?? "unmeasured",
+    // The spec declares no role, so the factory applies the stated default
+    // (#1488) — see `createInteractiveServer`.
+    role: DEFAULT_LSP_SERVER_ROLE,
     root: spec.root,
     spawn(root, options) {
       return resolveAndLaunchTreeBinary({
@@ -3917,7 +4221,9 @@ var CppServer = createTreeBinaryServer({
 });
 var ZigServer = {
   id: "zig",
+  executesProjectCode: true,
   idleEviction: "unmeasured",
+  role: "language",
   name: "ZLS",
   extensions: KIND_EXTENSIONS["zig"],
   root: RootWithFallback(createRootDetector(["build.zig"])),
@@ -3933,6 +4239,7 @@ var ZigServer = {
 var HaskellServer = createInteractiveServer({
   id: "haskell",
   name: "Haskell Language Server",
+  executesProjectCode: true,
   extensions: KIND_EXTENSIONS["haskell"],
   root: createRootDetector(["stack.yaml", "cabal.project", "*.cabal"]),
   language: "haskell",
@@ -3942,6 +4249,7 @@ var HaskellServer = createInteractiveServer({
 var ElixirServer = createInteractiveServer({
   id: "elixir",
   name: "ElixirLS",
+  executesProjectCode: true,
   extensions: KIND_EXTENSIONS["elixir"],
   root: RootWithFallback(createRootDetector(["mix.exs"])),
   language: "elixir",
@@ -3950,7 +4258,9 @@ var ElixirServer = createInteractiveServer({
 var ElixirExpertServer = {
   id: "expert",
   idleEviction: "unmeasured",
+  role: "language",
   name: "Expert",
+  executesProjectCode: true,
   fallbackFor: "elixir",
   extensions: KIND_EXTENSIONS["elixir"],
   root: RootWithFallback(createRootDetector(["mix.exs"])),
@@ -3968,6 +4278,7 @@ var ElixirExpertServer = {
 var GleamServer = {
   id: "gleam",
   idleEviction: "unmeasured",
+  role: "language",
   name: "Gleam LSP",
   extensions: KIND_EXTENSIONS["gleam"],
   root: RootWithFallback(createRootDetector(["gleam.toml"])),
@@ -3982,7 +4293,9 @@ var GleamServer = {
 };
 var TinymistServer = {
   id: "tinymist",
+  executesProjectCode: true,
   idleEviction: "unmeasured",
+  role: "language",
   name: "Tinymist",
   extensions: extensionsForLanguage("typst"),
   root: RootWithFallback(createRootDetector(["typst.toml", ".git"])),
@@ -3999,6 +4312,7 @@ var TinymistServer = {
 var MarksmanServer = {
   id: "marksman",
   idleEviction: "transparent",
+  role: "language",
   name: "Marksman",
   extensions: KIND_EXTENSIONS["markdown"],
   // Index at the workspace root so cross-file checks (broken intra-repo links,
@@ -4016,6 +4330,7 @@ var MarksmanServer = {
 };
 var OCamlServer = createInteractiveServer({
   id: "ocaml",
+  executesProjectCode: true,
   name: "ocamllsp",
   extensions: KIND_EXTENSIONS["ocaml"],
   root: createRootDetector(["dune-project", "opam"]),
@@ -4024,7 +4339,9 @@ var OCamlServer = createInteractiveServer({
 });
 var ClojureServer = {
   id: "clojure",
+  executesProjectCode: true,
   idleEviction: "transparent",
+  role: "language",
   name: "Clojure LSP",
   extensions: KIND_EXTENSIONS["clojure"],
   root: createRootDetector(["deps.edn", "project.clj"]),
@@ -4040,6 +4357,7 @@ var ClojureServer = {
 var CueServer = {
   id: "cue",
   idleEviction: "unmeasured",
+  role: "language",
   name: "CUE Language Server",
   extensions: KIND_EXTENSIONS["cue"],
   root: RootWithFallback(createRootDetector(["cue.mod", ".git"])),
@@ -4054,7 +4372,9 @@ var CueServer = {
 };
 var TerraformServer = {
   id: "terraform",
+  executesProjectCode: true,
   idleEviction: "unmeasured",
+  role: "language",
   name: "Terraform LSP",
   extensions: KIND_EXTENSIONS["terraform"],
   root: RootWithFallback(createRootDetector([".terraform.lock.hcl", ".terraform"])),
@@ -4069,6 +4389,7 @@ var TerraformServer = {
 };
 var NixServer = createInteractiveServer({
   id: "nix",
+  executesProjectCode: true,
   name: "nixd",
   extensions: KIND_EXTENSIONS["nix"],
   root: createRootDetector(["flake.nix"]),
@@ -4078,6 +4399,7 @@ var NixServer = createInteractiveServer({
 var BashServer = {
   id: "bash",
   idleEviction: "transparent",
+  role: "language",
   name: "Bash Language Server",
   // #3968: narrowed from [".bash", ".sh", ".zsh"] — bash-language-server does
   // not support zsh (its own analyzer refuses the dialect), and its ≥5.7.0
@@ -4121,6 +4443,7 @@ var ShuckServer = createInteractiveServer({
 var FishServer = {
   id: "fish",
   idleEviction: "transparent",
+  role: "language",
   name: "Fish Language Server",
   extensions: KIND_EXTENSIONS["fish"],
   root: RootWithFallback(createRootDetector([".git"])),
@@ -4135,7 +4458,9 @@ var FishServer = {
 };
 var CMakeServer = {
   id: "cmake",
+  executesProjectCode: true,
   idleEviction: "unmeasured",
+  role: "language",
   name: "CMake Language Server",
   // CMake's canonical project file has no .cmake suffix. The configured-server
   // matcher supports exact basenames as well as extensions.
@@ -4152,7 +4477,8 @@ var CMakeServer = {
 };
 var DockerServer = {
   id: "docker",
-  idleEviction: "unmeasured",
+  idleEviction: "transparent",
+  role: "language",
   name: "Dockerfile Language Server",
   extensions: [".dockerfile", "Dockerfile"],
   root: RootWithFallback(PriorityRoot([
@@ -4176,6 +4502,7 @@ var DockerServer = {
 var DockerOfficialServer = {
   id: "docker-official",
   idleEviction: "unmeasured",
+  role: "language",
   name: "Docker Language Server (official)",
   fallbackFor: "docker",
   extensions: [".dockerfile", "Dockerfile"],
@@ -4199,6 +4526,7 @@ var DockerOfficialServer = {
 var YamlServer = {
   id: "yaml",
   idleEviction: "transparent",
+  role: "language",
   name: "YAML Language Server",
   extensions: KIND_EXTENSIONS["yaml"],
   root: RootWithFallback(PriorityRoot([
@@ -4216,7 +4544,8 @@ var YamlServer = {
 };
 var JsonServer = {
   id: "json",
-  idleEviction: "unmeasured",
+  idleEviction: "transparent",
+  role: "language",
   name: "VSCode JSON Language Server",
   extensions: KIND_EXTENSIONS["json"],
   root: RootWithFallback(WorkspacePriorityRoot([
@@ -4242,6 +4571,7 @@ var JsonServer = {
 var HtmlServer = {
   id: "html",
   idleEviction: "transparent",
+  role: "language",
   name: "VSCode HTML Language Server",
   extensions: KIND_EXTENSIONS["html"],
   root: RootWithFallback(IgnoreHomeRoot(PriorityRoot([["package.json", "index.html", "vite.config.ts"]]))),
@@ -4257,6 +4587,7 @@ var HtmlServer = {
 var TomlServer = {
   id: "toml",
   idleEviction: "unmeasured",
+  role: "language",
   name: "Taplo",
   extensions: KIND_EXTENSIONS["toml"],
   root: RootWithFallback(PriorityRoot([["pyproject.toml", "Cargo.toml", "taplo.toml"], [".git"]])),
@@ -4272,6 +4603,7 @@ var TomlServer = {
 var PrismaServer = {
   id: "prisma",
   idleEviction: "transparent",
+  role: "language",
   name: "Prisma Language Server",
   extensions: KIND_EXTENSIONS["prisma"],
   root: RootWithFallback(createRootDetector(["prisma/schema.prisma", "schema.prisma"])),
@@ -4297,7 +4629,9 @@ var PrismaServer = {
 };
 var VueServer = {
   id: "vue",
+  executesProjectCode: true,
   idleEviction: "unmeasured",
+  role: "language",
   name: "Vue Language Server",
   extensions: [".vue"],
   root: RootWithFallback(IgnoreHomeRoot(createRootDetector([
@@ -4318,9 +4652,9 @@ var VueServer = {
   clientWaitTimeoutMs: 3e4,
   initializeTimeoutMs: 3e4,
   async spawn(root, options) {
-    const tsserverPath = await findTsserverPath(root, options?.allowInstall);
-    const hasPackageJson = existsSync3(path7.join(root, "package.json"));
-    const hasNodeModules = existsSync3(path7.join(root, "node_modules"));
+    const tsserverPath = await findTsserverPath(root, options?.allowInstall, options);
+    const hasPackageJson = existsSync3(path6.join(root, "package.json"));
+    const hasNodeModules = existsSync3(path6.join(root, "node_modules"));
     if (hasPackageJson && !hasNodeModules) {
       logSessionStart(`lsp vue: node_modules missing in ${root} \u2014 Vue navigation may be limited. Run: npm install (or pnpm/yarn install) in this project.`);
     }
@@ -4335,13 +4669,15 @@ var VueServer = {
     return {
       process: proc.process,
       source: proc.source,
-      initialization: tsserverPath ? { typescript: { tsdk: path7.dirname(tsserverPath) } } : void 0
+      initialization: tsserverPath ? { typescript: { tsdk: path6.dirname(tsserverPath) } } : void 0
     };
   }
 };
 var SvelteServer = {
   id: "svelte",
+  executesProjectCode: true,
   idleEviction: "unmeasured",
+  role: "language",
   name: "Svelte Language Server",
   extensions: [".svelte"],
   root: RootWithFallback(IgnoreHomeRoot(createRootDetector([
@@ -4360,7 +4696,7 @@ var SvelteServer = {
   clientWaitTimeoutMs: 2e4,
   initializeTimeoutMs: 2e4,
   async spawn(root, options) {
-    const tsserverPath = await findTsserverPath(root, options?.allowInstall);
+    const tsserverPath = await findTsserverPath(root, options?.allowInstall, options);
     const proc = await resolveAndLaunch({
       candidates: [
         ...nodeBinCandidates(root, "svelteserver"),
@@ -4375,13 +4711,14 @@ var SvelteServer = {
     return {
       process: proc.process,
       source: proc.source,
-      initialization: tsserverPath ? { typescript: { tsdk: path7.dirname(tsserverPath) } } : void 0
+      initialization: tsserverPath ? { typescript: { tsdk: path6.dirname(tsserverPath) } } : void 0
     };
   }
 };
 var CssServer = {
   id: "css",
   idleEviction: "transparent",
+  role: "language",
   name: "CSS Language Server",
   extensions: KIND_EXTENSIONS["css"],
   root: RootWithFallback(IgnoreHomeRoot(PriorityRoot([
@@ -4439,8 +4776,8 @@ function opengrepInitialization(root) {
 var OpengrepServer = {
   id: "opengrep",
   idleEviction: "transparent",
-  name: "Opengrep Security Scanner",
   role: "auxiliary",
+  name: "Opengrep Security Scanner",
   extensions: OPENGREP_EXTENSIONS,
   // Stable per-repo root so ONE warm server serves the whole project (a
   // per-directory root would spawn a fresh server — and re-pay rule load —
@@ -4489,8 +4826,8 @@ var AST_GREP_EXTENSIONS = Array.from(new Set(AST_GREP_KINDS.flatMap((k) => KIND_
 var AstGrepServer = {
   id: "ast-grep",
   idleEviction: "unmeasured",
-  name: "ast-grep structural linter",
   role: "auxiliary",
+  name: "ast-grep structural linter",
   extensions: AST_GREP_EXTENSIONS,
   // Attaches everywhere (#239 Phase 2): prefer a project `sgconfig.y[a]ml` root,
   // else the repo root (.git) or cwd — like Opengrep. When there's no project
@@ -4506,6 +4843,13 @@ var AstGrepServer = {
   // the whole file on every didOpen, so it absorbs a sweep more slowly than the
   // other scanners — hold it to half the shared default.
   notifyInflightLimit: 4,
+  // #1722, measured against the real binary over 30 repository files rather
+  // than assumed: ast-grep-lsp is tower-lsp-server and drains its message
+  // stream in order on one task, so the notify barrier's round-trip proves
+  // the backlog was scanned. Declared here because the barrier's soundness
+  // rests on it (#1756 stage 1); the evidence table is on
+  // `LspReplyOrdering`.
+  replyOrdering: "single-task-ordered",
   // First scan of a session compiles the rules.
   initializeTimeoutMs: 15e3,
   async spawn(root, options) {
@@ -4531,8 +4875,8 @@ var ZIZMOR_EXTENSIONS = KIND_EXTENSIONS["yaml"];
 var ZizmorServer = {
   id: "zizmor",
   idleEviction: "unmeasured",
-  name: "zizmor Actions Security Scanner",
   role: "auxiliary",
+  name: "zizmor Actions Security Scanner",
   extensions: ZIZMOR_EXTENSIONS,
   pathFilter: isZizmorAuditTarget,
   // Stable per-repo root so ONE warm server serves the whole project (like
@@ -4579,8 +4923,8 @@ function typosInitialization(root) {
 var TyposServer = {
   id: "typos",
   idleEviction: "unmeasured",
-  name: "typos Spell Checker",
   role: "auxiliary",
+  name: "typos Spell Checker",
   extensions: TYPOS_EXTENSIONS,
   // Stable per-repo root so ONE warm server serves the whole project (like the
   // other auxiliaries) — typos.toml discovery is repo-relative.
@@ -4618,6 +4962,7 @@ var LSP_SERVERS = [
   FSharpServer,
   JavaServer,
   KotlinServer,
+  LeanServer,
   SwiftServer,
   DartServer,
   LuaServer,
@@ -4656,11 +5001,67 @@ var LSP_SERVERS = [
   ZizmorServer,
   TyposServer
 ];
+function getServerById(id) {
+  return LSP_SERVERS.find((server) => server.id === id);
+}
+
+// dist/clients/lsp/session-roots.js
+import path7 from "node:path";
+var SESSION_ROOT_CAP = 128;
+var sessionRoots = new BoundedFifoMap(SESSION_ROOT_CAP);
+function noteEvictedRoots(evicted) {
+  const roots = evicted.map(([root]) => root);
+  if (roots.length > 0) {
+    incrementDegradationCount({
+      kind: "lsp-session-root-evicted",
+      subject: `cap=${SESSION_ROOT_CAP}`,
+      reason: `session root registry at capacity; will load the dropped root again on the next session start or tool call naming it (dropped: ${roots[0]})`
+    });
+  }
+  return roots;
+}
+function registerSessionRoot(cwd) {
+  const root = path7.resolve(cwd);
+  if (sessionRoots.has(root))
+    return [];
+  return noteEvictedRoots(sessionRoots.set(root, void 0));
+}
+function setSessionRootConfig(cwd, config) {
+  return noteEvictedRoots(sessionRoots.set(path7.resolve(cwd), config));
+}
+function sessionRootConfigEntries() {
+  return sessionRoots;
+}
+function isSessionRootRegistered(cwd) {
+  return sessionRoots.has(path7.resolve(cwd));
+}
+function shouldInitializeSessionRoot(cwd, readyRoots) {
+  const normalized = path7.resolve(cwd);
+  return !readyRoots.has(normalized) || !isSessionRootRegistered(normalized);
+}
+function isOutsideAllSessionRoots(filePath) {
+  if (sessionRoots.size === 0)
+    return false;
+  const resolved = path7.resolve(filePath);
+  for (const root of sessionRoots.keys()) {
+    if (isSameOrWithin(root, resolved))
+      return false;
+  }
+  return true;
+}
+function getSessionRootsForTelemetry(limit = 4) {
+  return [...sessionRoots.keys()].sort((a, b) => Number(a > b) - Number(a < b)).slice(0, limit);
+}
 
 export {
   findLocalTyposConfig,
   getAstGrepRuleSources,
+  getAstGrepRuleFingerprint,
+  isAuxiliary,
+  serverTraits,
   registerRunnerId,
+  withLspProjectCodePermission,
+  refuseUntrustedLspExecution,
   BUILTIN_SERVER_RUNNER_COVERS,
   describeRootFallback,
   resolveLspServerCwd,
@@ -4673,6 +5074,7 @@ export {
   isDirectLspCommandTemporarilyUnavailable,
   resetClassicTsRepairGuard,
   LSP_SERVERS,
+  getServerById,
   shouldInitializeSessionRoot,
   isOutsideAllSessionRoots,
   getSessionRootsForTelemetry,