pi-lens 4.4.1 → 4.4.3

package/dist/{chunk-IQZXOZ7S.js → chunk-EU63SDCG.js}

@@ -1,18 +1,22 @@
 import { createRequire as __pilensCreateRequire } from "node:module"; const require = __pilensCreateRequire(import.meta.url);
+import {
+  resolveOpengrepConfig
+} from "./chunk-VWCXW2E7.js";
 import {
   augmentPythonEnvironment,
   detectPythonEnvironment,
   detectPythonVenv,
   pythonEnvironmentToolCandidates
-} from "./chunk-LNOMA3MP.js";
+} from "./chunk-FCSOVF55.js";
 import {
-  resolveOpengrepConfig
-} from "./chunk-U52SAGRM.js";
+  resolveGitCheckout,
+  resolveLinkedWorktreeOwner
+} from "./chunk-PNQDPDRC.js";
 import {
   extensionsForLanguage,
   getUserRuleRoot,
   ruleCorpusFingerprintForCycle
-} from "./chunk-KJCWXUUS.js";
+} from "./chunk-724UL2TJ.js";
 import {
   load,
   resolvePackagePath
@@ -22,11 +26,11 @@ import {
   readCargoWorkspaceExclude,
   readCargoWorkspaceMembers,
   readTextFileOrUndefined
-} from "./chunk-S6AMWKPC.js";
+} from "./chunk-P7266HLM.js";
 import {
   HOOK_WALL_BUDGET_MS,
   bounded
-} from "./chunk-F5VLZHUW.js";
+} from "./chunk-52FUZI6K.js";
 import {
   ensureTool,
   findManagedToolBinary,
@@ -36,20 +40,21 @@ import {
   isZizmorAuditTarget,
   logSessionStart,
   resolveZizmorGitHubToken
-} from "./chunk-LD7WFTRX.js";
+} from "./chunk-ACXEQZOU.js";
 import {
   resolveToolCwd
-} from "./chunk-IUR76K6A.js";
+} from "./chunk-Q7DUK4LX.js";
 import {
-  findGlobalBinary
-} from "./chunk-T4QZ6FEH.js";
+  findGlobalBinary,
+  isProjectLocalBinPath
+} from "./chunk-AW7R2GWG.js";
 import {
   classifyProbeFailure,
   createAvailabilityLatch,
   describeInstallAttempt,
   logAvailabilityDecision,
   startHostStallSampler
-} from "./chunk-O7HZX7CA.js";
+} from "./chunk-VRZP76YM.js";
 import {
   OWNER_TAG_ENV,
   SpawnFailureError,
@@ -62,22 +67,27 @@ import {
   holdOwnChildPid,
   isCommandAvailableAsync,
   isPathIgnoredByProject,
+  isPiLensInternalPath,
   ownerTagForChildren,
+  resolveWindowsCommandForEnvironment,
   safeSpawnAsync
-} from "./chunk-T54VJRAD.js";
+} from "./chunk-C34ZXZ7O.js";
 import {
   DOTNET_CSHARP_ROOT_MARKERS,
   DOTNET_FSHARP_ROOT_MARKERS,
-  KIND_EXTENSIONS
-} from "./chunk-64LU2OVH.js";
+  KIND_EXTENSIONS,
+  LEAN_ROOT_MARKERS
+} from "./chunk-PHDMFAKM.js";
 import {
+  isRepoTier,
   lspSectionOf,
   migrationSubject,
+  provenanceFor,
   reportConfigReadFailure,
   reportPiLensConfigRecords,
   resolvePiLensConfig,
   summarizeConfigResolution
-} from "./chunk-N2IRDBZI.js";
+} from "./chunk-2BBLFX75.js";
 import {
   FRESHNESS_CADENCE_MS,
   LSP_NAMESPACE_KEY,
@@ -85,23 +95,30 @@ import {
   dirMtimesStillFreshAsync,
   getPiLensGlobalConfigPath,
   unknownDirMtimeRecords
-} from "./chunk-Z6BB4JLQ.js";
+} from "./chunk-XVF2VVXP.js";
 import {
+  getProjectTrustState
+} from "./chunk-ZANLILYD.js";
+import {
+  getDegradationLedgerGeneration,
   incrementDegradationCount,
   recordDegradationOnce
-} from "./chunk-7ELY2CSM.js";
+} from "./chunk-JAU72XNY.js";
+import {
+  logExtension
+} from "./chunk-XTMJ7XDT.js";
 import {
   claimPhaseOncePerSession,
   currentSessionRecordId,
   logLatency,
   releasePhaseClaim
-} from "./chunk-3PNFWVHT.js";
+} from "./chunk-QQNQ7SJW.js";
 import {
   getGlobalPiLensLogDir,
   getProcessSingleton,
   isTestMode,
   redactSecrets
-} from "./chunk-VSMJK3ZJ.js";
+} from "./chunk-AOHZU2BM.js";
 import {
   STAGE_TMP_PATTERN
 } from "./chunk-LJDODBBZ.js";
@@ -115,6 +132,8 @@ import {
   findLocalToolConfig,
   isAtOrAboveHomeDir,
   isFullyQualified,
+  isUnderDir,
+  isVendorPath,
   isWindowsPath,
   matchesWorkspaceMemberPattern,
   normalizeEphemeralMapKey,
@@ -122,56 +141,120 @@ import {
   normalizeMapKey,
   pathsEqual,
   toPosix
-} from "./chunk-G3RLJYA2.js";
+} from "./chunk-N2H3ZPZY.js";
 import {
   __require
 } from "./chunk-NXL4FFQQ.js";
 
-// dist/clients/lsp/server-traits.js
-var ROLE_MEMBERS = {
-  language: "language",
-  auxiliary: "auxiliary"
-};
-var DEFAULT_LSP_SERVER_ROLE = "language";
-function isAuxiliary(bearer) {
-  const declared = bearer?.role;
-  const role = typeof declared === "string" && Object.hasOwn(ROLE_MEMBERS, declared) ? ROLE_MEMBERS[declared] : DEFAULT_LSP_SERVER_ROLE;
-  switch (role) {
-    case "auxiliary":
-      return true;
-    case "language":
+// dist/clients/analysis-root.js
+import * as fs from "node:fs";
+import * as os from "node:os";
+import * as nodePath from "node:path";
+var PROJECT_MARKERS = [
+  ".git",
+  "package.json",
+  "pyproject.toml",
+  "Cargo.toml",
+  "go.mod",
+  "pom.xml",
+  "build.gradle",
+  "Gemfile",
+  "mix.exs",
+  "composer.json"
+];
+function hasProjectMarker(dir) {
+  return PROJECT_MARKERS.some((marker) => {
+    try {
+      const stat2 = fs.statSync(nodePath.join(dir, marker));
+      return stat2.isFile() || marker === ".git";
+    } catch {
       return false;
+    }
+  });
+}
+function nearestProjectRoot(filePath) {
+  let dir = nodePath.dirname(nodePath.resolve(filePath));
+  const filesystemRoot = nodePath.parse(dir).root;
+  while (dir !== filesystemRoot) {
+    if (hasProjectMarker(dir))
+      return dir;
+    dir = nodePath.dirname(dir);
   }
+  return hasProjectMarker(filesystemRoot) ? filesystemRoot : void 0;
 }
-var DEFAULT_NOTIFY_INFLIGHT_LIMIT = 8;
-var DEFAULT_REPLY_ORDERING = "unmeasured";
-function serverTraits(declaration) {
-  const declaredLimit = declaration.notifyInflightLimit;
-  if (typeof declaredLimit === "number" && Number.isFinite(declaredLimit) && declaredLimit > 0) {
-    return {
-      role: declaration.role,
-      notifyInflightLimit: Math.floor(declaredLimit),
-      replyOrdering: declaration.replyOrdering ?? DEFAULT_REPLY_ORDERING
-    };
+function realPathOrResolved(filePath) {
+  const resolved = nodePath.resolve(filePath);
+  let current = resolved;
+  const missing = [];
+  while (true) {
+    try {
+      const real = fs.realpathSync.native(current);
+      return nodePath.join(real, ...missing.reverse());
+    } catch {
+      const parent = nodePath.dirname(current);
+      if (parent === current)
+        return resolved;
+      missing.push(nodePath.basename(current));
+      current = parent;
+    }
   }
-  const envLimit = Number(process.env.PI_LENS_LSP_AUX_NOTIFY_INFLIGHT);
-  return {
-    role: declaration.role,
-    notifyInflightLimit: Number.isFinite(envLimit) && envLimit > 0 ? Math.floor(envLimit) : DEFAULT_NOTIFY_INFLIGHT_LIMIT,
-    replyOrdering: declaration.replyOrdering ?? DEFAULT_REPLY_ORDERING
-  };
+}
+function resolveAnalysisRootPath(filePath, sessionRoot, homeDirOverride) {
+  const resolved = realPathOrResolved(filePath);
+  const session = realPathOrResolved(sessionRoot);
+  const tmp = realPathOrResolved(os.tmpdir());
+  const data = process.env.PI_LENS_HOME ? realPathOrResolved(process.env.PI_LENS_HOME) : void 0;
+  if (isVendorPath(resolved))
+    return void 0;
+  if (resolved === tmp || resolved === session || isUnderDir(session, resolved) || !isUnderDir(resolved, session) && (isPiLensInternalPath(resolved, session) || data !== void 0 && (resolved === data || isUnderDir(resolved, data))))
+    return void 0;
+  if (isUnderDir(resolved, session))
+    return session;
+  const checkout = resolveGitCheckout(session);
+  const linked = checkout && resolveLinkedWorktreeOwner(checkout, resolved);
+  if (linked && !isVendorPath(resolved))
+    return linked.root;
+  const candidate = nearestProjectRoot(resolved);
+  if (!candidate || candidate === nodePath.parse(candidate).root)
+    return void 0;
+  const home = realPathOrResolved(homeDirOverride ?? os.homedir());
+  if (isAtOrAboveHomeDir(candidate, home))
+    return void 0;
+  if (candidate === tmp || isUnderDir(session, candidate))
+    return void 0;
+  if (isVendorPath(candidate))
+    return void 0;
+  return candidate;
+}
+function resolveAnalysisRoot(filePath, sessionRoot, homeDirOverride) {
+  const resolved = realPathOrResolved(filePath);
+  if (isVendorPath(resolved))
+    return "none";
+  const checkout = resolveGitCheckout(sessionRoot);
+  if (checkout && resolveLinkedWorktreeOwner(checkout, resolved)) {
+    return "linked-worktree";
+  }
+  const root = resolveAnalysisRootPath(filePath, sessionRoot, homeDirOverride);
+  if (!root)
+    return "none";
+  if (root === nodePath.resolve(sessionRoot))
+    return "session";
+  return "adopted";
+}
+function canWriteAnalysisRoot(mode) {
+  return mode === "session" || mode === "linked-worktree";
 }
 
 // dist/clients/lsp/server.js
-import { existsSync as existsSync3, mkdirSync as mkdirSync2, statSync as statSync3 } from "node:fs";
+import { existsSync as existsSync3, mkdirSync as mkdirSync2, statSync as statSync4 } from "node:fs";
 import { access, readFile, readdir, stat } from "node:fs/promises";
-import os6 from "node:os";
-import path7 from "node:path";
+import os7 from "node:os";
+import path6 from "node:path";
 
 // dist/clients/sgconfig.js
 import { createHash } from "node:crypto";
-import * as fs from "node:fs";
-import * as os from "node:os";
+import * as fs2 from "node:fs";
+import * as os2 from "node:os";
 import * as path from "node:path";
 var SGCONFIG_NAMES = ["sgconfig.yml", "sgconfig.yaml"];
 function findLocalSgconfig(startDir) {
@@ -179,7 +262,7 @@ function findLocalSgconfig(startDir) {
 }
 function canonicalDir(dir) {
   try {
-    return fs.realpathSync.native(dir);
+    return fs2.realpathSync.native(dir);
   } catch {
     return path.resolve(dir);
   }
@@ -222,7 +305,7 @@ function getAstGrepRuleSources(projectRoot = process.cwd()) {
   });
   const seen = /* @__PURE__ */ new Set();
   return candidates.filter((source) => {
-    if (!fs.existsSync(source.dir))
+    if (!fs2.existsSync(source.dir))
       return false;
     const key = canonicalDir(source.dir);
     if (seen.has(key))
@@ -235,7 +318,7 @@ function findYamlFiles(dir) {
   const files = [];
   let entries;
   try {
-    entries = fs.readdirSync(dir, { withFileTypes: true }).sort((a, b) => a.name.localeCompare(b.name));
+    entries = fs2.readdirSync(dir, { withFileTypes: true }).sort((a, b) => a.name.localeCompare(b.name));
   } catch {
     return files;
   }
@@ -287,7 +370,7 @@ function snapshotRuleSource(source) {
     hash.update("\0");
     let content;
     try {
-      content = fs.readFileSync(file, "utf8");
+      content = fs2.readFileSync(file, "utf8");
     } catch {
       hash.update("missing");
       hash.update("\0");
@@ -329,8 +412,8 @@ function getAstGrepRuleFingerprint(projectRoot = process.cwd(), options = {}) {
   return ruleCorpusFingerprintForCycle("ast-grep", root, (fingerprintRoot) => sourceFingerprint(getAstGrepRuleSources(fingerprintRoot).map(snapshotRuleSource)), options.force);
 }
 function materializeMergedRuleDir(sources, mergedDir) {
-  fs.rmSync(mergedDir, { recursive: true, force: true });
-  fs.mkdirSync(mergedDir, { recursive: true });
+  fs2.rmSync(mergedDir, { recursive: true, force: true });
+  fs2.mkdirSync(mergedDir, { recursive: true });
   const claimedByEarlierSource = /* @__PURE__ */ new Set();
   for (const [sourceIndex, source] of sources.entries()) {
     const claimedThisSource = /* @__PURE__ */ new Set();
@@ -347,9 +430,9 @@ function materializeMergedRuleDir(sources, mergedDir) {
         continue;
       const destination = path.join(mergedDir, `source${sourceIndex}-${String(fileIndex).padStart(5, "0")}.yml`);
       if (survivingDocuments.length === file.documents.length) {
-        fs.copyFileSync(file.file, destination);
+        fs2.copyFileSync(file.file, destination);
       } else {
-        fs.writeFileSync(destination, `${survivingDocuments.map((document) => document.raw.trim()).join("\n---\n")}
+        fs2.writeFileSync(destination, `${survivingDocuments.map((document) => document.raw.trim()).join("\n---\n")}
 `);
       }
     }
@@ -365,14 +448,14 @@ function resolveBaselineSgconfig(projectRoot = process.cwd()) {
   const root = canonicalDir(path.resolve(projectRoot || process.cwd()));
   const fingerprint = getAstGrepRuleFingerprint(root, { force: true });
   const cached = cachedBaselines.get(root);
-  if (cached?.fingerprint === fingerprint && fs.existsSync(cached.path) && fs.existsSync(cached.mergedDir)) {
+  if (cached?.fingerprint === fingerprint && fs2.existsSync(cached.path) && fs2.existsSync(cached.mergedDir)) {
     return cached.path;
   }
   const sources = getAstGrepRuleSources(root).map(snapshotRuleSource);
   if (sources.length === 0)
     return void 0;
-  const dir = path.join(os.tmpdir(), "pi-lens-ast-grep");
-  fs.mkdirSync(dir, { recursive: true });
+  const dir = path.join(os2.tmpdir(), "pi-lens-ast-grep");
+  fs2.mkdirSync(dir, { recursive: true });
   const artifactKey = rootArtifactKey(root);
   const file = path.join(dir, `baseline-${process.pid}-${artifactKey}.sgconfig.yml`);
   const mergedDir = path.join(dir, `baseline-${process.pid}-${artifactKey}.rules`);
@@ -384,7 +467,7 @@ function resolveBaselineSgconfig(projectRoot = process.cwd()) {
   cleanupStaleBaselines(dir, protectedArtifacts);
   materializeMergedRuleDir(sources, mergedDir);
   const ruleDirForYaml = mergedDir.split(path.sep).join("/");
-  fs.writeFileSync(file, `ruleDirs:
+  fs2.writeFileSync(file, `ruleDirs:
   - ${JSON.stringify(ruleDirForYaml)}
 `);
   cachedBaselines.set(root, { fingerprint, path: file, mergedDir });
@@ -395,7 +478,7 @@ var SG_BASELINE_RETAINED_ENTRIES = 24;
 function enforceBaselineEntryCap(dir, keep) {
   let names;
   try {
-    names = fs.readdirSync(dir);
+    names = fs2.readdirSync(dir);
   } catch {
     return;
   }
@@ -411,7 +494,7 @@ function enforceBaselineEntryCap(dir, keep) {
     try {
       candidates.push({
         full,
-        mtimeMs: fs.statSync(full).mtimeMs,
+        mtimeMs: fs2.statSync(full).mtimeMs,
         recursive: isMergedDir
       });
     } catch {
@@ -424,7 +507,7 @@ function enforceBaselineEntryCap(dir, keep) {
   let evicted = 0;
   for (const candidate of candidates.slice(0, over)) {
     try {
-      fs.rmSync(candidate.full, {
+      fs2.rmSync(candidate.full, {
         recursive: candidate.recursive,
         force: true
       });
@@ -448,7 +531,7 @@ function enforceBaselineEntryCap(dir, keep) {
 function cleanupStaleBaselines(dir, keep) {
   try {
     const cutoff = Date.now() - 7 * 24 * 60 * 60 * 1e3;
-    for (const name of fs.readdirSync(dir)) {
+    for (const name of fs2.readdirSync(dir)) {
       const isConfig = /^baseline(?:-\d+(?:-[a-f0-9]+)?)?\.sgconfig\.yml$/.test(name);
       const isMergedDir = /^baseline-\d+(?:-[a-f0-9]+)?\.rules$/.test(name);
       if (!isConfig && !isMergedDir)
@@ -457,9 +540,9 @@ function cleanupStaleBaselines(dir, keep) {
       if (keep.has(full))
         continue;
       try {
-        const stat2 = fs.statSync(full);
+        const stat2 = fs2.statSync(full);
         if (stat2.mtimeMs < cutoff) {
-          fs.rmSync(full, { recursive: stat2.isDirectory(), force: true });
+          fs2.rmSync(full, { recursive: stat2.isDirectory(), force: true });
         }
       } catch {
       }
@@ -478,9 +561,44 @@ function findLocalTyposConfig(startDir) {
   return findLocalToolConfig(startDir, LOCAL_TYPOS_CONFIG_NAMES);
 }
 
+// dist/clients/lsp/server-traits.js
+var ROLE_MEMBERS = {
+  language: "language",
+  auxiliary: "auxiliary"
+};
+var DEFAULT_LSP_SERVER_ROLE = "language";
+function isAuxiliary(bearer) {
+  const declared = bearer?.role;
+  const role = typeof declared === "string" && Object.hasOwn(ROLE_MEMBERS, declared) ? ROLE_MEMBERS[declared] : DEFAULT_LSP_SERVER_ROLE;
+  switch (role) {
+    case "auxiliary":
+      return true;
+    case "language":
+      return false;
+  }
+}
+var DEFAULT_NOTIFY_INFLIGHT_LIMIT = 8;
+var DEFAULT_REPLY_ORDERING = "unmeasured";
+function serverTraits(declaration) {
+  const declaredLimit = declaration.notifyInflightLimit;
+  if (typeof declaredLimit === "number" && Number.isFinite(declaredLimit) && declaredLimit > 0) {
+    return {
+      role: declaration.role,
+      notifyInflightLimit: Math.floor(declaredLimit),
+      replyOrdering: declaration.replyOrdering ?? DEFAULT_REPLY_ORDERING
+    };
+  }
+  const envLimit = Number(process.env.PI_LENS_LSP_AUX_NOTIFY_INFLIGHT);
+  return {
+    role: declaration.role,
+    notifyInflightLimit: Number.isFinite(envLimit) && envLimit > 0 ? Math.floor(envLimit) : DEFAULT_NOTIFY_INFLIGHT_LIMIT,
+    replyOrdering: declaration.replyOrdering ?? DEFAULT_REPLY_ORDERING
+  };
+}
+
 // dist/clients/lsp/config.js
-import * as os3 from "node:os";
-import path4 from "node:path";
+import * as os4 from "node:os";
+import path3 from "node:path";
 
 // dist/clients/dispatch/known-runner-ids.js
 var knownRunnerIds = /* @__PURE__ */ new Set();
@@ -495,13 +613,14 @@ function isKnownRunnerId(id) {
 }
 
 // dist/clients/lsp/launch.js
+import { AsyncLocalStorage } from "node:async_hooks";
 import { execFileSync, spawn as nodeSpawn } from "node:child_process";
-import fs3 from "node:fs";
-import os2 from "node:os";
+import fs4 from "node:fs";
+import os3 from "node:os";
 import path2 from "node:path";
 
 // dist/clients/lsp/ruby-drive-dirs.js
-import * as fs2 from "node:fs";
+import * as fs3 from "node:fs";
 var RUBY_VERSION_DIR = /^ruby\d/i;
 var rubyDirNamesCache = new BoundedLruCache(16);
 function rubyDriveKey(driveRoot) {
@@ -517,7 +636,7 @@ function getRubyVersionDirNamesSync(driveRoot) {
     return cached;
   let names;
   try {
-    names = filterRubyDirNames(fs2.readdirSync(driveRoot));
+    names = filterRubyDirNames(fs3.readdirSync(driveRoot));
   } catch {
     names = [];
   }
@@ -531,7 +650,7 @@ async function getRubyVersionDirNamesAsync(driveRoot) {
     return cached;
   let names;
   try {
-    names = filterRubyDirNames(await fs2.promises.readdir(driveRoot));
+    names = filterRubyDirNames(await fs3.promises.readdir(driveRoot));
   } catch {
     names = [];
   }
@@ -558,8 +677,8 @@ function logSessionStart2(msg) {
   const line = redactSecrets(`[${(/* @__PURE__ */ new Date()).toISOString()}] ${msg}
 `);
   try {
-    fs3.mkdirSync(SESSIONSTART_LOG_DIR, { recursive: true });
-    fs3.appendFileSync(SESSIONSTART_LOG, line);
+    fs4.mkdirSync(SESSIONSTART_LOG_DIR, { recursive: true });
+    fs4.appendFileSync(SESSIONSTART_LOG, line);
   } catch {
   }
 }
@@ -640,7 +759,7 @@ async function buildAugmentedPath(basePath) {
     candidates.push(nodeDir);
   }
   if (isWindows) {
-    const home = os2.homedir();
+    const home = os3.homedir();
     const driveRoot = path2.parse(home).root;
     candidates.push(path2.join(home, ".cargo", "bin"));
     candidates.push(path2.join(home, "go", "bin"));
@@ -662,7 +781,7 @@ async function buildAugmentedPath(basePath) {
   }
   const toAppend = [];
   for (const candidate of candidates) {
-    if (!candidate || !fs3.existsSync(candidate))
+    if (!candidate || !fs4.existsSync(candidate))
       continue;
     const normalized = normalizePathEntry(candidate, process.platform);
     if (existing.has(normalized))
@@ -678,29 +797,39 @@ async function buildAugmentedPath(basePath) {
 }
 function isCmdShimValid(cmdPath) {
   try {
-    const content = fs3.readFileSync(cmdPath, "utf-8");
+    const content = fs4.readFileSync(cmdPath, "utf-8");
     const match = content.match(/"%~dp0[/\\]\.\.[/\\]((?:[\w./@-]|\\)+\.(?:mjs|cjs|js))"/i);
     if (!match)
       return true;
     const relPath = match[1].replace(/[/\\]/g, path2.sep);
     const target = path2.resolve(path2.dirname(cmdPath), "..", relPath);
-    return fs3.existsSync(target);
+    return fs4.existsSync(target);
   } catch {
     return true;
   }
 }
+function isMissingWindowsStartupCommand(command, spawnCommand, cwd, env) {
+  if (!isWindows)
+    return false;
+  if (/\.(cmd|bat)$/i.test(spawnCommand) && !isCmdShimValid(spawnCommand)) {
+    return true;
+  }
+  if (spawnCommand !== command)
+    return false;
+  return resolveWindowsCommandForEnvironment(command, cwd, env) === null;
+}
 function bypassPs1OnWindows(ps1Path, args) {
   const cmdPath = `${ps1Path.slice(0, -4)}.cmd`;
-  if (fs3.existsSync(cmdPath)) {
+  if (fs4.existsSync(cmdPath)) {
     return { command: cmdPath, args, needsShell: true };
   }
   try {
-    const content = fs3.readFileSync(ps1Path, "utf-8");
+    const content = fs4.readFileSync(ps1Path, "utf-8");
     const match = content.match(/"\$basedir[/\\]\.\.[/\\]((?:[\w./@-]|\\)+\.(?:mjs|cjs|js))"/i);
     if (match) {
       const relPath = match[1].replace(/[/\\]/g, path2.sep);
       const jsPath = path2.resolve(path2.dirname(ps1Path), "..", relPath);
-      if (fs3.existsSync(jsPath)) {
+      if (fs4.existsSync(jsPath)) {
         return {
           command: process.execPath,
           args: [jsPath, ...args],
@@ -728,7 +857,7 @@ function findBinaryOnPath(command, env) {
       timeout: 5e3
     }).split(/\r?\n/).map((line) => line.trim()).filter(Boolean);
     for (const candidate of result) {
-      if (fs3.existsSync(candidate)) {
+      if (fs4.existsSync(candidate)) {
         return candidate;
       }
     }
@@ -736,6 +865,65 @@ function findBinaryOnPath(command, env) {
   }
   return void 0;
 }
+var lspProjectCodePermission = new AsyncLocalStorage();
+function withLspProjectCodePermission(allowed, spawn) {
+  return lspProjectCodePermission.run(allowed, spawn);
+}
+var unknownProjectLocalNoticeGeneration = -1;
+function recordUntrustedLspExecution(request, trust) {
+  const generation = getDegradationLedgerGeneration();
+  const subject = request.kind === "project-code-server" ? `project-code-server:g${generation}:${request.serverId}:${request.root}` : `project-local-binary:g${generation}:${path2.basename(request.command)}`;
+  const metadata = request.kind === "project-code-server" ? {
+    field: request.kind,
+    serverId: request.serverId,
+    root: request.root,
+    trust
+  } : {
+    field: request.kind,
+    trust
+  };
+  recordDegradationOnce({
+    kind: "lsp-registry-decision",
+    subject,
+    reason: (request.kind === "project-local-binary" ? request.reason : void 0) ?? `LSP execution refused: ${request.kind} and project trust is ${trust}`,
+    metadata
+  });
+  if (unknownProjectLocalNoticeGeneration !== generation) {
+    unknownProjectLocalNoticeGeneration = generation;
+    const label = request.kind === "project-code-server" ? "project-code LSP server" : "project-local LSP binary";
+    logExtension({
+      subsystem: "lsp-registry",
+      level: "warn",
+      message: `${label} refused: mark the project trusted in pi or upgrade pi`,
+      metadata: { field: request.kind }
+    });
+  }
+}
+function refuseUntrustedLspExecution(request) {
+  const trust = getProjectTrustState();
+  const needsTrust = request.kind === "project-code-server" ? trust !== "trusted" : !admitProjectSuppliedTsserver(request.resolvedCommand, request.cwd, true);
+  if (!needsTrust)
+    return;
+  if (request.kind === "project-code-server")
+    recordUntrustedLspExecution(request, trust);
+  throw new SpawnFailureError("spawn-failed", `LSP ${request.kind === "project-code-server" ? "project-code server" : "project-local binary"} refused: project trust is ${trust}`, new Error(`project trust is ${trust}`));
+}
+function admitProjectSuppliedTsserver(tsserverPath, cwd, projectSupplied, projectCodeAllowed = lspProjectCodePermission.getStore() ?? false) {
+  const trust = getProjectTrustState();
+  if (tsserverPath && (!projectSupplied || projectCodeAllowed && trust === "trusted"))
+    return tsserverPath;
+  recordUntrustedLspExecution({
+    kind: "project-local-binary",
+    command: tsserverPath ?? "tsserver.js",
+    resolvedCommand: tsserverPath ?? "tsserver.js",
+    cwd,
+    reason: tsserverPath ? "LSP execution refused: project compiler requires trusted session ownership" : "LSP execution refused: no admitted absolute TypeScript compiler"
+  }, trust);
+  return void 0;
+}
+function isProjectLocalLspBinary(resolvedCommand, cwd) {
+  return isProjectLocalBinPath(resolvedCommand, cwd);
+}
 function trySpawn(command, args, cwd, env, needsShell) {
   let proc;
   if (needsShell) {
@@ -764,9 +952,6 @@ function trySpawn(command, args, cwd, env, needsShell) {
   if (!proc.stdin || !proc.stdout || !proc.stderr) {
     throw new Error(`Failed to spawn LSP server: ${command}`);
   }
-  if (proc.exitCode !== null || proc.killed) {
-    throw new Error(`LSP server ${command} exited immediately (code: ${proc.exitCode}). The binary may be missing or corrupted.`);
-  }
   holdOwnChildPid(proc.pid, "lsp-spawn");
   return proc;
 }
@@ -842,6 +1027,14 @@ async function launchLSP(command, args = [], options = {}) {
       needsShell = computeNeedsShell(spawnCommand);
     }
   }
+  if (isProjectLocalLspBinary(spawnCommand, cwd)) {
+    refuseUntrustedLspExecution({
+      kind: "project-local-binary",
+      command,
+      resolvedCommand: spawnCommand,
+      cwd
+    });
+  }
   if (isWindows && /\.(cmd|bat)$/i.test(spawnCommand) && !isCmdShimValid(spawnCommand)) {
     logSessionStart2(`lsp cmd-shim-invalid: ${spawnCommand} target missing \u2014 skipping candidate`);
     const cause = Object.assign(new Error(`LSP .cmd shim target not found: ${spawnCommand}`), { code: "ENOENT" });
@@ -878,7 +1071,12 @@ async function launchLSP(command, args = [], options = {}) {
     throw new Error(`Failed to spawn LSP server: ${command}`);
   }
   if (proc.exitCode !== null || proc.killed) {
-    throw new Error(`LSP server ${command} exited immediately (code: ${proc.exitCode}). The binary may be missing or corrupted.`);
+    const message = `LSP server ${command} exited immediately (code: ${proc.exitCode}). The binary may be missing or corrupted.`;
+    const failure = new Error(message);
+    if (proc.exitCode === 1 && isMissingWindowsStartupCommand(command, spawnCommand, cwd, env)) {
+      throw new SpawnFailureError("tool-not-found", message, failure);
+    }
+    throw failure;
   }
   logSessionStart2(`lsp launch: command=${command} resolved=${spawnCommand} args=${JSON.stringify(args)} cwd=${cwd} shell=${needsShell ? "true" : "false"} pid=${proc.pid ?? 0}`);
   const formatStartupStderr = (stderr) => {
@@ -895,7 +1093,7 @@ async function launchLSP(command, args = [], options = {}) {
   };
   proc.stderr?.on("data", onStartupStderr);
   try {
-    await new Promise((resolve3, reject) => {
+    await new Promise((resolve4, reject) => {
       let settled = false;
       proc.on("error", (err) => {
         if (!settled) {
@@ -911,7 +1109,13 @@ async function launchLSP(command, args = [], options = {}) {
           settled = true;
           const isWindowsCmd = isWindows && command.endsWith(".cmd");
           const errorMsg = isWindowsCmd && code === 1 ? `npm .cmd shim failed (underlying binary not installed). Run 'npm install' in this project or use a global installation.` : `The binary may be missing or corrupted.`;
-          reject(new Error(`LSP server ${command} exited immediately with code ${code}. ${errorMsg}${formatStartupStderr(startupStderr)}`));
+          const message = `LSP server ${command} exited immediately with code ${code}. ${errorMsg}${formatStartupStderr(startupStderr)}`;
+          const failure = new Error(message);
+          if (code === 1 && isMissingWindowsStartupCommand(command, spawnCommand, cwd, env)) {
+            reject(new SpawnFailureError("tool-not-found", message, failure));
+            return;
+          }
+          reject(failure);
         }
       });
       const startupFailureWindowMs = (() => {
@@ -926,7 +1130,7 @@ async function launchLSP(command, args = [], options = {}) {
       setTimeout(() => {
         if (!settled) {
           settled = true;
-          resolve3();
+          resolve4();
         }
       }, startupFailureWindowMs);
     });
@@ -951,61 +1155,13 @@ async function launchLSP(command, args = [], options = {}) {
   };
 }
 
-// dist/clients/lsp/session-roots.js
-import path3 from "node:path";
-var SESSION_ROOT_CAP = 128;
-var sessionRoots = new BoundedFifoMap(SESSION_ROOT_CAP);
-function noteEvictedRoots(evicted) {
-  const roots = evicted.map(([root]) => root);
-  if (roots.length > 0) {
-    incrementDegradationCount({
-      kind: "lsp-session-root-evicted",
-      subject: `cap=${SESSION_ROOT_CAP}`,
-      reason: `session root registry at capacity; will load the dropped root again on the next session start or tool call naming it (dropped: ${roots[0]})`
-    });
-  }
-  return roots;
-}
-function registerSessionRoot(cwd) {
-  const root = path3.resolve(cwd);
-  if (sessionRoots.has(root))
-    return [];
-  return noteEvictedRoots(sessionRoots.set(root, void 0));
-}
-function setSessionRootConfig(cwd, config) {
-  return noteEvictedRoots(sessionRoots.set(path3.resolve(cwd), config));
-}
-function sessionRootConfigEntries() {
-  return sessionRoots;
-}
-function isSessionRootRegistered(cwd) {
-  return sessionRoots.has(path3.resolve(cwd));
-}
-function shouldInitializeSessionRoot(cwd, readyRoots) {
-  const normalized = path3.resolve(cwd);
-  return !readyRoots.has(normalized) || !isSessionRootRegistered(normalized);
-}
-function isOutsideAllSessionRoots(filePath) {
-  if (sessionRoots.size === 0)
-    return false;
-  const resolved = path3.resolve(filePath);
-  for (const root of sessionRoots.keys()) {
-    if (isSameOrWithin(root, resolved))
-      return false;
-  }
-  return true;
-}
-function getSessionRootsForTelemetry(limit = 4) {
-  return [...sessionRoots.keys()].sort((a, b) => Number(a > b) - Number(a < b)).slice(0, limit);
-}
-
 // dist/clients/lsp/config.js
 function asRecord(value) {
   return value && typeof value === "object" && !Array.isArray(value) ? value : void 0;
 }
 var CONFIG_RESOLVED_PHASE = "config_resolved";
 function configResolutionKey(cwd) {
-  return normalizeFilePath(path4.resolve(normalizeFilePath(cwd)));
+  return normalizeFilePath(path3.resolve(normalizeFilePath(cwd)));
 }
 function publishConfigResolutionPending(cwd) {
   logSessionStart(`session_start config_resolution_pending session=${currentSessionRecordId()} root=${configResolutionKey(cwd)}`);
@@ -1035,7 +1191,7 @@ function recordConfigResolved(cwd, resolution, lspConfig, homeDir, resolveMs) {
   });
   logSessionStart(`config resolved documents=${summary.documents.length} legacy=${legacyDocuments} records=${summary.recordCount} deniedServers=${deniedServers} resolveMs=${resolveMs} session=${sessionId} root=${root}`);
 }
-async function loadLSPConfig(cwd, homeDir = os3.homedir(), options = {}) {
+async function loadLSPConfig(cwd, homeDir = os4.homedir(), options = {}) {
   const reporting = options.report !== false;
   publishConfigResolutionPending(cwd);
   const resolveStartedAt = Date.now();
@@ -1061,6 +1217,10 @@ async function loadLSPConfig(cwd, homeDir = os3.homedir(), options = {}) {
   });
   const coversProblems = newCoversClaimProblems();
   const config = lspConfigOf(resolution.value, coversProblems);
+  Object.defineProperty(config, "__provenance", {
+    value: resolution.provenance,
+    enumerable: false
+  });
   if (reporting) {
     reportPiLensConfigRecords([
       ...resolution.records,
@@ -1158,7 +1318,7 @@ function customServerSpecsOf(value) {
   const servers = asRecord(lspSectionOf(value).servers);
   return servers ? coversValidatedServers(servers) : {};
 }
-function lspConfigOf(value, problems) {
+function lspConfigOf(value, problems, provenance) {
   const section = lspSectionOf(value);
   const config = {};
   const servers = asRecord(section.servers);
@@ -1174,6 +1334,12 @@ function lspConfigOf(value, problems) {
   if (Array.isArray(section.warmFiles)) {
     config.warmFiles = section.warmFiles;
   }
+  if (provenance) {
+    Object.defineProperty(config, "__provenance", {
+      value: provenance,
+      enumerable: false
+    });
+  }
   return config;
 }
 function createCustomServer(config, id) {
@@ -1209,26 +1375,74 @@ function createCustomServer(config, id) {
         cwd: root,
         env: config.env ? { ...process.env, ...config.env } : process.env
       });
-      return { process: proc };
+      return {
+        process: proc,
+        ...config.initializationOptions ? { initialization: config.initializationOptions } : {}
+      };
     }
   };
 }
 var EMPTY_CONFIG = {
   customServers: [],
+  // Avoid reading LSP_SERVERS during the config/server module cycle. The
+  // selection helper falls back to the live builtin table after evaluation.
+  registeredServers: [],
   disabledServerIds: /* @__PURE__ */ new Set(),
   serverOverrides: /* @__PURE__ */ new Map()
 };
 var configInFlight = /* @__PURE__ */ new Map();
 function normalizeWorkspacePath(cwd) {
-  return path4.resolve(cwd);
+  return path3.resolve(cwd);
+}
+var unknownTrustNoticeGeneration = -1;
+function sourceFor(provenance, key) {
+  const direct = provenanceFor({ value: void 0, provenance }, key);
+  if (direct)
+    return direct;
+  let fallback;
+  for (const [candidate, entry] of provenance) {
+    if (!candidate.startsWith(`${key}/`))
+      continue;
+    if (isRepoTier(entry.tier))
+      return entry;
+    fallback ??= entry;
+  }
+  return fallback;
+}
+function executableAllowed(provenance, trust) {
+  return !provenance || !isRepoTier(provenance.tier) || trust === "trusted";
+}
+function registryDecision(id, field, provenance, trust, allowed) {
+  if (allowed || !provenance || !isRepoTier(provenance.tier))
+    return;
+  const subject = `${id}:${field}:${provenance.tier}`;
+  const reason = `project LSP ${field} refused for ${id}: pi project trust is ${trust}`;
+  recordDegradationOnce({
+    kind: "lsp-registry-decision",
+    subject,
+    reason,
+    metadata: { serverId: id, field, tier: provenance.tier, trust }
+  });
+  if (trust === "unknown") {
+    const generation = getDegradationLedgerGeneration();
+    if (unknownTrustNoticeGeneration !== generation) {
+      unknownTrustNoticeGeneration = generation;
+      logExtension({
+        subsystem: "lsp-registry",
+        level: "warn",
+        message: "project LSP executables refused: mark the project trusted in pi or upgrade pi",
+        metadata: { serverId: id, field }
+      });
+    }
+  }
 }
 function isSameOrChildPath(filePath, candidateRoot) {
   if (filePath === candidateRoot)
     return true;
-  return filePath.startsWith(`${candidateRoot}${path4.sep}`);
+  return filePath.startsWith(`${candidateRoot}${path3.sep}`);
 }
 function getConfigForFile(filePath) {
-  const resolvedFilePath = path4.resolve(filePath);
+  const resolvedFilePath = path3.resolve(filePath);
   let bestMatch;
   for (const [root, config] of sessionRootConfigEntries()) {
     if (config === void 0)
@@ -1242,13 +1456,33 @@ function getConfigForFile(filePath) {
   return bestMatch?.config ?? EMPTY_CONFIG;
 }
 function registerLSPConfig(config) {
+  return compileLspRegistry(config, config.__provenance);
+}
+function compileLspRegistry(config, provenance = /* @__PURE__ */ new Map()) {
+  const trust = getProjectTrustState();
   const customServers = [];
   const disabledServerIds = new Set(config.disabledServers ?? []);
   if (config.servers) {
     for (const [id, serverConfig] of Object.entries(config.servers)) {
+      const commandSource = sourceFor(provenance, `/lsp/servers/${id}/command`);
+      const commandAllowed = executableAllowed(commandSource, trust);
+      registryDecision(id, "command", commandSource, trust, commandAllowed);
+      if (!commandAllowed)
+        continue;
+      const envSource = sourceFor(provenance, `/lsp/servers/${id}/env`);
+      const initSource = sourceFor(provenance, `/lsp/servers/${id}/initializationOptions`);
+      const envAllowed = executableAllowed(envSource, trust);
+      const initAllowed = executableAllowed(initSource, trust);
+      registryDecision(id, "env", envSource, trust, envAllowed);
+      registryDecision(id, "initializationOptions", initSource, trust, initAllowed);
+      const admitted = { ...serverConfig };
+      if (!envAllowed)
+        delete admitted.env;
+      if (!initAllowed)
+        delete admitted.initializationOptions;
       try {
-        const server = createCustomServer(serverConfig, id);
-        customServers.push(server);
+        const server = createCustomServer(admitted, id);
+        customServers.push({ ...server, trustAllowed: true });
       } catch {
       }
     }
@@ -1258,15 +1492,53 @@ function registerLSPConfig(config) {
     for (const [id, entry] of Object.entries(config.serverOverrides)) {
       if (entry && typeof entry === "object" && !Array.isArray(entry)) {
         const initOpts = entry.initializationOptions;
-        if (initOpts !== void 0 && typeof initOpts === "object" && initOpts !== null && !Array.isArray(initOpts)) {
+        const command = entry.command;
+        const commandSource = sourceFor(provenance, `/lsp/serverOverrides/${id}/command`);
+        const envSource = sourceFor(provenance, `/lsp/serverOverrides/${id}/env`);
+        const initSource = sourceFor(provenance, `/lsp/serverOverrides/${id}/initializationOptions`);
+        const commandAllowed = executableAllowed(commandSource, trust);
+        const envAllowed = executableAllowed(envSource, trust);
+        const overrideInitAllowed = executableAllowed(initSource, trust);
+        registryDecision(id, "command override", commandSource, trust, commandAllowed);
+        registryDecision(id, "env override", envSource, trust, envAllowed);
+        registryDecision(id, "initializationOptions", initSource, trust, overrideInitAllowed);
+        if (command !== void 0 || entry.env !== void 0 || initOpts !== void 0 && typeof initOpts === "object" && initOpts !== null && !Array.isArray(initOpts)) {
           serverOverrides.set(id, {
-            initializationOptions: initOpts
+            ...overrideInitAllowed && initOpts !== void 0 ? { initializationOptions: initOpts } : {},
+            ...commandAllowed && command !== void 0 ? { command } : {},
+            ...envAllowed && entry.env ? { env: entry.env } : {}
           });
         }
       }
     }
   }
-  return { customServers, disabledServerIds, serverOverrides };
+  const overriddenBuiltins = LSP_SERVERS.map((server) => {
+    const override = serverOverrides.get(server.id);
+    if (!override?.command)
+      return { ...server };
+    const argv = Array.isArray(override.command) ? override.command : [override.command, "--stdio"];
+    return {
+      ...server,
+      trustAllowed: true,
+      async spawn(root, options) {
+        void options;
+        const program = argv[0];
+        if (!program)
+          throw new Error(`empty command override for ${server.id}`);
+        const proc = await launchLSP(program, argv.slice(1), {
+          cwd: root,
+          env: override.env ? { ...process.env, ...override.env } : process.env
+        });
+        return { process: proc };
+      }
+    };
+  });
+  return {
+    customServers,
+    registeredServers: overriddenBuiltins,
+    disabledServerIds,
+    serverOverrides
+  };
 }
 function forgetConfigResolvedClaims(evictedRoots) {
   for (const root of evictedRoots) {
@@ -1280,7 +1552,7 @@ async function initLSPConfig(cwd) {
   if (existing)
     return existing;
   const promise = (async () => {
-    const config = registerLSPConfig(await loadLSPConfig(cwd, os3.homedir()));
+    const config = registerLSPConfig(await loadLSPConfig(cwd, os4.homedir()));
     forgetConfigResolvedClaims(setSessionRootConfig(normalizedCwd, config));
   })();
   configInFlight.set(normalizedCwd, promise);
@@ -1293,7 +1565,8 @@ async function initLSPConfig(cwd) {
   }
 }
 function registeredServers(config) {
-  return [...LSP_SERVERS, ...config.customServers];
+  const builtins = config.registeredServers.length ? config.registeredServers : LSP_SERVERS;
+  return [...builtins, ...config.customServers];
 }
 function selectionReason(server, config, filePath, ext, base) {
   if (config.disabledServerIds.has(server.id))
@@ -1313,8 +1586,8 @@ function selectionReason(server, config, filePath, ext, base) {
   return "selected";
 }
 function explainServersForFile(filePath, config = getConfigForFile(filePath)) {
-  const ext = path4.extname(filePath).toLowerCase();
-  const base = path4.basename(filePath).toLowerCase();
+  const ext = path3.extname(filePath).toLowerCase();
+  const base = path3.basename(filePath).toLowerCase();
   return registeredServers(config).map((server) => {
     const reason = selectionReason(server, config, filePath, ext, base);
     return { server, selected: reason === "selected", reason };
@@ -1322,8 +1595,8 @@ function explainServersForFile(filePath, config = getConfigForFile(filePath)) {
 }
 function getServersForFileWithConfig(filePath) {
   const config = getConfigForFile(filePath);
-  const ext = path4.extname(filePath).toLowerCase();
-  const base = path4.basename(filePath).toLowerCase();
+  const ext = path3.extname(filePath).toLowerCase();
+  const base = path3.basename(filePath).toLowerCase();
   return registeredServers(config).filter((server) => selectionReason(server, config, filePath, ext, base) === "selected");
 }
 function primaryServerEntry(filePath) {
@@ -1384,11 +1657,15 @@ function resolveAstGrepNativeExe(platform = process.platform, arch = process.arc
 }
 var SERVER_DIAGNOSTIC_STRATEGIES = {
   typescript: {
-    seedFirstPush: true,
+    seedFirstPush: false,
     pullRetryBudgetMs: 0,
     debounceMs: 50,
     aggregateWaitMs: 1e3,
     expectSemanticSecondPush: false,
+    // #3310 / nightly run 37930006227: the clean TypeScript fixture
+    // published an empty pre-index result before its settled result.
+    // Hold that first publish so it cannot resolve a push wait as clean.
+    emptyFirstPublish: "indexing",
     // Tier 3 (#458): typescript-language-server publishes nothing on a
     // clean→clean edit (docs/lsp-capability-matrix.md, re-confirmed
     // 2026-07-12). It's the lone core-set tier-3 server, which is exactly
@@ -1788,32 +2065,32 @@ function classifyCascadeWaitTier(lspService, filePath, snapshots) {
 }
 
 // dist/clients/lsp/lombok.js
-import * as fs4 from "node:fs";
-import * as os4 from "node:os";
-import * as path5 from "node:path";
+import * as fs5 from "node:fs";
+import * as os5 from "node:os";
+import * as path4 from "node:path";
 var LOMBOK_ENV_KEYS = ["PI_LENS_LOMBOK_JAR", "LOMBOK_JAR"];
 var LOMBOK_PROJECT_FILES = [
   "lombok.config",
   "pom.xml",
   "build.gradle",
   "build.gradle.kts",
-  path5.join("gradle", "libs.versions.toml")
+  path4.join("gradle", "libs.versions.toml")
 ];
 function fileExists(filePath) {
   if (!filePath)
     return false;
   try {
-    return fs4.statSync(filePath).isFile();
+    return fs5.statSync(filePath).isFile();
   } catch {
     return false;
   }
 }
 function readTextIfSmall(filePath, maxBytes = 512 * 1024) {
   try {
-    const stat2 = fs4.statSync(filePath);
+    const stat2 = fs5.statSync(filePath);
     if (!stat2.isFile() || stat2.size > maxBytes)
       return "";
-    return fs4.readFileSync(filePath, "utf-8");
+    return fs5.readFileSync(filePath, "utf-8");
   } catch {
     return "";
   }
@@ -1822,13 +2099,13 @@ function containsLombokDependency(text) {
   return /\borg\.projectlombok\b/i.test(text) || /<artifactId>\s*lombok\s*<\/artifactId>/i.test(text) || /\b(annotationProcessor|compileOnly|testCompileOnly|testAnnotationProcessor)\b[^\n]*\blombok\b/i.test(text);
 }
 function hasLombokProject(root) {
-  const lombokConfig = path5.join(root, "lombok.config");
+  const lombokConfig = path4.join(root, "lombok.config");
   if (fileExists(lombokConfig))
     return true;
   for (const name of LOMBOK_PROJECT_FILES) {
     if (name === "lombok.config")
       continue;
-    const text = readTextIfSmall(path5.join(root, name));
+    const text = readTextIfSmall(path4.join(root, name));
     if (text && containsLombokDependency(text))
       return true;
   }
@@ -1838,23 +2115,23 @@ function envJarCandidate(env) {
   for (const key of LOMBOK_ENV_KEYS) {
     const value = env[key]?.trim();
     if (fileExists(value))
-      return path5.resolve(value);
+      return path4.resolve(value);
   }
   return void 0;
 }
 function localJarCandidates(root) {
   return [
-    path5.join(root, "lombok.jar"),
-    path5.join(root, ".lombok", "lombok.jar"),
-    path5.join(root, "lib", "lombok.jar"),
-    path5.join(root, "libs", "lombok.jar")
+    path4.join(root, "lombok.jar"),
+    path4.join(root, ".lombok", "lombok.jar"),
+    path4.join(root, "lib", "lombok.jar"),
+    path4.join(root, "libs", "lombok.jar")
   ];
 }
 function newestExistingJar(candidates) {
   let best;
   for (const candidate of candidates) {
     try {
-      const stat2 = fs4.statSync(candidate);
+      const stat2 = fs5.statSync(candidate);
       if (!stat2.isFile())
         continue;
       if (!best || stat2.mtimeMs > best.mtimeMs) {
@@ -1865,35 +2142,35 @@ function newestExistingJar(candidates) {
   }
   return best?.filePath;
 }
-function mavenLocalLombokJar(home = os4.homedir()) {
-  const base = path5.join(home, ".m2", "repository", "org", "projectlombok", "lombok");
+function mavenLocalLombokJar(home = os5.homedir()) {
+  const base = path4.join(home, ".m2", "repository", "org", "projectlombok", "lombok");
   let versions = [];
   try {
-    versions = fs4.readdirSync(base);
+    versions = fs5.readdirSync(base);
   } catch {
     return void 0;
   }
-  return newestExistingJar(versions.map((version) => path5.join(base, version, `lombok-${version}.jar`)));
+  return newestExistingJar(versions.map((version) => path4.join(base, version, `lombok-${version}.jar`)));
 }
-function gradleCacheLombokJar(home = os4.homedir()) {
-  const base = path5.join(home, ".gradle", "caches", "modules-2", "files-2.1", "org.projectlombok", "lombok");
+function gradleCacheLombokJar(home = os5.homedir()) {
+  const base = path4.join(home, ".gradle", "caches", "modules-2", "files-2.1", "org.projectlombok", "lombok");
   const candidates = [];
   let versions = [];
   try {
-    versions = fs4.readdirSync(base);
+    versions = fs5.readdirSync(base);
   } catch {
     return void 0;
   }
   for (const version of versions) {
-    const versionDir = path5.join(base, version);
+    const versionDir = path4.join(base, version);
     let hashes = [];
     try {
-      hashes = fs4.readdirSync(versionDir);
+      hashes = fs5.readdirSync(versionDir);
     } catch {
       continue;
     }
     for (const hash of hashes) {
-      candidates.push(path5.join(versionDir, hash, `lombok-${version}.jar`));
+      candidates.push(path4.join(versionDir, hash, `lombok-${version}.jar`));
     }
   }
   return newestExistingJar(candidates);
@@ -1925,16 +2202,16 @@ function createLombokJdtlsArgs(root, baseEnv = process.env) {
 
 // dist/clients/lsp/jvm-runtime.js
 import { existsSync as existsSync2, readdirSync as readdirSync4 } from "node:fs";
-import os5 from "node:os";
-import path6 from "node:path";
+import os6 from "node:os";
+import path5 from "node:path";
 var JAVA_EXE = process.platform === "win32" ? "java.exe" : "java";
 var JAVA_PROBE_TIMEOUT_MS = 5e3;
 var MIN_JAVA_MAJOR = 17;
 function jdkHomeFrom(dir) {
-  if (existsSync2(path6.join(dir, "bin", JAVA_EXE)))
+  if (existsSync2(path5.join(dir, "bin", JAVA_EXE)))
     return dir;
-  const macHome = path6.join(dir, "Contents", "Home");
-  if (existsSync2(path6.join(macHome, "bin", JAVA_EXE)))
+  const macHome = path5.join(dir, "Contents", "Home");
+  if (existsSync2(path5.join(macHome, "bin", JAVA_EXE)))
     return macHome;
   return void 0;
 }
@@ -1947,34 +2224,34 @@ function parseMajorVersion(name) {
 }
 function childDirs(base) {
   try {
-    return readdirSync4(base, { withFileTypes: true }).filter((e) => e.isDirectory() || e.isSymbolicLink()).map((e) => path6.join(base, e.name));
+    return readdirSync4(base, { withFileTypes: true }).filter((e) => e.isDirectory() || e.isSymbolicLink()).map((e) => path5.join(base, e.name));
   } catch {
     return [];
   }
 }
 function candidateRoots() {
-  const home = os5.homedir();
+  const home = os6.homedir();
   const roots = [];
-  roots.push(path6.join(home, ".jdks"));
-  roots.push(path6.join(getGlobalPiLensDir(), "tools"));
+  roots.push(path5.join(home, ".jdks"));
+  roots.push(path5.join(getGlobalPiLensDir(), "tools"));
   if (process.platform === "win32") {
     const progFiles = [
       process.env.ProgramFiles,
       process.env["ProgramFiles(x86)"],
       process.env.ProgramW6432,
-      path6.join(process.env.LOCALAPPDATA ?? path6.join(home, "AppData", "Local"), "Programs")
+      path5.join(process.env.LOCALAPPDATA ?? path5.join(home, "AppData", "Local"), "Programs")
     ].filter((p) => Boolean(p));
     for (const base of progFiles) {
-      roots.push(path6.join(base, "Eclipse Adoptium"));
-      roots.push(path6.join(base, "Java"));
-      roots.push(path6.join(base, "Microsoft"));
-      roots.push(path6.join(base, "Zulu"));
-      roots.push(path6.join(base, "Amazon Corretto"));
-      roots.push(path6.join(base, "BellSoft"));
+      roots.push(path5.join(base, "Eclipse Adoptium"));
+      roots.push(path5.join(base, "Java"));
+      roots.push(path5.join(base, "Microsoft"));
+      roots.push(path5.join(base, "Zulu"));
+      roots.push(path5.join(base, "Amazon Corretto"));
+      roots.push(path5.join(base, "BellSoft"));
     }
   } else if (process.platform === "darwin") {
     roots.push("/Library/Java/JavaVirtualMachines");
-    roots.push(path6.join(home, "Library", "Java", "JavaVirtualMachines"));
+    roots.push(path5.join(home, "Library", "Java", "JavaVirtualMachines"));
     roots.push("/opt/homebrew/opt");
     roots.push("/usr/local/opt");
   } else {
@@ -1998,7 +2275,7 @@ function discoverJdkHome(roots = candidateRoots(), javaHome = process.env.JAVA_H
         continue;
       found.push({
         home: resolved,
-        major: parseMajorVersion(path6.basename(dir))
+        major: parseMajorVersion(path5.basename(dir))
       });
     }
   }
@@ -2097,12 +2374,12 @@ async function resolveJavaRuntimeEnv() {
   }
   const home = discoverJdkHome();
   if (home) {
-    const binDir = path6.join(home, "bin");
+    const binDir = path5.join(home, "bin");
     const currentPath = process.env.PATH ?? process.env.Path ?? "";
     _cachedEnv = {
       value: {
         JAVA_HOME: home,
-        PATH: binDir + path6.delimiter + currentPath
+        PATH: binDir + path5.delimiter + currentPath
       }
     };
     return _cachedEnv.value;
@@ -2158,7 +2435,7 @@ async function resolveLspServerCwd(server, filePath, sessionCwd, onRootFailure,
     rootFailed = true;
     onRootFailure?.(reason);
   }
-  const isFileDirFallback = serverRoot !== void 0 && rootMarkers?.length && path7.resolve(serverRoot) === path7.resolve(path7.dirname(filePath));
+  const isFileDirFallback = serverRoot !== void 0 && rootMarkers?.length && path6.resolve(serverRoot) === path6.resolve(path6.dirname(filePath));
   if (!serverRoot || isFileDirFallback) {
     const probedMarker = onRootFallback && !rootFailed && rootMarkers?.length ? resolveToolCwd("lsp", server.id, filePath, {
       cwd: sessionCwd,
@@ -2167,7 +2444,7 @@ async function resolveLspServerCwd(server, filePath, sessionCwd, onRootFailure,
     }).marker : void 0;
     const refusedMarker = probedMarker !== void 0 && rootMarkers?.includes(probedMarker) ? probedMarker : void 0;
     const fallbackCwd = rootMarkers?.length ? resolveToolCwd("lsp", server.id, filePath, {
-      cwd: path7.dirname(path7.resolve(filePath)),
+      cwd: path6.dirname(path6.resolve(filePath)),
       rootMarkers
     }) : void 0;
     if (!serverRoot) {
@@ -2237,21 +2514,21 @@ var PROJECT_BOUNDARY_MARKERS = [
 var loggedRootCeilingClamps = /* @__PURE__ */ new Set();
 var posixCaseInsensitiveByPath = /* @__PURE__ */ new Map();
 function posixFilesystemIsCaseInsensitive(root) {
-  const resolved = path7.resolve(root);
+  const resolved = path6.resolve(root);
   const cached = posixCaseInsensitiveByPath.get(resolved);
   if (cached !== void 0)
     return cached;
   if (!existsSync3(resolved)) {
     return false;
   }
-  const name = path7.basename(resolved);
+  const name = path6.basename(resolved);
   const alternate = name.toLowerCase() === name ? name.toUpperCase() : name.toLowerCase();
   let insensitive = false;
-  const alternatePath = path7.join(path7.dirname(resolved), alternate);
+  const alternatePath = path6.join(path6.dirname(resolved), alternate);
   if (alternate !== name && existsSync3(alternatePath)) {
     try {
-      const actual = statSync3(resolved);
-      const alternateStat = statSync3(alternatePath);
+      const actual = statSync4(resolved);
+      const alternateStat = statSync4(alternatePath);
       insensitive = actual.dev === alternateStat.dev && actual.ino === alternateStat.ino;
     } catch {
       insensitive = false;
@@ -2265,7 +2542,7 @@ function resetLSPCaseSensitivityState() {
 }
 function isSameOrWithin(ancestor, candidate, deps = {}) {
   const windowsShaped = isWindowsPath(ancestor) || isWindowsPath(candidate);
-  const pathApi = windowsShaped ? path7.win32 : path7;
+  const pathApi = windowsShaped ? path6.win32 : path6;
   const resolvedAncestor = pathApi.resolve(ancestor);
   const resolvedCandidate = pathApi.resolve(candidate);
   let caseInsensitive = false;
@@ -2285,7 +2562,7 @@ function isSameOrWithin(ancestor, candidate, deps = {}) {
 }
 function enforceLspRootCeiling(root, sessionCwd, filePath) {
   const windowsShaped = isWindowsPath(root) || isWindowsPath(sessionCwd);
-  const pathApi = windowsShaped ? path7.win32 : path7;
+  const pathApi = windowsShaped ? path6.win32 : path6;
   const resolvedRoot = pathApi.resolve(root);
   const resolvedCwd = pathApi.resolve(sessionCwd);
   if (filePath && !isSameOrWithin(resolvedCwd, pathApi.resolve(filePath))) {
@@ -2310,8 +2587,8 @@ async function hasProjectBoundaryMarker(dir) {
   return false;
 }
 function pathSegments(dir) {
-  const parsed = path7.parse(path7.resolve(dir));
-  return path7.relative(parsed.root, path7.resolve(dir)).split(path7.sep).filter(Boolean).map((segment) => segment.toLowerCase());
+  const parsed = path6.parse(path6.resolve(dir));
+  return path6.relative(parsed.root, path6.resolve(dir)).split(path6.sep).filter(Boolean).map((segment) => segment.toLowerCase());
 }
 function hasFixtureConvention(dir) {
   const segments = pathSegments(dir);
@@ -2323,18 +2600,18 @@ function hasAtomicStageSegment(dir) {
   return pathSegments(dir).some((segment) => STAGE_TMP_PATTERN.test(segment));
 }
 async function findGitBoundary(dir) {
-  let current = path7.resolve(dir);
-  const fsRoot = path7.parse(current).root;
+  let current = path6.resolve(dir);
+  const fsRoot = path6.parse(current).root;
   while (true) {
     if (await markerExists(current, ".git"))
       return current;
     if (current === fsRoot)
       return void 0;
-    current = path7.dirname(current);
+    current = path6.dirname(current);
   }
 }
 async function isExcludedLspRoot(dir) {
-  const candidate = path7.resolve(dir);
+  const candidate = path6.resolve(dir);
   if (hasFixtureConvention(candidate) || hasAtomicStageSegment(candidate))
     return true;
   const gitRoot = await findGitBoundary(candidate);
@@ -2346,9 +2623,9 @@ async function isExcludedLspRoot(dir) {
 }
 async function nearestNonExcludedFallbackRoot(candidate) {
   if (!await isExcludedLspRoot(candidate))
-    return path7.resolve(candidate);
-  let current = path7.dirname(path7.resolve(candidate));
-  const fsRoot = path7.parse(current).root;
+    return path6.resolve(candidate);
+  let current = path6.dirname(path6.resolve(candidate));
+  const fsRoot = path6.parse(current).root;
   let nearestAllowed;
   while (true) {
     if (!await isExcludedLspRoot(current)) {
@@ -2360,7 +2637,7 @@ async function nearestNonExcludedFallbackRoot(candidate) {
     }
     if (current === fsRoot)
       break;
-    current = path7.dirname(current);
+    current = path6.dirname(current);
   }
   return nearestAllowed ?? fsRoot;
 }
@@ -2401,7 +2678,7 @@ async function installEvidenceForLaunch(toolId, installed, attempt) {
   const confirmedManagedPath = await findManagedToolBinary(toolId);
   return {
     ...evidence,
-    binary: path7.basename(installed),
+    binary: path6.basename(installed),
     ...confirmedManagedPath !== void 0 && pathsEqual(confirmedManagedPath, installed) && {
       source: "managed-dir"
     }
@@ -2454,7 +2731,7 @@ function markDirectLspCommandUnavailable(command) {
   directLspCommandUnavailableUntil.set(command, Date.now() + DIRECT_LSP_NEGATIVE_TTL_MS);
   directLspCommandSkipLoggedUntil.delete(command);
 }
-var PI_LENS_BIN_DIR2 = path7.join(getGlobalPiLensDir(), "bin");
+var PI_LENS_BIN_DIR2 = path6.join(getGlobalPiLensDir(), "bin");
 async function resolveAndLaunch(spec, allowInstall) {
   const generation = lspLaunchAvailabilityGeneration.capture();
   const toolLabel = spec.managedToolId ?? spec.candidates[spec.candidates.length - 1] ?? "unknown";
@@ -2519,7 +2796,7 @@ async function resolveAndLaunch(spec, allowInstall) {
           producer: "lsp-launch",
           classifiedBy: "probe",
           evidence: {
-            binary: path7.basename(managedCandidate),
+            binary: path6.basename(managedCandidate),
             source: "managed-dir",
             correctsLatchedRow: false
           }
@@ -2812,7 +3089,7 @@ async function resolveAndLaunchTreeBinary(spec, allowInstall) {
     return void 0;
   }
   const suffix = process.platform === "win32" ? ".exe" : "";
-  const binPath = path7.join(bundleDir, ...spec.binRelPath.split("/")) + suffix;
+  const binPath = path6.join(bundleDir, ...spec.binRelPath.split("/")) + suffix;
   try {
     const proc = await launchLSP(binPath, spec.args, {
       cwd: spec.cwd,
@@ -2827,7 +3104,7 @@ async function resolveAndLaunchTreeBinary(spec, allowInstall) {
   }
 }
 function nodeBinLocalCandidates(root, baseName) {
-  const localBase = path7.join(root, "node_modules", ".bin", baseName);
+  const localBase = path6.join(root, "node_modules", ".bin", baseName);
   if (process.platform === "win32") {
     return [`${localBase}.cmd`, `${localBase}.exe`];
   }
@@ -2837,7 +3114,7 @@ function nodeBinCandidates(root, baseName) {
   return [...nodeBinLocalCandidates(root, baseName), baseName];
 }
 function piAgentExtensionsRootKey(file) {
-  const dirKey = normalizeEphemeralMapKey(path7.dirname(path7.resolve(file)));
+  const dirKey = normalizeEphemeralMapKey(path6.dirname(path6.resolve(file)));
   const marker = "/.pi/agent/extensions";
   const index = dirKey.indexOf(marker);
   if (index === -1)
@@ -2845,26 +3122,26 @@ function piAgentExtensionsRootKey(file) {
   return dirKey.slice(0, index + marker.length);
 }
 function IgnoreHomeRoot(primary) {
-  const homeKey = normalizeEphemeralMapKey(path7.resolve(os6.homedir()));
+  const homeKey = normalizeEphemeralMapKey(path6.resolve(os7.homedir()));
   return withRootMarkers(async (file) => {
     const root = await primary(file);
     if (!root)
       return void 0;
-    return normalizeEphemeralMapKey(path7.resolve(root)) === homeKey ? void 0 : root;
+    return normalizeEphemeralMapKey(path6.resolve(root)) === homeKey ? void 0 : root;
   }, primary.rootMarkers ?? []);
 }
 function rubyBinCandidates(baseName) {
   const candidates = [];
-  const home = os6.homedir();
+  const home = os7.homedir();
   const isWin = process.platform === "win32";
   const ext = isWin ? ".bat" : "";
-  candidates.push(path7.join(home, ".local", "share", "mise", "installs", "ruby", "bin", `${baseName}${ext}`));
-  candidates.push(path7.join(home, ".asdf", "installs", "ruby", "bin", `${baseName}${ext}`));
+  candidates.push(path6.join(home, ".local", "share", "mise", "installs", "ruby", "bin", `${baseName}${ext}`));
+  candidates.push(path6.join(home, ".asdf", "installs", "ruby", "bin", `${baseName}${ext}`));
   if (isWin) {
-    const driveRoot = path7.parse(home).root;
+    const driveRoot = path6.parse(home).root;
     for (const entry of getRubyVersionDirNamesSync(driveRoot)) {
-      candidates.push(path7.join(driveRoot, entry, "bin", `${baseName}.bat`));
-      candidates.push(path7.join(driveRoot, entry, "bin", baseName));
+      candidates.push(path6.join(driveRoot, entry, "bin", `${baseName}.bat`));
+      candidates.push(path6.join(driveRoot, entry, "bin", baseName));
     }
   }
   return candidates;
@@ -2884,6 +3161,7 @@ function createInteractiveServer(spec) {
     rootMarkers: spec.root.rootMarkers,
     fallbackFor: spec.fallbackFor,
     requiresProjectRoot: spec.requiresProjectRoot,
+    executesProjectCode: spec.executesProjectCode,
     availabilityKey: typeof spec.command === "string" && isSimpleCommand(spec.command) ? spec.command : void 0,
     async spawn(root) {
       const command = typeof spec.command === "function" ? spec.command(root) : spec.command;
@@ -2911,8 +3189,8 @@ function createInteractiveServer(spec) {
 function PriorityRoot(markerGroups, excludePatterns, stopDir) {
   const resolvers = markerGroups.map((markers) => NearestRoot(markers, excludePatterns, stopDir));
   return withRootMarkers(async (file) => {
-    for (const resolve3 of resolvers) {
-      const root = await resolve3(file);
+    for (const resolve4 of resolvers) {
+      const root = await resolve4(file);
       if (root)
         return root;
     }
@@ -2920,7 +3198,7 @@ function PriorityRoot(markerGroups, excludePatterns, stopDir) {
   }, markerGroups.flat());
 }
 var FileDirRoot = async (file) => {
-  const candidate = path7.resolve(path7.dirname(file));
+  const candidate = path6.resolve(path6.dirname(file));
   return nearestNonExcludedFallbackRoot(candidate);
 };
 function RootWithFallback(primary, fallback = FileDirRoot) {
@@ -2942,16 +3220,16 @@ function markerProbeDir(dir, pattern) {
   const normalized = toPosix(pattern);
   const slash = normalized.lastIndexOf("/");
   const parentPattern = slash >= 0 ? normalized.slice(0, slash) : "";
-  return parentPattern ? path7.join(dir, ...parentPattern.split("/").filter(Boolean)) : dir;
+  return parentPattern ? path6.join(dir, ...parentPattern.split("/").filter(Boolean)) : dir;
 }
 async function markerExists(dir, pattern) {
   if (!pattern.includes("*")) {
     try {
-      await stat(path7.join(dir, pattern));
+      await stat(path6.join(dir, pattern));
       return true;
     } catch (err) {
       if (isPermissionFsError(err)) {
-        logSessionStart(`lsp root marker skipped: permission error stat ${path7.join(dir, pattern)}`);
+        logSessionStart(`lsp root marker skipped: permission error stat ${path6.join(dir, pattern)}`);
       }
       return false;
     }
@@ -2987,7 +3265,7 @@ function NearestRoot(includePatterns, excludePatterns, stopDir) {
       subdirPatterns.push(pattern);
   }
   return withRootMarkers(async (file) => {
-    const startDir = path7.resolve(path7.dirname(file));
+    const startDir = path6.resolve(path6.dirname(file));
     const dirKey = normalizeMapKey(startDir);
     const cached = cache.get(dirKey);
     if (cached !== void 0 && Date.now() - cached.walkedAt < FRESHNESS_CADENCE_MS && await bounded(dirMtimesStillFreshAsync(cached.probedDirs), rootMtimeBound("lsp-root-memo-freshness")) === true)
@@ -2999,10 +3277,10 @@ function NearestRoot(includePatterns, excludePatterns, stopDir) {
     const walkedAt = Date.now();
     const promise = (async () => {
       let currentDir = startDir;
-      const fsRoot = path7.parse(currentDir).root;
-      const stop = stopDir ? path7.resolve(stopDir) : fsRoot;
+      const fsRoot = path6.parse(currentDir).root;
+      const stop = stopDir ? path6.resolve(stopDir) : fsRoot;
       while (true) {
-        if (stop !== fsRoot && currentDir.startsWith(stop + path7.sep) === false && currentDir !== stop) {
+        if (stop !== fsRoot && currentDir.startsWith(stop + path6.sep) === false && currentDir !== stop) {
           break;
         }
         const stepDirs = [
@@ -3020,19 +3298,19 @@ function NearestRoot(includePatterns, excludePatterns, stopDir) {
             }
           }
           if (excluded) {
-            currentDir = path7.dirname(currentDir);
+            currentDir = path6.dirname(currentDir);
             continue;
           }
         }
         for (const pattern of includePatterns) {
-          if (await markerExists(currentDir, pattern) && (pattern !== ".git" || currentDir !== os6.tmpdir()) && !await isExcludedLspRoot(currentDir)) {
+          if (await markerExists(currentDir, pattern) && (pattern !== ".git" || currentDir !== os7.tmpdir()) && !await isExcludedLspRoot(currentDir)) {
             return enforceLspRootCeiling(currentDir, process.cwd(), file);
           }
         }
         if (currentDir === stop || currentDir === fsRoot) {
           break;
         }
-        currentDir = path7.dirname(currentDir);
+        currentDir = path6.dirname(currentDir);
       }
       return void 0;
     })();
@@ -3073,18 +3351,18 @@ async function findAncestorFile(startDir, ...relativeSegments) {
   return findAncestorFileAmong(startDir, [relativeSegments]);
 }
 async function findAncestorFileAmong(startDir, candidateSegmentLists) {
-  const fs5 = await import("node:fs/promises");
-  let currentDir = path7.resolve(startDir);
+  const fs6 = await import("node:fs/promises");
+  let currentDir = path6.resolve(startDir);
   while (!isAtOrAboveHomeDir(currentDir)) {
     for (const segments of candidateSegmentLists) {
-      const candidate = path7.join(currentDir, ...segments);
+      const candidate = path6.join(currentDir, ...segments);
       try {
-        await fs5.access(candidate);
+        await fs6.access(candidate);
         return candidate;
       } catch {
       }
     }
-    const parent = path7.dirname(currentDir);
+    const parent = path6.dirname(currentDir);
     if (parent === currentDir)
       break;
     currentDir = parent;
@@ -3100,19 +3378,19 @@ function resetClassicTsRepairGuard() {
   classicTsRepairState().attempted = false;
 }
 function typescriptDirsForTsc(tscPath) {
-  const binDir = path7.dirname(tscPath);
+  const binDir = path6.dirname(tscPath);
   return [
-    path7.join(binDir, "..", "typescript"),
-    path7.join(binDir, "..", "..", "typescript")
+    path6.join(binDir, "..", "typescript"),
+    path6.join(binDir, "..", "..", "typescript")
   ];
 }
 async function typescriptVersionForTsc(tscPath) {
-  if (!path7.isAbsolute(tscPath))
+  if (!path6.isAbsolute(tscPath))
     return void 0;
   for (const dir of typescriptDirsForTsc(tscPath)) {
     let manifest;
     try {
-      manifest = await readFile(path7.join(dir, "package.json"), "utf8");
+      manifest = await readFile(path6.join(dir, "package.json"), "utf8");
     } catch {
       continue;
     }
@@ -3134,25 +3412,45 @@ async function typescriptVersionForTsc(tscPath) {
   }
   return void 0;
 }
-async function findTsserverPath(root, allowInstall) {
-  const fs5 = await import("node:fs/promises");
+async function findTsserverPath(root, allowInstall, options) {
+  const fs6 = await import("node:fs/promises");
+  const projectRoots = await Promise.all([root, options?.sessionRoot ?? process.cwd(), process.cwd()].map((dir) => fs6.realpath(dir).catch(() => path6.resolve(dir))));
+  const admitCandidate = async (candidate, projectSupplied) => {
+    try {
+      const real = await fs6.realpath(candidate);
+      if (path6.basename(real) !== "tsserver.js" || !(await fs6.stat(real)).isFile())
+        return void 0;
+      const manifest = JSON.parse(await fs6.readFile(path6.join(path6.dirname(real), "..", "package.json"), "utf8"));
+      if (typeof manifest?.version !== "string" || !manifest.version)
+        return void 0;
+      return admitProjectSuppliedTsserver(real, options?.sessionRoot ?? process.cwd(), projectSupplied || projectRoots.some((dir) => isUnderDir(real, dir)), options?.projectCodeAllowed);
+    } catch {
+      return void 0;
+    }
+  };
   const ancestorHit = await findAncestorFile(root, "node_modules", "typescript", "lib", "tsserver.js");
-  if (ancestorHit)
-    return ancestorHit;
-  const cwdCandidate = path7.join(process.cwd(), "node_modules", "typescript", "lib", "tsserver.js");
+  if (ancestorHit) {
+    const admittedAncestor = await admitCandidate(ancestorHit, true);
+    if (admittedAncestor)
+      return admittedAncestor;
+  }
+  const cwdCandidate = path6.join(process.cwd(), "node_modules", "typescript", "lib", "tsserver.js");
   try {
-    await fs5.access(cwdCandidate);
-    return cwdCandidate;
+    await fs6.access(cwdCandidate);
+    const admittedCwd = await admitCandidate(cwdCandidate, false);
+    if (admittedCwd)
+      return admittedCwd;
   } catch {
   }
   const tsserverForTsc = async (tscPath) => {
-    if (!tscPath)
+    if (!tscPath || !path6.isAbsolute(tscPath))
       return void 0;
     for (const dir of typescriptDirsForTsc(tscPath)) {
-      const candidate = path7.join(dir, "lib", "tsserver.js");
+      const candidate = path6.join(dir, "lib", "tsserver.js");
       try {
-        await fs5.access(candidate);
-        return candidate;
+        const admitted = await admitCandidate(candidate, false);
+        if (admitted)
+          return admitted;
       } catch {
       }
     }
@@ -3178,10 +3476,10 @@ async function findTsserverPath(root, allowInstall) {
   return tsserverForTsc(repairedTsc);
 }
 async function findNativeTypeScriptLsp(root) {
-  let currentDir = path7.resolve(root);
+  let currentDir = path6.resolve(root);
   while (!isAtOrAboveHomeDir(currentDir)) {
-    const typescriptDir = path7.join(currentDir, "node_modules", "typescript");
-    const packageJsonPath = path7.join(typescriptDir, "package.json");
+    const typescriptDir = path6.join(currentDir, "node_modules", "typescript");
+    const packageJsonPath = path6.join(typescriptDir, "package.json");
     let packageJsonText;
     try {
       packageJsonText = await readFile(packageJsonPath, "utf8");
@@ -3195,7 +3493,7 @@ async function findNativeTypeScriptLsp(root) {
           return void 0;
       } catch {
       }
-      const parent = path7.dirname(currentDir);
+      const parent = path6.dirname(currentDir);
       if (parent === currentDir)
         return void 0;
       currentDir = parent;
@@ -3215,7 +3513,7 @@ async function findNativeTypeScriptLsp(root) {
     const major = /^\d+$/.test(majorText) ? Number(majorText) : Number.NaN;
     if (!Number.isFinite(major) || major < 7)
       return void 0;
-    const localTsc = path7.join(currentDir, "node_modules", ".bin", "tsc");
+    const localTsc = path6.join(currentDir, "node_modules", ".bin", "tsc");
     const candidates = process.platform === "win32" ? [`${localTsc}.cmd`, `${localTsc}.exe`, localTsc] : [localTsc];
     for (const command of candidates) {
       try {
@@ -3229,29 +3527,29 @@ async function findNativeTypeScriptLsp(root) {
   return void 0;
 }
 function dotnetToolCandidates(tool) {
-  const home = os6.homedir();
+  const home = os7.homedir();
   return [
-    path7.join(PI_LENS_BIN_DIR2, `${tool}.exe`),
-    path7.join(PI_LENS_BIN_DIR2, tool),
-    path7.join(home, ".dotnet", "tools", `${tool}.exe`),
-    path7.join(home, ".dotnet", "tools", tool),
+    path6.join(PI_LENS_BIN_DIR2, `${tool}.exe`),
+    path6.join(PI_LENS_BIN_DIR2, tool),
+    path6.join(home, ".dotnet", "tools", `${tool}.exe`),
+    path6.join(home, ".dotnet", "tools", tool),
     tool
   ].filter(Boolean);
 }
 function binExeVariants(dir, tool) {
-  return process.platform === "win32" ? [path7.join(dir, `${tool}.exe`), path7.join(dir, tool)] : [path7.join(dir, tool)];
+  return process.platform === "win32" ? [path6.join(dir, `${tool}.exe`), path6.join(dir, tool)] : [path6.join(dir, tool)];
 }
 function goBinCandidates(tool) {
-  const gopath = process.env.GOPATH?.split(path7.delimiter)[0] || path7.join(os6.homedir(), "go");
-  return [tool, ...binExeVariants(path7.join(gopath, "bin"), tool)];
+  const gopath = process.env.GOPATH?.split(path6.delimiter)[0] || path6.join(os7.homedir(), "go");
+  return [tool, ...binExeVariants(path6.join(gopath, "bin"), tool)];
 }
 function cargoBinCandidates(tool) {
-  const cargoHome = process.env.CARGO_HOME || path7.join(os6.homedir(), ".cargo");
-  return [tool, ...binExeVariants(path7.join(cargoHome, "bin"), tool)];
+  const cargoHome = process.env.CARGO_HOME || path6.join(os7.homedir(), ".cargo");
+  return [tool, ...binExeVariants(path6.join(cargoHome, "bin"), tool)];
 }
 async function tryGemInstall(gem) {
-  const { join: join3 } = await import("node:path");
-  const binDir = join3(getGlobalPiLensDir(), "bin");
+  const { join: join4 } = await import("node:path");
+  const binDir = join4(getGlobalPiLensDir(), "bin");
   const { mkdir } = await import("node:fs/promises");
   await mkdir(binDir, { recursive: true });
   const result = await safeSpawnAsync("gem", ["install", gem, "--bindir", binDir, "--no-document"], { timeout: 18e4, ignoreAmbientSignal: true });
@@ -3285,7 +3583,7 @@ var TS_TOOLING_MARKERS = [
 ];
 var TS_FAMILY_EXTENSIONS = /* @__PURE__ */ new Set([".ts", ".tsx", ".mts", ".cts"]);
 function isTsFamilyFile(file) {
-  return TS_FAMILY_EXTENSIONS.has(path7.extname(file).toLowerCase());
+  return TS_FAMILY_EXTENSIONS.has(path6.extname(file).toLowerCase());
 }
 function tsConfigMarkersForFile(file) {
   return isTsFamilyFile(file) ? ["tsconfig.json"] : TS_CONFIG_MARKERS;
@@ -3306,40 +3604,40 @@ async function findTypeScriptProjectRoot(file) {
   return isSameOrWithin(toolingRoot, configRoot) ? configRoot : toolingRoot;
 }
 async function findExtensionBoundedRoot(file, extensionRootKey) {
-  const startDir = path7.resolve(path7.dirname(file));
+  const startDir = path6.resolve(path6.dirname(file));
   let currentDir = startDir;
   const configMarkers = tsConfigMarkersForFile(file);
   while (true) {
     for (const pattern of configMarkers) {
       try {
-        await stat(path7.join(currentDir, pattern));
+        await stat(path6.join(currentDir, pattern));
         return currentDir;
       } catch {
       }
     }
     for (const pattern of TS_TOOLING_MARKERS) {
       try {
-        await stat(path7.join(currentDir, pattern));
+        await stat(path6.join(currentDir, pattern));
         return currentDir;
       } catch {
       }
     }
-    const currentKey = normalizeEphemeralMapKey(path7.resolve(currentDir));
+    const currentKey = normalizeEphemeralMapKey(path6.resolve(currentDir));
     if (currentKey === extensionRootKey)
       return void 0;
-    const parent = path7.dirname(currentDir);
+    const parent = path6.dirname(currentDir);
     if (parent === currentDir)
       return void 0;
     currentDir = parent;
   }
 }
 async function hasAgentLevelProjectMarker(extensionRootKey) {
-  const agentDir = path7.dirname(extensionRootKey);
+  const agentDir = path6.dirname(extensionRootKey);
   if (!agentDir || agentDir === extensionRootKey)
     return false;
   for (const pattern of [...TS_CONFIG_MARKERS, ...TS_TOOLING_MARKERS]) {
     try {
-      await stat(path7.join(agentDir, pattern));
+      await stat(path6.join(agentDir, pattern));
       return true;
     } catch {
     }
@@ -3367,14 +3665,14 @@ var TypeScriptServer = {
   idleEviction: "transparent",
   role: "language",
   name: "TypeScript Language Server",
+  projectLocalCommand: "typescript-language-server",
   extensions: JS_TS_LSP_EXTENSIONS,
   autoPropagateDiagnostics: true,
   root: TypeScriptRoot,
   rootMarkers: TypeScriptRoot.rootMarkers,
   async spawn(root, options) {
-    const fs5 = await import("node:fs/promises");
     const nativeLsp = await findNativeTypeScriptLsp(root);
-    if (nativeLsp) {
+    if (nativeLsp && admitProjectSuppliedTsserver(nativeLsp.command, root, true, options?.projectCodeAllowed)) {
       const env2 = await getToolEnvironment();
       logSessionStart(`lsp typescript-native: version=${nativeLsp.version} command=${nativeLsp.command}`);
       const proc2 = await launchLSP(nativeLsp.command, ["--lsp", "--stdio"], {
@@ -3398,14 +3696,10 @@ var TypeScriptServer = {
         return void 0;
       }
     }
-    let tsserverPath = await findTsserverPath(root, options?.allowInstall);
+    const tsserverPath = await findTsserverPath(root, options?.allowInstall, options);
     if (!tsserverPath) {
-      const localCandidate = path7.join(path7.dirname(lspPath), "..", "typescript", "lib", "tsserver.js");
-      try {
-        await fs5.access(localCandidate);
-        tsserverPath = localCandidate;
-      } catch {
-      }
+      admitProjectSuppliedTsserver(void 0, root, true, options?.projectCodeAllowed);
+      return void 0;
     }
     if (tsserverPath)
       source = "managed";
@@ -3521,13 +3815,13 @@ var PythonServer = {
     if (!pyrightPath)
       return void 0;
     source = "managed";
-    const binDir = path7.dirname(pyrightPath);
+    const binDir = path6.dirname(pyrightPath);
     const isWindows2 = process.platform === "win32";
     const managedCandidates = isWindows2 ? [
-      path7.join(binDir, "pyright-langserver.cmd"),
-      path7.join(binDir, "pyright-langserver"),
+      path6.join(binDir, "pyright-langserver.cmd"),
+      path6.join(binDir, "pyright-langserver"),
       "pyright-langserver"
-    ] : [path7.join(binDir, "pyright-langserver"), "pyright-langserver"];
+    ] : [path6.join(binDir, "pyright-langserver"), "pyright-langserver"];
     const resolved = await resolveAndLaunch({ candidates: managedCandidates, args: ["--stdio"], cwd: root, env }, false);
     if (!resolved)
       return void 0;
@@ -3596,7 +3890,7 @@ var GoServer = {
   }
 };
 function cargoWorkspaceDeclaresMember(workspaceContent, parentDir, childDir) {
-  const relativePath = path7.relative(parentDir, childDir).split(path7.sep).join("/");
+  const relativePath = path6.relative(parentDir, childDir).split(path6.sep).join("/");
   if (relativePath === "" || relativePath.startsWith(".."))
     return false;
   const matches = (pattern) => matchesWorkspaceMemberPattern(pattern, relativePath, CARGO_WORKSPACE_MEMBER_DIALECT, () => recordDegradationOnce({
@@ -3610,7 +3904,7 @@ function cargoWorkspaceDeclaresMember(workspaceContent, parentDir, childDir) {
   return readCargoWorkspaceMembers(workspaceContent).some(matches);
 }
 function sessionHoistCeiling(sessionCwd, file) {
-  return isSameOrWithin(path7.resolve(sessionCwd), path7.resolve(file)) ? path7.resolve(sessionCwd) : void 0;
+  return isSameOrWithin(path6.resolve(sessionCwd), path6.resolve(file)) ? path6.resolve(sessionCwd) : void 0;
 }
 function RustWorkspaceRoot() {
   const crateRoot = createRootDetector(["Cargo.toml", "Cargo.lock"]);
@@ -3621,14 +3915,14 @@ function RustWorkspaceRoot() {
     const sessionCwd = process.cwd();
     const stop = sessionHoistCeiling(sessionCwd, file);
     let current = root;
-    const fsRoot = path7.parse(current).root;
+    const fsRoot = path6.parse(current).root;
     while (true) {
       if (stop !== void 0 && current === stop)
         break;
-      const parent = path7.dirname(current);
+      const parent = path6.dirname(current);
       if (parent === current || parent === fsRoot)
         break;
-      const parentCargoPath = path7.join(parent, "Cargo.toml");
+      const parentCargoPath = path6.join(parent, "Cargo.toml");
       const parentCargoContent = await readTextFileOrUndefined(parentCargoPath);
       if (parentCargoContent !== void 0 && hasCargoWorkspaceTable(parentCargoContent)) {
         if (cargoWorkspaceDeclaresMember(parentCargoContent, parent, root)) {
@@ -3656,9 +3950,9 @@ async function declaresMavenModule(parentDir, parentPomPath, childDir) {
     const modulesBlock = content.match(/<modules>([\s\S]*?)<\/modules>/);
     if (!modulesBlock)
       return false;
-    const resolvedChild = path7.resolve(childDir);
+    const resolvedChild = path6.resolve(childDir);
     for (const match of modulesBlock[1].matchAll(/<module>\s*([^<]+?)\s*<\/module>/g)) {
-      if (pathsEqual(path7.resolve(parentDir, match[1]), resolvedChild))
+      if (pathsEqual(path6.resolve(parentDir, match[1]), resolvedChild))
         return true;
     }
     return false;
@@ -3682,15 +3976,15 @@ function JavaWorkspaceRoot() {
     const stop = sessionHoistCeiling(sessionCwd, file);
     let current = root;
     let lastHop = root;
-    const fsRoot = path7.parse(current).root;
+    const fsRoot = path6.parse(current).root;
     while (true) {
       if (stop !== void 0 && current === stop)
         break;
-      const parent = path7.dirname(current);
+      const parent = path6.dirname(current);
       if (parent === current || parent === fsRoot)
         break;
       if (await markerExists(parent, "pom.xml")) {
-        const parentPom = path7.join(parent, "pom.xml");
+        const parentPom = path6.join(parent, "pom.xml");
         if (!await declaresMavenModule(parent, parentPom, lastHop))
           break;
         current = parent;
@@ -3709,6 +4003,7 @@ var RustServer = {
   // Measured (#3750): rust-analyzer answers an empty result for a detached file.
   requiresProjectRoot: true,
   name: "rust-analyzer",
+  executesProjectCode: true,
   extensions: KIND_EXTENSIONS["rust"],
   // No FileDirRoot fallback (#201): rust-analyzer is a heavy workspace server
   // that is useless without a Cargo manifest. With the fallback, every .rs file
@@ -3742,6 +4037,7 @@ var RubyServer = {
   idleEviction: "unmeasured",
   role: "language",
   name: "Ruby LSP",
+  executesProjectCode: true,
   extensions: KIND_EXTENSIONS["ruby"],
   root: RootWithFallback(PriorityRoot([["Gemfile", ".ruby-version"], [".git"]])),
   // Ruby LSP may need extra time to finish composed-bundle setup before it can
@@ -3794,17 +4090,17 @@ var PHPServer = {
     return {
       ...result,
       initialization: {
-        storagePath: path7.join(getGlobalPiLensDir(), "intelephense")
+        storagePath: path6.join(getGlobalPiLensDir(), "intelephense")
       }
     };
   }
 };
 function buildPsesArgs(bundleDir) {
-  const script = path7.join(bundleDir, "PowerShellEditorServices", "Start-EditorServices.ps1");
-  const sessionDir = path7.join(getGlobalPiLensDir(), "pses", `${process.pid}-${Date.now()}`);
+  const script = path6.join(bundleDir, "PowerShellEditorServices", "Start-EditorServices.ps1");
+  const sessionDir = path6.join(getGlobalPiLensDir(), "pses", `${process.pid}-${Date.now()}`);
   mkdirSync2(sessionDir, { recursive: true });
-  const logPath = path7.join(sessionDir, "pses.log");
-  const sessionDetailsPath = path7.join(sessionDir, "session.json");
+  const logPath = path6.join(sessionDir, "pses.log");
+  const sessionDetailsPath = path6.join(sessionDir, "session.json");
   return [
     "-NoLogo",
     "-NoProfile",
@@ -3838,6 +4134,7 @@ var PowerShellServer = {
   idleEviction: "unmeasured",
   role: "language",
   name: "PowerShell Editor Services",
+  executesProjectCode: true,
   extensions: KIND_EXTENSIONS["powershell"],
   // Index at the workspace (script modules reference siblings); fall back to the
   // file dir.
@@ -3858,6 +4155,7 @@ var CSharpServer = {
   // Documented (#3750): csharp-ls needs a solution or project.
   requiresProjectRoot: true,
   name: "csharp-ls",
+  executesProjectCode: true,
   extensions: KIND_EXTENSIONS["csharp"],
   // No FileDirRoot fallback (#201): csharp-ls is a workspace server and should
   // not spawn once per source directory before a .sln/.csproj exists. Glob root
@@ -3881,6 +4179,7 @@ var CSharpServer = {
 var OmniSharpServer = createInteractiveServer({
   id: "omnisharp",
   name: "OmniSharp",
+  executesProjectCode: true,
   // Documented (#3750): OmniSharp needs a solution or project.
   requiresProjectRoot: true,
   fallbackFor: "csharp",
@@ -3897,6 +4196,7 @@ var FSharpServer = {
   // Documented (#3750): FSAutocomplete needs a project.
   requiresProjectRoot: true,
   name: "FSAutocomplete",
+  executesProjectCode: true,
   extensions: KIND_EXTENSIONS["fsharp"],
   root: createRootDetector([...DOTNET_FSHARP_ROOT_MARKERS]),
   async spawn(root, options) {
@@ -3916,6 +4216,7 @@ var FSharpServer = {
 var JavaServer = createInteractiveServer({
   id: "java",
   name: "JDT Language Server",
+  executesProjectCode: true,
   extensions: KIND_EXTENSIONS["java"],
   root: RootWithFallback(JavaWorkspaceRoot()),
   language: "java",
@@ -3928,6 +4229,7 @@ var KotlinServer = {
   idleEviction: "unmeasured",
   role: "language",
   name: "Kotlin Language Server",
+  executesProjectCode: true,
   extensions: KIND_EXTENSIONS["kotlin"],
   root: RootWithFallback(createRootDetector(["build.gradle.kts", "build.gradle", "pom.xml"])),
   async spawn(root, options) {
@@ -3943,9 +4245,26 @@ var KotlinServer = {
     }, options?.allowInstall);
   }
 };
+var LeanServer = createInteractiveServer({
+  id: "lean",
+  name: "Lean 4 Language Server",
+  extensions: KIND_EXTENSIONS.lean,
+  root: RootWithFallback(createRootDetector([...LEAN_ROOT_MARKERS])),
+  language: "lean",
+  // Documented (#3750): `lake serve` analyses a file only when a Lake project
+  // roots it; a root-fallback empty answer is unconfirmed, not clean.
+  requiresProjectRoot: true,
+  // `lake serve` loads and interprets the project's `lakefile.lean` and its
+  // imported build scripts, so it executes project-owned code: refuse it until
+  // the host grants project trust (#4269).
+  executesProjectCode: true,
+  command: "lake",
+  args: ["serve"]
+});
 var SwiftServer = createInteractiveServer({
   id: "swift",
   name: "SourceKit-LSP",
+  executesProjectCode: true,
   extensions: KIND_EXTENSIONS["swift"],
   root: createRootDetector(["Package.swift"]),
   language: "swift",
@@ -3953,6 +4272,7 @@ var SwiftServer = createInteractiveServer({
 });
 var DartServer = createInteractiveServer({
   id: "dart",
+  executesProjectCode: true,
   name: "Dart Analysis Server",
   extensions: KIND_EXTENSIONS["dart"],
   root: RootWithFallback(createRootDetector(["pubspec.yaml"])),
@@ -4006,6 +4326,7 @@ var CppServer = createTreeBinaryServer({
 });
 var ZigServer = {
   id: "zig",
+  executesProjectCode: true,
   idleEviction: "unmeasured",
   role: "language",
   name: "ZLS",
@@ -4023,6 +4344,7 @@ var ZigServer = {
 var HaskellServer = createInteractiveServer({
   id: "haskell",
   name: "Haskell Language Server",
+  executesProjectCode: true,
   extensions: KIND_EXTENSIONS["haskell"],
   root: createRootDetector(["stack.yaml", "cabal.project", "*.cabal"]),
   language: "haskell",
@@ -4032,6 +4354,7 @@ var HaskellServer = createInteractiveServer({
 var ElixirServer = createInteractiveServer({
   id: "elixir",
   name: "ElixirLS",
+  executesProjectCode: true,
   extensions: KIND_EXTENSIONS["elixir"],
   root: RootWithFallback(createRootDetector(["mix.exs"])),
   language: "elixir",
@@ -4042,6 +4365,7 @@ var ElixirExpertServer = {
   idleEviction: "unmeasured",
   role: "language",
   name: "Expert",
+  executesProjectCode: true,
   fallbackFor: "elixir",
   extensions: KIND_EXTENSIONS["elixir"],
   root: RootWithFallback(createRootDetector(["mix.exs"])),
@@ -4074,6 +4398,7 @@ var GleamServer = {
 };
 var TinymistServer = {
   id: "tinymist",
+  executesProjectCode: true,
   idleEviction: "unmeasured",
   role: "language",
   name: "Tinymist",
@@ -4110,6 +4435,7 @@ var MarksmanServer = {
 };
 var OCamlServer = createInteractiveServer({
   id: "ocaml",
+  executesProjectCode: true,
   name: "ocamllsp",
   extensions: KIND_EXTENSIONS["ocaml"],
   root: createRootDetector(["dune-project", "opam"]),
@@ -4118,6 +4444,7 @@ var OCamlServer = createInteractiveServer({
 });
 var ClojureServer = {
   id: "clojure",
+  executesProjectCode: true,
   idleEviction: "transparent",
   role: "language",
   name: "Clojure LSP",
@@ -4150,6 +4477,7 @@ var CueServer = {
 };
 var TerraformServer = {
   id: "terraform",
+  executesProjectCode: true,
   idleEviction: "unmeasured",
   role: "language",
   name: "Terraform LSP",
@@ -4166,6 +4494,7 @@ var TerraformServer = {
 };
 var NixServer = createInteractiveServer({
   id: "nix",
+  executesProjectCode: true,
   name: "nixd",
   extensions: KIND_EXTENSIONS["nix"],
   root: createRootDetector(["flake.nix"]),
@@ -4234,6 +4563,7 @@ var FishServer = {
 };
 var CMakeServer = {
   id: "cmake",
+  executesProjectCode: true,
   idleEviction: "unmeasured",
   role: "language",
   name: "CMake Language Server",
@@ -4404,6 +4734,7 @@ var PrismaServer = {
 };
 var VueServer = {
   id: "vue",
+  executesProjectCode: true,
   idleEviction: "unmeasured",
   role: "language",
   name: "Vue Language Server",
@@ -4426,9 +4757,9 @@ var VueServer = {
   clientWaitTimeoutMs: 3e4,
   initializeTimeoutMs: 3e4,
   async spawn(root, options) {
-    const tsserverPath = await findTsserverPath(root, options?.allowInstall);
-    const hasPackageJson = existsSync3(path7.join(root, "package.json"));
-    const hasNodeModules = existsSync3(path7.join(root, "node_modules"));
+    const tsserverPath = await findTsserverPath(root, options?.allowInstall, options);
+    const hasPackageJson = existsSync3(path6.join(root, "package.json"));
+    const hasNodeModules = existsSync3(path6.join(root, "node_modules"));
     if (hasPackageJson && !hasNodeModules) {
       logSessionStart(`lsp vue: node_modules missing in ${root} \u2014 Vue navigation may be limited. Run: npm install (or pnpm/yarn install) in this project.`);
     }
@@ -4443,12 +4774,13 @@ var VueServer = {
     return {
       process: proc.process,
       source: proc.source,
-      initialization: tsserverPath ? { typescript: { tsdk: path7.dirname(tsserverPath) } } : void 0
+      initialization: tsserverPath ? { typescript: { tsdk: path6.dirname(tsserverPath) } } : void 0
     };
   }
 };
 var SvelteServer = {
   id: "svelte",
+  executesProjectCode: true,
   idleEviction: "unmeasured",
   role: "language",
   name: "Svelte Language Server",
@@ -4469,7 +4801,7 @@ var SvelteServer = {
   clientWaitTimeoutMs: 2e4,
   initializeTimeoutMs: 2e4,
   async spawn(root, options) {
-    const tsserverPath = await findTsserverPath(root, options?.allowInstall);
+    const tsserverPath = await findTsserverPath(root, options?.allowInstall, options);
     const proc = await resolveAndLaunch({
       candidates: [
         ...nodeBinCandidates(root, "svelteserver"),
@@ -4484,7 +4816,7 @@ var SvelteServer = {
     return {
       process: proc.process,
       source: proc.source,
-      initialization: tsserverPath ? { typescript: { tsdk: path7.dirname(tsserverPath) } } : void 0
+      initialization: tsserverPath ? { typescript: { tsdk: path6.dirname(tsserverPath) } } : void 0
     };
   }
 };
@@ -4735,6 +5067,7 @@ var LSP_SERVERS = [
   FSharpServer,
   JavaServer,
   KotlinServer,
+  LeanServer,
   SwiftServer,
   DartServer,
   LuaServer,
@@ -4777,6 +5110,54 @@ function getServerById(id) {
   return LSP_SERVERS.find((server) => server.id === id);
 }
 
+// dist/clients/lsp/session-roots.js
+import path7 from "node:path";
+var SESSION_ROOT_CAP = 128;
+var sessionRoots = new BoundedFifoMap(SESSION_ROOT_CAP);
+function noteEvictedRoots(evicted) {
+  const roots = evicted.map(([root]) => root);
+  if (roots.length > 0) {
+    incrementDegradationCount({
+      kind: "lsp-session-root-evicted",
+      subject: `cap=${SESSION_ROOT_CAP}`,
+      reason: `session root registry at capacity; will load the dropped root again on the next session start or tool call naming it (dropped: ${roots[0]})`
+    });
+  }
+  return roots;
+}
+function registerSessionRoot(cwd) {
+  const root = path7.resolve(cwd);
+  if (sessionRoots.has(root))
+    return [];
+  return noteEvictedRoots(sessionRoots.set(root, void 0));
+}
+function setSessionRootConfig(cwd, config) {
+  return noteEvictedRoots(sessionRoots.set(path7.resolve(cwd), config));
+}
+function sessionRootConfigEntries() {
+  return sessionRoots;
+}
+function isSessionRootRegistered(cwd) {
+  return sessionRoots.has(path7.resolve(cwd));
+}
+function shouldInitializeSessionRoot(cwd, readyRoots) {
+  const normalized = path7.resolve(cwd);
+  return !readyRoots.has(normalized) || !isSessionRootRegistered(normalized);
+}
+function isOutsideAllSessionRoots(filePath) {
+  if (sessionRoots.size === 0)
+    return false;
+  const resolved = path7.resolve(filePath);
+  for (const root of sessionRoots.keys()) {
+    if (isSameOrWithin(root, resolved))
+      return false;
+  }
+  return true;
+}
+function getSessionRootsForTelemetry(limit = 4) {
+  return [...sessionRoots.keys()].sort((a, b) => Number(a > b) - Number(a < b)).slice(0, limit);
+}
+
 export {
   findLocalTyposConfig,
   getAstGrepRuleSources,
@@ -4784,6 +5165,11 @@ export {
   isAuxiliary,
   serverTraits,
   registerRunnerId,
+  withLspProjectCodePermission,
+  refuseUntrustedLspExecution,
+  resolveAnalysisRootPath,
+  resolveAnalysisRoot,
+  canWriteAnalysisRoot,
   BUILTIN_SERVER_RUNNER_COVERS,
   describeRootFallback,
   resolveLspServerCwd,