fix(editor): colour PHP variables and function calls

PHP editors showed $variables and function calls in the plain text colour, because the Language Defaults that PHP inherits leave both uncoloured. The built-in schemes now give PHP its own colours for them (PHP_VAR, PHP_FUNCTION_CALL): each scheme's instance-field purple and function blue. An imported scheme's PHP_VAR / PHP_FUNCTION_CALL and the user's PHP overrides still take precedence.
fix(tomcat): keep the web app's META-INF/context.xml in the generated descriptor (#1576 )
2026-11-07 10:16:03 -10:00 · 2026-11-05 23:07:58 +08:00 · 2026-11-05 22:53:08 +08:00 · 2026-11-05 22:38:10 +08:00 · 2026-11-05 22:32:09 +08:00 · 2026-11-05 22:29:41 +08:00
1070 changed files with 102456 additions and 6066 deletions
@@ -1,4 +1,4 @@
-Closes #
+<!-- If this resolves an issue: Closes #<n> -->

 ## What and why

@@ -9,7 +9,8 @@ Closes #

 <!-- Required. Commands you actually ran and their results; what else this could
     affect and how you checked it still works.
-     UI changes: before/after screenshots. Multi-step interactions: a recording.
+     Visible UI changes: before/after screenshots (not for removed UI or copy-only
+     changes). Multi-step interactions: a recording.
     Backend changes: logs or command output. -->

 ## Review focus
@@ -7,6 +7,9 @@ on:
    types: [opened, synchronize, reopened]
  workflow_dispatch:

+permissions:
+  contents: read
+
 concurrency:
  group: ci-${{ github.ref }}
  # A newer push supersedes the run in progress, on main too.
@@ -15,20 +18,64 @@ concurrency:
 env:
  CARGO_TERM_COLOR: always
  CARGO_INCREMENTAL: 0
+  # Line tables keep test backtraces readable; full debuginfo only adds build time and cache size.
+  CARGO_PROFILE_DEV_DEBUG: line-tables-only

 jobs:
+  # Which parts a pull request touches, so jobs it can't affect skip and leave the
+  # shared runners to others. Pushes and manual runs always run everything.
+  changes:
+    name: Changes
+    runs-on: ubuntu-latest
+    timeout-minutes: 5
+    permissions:
+      pull-requests: read
+    outputs:
+      rust: ${{ steps.classify.outputs.rust }}
+      frontend: ${{ steps.classify.outputs.frontend }}
+    steps:
+      - id: classify
+        env:
+          GH_TOKEN: ${{ github.token }}
+          PR: ${{ github.event.pull_request.number }}
+        run: |
+          set -euo pipefail
+          if [ "$GITHUB_EVENT_NAME" != pull_request ]; then
+            echo "rust=true" >> "$GITHUB_OUTPUT"
+            echo "frontend=true" >> "$GITHUB_OUTPUT"
+            exit 0
+          fi
+          gh api --paginate "repos/$GITHUB_REPOSITORY/pulls/$PR/files" \
+            --jq '.[] | .filename, (.previous_filename // empty)' > files.txt
+          cat files.txt
+          docs='^(docs/|\.agents/|\.claude/|\.idea/|\.github/ISSUE_TEMPLATE/|\.github/pull_request_template\.md$|[^/]+\.md$|LICENSE$|NOTICE$)'
+          # Frontend-only paths. The Rust code embeds a few files under src/; those stay out.
+          web='^(src/|e2e/|perf/|public/|scripts/|smoke/|index\.html$|vite\.config\.ts$|tsconfig[^/]*\.json$|knip\.ts$|playwright\.config\.ts$|\.oxlintrc\.json$|\.oxfmtrc\.json$)'
+          embedded='^src/(bindings\.ts|styles/tokens\.css|features/plugins/views/frame-bridge\.js|platform/keymaps/)'
+          # A job runs when any changed file falls outside the paths that can't affect it.
+          rust=false
+          if grep -Ev "$docs|$web" files.txt | grep -q . || grep -Eq "$embedded" files.txt; then rust=true; fi
+          frontend=false
+          if grep -Ev "$docs" files.txt | grep -q .; then frontend=true; fi
+          echo "rust=$rust frontend=$frontend"
+          echo "rust=$rust" >> "$GITHUB_OUTPUT"
+          echo "frontend=$frontend" >> "$GITHUB_OUTPUT"
+
  rust:
    name: Rust (${{ matrix.os }})
+    needs: changes
+    if: needs.changes.outputs.rust == 'true'
+    timeout-minutes: 60
    strategy:
      fail-fast: false
      matrix:
        os: [macos-latest, ubuntu-22.04, windows-latest]
    runs-on: ${{ matrix.os }}
    steps:
-      - uses: actions/checkout@v4
-      - uses: pnpm/action-setup@v4
+      - uses: actions/checkout@v5
+      - uses: pnpm/action-setup@v5
        with: { version: 11 }
-      - uses: actions/setup-node@v4
+      - uses: actions/setup-node@v5
        with: { node-version: 22, cache: pnpm }
      - uses: dtolnay/rust-toolchain@stable
        with: { components: "clippy, rustfmt" }
@@ -60,9 +107,12 @@ jobs:
  # keep that build working.
  server:
    name: Remote server (linux musl)
+    needs: changes
+    if: needs.changes.outputs.rust == 'true'
+    timeout-minutes: 40
    runs-on: ubuntu-22.04
    steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v5
      - uses: dtolnay/rust-toolchain@stable
        with: { targets: x86_64-unknown-linux-musl }
      - uses: Swatinem/rust-cache@v2
@@ -75,11 +125,14 @@ jobs:
  # own workspaces (the root excludes them), so the jobs above don't see them.
  plugins:
    name: Plugins (SDK, official, fixtures)
+    needs: changes
+    if: needs.changes.outputs.rust == 'true'
+    timeout-minutes: 30
    runs-on: ubuntu-22.04
    env:
      CARGO_TARGET_DIR: ${{ github.workspace }}/target-plugins
    steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v5
      - uses: dtolnay/rust-toolchain@stable
        with: { targets: wasm32-wasip2, components: "clippy, rustfmt" }
      - uses: Swatinem/rust-cache@v2
@@ -100,9 +153,9 @@ jobs:
            cargo test --locked --manifest-path "$dir/Cargo.toml"
            echo "::endgroup::"
          done
-      - uses: pnpm/action-setup@v4
+      - uses: pnpm/action-setup@v5
        with: { version: 11 }
-      - uses: actions/setup-node@v4
+      - uses: actions/setup-node@v5
        with: { node-version: 22 }
      # Plugin web pages (`web-src/`, their own pnpm projects): typecheck and test.
      - name: Web pages typecheck and test
@@ -124,21 +177,27 @@ jobs:

  deny:
    name: Cargo deny
+    needs: changes
+    if: needs.changes.outputs.rust == 'true'
+    timeout-minutes: 15
    runs-on: ubuntu-latest
    steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v5
      - uses: dtolnay/rust-toolchain@stable
      - uses: taiki-e/install-action@cargo-deny
      - run: cargo deny check

  frontend:
    name: Frontend
+    needs: changes
+    if: needs.changes.outputs.frontend == 'true'
+    timeout-minutes: 30
    runs-on: ubuntu-22.04
    steps:
-      - uses: actions/checkout@v4
-      - uses: pnpm/action-setup@v4
+      - uses: actions/checkout@v5
+      - uses: pnpm/action-setup@v5
        with: { version: 11 }
-      - uses: actions/setup-node@v4
+      - uses: actions/setup-node@v5
        with: { node-version: 22, cache: pnpm }
      - run: pnpm install --frozen-lockfile
      - run: pnpm typecheck
@@ -150,20 +209,23 @@ jobs:

  e2e:
    name: E2E
+    needs: changes
+    if: needs.changes.outputs.frontend == 'true'
+    timeout-minutes: 30
    runs-on: ubuntu-24.04
    # Browsers and their system libraries are preinstalled; keep the tag in step with @playwright/test.
    container: mcr.microsoft.com/playwright:v1.64.1-noble
    steps:
-      - uses: actions/checkout@v4
-      - uses: pnpm/action-setup@v4
+      - uses: actions/checkout@v5
+      - uses: pnpm/action-setup@v5
        with: { version: 11 }
-      - uses: actions/setup-node@v4
+      - uses: actions/setup-node@v5
        with: { node-version: 22, cache: pnpm }
      - run: pnpm install --frozen-lockfile
      - run: pnpm e2e
        env:
          HOME: /root
-      - uses: actions/upload-artifact@v4
+      - uses: actions/upload-artifact@v6
        if: failure()
        with:
          name: playwright-report
@@ -0,0 +1,125 @@
+name: Language smoke
+# Everyday code intelligence (completion, go to definition, Find Usages, hover, diagnostics
+# with a quick fix, an intention, formatting, rename) per language, against the language
+# server the app starts by default: crates/ide-host/tests/language_smoke.rs.
+# Opening the fixture with its build tool and SDK (Maven / Gradle sync, the virtualenv, the
+# JDK): the ignored tests of crates/ide-host/tests/project_smoke.rs.
+# Then running and testing each fixture through the run store and openidea-server
+# (Run, Run tests, the test tree, Rerun Failed Tests): smoke/run.test.ts; and debugging its
+# entry point with the debugger the IDE installs (breakpoint, frames, variables, evaluate,
+# Step Over, Resume): smoke/debug.test.ts.
+on:
+  push:
+    branches: [main]
+    paths: &paths
+      - "crates/**"
+      - "languages/**"
+      - "fixtures/**"
+      - "Cargo.toml"
+      - "Cargo.lock"
+      - "src/features/run/**"
+      - "src/features/debugger/**"
+      - "src/platform/**"
+      - "smoke/**"
+      - "package.json"
+      - "pnpm-lock.yaml"
+      - ".github/workflows/language-smoke.yml"
+  pull_request:
+    branches: [main]
+    types: [opened, synchronize, reopened]
+    paths: *paths
+  workflow_dispatch:
+
+concurrency:
+  group: language-smoke-${{ github.ref }}
+  # A new push supersedes a PR's run; on main every merge runs to the end (and saves the cache).
+  cancel-in-progress: ${{ github.event_name == 'pull_request' }}
+
+env:
+  CARGO_TERM_COLOR: always
+  CARGO_INCREMENTAL: 0
+  # Pinned so a server release can't fail an unrelated PR; bump them deliberately.
+  VTSLS: 0.3.0
+  TYPESCRIPT: 6.0.3
+  BASEDPYRIGHT: 1.40.2
+  RUFF: 0.17.3
+  GOPLS: v0.24.0
+  JDTLS: 1.63.0-202610191322
+  KOTLIN_LSP: 263.7084.0
+  GRADLE: 8.14.3
+
+jobs:
+  smoke:
+    name: Language smoke (${{ matrix.language }})
+    strategy:
+      fail-fast: false
+      matrix:
+        language: [typescript, python, rust, go, java, kotlin]
+    runs-on: ubuntu-22.04
+    timeout-minutes: 40
+    steps:
+      - uses: actions/checkout@v4
+      - uses: dtolnay/rust-toolchain@stable
+        with: { components: "rust-analyzer, rustfmt" }
+      # One build cache for every language; main saves it.
+      - uses: Swatinem/rust-cache@v2
+        with:
+          shared-key: language-smoke
+          save-if: ${{ github.ref == 'refs/heads/main' && matrix.language == 'rust' }}
+
+      - uses: pnpm/action-setup@v4
+        with: { version: 11 }
+      - uses: actions/setup-node@v4
+        with: { node-version: 22, cache: pnpm }
+      - if: matrix.language == 'typescript'
+        run: npm install --global "@vtsls/language-server@$VTSLS" "typescript@$TYPESCRIPT"
+
+      - if: matrix.language == 'python'
+        uses: actions/setup-python@v5
+        with: { python-version: "3.12" }
+      - if: matrix.language == 'python'
+        run: pip install "basedpyright==$BASEDPYRIGHT" "ruff==$RUFF"
+
+      - if: matrix.language == 'go'
+        uses: actions/setup-go@v5
+        with: { go-version: "1.27", cache: false }
+      - if: matrix.language == 'go'
+        run: go install "golang.org/x/tools/gopls@$GOPLS"
+
+      - if: matrix.language == 'java' || matrix.language == 'kotlin'
+        uses: actions/setup-java@v4
+        with: { distribution: temurin, java-version: "21" }
+      - if: matrix.language == 'java'
+        run: |
+          mkdir -p "$RUNNER_TEMP/jdtls"
+          curl -fsSL "https://download.eclipse.org/jdtls/milestones/${JDTLS%-*}/jdt-language-server-$JDTLS.tar.gz" \
+            | tar xz -C "$RUNNER_TEMP/jdtls"
+          echo "$RUNNER_TEMP/jdtls/bin" >> "$GITHUB_PATH"
+
+      # The Kotlin fixture has no Gradle wrapper: the server imports it with the Gradle on PATH.
+      - if: matrix.language == 'kotlin'
+        uses: gradle/actions/setup-gradle@v4
+        with: { gradle-version: "${{ env.GRADLE }}" }
+      - if: matrix.language == 'kotlin'
+        run: |
+          mkdir -p "$RUNNER_TEMP/kotlin-lsp" "$RUNNER_TEMP/bin"
+          curl -fsSL "https://download.jetbrains.com/language-server/kotlin-server/$KOTLIN_LSP/kotlin-server-$KOTLIN_LSP.tar.gz" \
+            | tar xz -C "$RUNNER_TEMP/kotlin-lsp" --strip-components=1
+          ln -s "$RUNNER_TEMP/kotlin-lsp/kotlin-lsp.sh" "$RUNNER_TEMP/bin/kotlin-lsp"
+          echo "$RUNNER_TEMP/bin" >> "$GITHUB_PATH"
+
+      - run: cargo test --locked -p ide-host --test language_smoke --no-run
+      - run: cargo test --locked -p ide-host --test language_smoke -- --ignored --exact ${{ matrix.language }}
+      - if: matrix.language == 'java'
+        run: cargo test --locked -p ide-host --test project_smoke -- --ignored --exact maven_sync jdk
+      - if: matrix.language == 'kotlin'
+        run: cargo test --locked -p ide-host --test project_smoke -- --ignored --exact gradle_sync
+      - if: matrix.language == 'python'
+        run: cargo test --locked -p ide-host --test project_smoke -- --ignored --exact python_venv
+
+      - run: pnpm install --frozen-lockfile
+      - run: cargo build --locked -p ide-host --bin openidea-server
+      - run: pnpm smoke smoke/run.test.ts -t "^${{ matrix.language }}$"
+      - run: pnpm smoke smoke/debug.test.ts -t "^${{ matrix.language }}$"
+        # The IDE installs the debugger from GitHub releases: authenticated, against rate limits.
+        env: { GITHUB_TOKEN: "${{ github.token }}" }
@@ -0,0 +1,46 @@
+name: Plugin index
+
+# Refreshes the community plugins in the latest release's plugins-index.json
+# (what released apps read) from the registry, l0ng-ai/openidea-plugins. The
+# official plugins, their key and revocations stay as the release wrote them.
+on:
+  schedule:
+    - cron: "17 * * * *"
+  workflow_dispatch:
+  # Sent by the registry when its index changes.
+  repository_dispatch:
+    types: [community-plugins]
+
+permissions:
+  contents: write
+
+concurrency:
+  group: plugins-index
+
+env:
+  COMMUNITY_PLUGINS_INDEX: https://github.com/l0ng-ai/openidea-plugins/releases/download/index/index.json
+
+jobs:
+  merge:
+    runs-on: ubuntu-latest
+    steps:
+      - name: Merge the community index
+        env:
+          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+        run: |
+          set -euo pipefail
+          cd "$RUNNER_TEMP"
+          tag="$(gh release view --repo "$GITHUB_REPOSITORY" --json tagName -q .tagName)"
+          tool=openidea-plugin-linux-x86_64
+          if ! gh release download "$tag" --repo "$GITHUB_REPOSITORY" -p plugins-index.json -p "$tool.gz"; then
+            echo "::notice::$tag has no plugin index or openidea-plugin tool yet"
+            exit 0
+          fi
+          gunzip "$tool.gz" && chmod +x "$tool"
+          cp plugins-index.json before.json
+          "./$tool" merge plugins-index.json "$COMMUNITY_PLUGINS_INDEX" --keep openidea
+          if cmp -s before.json plugins-index.json; then
+            echo "unchanged"
+          else
+            gh release upload "$tag" plugins-index.json --repo "$GITHUB_REPOSITORY" --clobber
+          fi
@@ -18,24 +18,15 @@ jobs:
    if: github.event.pull_request.user.type != 'Bot' && !github.event.pull_request.draft
    runs-on: ubuntu-latest
    steps:
-      - uses: actions/github-script@v7
+      - uses: actions/github-script@v8
        with:
          script: |
            const pr = context.payload.pull_request;
            const LABEL = 'needs-info';
            const MARKER = '<!-- pr-check -->';
-            // Docs, CI and pure refactors may skip the linked issue.
-            const NO_ISSUE_TYPES = /^(docs|ci|build|chore|refactor|style|test)(\(.+\))?!?:/;
-
            const body = (pr.body || '').replace(/<!--[\s\S]*?-->/g, '');
            const problems = [];

-            const linksIssue =
-              /\b(close[sd]?|fix(e[sd])?|resolve[sd]?)\s*:?\s+(#\d+|https:\/\/github\.com\/[\w.-]+\/[\w.-]+\/issues\/\d+)/i.test(body);
-            if (!linksIssue && !NO_ISSUE_TYPES.test(pr.title)) {
-              problems.push('Link the issue this PR resolves, e.g. `Closes #123`.');
-            }
-
            const verified = body.match(/^##+\s*How it was verified\s*$([\s\S]*?)(?=^##+\s|(?![\s\S]))/im);
            if (!verified || !verified[1].trim()) {
              problems.push('Fill in **How it was verified**: the commands you ran and their results. UI changes need before/after screenshots.');
@@ -18,6 +18,7 @@ env:
  CARGO_TERM_COLOR: always
  CARGO_INCREMENTAL: 0
  TAG: ${{ github.event.inputs.tag || github.ref_name }}
+  COMMUNITY_PLUGINS_INDEX: https://github.com/l0ng-ai/openidea-plugins/releases/download/index/index.json

 jobs:
  # Creates (or reuses) one draft release that every platform build uploads into.
@@ -25,8 +26,9 @@ jobs:
    runs-on: ubuntu-latest
    outputs:
      release_id: ${{ steps.release.outputs.id }}
+      official_plugin_keys: ${{ steps.plugin-keys.outputs.keys }}
    steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v5
        with: { ref: "${{ env.TAG }}" }
      - name: Tag matches app version
        run: |
@@ -35,8 +37,32 @@ jobs:
            echo "::error::tag $TAG does not match tauri.conf.json version $app"
            exit 1
          fi
+      # A shipped plugin API is frozen: its WIT must be the snapshot api_frozen.rs checks later
+      # versions against (plugins/README.md, "Evolving the plugin API").
+      - name: Plugin API snapshot matches wit/
+        run: |
+          api() { sed -n 's/^package openidea:plugin@\(.*\);$/\1/p' "$1/plugin.wit"; }
+          snapshot=sdk/rust/openidea-plugin/tests/api/released
+          if [ "$(api wit)" != "$(api "$snapshot")" ]; then
+            echo "::error::plugin API $(api wit) ships without a snapshot ($snapshot is $(api "$snapshot")): copy wit/*.wit to $snapshot/"
+            exit 1
+          fi
+      # The official plugins' public key (from PLUGIN_SIGNING_KEY, the seed
+      # `openidea-plugin keygen` writes), built into the app: their packages
+      # must carry its signature whatever the marketplace index lists. Without
+      # the secret the app takes the index's word, as development builds do.
+      - id: plugin-keys
+        env:
+          SIGNING_KEY: ${{ secrets.PLUGIN_SIGNING_KEY }}
+        run: |
+          if [ -n "$SIGNING_KEY" ]; then
+            seed="$(printf %s "$SIGNING_KEY" | base64 -d | od -An -tx1 | tr -d ' \n')"
+            key="$(printf '302e020100300506032b657004220420%s' "$seed" | xxd -r -p |
+              openssl pkey -inform DER -pubout -outform DER | tail -c 32 | base64)"
+            echo "keys=$key" >> "$GITHUB_OUTPUT"
+          fi
      - id: release
-        uses: actions/github-script@v7
+        uses: actions/github-script@v8
        with:
          script: |
            const tag = process.env.TAG;
@@ -57,6 +83,8 @@ jobs:
  build:
    needs: create-release
    name: Build (${{ matrix.name }})
+    env:
+      OPENIDEA_OFFICIAL_PLUGIN_KEYS: ${{ needs.create-release.outputs.official_plugin_keys }}
    strategy:
      fail-fast: false
      matrix:
@@ -81,11 +109,11 @@ jobs:
            target: x86_64-pc-windows-msvc
    runs-on: ${{ matrix.os }}
    steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v5
        with: { ref: "${{ env.TAG }}" }
-      - uses: pnpm/action-setup@v4
+      - uses: pnpm/action-setup@v5
        with: { version: 11 }
-      - uses: actions/setup-node@v4
+      - uses: actions/setup-node@v5
        with: { node-version: 22, cache: pnpm }
      - uses: dtolnay/rust-toolchain@stable
        with: { targets: "${{ matrix.target }}" }
@@ -155,7 +183,7 @@ jobs:
          - { runner: macos-latest, target: x86_64-apple-darwin, os: macos, arch: x86_64 }
    runs-on: ${{ matrix.runner }}
    steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v5
        with: { ref: "${{ env.TAG }}" }
      - uses: dtolnay/rust-toolchain@stable
        with: { targets: "${{ matrix.target }}" }
@@ -184,7 +212,11 @@ jobs:
  # (releases/latest/download/plugins-index.json). They are not in the
  # installers: users install them from Settings › Plugins. Without the
  # signing key (secret PLUGIN_SIGNING_KEY: the file `openidea-plugin keygen`
-  # writes) nothing is published and the release goes on.
+  # writes) nothing is published and the release goes on. The index also lists
+  # the community plugins of the registry (COMMUNITY_PLUGINS_INDEX; refreshed
+  # between releases by plugins-index.yml), and the release carries the
+  # openidea-plugin tool for Linux x64, which that workflow and the registry's
+  # checks run.
  plugins:
    needs: create-release
    name: Official plugins
@@ -198,7 +230,7 @@ jobs:
            echo "::warning::PLUGIN_SIGNING_KEY is not set: the official plugins are not published"
            echo "skip=true" >> "$GITHUB_OUTPUT"
          fi
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v5
        if: steps.key.outputs.skip != 'true'
        with: { ref: "${{ env.TAG }}" }
      - uses: dtolnay/rust-toolchain@stable
@@ -207,10 +239,10 @@ jobs:
      - uses: Swatinem/rust-cache@v2
        if: steps.key.outputs.skip != 'true'
        with: { key: release-plugins }
-      - uses: pnpm/action-setup@v4
+      - uses: pnpm/action-setup@v5
        if: steps.key.outputs.skip != 'true'
        with: { version: 11 }
-      - uses: actions/setup-node@v4
+      - uses: actions/setup-node@v5
        if: steps.key.outputs.skip != 'true'
        with: { node-version: 22 }
      # Builds the web pages; fails when a checked-in component isn't built from these sources.
@@ -237,11 +269,17 @@ jobs:
            version="$(sed -n 's/^version *= *"\(.*\)".*/\1/p' "$dir/plugin.toml" | head -1)"
            "$tool" pack "$dir" --key "$key" --publisher openidea --out "$out/$id-$version.oiplugin"
          done
-          # The published index's revocations and earlier keys carry over.
+          # The published index's revocations, earlier keys and community plugins carry over.
          curl -fsSL "https://github.com/$GITHUB_REPOSITORY/releases/latest/download/plugins-index.json" \
            -o "$out/plugins-index.json" || rm -f "$out/plugins-index.json"
-          "$tool" index "$out" --publisher openidea --name OpenIDEA --key "$key" --out "$out/plugins-index.json"
-          gh release upload "$TAG" "$out"/*.oiplugin "$out/plugins-index.json" --clobber
+          # Downloads point at this release: older versions kept for older IDEs stay where they were published.
+          "$tool" index "$out" --publisher openidea --name OpenIDEA --key "$key" --out "$out/plugins-index.json" \
+            --download-base "https://github.com/$GITHUB_REPOSITORY/releases/download/$TAG"
+          "$tool" merge "$out/plugins-index.json" "$COMMUNITY_PLUGINS_INDEX" --keep openidea ||
+            echo "::warning::the community plugins were not refreshed"
+          gzip -9 -c "$tool" > "$out/openidea-plugin-linux-x86_64.gz"
+          gh release upload "$TAG" "$out"/*.oiplugin "$out/plugins-index.json" \
+            "$out/openidea-plugin-linux-x86_64.gz" --clobber

  # The updater manifest (latest.json), built once from the signed bundles every build uploaded.
  # Fails when a platform is missing, so a release never ships a manifest without it.
@@ -249,7 +287,7 @@ jobs:
    needs: [create-release, build]
    runs-on: ubuntu-latest
    steps:
-      - uses: actions/github-script@v7
+      - uses: actions/github-script@v8
        env:
          RELEASE_ID: ${{ needs.create-release.outputs.release_id }}
        with:
@@ -309,7 +347,7 @@ jobs:
    needs: [create-release, build, server, plugins, updater-manifest]
    runs-on: ubuntu-latest
    steps:
-      - uses: actions/github-script@v7
+      - uses: actions/github-script@v8
        env:
          RELEASE_ID: ${{ needs.create-release.outputs.release_id }}
        with:
@@ -18,9 +18,12 @@ Visual style: dark, low-contrast greys, one cool accent
 - `src/ui/` — design-system primitives. `src/features/<name>/` — one feature each,
  exporting `activate()` registered in `src/features/index.ts`.
 - `languages/<id>.toml` — language definitions (detection, comments, LSP, DAP).
- `crates/ide-host` — the `openidea-server` binary for remote development.
- `wit/` — plugin interface definitions; `plugins/` — sample and bundled plugins;
-  `templates/` — plugin starter templates.
+- `crates/ide-host` — the `openidea-server` binary for remote development and the
+  `openidea-plugin` CLI (plugin starter templates live in its `templates.rs`).
+- `wit/` — plugin interface definitions; `plugins/` — sample and bundled plugins.
+  Plugin docs: `plugins/README.md`, `docs/plugins/themes.md`.
+- `java/` — JDT LS extension bundles (`java-usages`, `kotlin-bridge`) and the patched
+  Lombok agent, embedded into the app by `ide-sdk` / `ide-tools`.
 - `e2e/` — Playwright UI tests (`pnpm e2e`). `fixtures/` — sample projects per language
  for manual and automated testing.

@@ -39,15 +42,17 @@ Visual style: dark, low-contrast greys, one cool accent
  icons from `src/ui/icons.tsx`, never emoji. Real `<button>`/`<input>`; `aria-label` on icon buttons.
 - User-visible text goes through the text catalog: add every new string to both
  `src/platform/locales/text/en.json` and `zh.json` (`textCatalog.test.ts` enforces it).
+  Other locales may lack entries; their UI shows the English text until a translator adds it.
 - Keep comments sparse and purposeful; match surrounding style.
 - For GUI verification, prefer Tauri MCP; use Computer Use only when Tauri MCP is
  unavailable or cannot cover the required checks.

 ## Issues & PRs

-Follow `CONTRIBUTING.md` and `.github/pull_request_template.md`: one issue per PR with
-`Closes #<n>`, reproduce first, keep the diff focused, short plain description, and a
-**How it was verified** section with commands run, results and (for UI) before/after screenshots.
+Follow `CONTRIBUTING.md` and `.github/pull_request_template.md`: one problem per PR
+(`Closes #<n>` when it resolves an issue), reproduce first, keep the diff focused, short plain description, and a
+**How it was verified** section with commands run, results and, when the change alters what users
+see, before/after screenshots (not for UI removed along with a feature, copy-only or non-visual changes).
 Unclear product decisions → `needs-decision` and stop.

 ## Skills
@@ -63,6 +68,13 @@ Shared agent skills live in `.agents/skills/` (`.claude/skills/` links to them):
  this worktree's running MCP bridges and actual ports.
 - `pnpm build` — typecheck + bundle frontend.
 - `cargo nextest run --workspace` (or `cargo test`), `cargo clippy --workspace --all-targets -- -D warnings`, `cargo fmt --all`.
+- `cargo test -p ide-host --test language_smoke -- --ignored --exact <language>` — code intelligence
+  on `fixtures/` with that language's real server installed (CI: `Language smoke`, pinned versions).
+- `pnpm smoke smoke/run.test.ts -t <language>` — run and test that language's fixture through the
+  run store and a real `openidea-server` (build it first: `cargo build -p ide-host --bin openidea-server`).
+- `pnpm smoke smoke/debug.test.ts -t <language>` — debug that fixture's entry point the same way, with
+  the debugger the IDE installs (on macOS, CodeLLDB and Delve may need Developer Mode:
+  `sudo DevToolsSecurity -enable`).
 - `pnpm test`, `pnpm e2e`, `pnpm lint`, `pnpm format:check`, `pnpm knip`, `pnpm typecheck`,
  `pnpm gen:bindings`.
 - `pnpm perf` (UI interaction latency / frames / leaks), `pnpm perf:rust` (criterion
@@ -110,8 +122,8 @@ Several worktrees can be developed and run side by side.
  default MCP session belongs to this worktree.
 - Keep each worktree's Cargo output directory separate; do not point `CARGO_TARGET_DIR` or
  `target` symlinks at a shared directory.
- Each worktree's first build is cold (around 5 minutes) and its Cargo output takes
-  15–30 GB. Avoid running several heavy builds on one machine at the same time.
+- Each worktree's first build is cold (several minutes) and `cargo build` output takes
+  around 9 GB; tests, clippy and incremental builds add more. Avoid running several heavy builds on one machine at the same time.
 - Stop only processes started for the current worktree/session. Never use broad
  process-name kills such as `pkill openidea`.
 - When done: stop that worktree's app and dev session, delete its build output, then
@@ -16,8 +16,7 @@ Project layout, coding rules, commands and checks are in [AGENTS.md](AGENTS.md).

 ## Pull requests

- One issue per PR, linked with `Closes #123`. Feature PRs need a `planned` issue.
-  Docs, CI and pure refactors may skip the issue.
+- One problem per PR. If it resolves an issue, link it with `Closes #123`.
 - Reproduce the problem first, or write a test that fails before the fix.
 - Fix the cause, and check whether the same cause breaks anything nearby.
 - Keep the diff focused. Unrelated refactors go in their own PR.
@@ -26,10 +25,15 @@ Project layout, coding rules, commands and checks are in [AGENTS.md](AGENTS.md).
 - Fill in the template. Keep the description short and in plain words. If it
  doesn't fit in a few sentences, the PR is probably too big.
 - **How it was verified** is required: the commands you ran and their results,
-  and what else the change could affect. UI changes need before/after screenshots;
-  multi-step interactions need a recording.
+  and what else the change could affect. Changes to what users see need before/after
+  screenshots; multi-step interactions need a recording. UI that goes away with a removed
+  feature, copy-only and non-visual changes don't; say what you checked instead.
 - If a change needs a product decision you can't make, ask in the issue and stop
  rather than guessing.

-A check on each PR adds `needs-info` when the issue link or the verification
-section is missing, and removes it once they're filled in.
+Plugins: pull requests here add or change official plugins (`plugins/official/`)
+and the plugin API. Community plugins live in their authors' repositories and
+are listed through [l0ng-ai/openidea-plugins](https://github.com/l0ng-ai/openidea-plugins);
+see [`plugins/README.md`](plugins/README.md) § 8.1.
+
+A check on each PR adds `needs-info` when the verification section is missing, and removes it once it's filled in.
@@ -123,6 +123,17 @@ version = "1.0.104"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "330a5ed07fa54e4702c9d6c4174f74427fc0ef6e214bbd677ae50a5099946470"

+[[package]]
+name = "apple-native-keyring-store"
+version = "1.0.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "2b350bfd03649e07aa05c0a81b3e15934374e585c98204a57e20b9d49f49bb9a"
+dependencies = [
+ "keyring-core",
+ "log",
+ "security-framework",
+]
+
 [[package]]
 name = "arbitrary"
 version = "1.5.0"
@@ -156,6 +167,27 @@ version = "0.7.8"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "d3fb67a6e08acf24fdeccbac2cb6ac4305825bd1f117462e0e6f2f193345ad56"

+[[package]]
+name = "ashpd"
+version = "0.11.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "d2f3f79755c74fd155000314eb349864caa787c6592eace6c6882dad873d9c39"
+dependencies = [
+ "enumflags2",
+ "futures-channel",
+ "futures-util",
+ "rand 0.9.5",
+ "raw-window-handle",
+ "serde",
+ "serde_repr",
+ "tokio",
+ "url",
+ "wayland-backend",
+ "wayland-client",
+ "wayland-protocols",
+ "zbus",
+]
+
 [[package]]
 name = "ast-grep-core"
 version = "0.40.1"
@@ -1464,7 +1496,7 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "d045de693cb712d0b22c6a64be5b953f67b3ce00ab5ad3dd5d8b441886ab8e1a"
 dependencies = [
 "quote",
- "syn 3.0.9",
+ "syn 2.0.119",
 ]

 [[package]]
@@ -1600,6 +1632,7 @@ dependencies = [
 "lock_api",
 "once_cell",
 "parking_lot_core",
+ "serde",
 ]

 [[package]]
@@ -1795,6 +1828,15 @@ dependencies = [
 "syn 3.0.9",
 ]

+[[package]]
+name = "dlib"
+version = "0.5.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "ab8ecd87370524b461f8557c119c405552c396ed91fc0a8eec68679eab26f94a"
+dependencies = [
+ "libloading",
+]
+
 [[package]]
 name = "dlopen2"
 version = "0.8.2"
@@ -2163,15 +2205,6 @@ dependencies = [
 "rustc_version",
 ]

-[[package]]
-name = "file-id"
-version = "0.2.3"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "e1fc6a637b6dc58414714eddd9170ff187ecb0933d4c7024d1abbd23a3cc26e9"
-dependencies = [
- "windows-sys 0.60.2",
-]
-
 [[package]]
 name = "filedescriptor"
 version = "0.8.3"
@@ -2968,7 +3001,7 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "1c48eccd894bd15555b0346470e63491ded94aefe76b3fcb1052084b5a393238"
 dependencies = [
 "bstr",
- "hashbrown 0.17.1",
+ "hashbrown 0.16.1",
 ]

 [[package]]
@@ -4038,7 +4071,7 @@ checksum = "3d3067d79b975e8844ca9eb072e16b31c3c1c36928edf9c6789548c524d0d954"

 [[package]]
 name = "ide-agent"
-version = "0.1.35"
+version = "0.1.37"
 dependencies = [
 "dunce",
 "encoding_rs",
@@ -4061,7 +4094,7 @@ dependencies = [

 [[package]]
 name = "ide-analysis"
-version = "0.1.35"
+version = "0.1.37"
 dependencies = [
 "ast-grep-core",
 "ide-core",
@@ -4073,9 +4106,20 @@ dependencies = [
 "tree-sitter",
 ]

+[[package]]
+name = "ide-android"
+version = "0.1.37"
+dependencies = [
+ "ide-core",
+ "serde",
+ "specta",
+ "tempfile",
+ "which",
+]
+
 [[package]]
 name = "ide-build"
-version = "0.1.35"
+version = "0.1.37"
 dependencies = [
 "dirs 6.0.0",
 "dunce",
@@ -4090,7 +4134,7 @@ dependencies = [

 [[package]]
 name = "ide-clipboard"
-version = "0.1.35"
+version = "0.1.37"
 dependencies = [
 "objc2 0.6.5",
 "objc2-app-kit 0.3.2",
@@ -4099,7 +4143,7 @@ dependencies = [

 [[package]]
 name = "ide-core"
-version = "0.1.35"
+version = "0.1.37"
 dependencies = [
 "dunce",
 "encoding_rs",
@@ -4116,11 +4160,11 @@ dependencies = [

 [[package]]
 name = "ide-coverage"
-version = "0.1.35"
+version = "0.1.37"
 dependencies = [
 "ide-core",
 "ide-run",
- "quick-xml",
+ "quick-xml 0.42.0",
 "serde",
 "serde_json",
 "specta",
@@ -4130,7 +4174,7 @@ dependencies = [

 [[package]]
 name = "ide-dap"
-version = "0.1.35"
+version = "0.1.37"
 dependencies = [
 "ide-core",
 "ide-jsonrpc",
@@ -4148,14 +4192,17 @@ dependencies = [

 [[package]]
 name = "ide-db"
-version = "0.1.35"
+version = "0.1.37"
 dependencies = [
 "bb8",
 "dirs 6.0.0",
 "futures",
 "ide-core",
+ "ide-http",
 "ide-ssh",
 "parking_lot",
+ "reqwest",
+ "rustls",
 "serde",
 "serde_json",
 "specta",
@@ -4166,11 +4213,12 @@ dependencies = [
 "tokio-util",
 "toml 0.9.12+spec-1.1.0",
 "tracing",
+ "uuid",
 ]

 [[package]]
 name = "ide-docker"
-version = "0.1.35"
+version = "0.1.37"
 dependencies = [
 "ide-core",
 "serde",
@@ -4183,7 +4231,7 @@ dependencies = [

 [[package]]
 name = "ide-extension"
-version = "0.1.35"
+version = "0.1.37"
 dependencies = [
 "base64 0.22.1",
 "blake3",
@@ -4203,7 +4251,7 @@ dependencies = [

 [[package]]
 name = "ide-fonts"
-version = "0.1.35"
+version = "0.1.37"
 dependencies = [
 "objc2-core-foundation",
 "objc2-core-text",
@@ -4215,7 +4263,7 @@ dependencies = [

 [[package]]
 name = "ide-github"
-version = "0.1.35"
+version = "0.1.37"
 dependencies = [
 "ide-core",
 "ide-vcs",
@@ -4228,7 +4276,7 @@ dependencies = [

 [[package]]
 name = "ide-host"
-version = "0.1.35"
+version = "0.1.37"
 dependencies = [
 "base64 0.22.1",
 "criterion",
@@ -4268,8 +4316,11 @@ dependencies = [
 "ide-workspace",
 "ignore",
 "parking_lot",
+ "quick-xml 0.42.0",
+ "regex-syntax",
 "reqwest",
 "rustix",
+ "semver",
 "serde",
 "serde_json",
 "specta",
@@ -4286,7 +4337,7 @@ dependencies = [

 [[package]]
 name = "ide-http"
-version = "0.1.35"
+version = "0.1.37"
 dependencies = [
 "ide-core",
 "parking_lot",
@@ -4304,7 +4355,7 @@ dependencies = [

 [[package]]
 name = "ide-index"
-version = "0.1.35"
+version = "0.1.37"
 dependencies = [
 "blake3",
 "criterion",
@@ -4326,7 +4377,7 @@ dependencies = [

 [[package]]
 name = "ide-jsonrpc"
-version = "0.1.35"
+version = "0.1.37"
 dependencies = [
 "encoding_rs",
 "futures",
@@ -4334,6 +4385,7 @@ dependencies = [
 "parking_lot",
 "serde",
 "serde_json",
+ "tempfile",
 "thiserror 2.0.21",
 "tokio",
 "tokio-util",
@@ -4342,7 +4394,7 @@ dependencies = [

 [[package]]
 name = "ide-language"
-version = "0.1.35"
+version = "0.1.37"
 dependencies = [
 "blake3",
 "criterion",
@@ -4398,7 +4450,7 @@ dependencies = [

 [[package]]
 name = "ide-lsp"
-version = "0.1.35"
+version = "0.1.37"
 dependencies = [
 "dunce",
 "futures",
@@ -4424,7 +4476,7 @@ dependencies = [

 [[package]]
 name = "ide-notebook"
-version = "0.1.35"
+version = "0.1.37"
 dependencies = [
 "futures",
 "ide-core",
@@ -4447,7 +4499,7 @@ dependencies = [

 [[package]]
 name = "ide-plugin"
-version = "0.1.35"
+version = "0.1.37"
 dependencies = [
 "blake3",
 "ide-core",
@@ -4463,11 +4515,12 @@ dependencies = [
 "tracing",
 "wasmtime",
 "wasmtime-wasi",
+ "wat",
 ]

 [[package]]
 name = "ide-profiler"
-version = "0.1.35"
+version = "0.1.37"
 dependencies = [
 "ide-core",
 "ide-run",
@@ -4480,7 +4533,7 @@ dependencies = [

 [[package]]
 name = "ide-remote"
-version = "0.1.35"
+version = "0.1.37"
 dependencies = [
 "globset",
 "ide-core",
@@ -4497,7 +4550,7 @@ dependencies = [

 [[package]]
 name = "ide-run"
-version = "0.1.35"
+version = "0.1.37"
 dependencies = [
 "dunce",
 "encoding_rs",
@@ -4506,7 +4559,7 @@ dependencies = [
 "libc",
 "parking_lot",
 "portable-pty",
- "quick-xml",
+ "quick-xml 0.42.0",
 "serde",
 "serde_json",
 "specta",
@@ -4520,7 +4573,7 @@ dependencies = [

 [[package]]
 name = "ide-sdk"
-version = "0.1.35"
+version = "0.1.37"
 dependencies = [
 "dunce",
 "ide-core",
@@ -4539,7 +4592,7 @@ dependencies = [

 [[package]]
 name = "ide-search"
-version = "0.1.35"
+version = "0.1.37"
 dependencies = [
 "criterion",
 "globset",
@@ -4559,7 +4612,7 @@ dependencies = [

 [[package]]
 name = "ide-spell"
-version = "0.1.35"
+version = "0.1.37"
 dependencies = [
 "ide-core",
 "parking_lot",
@@ -4572,11 +4625,13 @@ dependencies = [

 [[package]]
 name = "ide-ssh"
-version = "0.1.35"
+version = "0.1.37"
 dependencies = [
 "dirs 6.0.0",
 "flate2",
 "ide-core",
+ "keyring",
+ "keyring-core",
 "parking_lot",
 "russh",
 "russh-config",
@@ -4587,11 +4642,12 @@ dependencies = [
 "tempfile",
 "tokio",
 "tracing",
+ "uuid",
 ]

 [[package]]
 name = "ide-syntax"
-version = "0.1.35"
+version = "0.1.37"
 dependencies = [
 "ide-core",
 "ide-language",
@@ -4606,7 +4662,7 @@ dependencies = [

 [[package]]
 name = "ide-terminal"
-version = "0.1.35"
+version = "0.1.37"
 dependencies = [
 "ide-core",
 "libc",
@@ -4619,19 +4675,20 @@ dependencies = [

 [[package]]
 name = "ide-text"
-version = "0.1.35"
+version = "0.1.37"
 dependencies = [
 "criterion",
 "ide-core",
 "proptest",
 "ropey",
 "serde",
+ "similar",
 "specta",
 ]

 [[package]]
 name = "ide-tools"
-version = "0.1.35"
+version = "0.1.37"
 dependencies = [
 "flate2",
 "hex",
@@ -4652,14 +4709,16 @@ dependencies = [

 [[package]]
 name = "ide-vcs"
-version = "0.1.35"
+version = "0.1.37"
 dependencies = [
+ "blake3",
 "dunce",
 "encoding_rs",
 "gix",
 "ide-core",
 "ignore",
 "libc",
+ "redb",
 "regex-lite",
 "serde",
 "serde_json",
@@ -4671,7 +4730,7 @@ dependencies = [

 [[package]]
 name = "ide-vfs"
-version = "0.1.35"
+version = "0.1.37"
 dependencies = [
 "chardetng",
 "dunce",
@@ -4680,7 +4739,7 @@ dependencies = [
 "globset",
 "ide-core",
 "ignore",
- "notify-debouncer-full",
+ "notify",
 "parking_lot",
 "serde",
 "serde_json",
@@ -4693,7 +4752,7 @@ dependencies = [

 [[package]]
 name = "ide-web"
-version = "0.1.35"
+version = "0.1.37"
 dependencies = [
 "ide-core",
 "open",
@@ -4709,7 +4768,7 @@ dependencies = [

 [[package]]
 name = "ide-workspace"
-version = "0.1.35"
+version = "0.1.37"
 dependencies = [
 "blake3",
 "dunce",
@@ -4727,6 +4786,7 @@ dependencies = [
 "toml 0.9.12+spec-1.1.0",
 "toml_edit 0.25.17+spec-1.1.0",
 "tracing",
+ "uuid",
 "zip",
 ]

@@ -5204,6 +5264,33 @@ dependencies = [
 "serde",
 ]

+[[package]]
+name = "keyring"
+version = "4.2.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "2270074a3d26bcac93c1dc5d2845eb4c089e8d761ccf6e0ea266a16004640627"
+dependencies = [
+ "apple-native-keyring-store",
+ "keyring-core",
+ "windows-native-keyring-store",
+ "zbus-secret-service-keyring-store",
+]
+
+[[package]]
+name = "keyring-core"
+version = "1.0.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "29fbf4b551298c67925f38cf341a1ada797a75f1837bdf8ae1fc8e2ebc6efb59"
+dependencies = [
+ "chrono",
+ "dashmap",
+ "log",
+ "regex",
+ "ron",
+ "serde",
+ "uuid",
+]
+
 [[package]]
 name = "kqueue"
 version = "1.2.1"
@@ -5626,19 +5713,6 @@ dependencies = [
 "windows-sys 0.60.2",
 ]

-[[package]]
-name = "notify-debouncer-full"
-version = "0.6.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "375bd3a138be7bfeff3480e4a623df4cbfb55b79df617c055cd810ba466fa078"
-dependencies = [
- "file-id",
- "log",
- "notify",
- "notify-types",
- "walkdir",
-]
-
 [[package]]
 name = "notify-types"
 version = "2.1.0"
@@ -5667,6 +5741,30 @@ dependencies = [
 "unicode-segmentation",
 ]

+[[package]]
+name = "num"
+version = "0.4.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "35bd024e8b2ff75562e5f34e7f4905839deb4b22955ef5e73d2fea1b9813cb23"
+dependencies = [
+ "num-bigint 0.4.8",
+ "num-complex",
+ "num-integer",
+ "num-iter",
+ "num-rational",
+ "num-traits",
+]
+
+[[package]]
+name = "num-bigint"
+version = "0.4.8"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "c89e69e7e0f03bea5ef08013795c25018e101932225a656383bd384495ecc367"
+dependencies = [
+ "num-integer",
+ "num-traits",
+]
+
 [[package]]
 name = "num-bigint"
 version = "0.5.1"
@@ -5679,6 +5777,15 @@ dependencies = [
 "rand_core 0.10.1",
 ]

+[[package]]
+name = "num-complex"
+version = "0.4.6"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "73f88a1307638156682bada9d7604135552957b7818057dcef22705b4d509495"
+dependencies = [
+ "num-traits",
+]
+
 [[package]]
 name = "num-conv"
 version = "0.2.2"
@@ -5694,6 +5801,27 @@ dependencies = [
 "num-traits",
 ]

+[[package]]
+name = "num-iter"
+version = "0.1.46"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "c92800bd69a1eac91786bcfe9da64a897eb72911b8dc3095decbd07429e8048b"
+dependencies = [
+ "num-integer",
+ "num-traits",
+]
+
+[[package]]
+name = "num-rational"
+version = "0.4.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "f83d14da390562dca69fc84082e73e548e1ad308d24accdedd2720017cb37824"
+dependencies = [
+ "num-bigint 0.4.8",
+ "num-integer",
+ "num-traits",
+]
+
 [[package]]
 name = "num-traits"
 version = "0.2.19"
@@ -6181,7 +6309,7 @@ dependencies = [

 [[package]]
 name = "openidea"
-version = "0.1.35"
+version = "0.1.37"
 dependencies = [
 "base64 0.22.1",
 "blake3",
@@ -6191,6 +6319,7 @@ dependencies = [
 "gtk",
 "ide-agent",
 "ide-analysis",
+ "ide-android",
 "ide-build",
 "ide-clipboard",
 "ide-core",
@@ -6245,10 +6374,12 @@ dependencies = [
 "tauri-plugin-updater",
 "tauri-plugin-window-state",
 "tauri-specta",
+ "tempfile",
 "tokio",
 "tracing",
 "tracing-appender",
 "tracing-subscriber",
+ "windows",
 "windows-sys 0.61.2",
 ]

@@ -6582,7 +6713,7 @@ checksum = "65dca778f41c79ebbe8b2b2139fee86f01b766b67130d108c7c2b8ffbd949f77"
 dependencies = [
 "base64 0.23.1",
 "indexmap 2.14.2",
- "quick-xml",
+ "quick-xml 0.42.0",
 "serde",
 "time",
 ]
@@ -6627,6 +6758,12 @@ dependencies = [
 "windows-sys 0.61.2",
 ]

+[[package]]
+name = "pollster"
+version = "0.4.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "2f3a9f18d041e6d0e102a0a46750538147e5e8992d3b4873aaafee2520b00ce3"
+
 [[package]]
 name = "poly1305"
 version = "0.9.1"
@@ -6887,6 +7024,15 @@ version = "1.2.3"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "a1d01941d82fa2ab50be1e79e6714289dd7cde78eba4c074bc5a4374f650dfe0"

+[[package]]
+name = "quick-xml"
+version = "0.41.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "e660451e55124f798a69a5af3f49ccfbefbd41910eefd25caf2393e1f3473ec1"
+dependencies = [
+ "memchr",
+]
+
 [[package]]
 name = "quick-xml"
 version = "0.42.0"
@@ -7133,6 +7279,7 @@ dependencies = [
 "rustls-platform-verifier",
 "serde",
 "serde_json",
+ "serde_urlencoded",
 "sync_wrapper",
 "tokio",
 "tokio-rustls",
@@ -7163,18 +7310,18 @@ version = "0.16.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "a15ad77d9e70a92437d8f74c35d99b4e4691128df018833e99f90bcd36152672"
 dependencies = [
+ "ashpd",
 "block2 0.6.2",
 "dispatch2",
- "glib-sys",
- "gobject-sys",
- "gtk-sys",
 "js-sys",
 "log",
 "objc2 0.6.5",
 "objc2-app-kit 0.3.2",
 "objc2-core-foundation",
 "objc2-foundation 0.3.2",
+ "pollster",
 "raw-window-handle",
+ "urlencoding",
 "wasm-bindgen",
 "wasm-bindgen-futures",
 "web-sys",
@@ -7195,6 +7342,19 @@ dependencies = [
 "windows-sys 0.52.0",
 ]

+[[package]]
+name = "ron"
+version = "0.12.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "97b3fe97c18ff24299ea56f802c5693eb34266fb0bc8317f4e101debc8a3ceaf"
+dependencies = [
+ "bitflags 2.13.2",
+ "serde",
+ "serde_derive",
+ "typeid",
+ "unicode-ident",
+]
+
 [[package]]
 name = "ropey"
 version = "1.6.1"
@@ -7261,7 +7421,7 @@ dependencies = [
 "md5",
 "ml-kem",
 "module-lattice",
- "num-bigint",
+ "num-bigint 0.5.1",
 "p256",
 "p384",
 "p521",
@@ -7491,6 +7651,12 @@ dependencies = [
 "wait-timeout",
 ]

+[[package]]
+name = "ryu"
+version = "1.0.23"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "9774ba4a74de5f7b1c1451ed6cd5285a32eddb5cccb8cc655a4e50009e06477f"
+
 [[package]]
 name = "saa"
 version = "5.6.2"
@@ -7586,6 +7752,12 @@ dependencies = [
 "syn 2.0.119",
 ]

+[[package]]
+name = "scoped-tls"
+version = "1.0.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "e1cf6437eb19a8f4a6cc0f7dca544973b0b78843adbfeb3683d1a94a0024a294"
+
 [[package]]
 name = "scopeguard"
 version = "1.2.0"
@@ -7636,6 +7808,25 @@ dependencies = [
 "zeroize",
 ]

+[[package]]
+name = "secret-service"
+version = "5.2.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "5107b24b91445dd2aa449a258a1807b63240942157292354dc5bfdbeb8bc6db8"
+dependencies = [
+ "aes",
+ "cbc",
+ "futures-util",
+ "getrandom 0.4.3",
+ "hkdf",
+ "hybrid-array",
+ "num",
+ "once_cell",
+ "serde",
+ "sha2 0.11.1",
+ "zbus",
+]
+
 [[package]]
 name = "security-framework"
 version = "3.7.0"
@@ -7795,6 +7986,18 @@ dependencies = [
 "serde_core",
 ]

+[[package]]
+name = "serde_urlencoded"
+version = "0.7.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "d3491c14715ca2294c4d6a88f15e84739788c1d030eed8c110436aafdaa2f3fd"
+dependencies = [
+ "form_urlencoded",
+ "itoa",
+ "ryu",
+ "serde",
+]
+
 [[package]]
 name = "serde_with"
 version = "3.24.0"
@@ -8174,7 +8377,7 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "0d204abcbdf8e88729306a8d0ca01a79d8a49969fe1f84696909d6dbc4321c1a"
 dependencies = [
 "foldhash",
- "hashbrown 0.17.1",
+ "hashbrown 0.16.1",
 ]

 [[package]]
@@ -9112,7 +9315,7 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "32497e9a4c7b38532efcdebeef879707aa9f794296a4f0244f6f69e9bc8574bd"
 dependencies = [
 "fastrand",
- "getrandom 0.3.4",
+ "getrandom 0.4.3",
 "once_cell",
 "rustix",
 "windows-sys 0.61.2",
@@ -9300,6 +9503,7 @@ dependencies = [
 "signal-hook-registry",
 "socket2",
 "tokio-macros",
+ "tracing",
 "windows-sys 0.61.2",
 ]

@@ -10116,6 +10320,12 @@ version = "1.13.3"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "c6f5d3c3b1bf09027a88a6bc961fc00497d651009560b5463668dc81b0fa87a8"

+[[package]]
+name = "unicode-width"
+version = "0.2.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "ca718471876992059f251e33aafc334346ada08042b7661dd1fe313a9bced557"
+
 [[package]]
 name = "universal-hash"
 version = "0.6.1"
@@ -10636,6 +10846,88 @@ dependencies = [
 "wasmtime",
 ]

+[[package]]
+name = "wast"
+version = "258.0.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "8b912cfe5696dfaae736e344fc82082dbd63609abbaeca3926466c0b10d9fecc"
+dependencies = [
+ "bumpalo",
+ "leb128fmt",
+ "memchr",
+ "unicode-width",
+ "wasm-encoder",
+]
+
+[[package]]
+name = "wat"
+version = "1.258.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "3069154948f5737a8bcd5c55dcdf2c2b59ca776057732e49821167bde268ec6e"
+dependencies = [
+ "wast",
+]
+
+[[package]]
+name = "wayland-backend"
+version = "0.3.17"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "38a91b4eaddff87b1cd1074985e3713da4af2c49742d1b356b2c01670a67a078"
+dependencies = [
+ "cc",
+ "downcast-rs",
+ "rustix",
+ "scoped-tls",
+ "smallvec",
+ "wayland-sys",
+]
+
+[[package]]
+name = "wayland-client"
+version = "0.31.15"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "e3c36a0f861ad76d0901f2800b46321410d9f73f2ea88aac0650d86c32688073"
+dependencies = [
+ "bitflags 2.13.2",
+ "rustix",
+ "wayland-backend",
+ "wayland-scanner",
+]
+
+[[package]]
+name = "wayland-protocols"
+version = "0.32.13"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "23d0c813de3daa2ed6520af85a3bd49b0e722a3078506899aa9686fea58dc4b6"
+dependencies = [
+ "bitflags 2.13.2",
+ "wayland-backend",
+ "wayland-client",
+ "wayland-scanner",
+]
+
+[[package]]
+name = "wayland-scanner"
+version = "0.31.11"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "338e30461b3a2b67d70eb30a6d89f8e0c93a833e07d2ae89085cd070c4a00ac0"
+dependencies = [
+ "proc-macro2",
+ "quick-xml 0.41.0",
+ "quote",
+]
+
+[[package]]
+name = "wayland-sys"
+version = "0.31.11"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "d8eab23fefc9e41f8e841df4a9c707e8a8c4ed26e944ef69297184de2785e3be"
+dependencies = [
+ "dlib",
+ "log",
+ "pkg-config",
+]
+
 [[package]]
 name = "web-sys"
 version = "0.3.106"
@@ -10921,6 +11213,19 @@ version = "0.2.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "f0805222e57f7521d6a62e36fa9163bc891acd422f971defe97d64e70d0a4fe5"

+[[package]]
+name = "windows-native-keyring-store"
+version = "1.1.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "063426e76fdec7438d56bb777f67e318a84a25c707b07e575cb8b78e10c028f8"
+dependencies = [
+ "byteorder",
+ "keyring-core",
+ "regex",
+ "windows-sys 0.61.2",
+ "zeroize",
+]
+
 [[package]]
 name = "windows-numerics"
 version = "0.3.1"
@@ -11447,6 +11752,7 @@ dependencies = [
 "rustix",
 "serde",
 "serde_repr",
+ "tokio",
 "tracing",
 "uds_windows",
 "uuid",
@@ -11457,6 +11763,17 @@ dependencies = [
 "zvariant",
 ]

+[[package]]
+name = "zbus-secret-service-keyring-store"
+version = "1.0.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "74801d001b9e7729adb4f1825b67b398185fed424749aa3d8bacf70417137d9a"
+dependencies = [
+ "keyring-core",
+ "secret-service",
+ "zbus",
+]
+
 [[package]]
 name = "zbus_macros"
 version = "5.19.0"
@@ -11662,6 +11979,7 @@ dependencies = [
 "endi",
 "enumflags2",
 "serde",
+ "url",
 "winnow 1.0.4",
 "zcheapstr",
 "zvariant_derive",
@@ -5,7 +5,7 @@ members = ["crates/*", "src-tauri"]
 exclude = ["sdk", "plugins"]

 [workspace.package]
-version = "0.1.35"
+version = "0.1.37"
 edition = "2024"
 rust-version = "1.96"
 license = "Apache-2.0"
@@ -76,7 +76,6 @@ ignore = "0.4"
 base64 = "0.22"
 globset = "0.4"
 notify = "8"
-notify-debouncer-full = "0.6"
 trash = "5"
 blake3 = "1"
 dunce = "1"
@@ -86,6 +85,7 @@ zip = { version = "9", default-features = false, features = ["deflate"] }
 # search, index, language
 grep-searcher = "0.1"
 grep-regex = "0.1"
+regex-syntax = "0.8"
 grep-matcher = "0.1"
 nucleo-matcher = "0.3"
 redb = "4"
@@ -105,6 +105,9 @@ sqlx = { version = "0.9", default-features = false, features = ["runtime-tokio",
 tiberius = { version = "0.13", default-features = false, features = ["tds73", "rustls", "sql-browser-tokio"] }
 bb8 = "0.9"
 uuid = { version = "1", features = ["v4"] }
+# OS credential stores
+keyring = "4.2"
+keyring-core = "1"

 # testing
 insta = { version = "1", features = ["yaml"] }
@@ -114,8 +117,14 @@ tempfile = "3"
 [profile.dev]
 # Keep debug builds snappy while giving dependencies decent speed.
 opt-level = 0
+# Full debug info is most of target/. Line tables keep file:line in our backtraces, but a
+# debugger can't show locals; re-enable with `--config profile.dev.debug=true`.
+debug = "line-tables-only"
 [profile.dev.package."*"]
 opt-level = 2
+# Dependency frames keep function names only. Re-enable one with
+# `--config 'profile.dev.package.<crate>.debug=true'`.
+debug = false

 [profile.release]
 codegen-units = 1
@@ -14,7 +14,9 @@
  &nbsp;·&nbsp;
  <a href="#benchmark">Benchmark</a>
  &nbsp;·&nbsp;
-  <a href="https://discord.gg/2Zy4yn7gP">Discord</a>
+  <a href="#plugins">Plugins</a>
+  &nbsp;·&nbsp;
+  <a href="#community">Community</a>
 </p>

 https://github.com/user-attachments/assets/234dd54c-1255-4b3a-b35c-533d78d737c0
@@ -45,6 +47,23 @@ IDEA analyses Python more deeply, so "ready" doesn't mean the same work on
 both sides. Both are measured from the outside, the same way: see
 [`perf/compare`](perf/compare) to run it on your machine and projects.

+## Plugins
+
+Plugins add actions, completion, quick fixes, tool windows, custom editors,
+themes, file icons and languages. They run as sandboxed WebAssembly components;
+themes, icon themes and languages need no code at all.
+
+Install them from Settings › Plugins, or start your own with
+`openidea-plugin new` — see [Writing OpenIDEA plugins](plugins/README.md) and
+the [official plugins](plugins/official). The plugin API is still a preview.
+
+## Community
+
+- [Discord](https://discord.gg/2Zy4yn7gP) — questions, feedback and release news.
+- WeChat group — scan to join:
+
+  <img src="docs/assets/wechat-group.png" alt="WeChat group QR code" width="200">
+
 ## License

 [Apache 2.0](LICENSE). Bundled third-party assets are listed in [`THIRD_PARTY_LICENSES.md`](THIRD_PARTY_LICENSES.md).
@@ -2,12 +2,12 @@

 ## Project Lombok

-`plugins/lombok/lombok-1.18.48-openidea.2.jar` contains Project Lombok v1.18.48 with the Equinox
+`java/lombok/lombok-1.18.48-openidea.2.jar` contains Project Lombok v1.18.48 with the Equinox
 classloader fix from [projectlombok/lombok#4059](https://github.com/projectlombok/lombok/pull/4059)
 and the ECJ constructor-call fix from [projectlombok/lombok#4089](https://github.com/projectlombok/lombok/pull/4089).
 Copyright (C) 2009-2021 The Project Lombok Authors. MIT license and bundled component
-notices are retained in [plugins/lombok/LICENSE](plugins/lombok/LICENSE) and inside the jar.
-Source tag, patch commits and build instructions: [plugins/lombok/README.md](plugins/lombok/README.md).
+notices are retained in [java/lombok/LICENSE](java/lombok/LICENSE) and inside the jar.
+Source tag, patch commits and build instructions: [java/lombok/README.md](java/lombok/README.md).

 ## JetBrains IntelliJ Platform icons

@@ -52,6 +52,15 @@ Their original copyright headers and Apache-2.0 licensing are retained.

 At render time `src/ui/icons.tsx` may recolour monochrome icons to `currentColor`.

+## JetBrains IntelliJ Platform VCS log graph algorithms
+
+`crates/ide-vcs/src/bek.rs` and `src/features/vcs/graph.ts` adapt the Bek ordering,
+graph layout and LinearBek merge linearization algorithms from
+[intellij-community](https://github.com/JetBrains/intellij-community/tree/1d70d5c54302d655758edbd2f808fb8dea8b1764/platform/vcs-log/graph/src/com/intellij/vcs/log/graph)
+(`impl/facade/sort/bek`, `impl/permanent/GraphLayoutBuilder.kt` and
+`linearBek/LinearBekGraphBuilder.java`). Modified from the originals.
+Copyright 2000-2026 JetBrains s.r.o. and contributors. Apache License 2.0 (below).
+
 ## JetBrains IntelliJ Platform diff algorithm

 `src/features/vcs/comparison/**` is a TypeScript port of the text comparison of
@@ -58,6 +58,8 @@ pub(crate) const LIMITS_UPDATE: &str = "openidea_limits";
 const MAX_EMBED: u64 = 256 * 1024;
 /// How long a probe waits for the agent to answer `initialize`.
 const PROBE_TIMEOUT: Duration = Duration::from_secs(30);
+/// How long deleting a task waits for its agent to exit before removing the worktree.
+const EXIT_WAIT: Duration = Duration::from_secs(5);

 /// The agent tasks of one project.
 pub struct AgentManager {
@@ -345,6 +347,14 @@ impl AgentManager {
        provider::set_builtin_command(&dir, id, command.as_deref())
    }

+    /// Sets the environment variables built-in `id` starts with; empty clears them.
+    pub fn set_builtin_env(&self, id: &str, env: std::collections::BTreeMap<String, String>) -> IdeResult<()> {
+        let Some(dir) = self.shared.paths.custom_agents_dir.clone() else {
+            return Err(IdeError::unavailable("there is no custom agents directory"));
+        };
+        provider::set_builtin_env(&dir, id, env)
+    }
+
    /// Re-reads configured/installed agents, drops cached probes, and notifies subscribers.
    pub fn reload_providers(&self) {
        let specs = provider::load(self.shared.paths.custom_agents_dir.as_deref());
@@ -831,7 +841,7 @@ impl AgentManager {
    /// Forgets the task; with `remove_worktree` also deletes its worktree (the branch stays).
    pub async fn delete(&self, id: &str, remove_worktree: bool) -> IdeResult<()> {
        let task = self.task(id)?;
-        task.kill();
+        let live = task.kill();
        let (isolation, cwd, root) = {
            let s = task.state.lock();
            (
@@ -843,6 +853,11 @@ impl AgentManager {
        // A copy of the task (a fork) may work in the same worktree.
        let shared = self.tasks.read().values().any(|t| t.id != id && t.state.lock().task.cwd.0 == cwd);
        if remove_worktree && !shared && isolation == Isolation::Worktree && cwd.exists() {
+            // On Windows the agent's processes lock the folder (their working directory,
+            // open files) until they have exited.
+            if let Some(peer) = live {
+                let _ = tokio::time::timeout(EXIT_WAIT, peer.exited()).await;
+            }
            let worktrees = self.shared.paths.worktrees_dir.clone();
            blocking(move || worktree::remove(&root, &worktrees, &cwd)).await?;
        }
@@ -1597,11 +1612,12 @@ impl Task {
        }
    }

-    fn kill(&self) {
+    /// Stops the agent; returns its connection, to wait for its process to exit.
+    fn kill(&self) -> Option<acp::Conn> {
        self.cancel_permissions();
-        if let Some(live) = self.live.lock().take() {
-            live.peer.kill();
-        }
+        let live = self.live.lock().take()?;
+        live.peer.kill();
+        Some(live.peer)
    }
 }

@@ -3,6 +3,7 @@
 use ide_core::IpcPath;
 use serde::{Deserialize, Serialize};
 use specta::Type;
+use std::collections::BTreeMap;

 #[derive(Clone, Copy, Debug, PartialEq, Eq, Serialize, Deserialize, Type)]
 #[serde(rename_all = "camelCase")]
@@ -357,6 +358,8 @@ pub struct AgentProvider {
    pub command_read_only_reason: Option<AgentCommandReadOnlyReason>,
    /// Whether the command was found (on `PATH`).
    pub installed: bool,
+    /// Environment variables it starts with (from its agent file).
+    pub env: BTreeMap<String, String>,
    /// Settings (models, modes…) the agent offered last time it ran; empty before its first session.
    pub config: Vec<AgentConfigOption>,
    /// Slash commands it offered last time.
@@ -124,6 +124,7 @@ pub(crate) fn describe(spec: &ProviderSpec) -> AgentProvider {
        command_editable: reason.is_none(),
        command_read_only_reason: reason,
        installed: installed(&spec.command),
+        env: spec.env.iter().cloned().collect(),
        config: vec![],
        commands: vec![],
        source: spec.source.clone(),
@@ -133,6 +134,16 @@ pub(crate) fn describe(spec: &ProviderSpec) -> AgentProvider {
 /// Overrides built-in `id`'s command through its agent file, preserving other
 /// customizations. `None` restores the built-in command and removes a redundant file.
 pub(crate) fn set_builtin_command(custom_dir: &Path, id: &str, command: Option<&str>) -> IdeResult<()> {
+    update_builtin(custom_dir, id, |agent, builtin| agent.command = command.unwrap_or(&builtin.command).to_owned())
+}
+
+/// The environment built-in `id` starts with, through its agent file (empty clears it).
+pub(crate) fn set_builtin_env(custom_dir: &Path, id: &str, env: BTreeMap<String, String>) -> IdeResult<()> {
+    update_builtin(custom_dir, id, |agent, _| agent.env = env)
+}
+
+/// Changes built-in `id`'s agent file; a file left with only the built-in's values is removed.
+fn update_builtin(custom_dir: &Path, id: &str, change: impl FnOnce(&mut CustomAgent, &ProviderSpec)) -> IdeResult<()> {
    let Some(builtin) = builtin_spec(id) else {
        return Err(IdeError::invalid(format!("{id} is not a built-in agent")));
    };
@@ -152,7 +163,8 @@ pub(crate) fn set_builtin_command(custom_dir: &Path, id: &str, command: Option<&
    if agent.registry.is_some() {
        return Err(IdeError::invalid(format!("{id} is installed from the ACP Registry")));
    }
-    if command.is_none()
+    change(&mut agent, &builtin);
+    if agent.command == builtin.command
        && agent.name.as_deref() == Some(builtin.name.as_str())
        && agent.driver == builtin.driver
        && agent.args == builtin.args
@@ -164,7 +176,6 @@ pub(crate) fn set_builtin_command(custom_dir: &Path, id: &str, command: Option<&
        }
        return Ok(());
    }
-    agent.command = command.unwrap_or(&builtin.command).to_owned();
    agent.write(&file)?;
    Ok(())
 }
@@ -368,6 +379,23 @@ mod tests {
        assert!(installed("sh"));
    }

+    #[test]
+    fn set_builtin_env_writes_and_clears_the_environment() {
+        let dir = tempfile::tempdir().unwrap();
+        let env = BTreeMap::from([("CLAUDE_CODE_ENTRYPOINT".to_owned(), "openidea".to_owned())]);
+        set_builtin_env(dir.path(), "claude", env.clone()).unwrap();
+        let claude = load(Some(dir.path())).into_iter().find(|s| s.id == "claude").unwrap();
+        assert_eq!(claude.env, vec![("CLAUDE_CODE_ENTRYPOINT".to_owned(), "openidea".to_owned())]);
+        assert_eq!(describe(&claude).env, env);
+        // The command override and the environment are kept independently.
+        set_builtin_command(dir.path(), "claude", Some("/opt/claude")).unwrap();
+        set_builtin_command(dir.path(), "claude", None).unwrap();
+        assert!(dir.path().join("claude.toml").is_file());
+        set_builtin_env(dir.path(), "claude", BTreeMap::new()).unwrap();
+        assert!(!dir.path().join("claude.toml").exists());
+        set_builtin_env(dir.path(), "not-a-builtin", env).unwrap_err();
+    }
+
    #[test]
    fn set_builtin_command_overrides_and_clears_a_builtin() {
        let dir = tempfile::tempdir().unwrap();
@@ -76,6 +76,8 @@ pub struct RegistryAgent {
    pub installed: Option<String>,
    /// Whether [`Self::version`] is newer than the installed one.
    pub update: bool,
+    /// An install of it is running (it goes on after the Settings page that started it closes).
+    pub installing: bool,
 }

 #[derive(Clone, Copy, Debug, PartialEq, Eq, Serialize, Type)]
@@ -332,6 +334,7 @@ fn visible(
                distribution,
                no_checksum,
                installed,
+                installing: false,
            })
        })
        .collect();
@@ -1109,3 +1109,114 @@ async fn idle_agents_stop_and_resume_their_session_on_the_next_message() {
    assert!(live(&mgr, &task.id));
    mgr.shutdown();
 }
+
+/// Deleting a task whose agent still runs in the worktree removes both and leaves no
+/// process behind, whether it is waiting for permission or idle without session/load.
+#[tokio::test(flavor = "multi_thread")]
+async fn deleting_a_task_waits_for_its_agent_to_exit_before_removing_the_worktree() {
+    for no_load in [false, true] {
+        delete_running_agent(no_load).await;
+    }
+}
+
+async fn delete_running_agent(no_load: bool) {
+    let tmp = tempfile::tempdir().unwrap();
+    let root = dunce::canonicalize(tmp.path()).unwrap();
+    let git = |args: &[&str]| {
+        let out = std::process::Command::new("git")
+            .args(["-c", "user.name=t", "-c", "user.email=t@t", "-c", "commit.gpgsign=false"])
+            .args(args)
+            .current_dir(&root)
+            .output()
+            .unwrap();
+        assert!(out.status.success(), "{}", String::from_utf8_lossy(&out.stderr));
+    };
+    git(&["init", "-q", "-b", "main"]);
+    std::fs::write(root.join("file.txt"), "original\n").unwrap();
+    git(&["add", "."]);
+    git(&["commit", "-qm", "initial"]);
+
+    let agent = Arc::new(FakeAgent { no_load, ..FakeAgent::default() });
+    let pids: Arc<Mutex<Vec<u32>>> = Arc::default();
+    let (fake, started) = (agent.clone(), pids.clone());
+    // The fake agent, served on behalf of a real process that exits only when killed.
+    let connector: Connector = Arc::new(move |_spec, cwd, client, _stderr| {
+        #[cfg(unix)]
+        let mut cmd = {
+            let mut cmd = tokio::process::Command::new("sleep");
+            cmd.arg("30");
+            cmd
+        };
+        #[cfg(windows)]
+        let mut cmd = {
+            let mut cmd = tokio::process::Command::new("cmd");
+            cmd.args(["/D", "/C", "echo ready>agent-ready & ping -n 30 127.0.0.1 >nul"]);
+            cmd
+        };
+        ide_core::process::prepare(cmd.as_std_mut());
+        ide_core::process::own_group(cmd.as_std_mut());
+        cmd.current_dir(cwd).kill_on_drop(true);
+        let child = cmd.spawn()?;
+        started.lock().push(child.id().unwrap());
+        let (a, b) = duplex(1 << 20);
+        let (ar, aw) = tokio::io::split(a);
+        let (br, bw) = tokio::io::split(b);
+        // `connect_with_child` frames with Content-Length.
+        fake.servers.lock().push(Peer::connect(br, bw, fake.clone()));
+        Ok(Peer::connect_with_child(ar, aw, client, child))
+    });
+    let mgr = AgentManager::with_connector(
+        AgentPaths {
+            project_root: root.clone(),
+            store_dir: root.join("store"),
+            worktrees_dir: root.join("worktrees"),
+            models_file: root.join("models.json"),
+            custom_agents_dir: None,
+            home_dir: None,
+        },
+        tokio::runtime::Handle::current(),
+        connector,
+    );
+    let task = mgr
+        .create(NewAgentTask {
+            project_root: None,
+            prompt: text(if no_load { "again" } else { "Fix the lexer" }),
+            provider: "claude".into(),
+            config: vec![],
+            isolation: Isolation::Worktree,
+            base: None,
+        })
+        .await
+        .unwrap();
+    wait_for(&mgr, &task.id, if no_load { AgentStatus::Ready } else { AgentStatus::NeedsInput }).await;
+    let pid = *pids.lock().last().expect("the agent was started");
+
+    #[cfg(windows)]
+    {
+        tokio::time::timeout(Duration::from_secs(5), async {
+            while !task.cwd.0.join("agent-ready").exists() {
+                tokio::time::sleep(Duration::from_millis(10)).await;
+            }
+        })
+        .await
+        .unwrap();
+        assert_eq!(
+            std::fs::rename(&task.cwd.0, task.cwd.0.with_extension("moved")).unwrap_err().raw_os_error(),
+            Some(32),
+            "the running agent really locks its worktree"
+        );
+    }
+
+    mgr.delete(&task.id, true).await.unwrap();
+    assert!(!task.cwd.0.exists());
+    // Killed and reaped: not even a zombie is left.
+    #[cfg(unix)]
+    let alive = std::process::Command::new("kill").args(["-0", &pid.to_string()]).status().unwrap().success();
+    #[cfg(windows)]
+    let alive = {
+        let mut cmd = std::process::Command::new("tasklist");
+        ide_core::process::prepare(&mut cmd).args(["/FI", &format!("PID eq {pid}"), "/FO", "CSV", "/NH"]);
+        String::from_utf8_lossy(&cmd.output().unwrap().stdout).contains(&format!("\"{pid}\""))
+    };
+    assert!(!alive, "the agent (pid {pid}) is still running");
+}
@@ -5,7 +5,7 @@ use ide_core::{IdeError, IdeResult, IpcPath};
 use ide_vcs::{ChangeKind, Repo};
 use std::collections::BTreeMap;
 use std::path::{Path, PathBuf};
-use std::time::UNIX_EPOCH;
+use std::time::{Duration, UNIX_EPOCH};

 pub(crate) struct Created {
    pub path: PathBuf,
@@ -65,7 +65,27 @@ pub(crate) fn remove(project_root: &Path, worktrees_dir: &Path, path: &Path) ->
    if !path.starts_with(worktrees_dir) || path == worktrees_dir {
        return Err(err);
    }
-    std::fs::remove_dir_all(path).map_err(|e| IdeError::internal(e.to_string()))
+    retrying(REMOVE_ATTEMPTS, REMOVE_PAUSE, || std::fs::remove_dir_all(path))
+        .map_err(|e| IdeError::internal(format!("{}: {e}", path.display())))
+}
+
+/// On Windows a folder can't be deleted while a process still has a file in it open
+/// (os error 32): an agent's helper that outlived it, an antivirus scan, the search indexer.
+/// Those let go within moments, so removing is retried for a few seconds.
+const REMOVE_ATTEMPTS: u32 = 10;
+const REMOVE_PAUSE: Duration = Duration::from_millis(300);
+
+fn retrying(attempts: u32, pause: Duration, mut op: impl FnMut() -> std::io::Result<()>) -> std::io::Result<()> {
+    for _ in 1..attempts {
+        match op() {
+            Err(e) if e.kind() != std::io::ErrorKind::NotFound => std::thread::sleep(pause),
+            _ => return Ok(()),
+        }
+    }
+    match op() {
+        Err(e) if e.kind() == std::io::ErrorKind::NotFound => Ok(()),
+        r => r,
+    }
 }

 /// Files under `cwd` that differ from `base` (untracked files included), with line counts.
@@ -149,6 +169,54 @@ fn unique_slug(base: &str, taken: impl Fn(&str) -> bool) -> String {
 mod tests {
    use super::*;

+    #[test]
+    fn removing_is_retried_while_a_file_is_still_in_use() {
+        use std::io::{Error, ErrorKind};
+        // A sharing violation as Windows reports it (os error 32), a vanished folder, other errors.
+        let in_use = || Error::from_raw_os_error(32);
+        for (fails, outcome) in [(0, true), (3, true), (REMOVE_ATTEMPTS - 1, true), (REMOVE_ATTEMPTS, false)] {
+            let mut calls = 0;
+            let r = retrying(REMOVE_ATTEMPTS, Duration::ZERO, || {
+                calls += 1;
+                if calls <= fails { Err(in_use()) } else { Ok(()) }
+            });
+            assert_eq!(r.is_ok(), outcome, "{fails} failures");
+            assert_eq!(calls, (fails + 1).min(REMOVE_ATTEMPTS));
+        }
+        let mut calls = 0;
+        let gone = retrying(REMOVE_ATTEMPTS, Duration::ZERO, || {
+            calls += 1;
+            if calls == 1 { Err(in_use()) } else { Err(Error::from(ErrorKind::NotFound)) }
+        });
+        assert!(gone.is_ok(), "deleted meanwhile: done");
+        assert_eq!(calls, 2);
+    }
+
+    #[cfg(windows)]
+    #[test]
+    fn removing_waits_for_a_windows_file_lock_to_be_released() {
+        use std::os::windows::fs::OpenOptionsExt;
+        let tmp = tempfile::tempdir().unwrap();
+        let repo = tmp.path().join("repo");
+        std::fs::create_dir(&repo).unwrap();
+        git(&repo, &["init", "-q", "-b", "main"]);
+        std::fs::write(repo.join("a.txt"), "one\n").unwrap();
+        git(&repo, &["add", "."]);
+        git(&repo, &["commit", "-q", "-m", "init"]);
+        let worktrees = tmp.path().join("wt");
+        let created = create(&repo, &worktrees, "Locked file", None).unwrap();
+        let file = std::fs::OpenOptions::new().read(true).share_mode(0).open(created.path.join("a.txt")).unwrap();
+        assert_eq!(std::fs::remove_file(created.path.join("a.txt")).unwrap_err().raw_os_error(), Some(32));
+        let release = std::thread::spawn(move || {
+            std::thread::sleep(Duration::from_millis(800));
+            drop(file);
+        });
+        let result = remove(&repo, &worktrees, &created.path);
+        release.join().unwrap();
+        result.unwrap();
+        assert!(!created.path.exists());
+    }
+
    #[test]
    fn slugs_are_branch_safe() {
        assert_eq!(slugify("Fix lexer UTF-16 columns!"), "fix-lexer-utf-16-columns");
@@ -0,0 +1,15 @@
+[package]
+name = "ide-android"
+description = "Android devices and logcat for the Logcat tool window, driven through the adb CLI"
+version.workspace = true
+edition.workspace = true
+license.workspace = true
+
+[dependencies]
+ide-core.workspace = true
+serde.workspace = true
+specta.workspace = true
+which = "8"
+
+[dev-dependencies]
+tempfile.workspace = true
@@ -0,0 +1,222 @@
+//! Android devices and their logs, driven through the `adb` CLI (like git is
+//! driven through its CLI).
+//!
+//! The Logcat tool window needs two things from a device: that it is there, and
+//! what it prints. Both come from `adb`, which the Android SDK installs — the
+//! IDE does not bundle it.
+//!
+//! Every function blocks; callers run them off the UI / command threads.
+
+mod model;
+mod process;
+
+pub use model::*;
+
+use ide_core::{CancellationToken, IdeError, IdeResult};
+use std::path::{Path, PathBuf};
+use std::process::Command;
+use std::sync::OnceLock;
+use std::time::Duration;
+
+/// `adb devices` is quick unless it starts the daemon, which can take a moment.
+const DEVICES: Duration = Duration::from_secs(20);
+/// `adb logcat -c` only truncates the buffers.
+const CLEAR: Duration = Duration::from_secs(15);
+/// How much of the buffer to show before following, so opening the window is not empty.
+const TAIL_LINES: u32 = 200;
+/// Logcat can print thousands of lines a second: batches keep the IPC channel sane,
+/// while `IDLE` makes sure a quiet stream still shows its last line promptly.
+const BATCH_IDLE: Duration = Duration::from_millis(60);
+const BATCH_MAX: usize = 300;
+
+fn exe(name: &str) -> String {
+    if cfg!(windows) { format!("{name}.exe") } else { name.to_owned() }
+}
+
+/// Android SDK locations, most specific first: the environment, then the usual
+/// per-platform installs (a GUI app on macOS does not see a shell's `ANDROID_HOME`).
+fn sdk_roots() -> Vec<PathBuf> {
+    let mut roots: Vec<PathBuf> = ["ANDROID_HOME", "ANDROID_SDK_ROOT"]
+        .iter()
+        .filter_map(|key| std::env::var_os(key).map(PathBuf::from))
+        .collect();
+    let home = std::env::var_os(if cfg!(windows) { "USERPROFILE" } else { "HOME" }).map(PathBuf::from);
+    if let Some(home) = home.filter(|_| !cfg!(windows)) {
+        roots.push(home.join("Library/Android/sdk"));
+        roots.push(home.join("Android/Sdk"));
+    }
+    if cfg!(windows)
+        && let Some(local) = std::env::var_os("LOCALAPPDATA").map(PathBuf::from)
+    {
+        roots.push(local.join("Android/Sdk"));
+    }
+    roots
+}
+
+/// Locates the adb executable once per process; `OPENIDEA_ADB` overrides.
+pub fn adb_executable() -> Option<PathBuf> {
+    static ADB: OnceLock<Option<PathBuf>> = OnceLock::new();
+    ADB.get_or_init(|| {
+        if let Some(explicit) = std::env::var_os("OPENIDEA_ADB").map(PathBuf::from).filter(|p| p.is_file()) {
+            return Some(explicit);
+        }
+        let name = exe("adb");
+        if let Some(found) =
+            sdk_roots().into_iter().map(|root| root.join("platform-tools").join(&name)).find(|p| p.is_file())
+        {
+            return Some(found);
+        }
+        if let Ok(found) = which::which("adb") {
+            return Some(found);
+        }
+        let mut candidates: Vec<PathBuf> = if cfg!(windows) {
+            vec![PathBuf::from(r"C:\platform-tools\adb.exe")]
+        } else {
+            ["/usr/local/bin/adb", "/opt/homebrew/bin/adb", "/usr/bin/adb"].iter().map(PathBuf::from).collect()
+        };
+        candidates.extend([
+            PathBuf::from("/opt/android-sdk/platform-tools/adb"),
+            PathBuf::from("/usr/lib/android-sdk/platform-tools/adb"),
+        ]);
+        candidates.into_iter().find(|p: &PathBuf| p.is_file())
+    })
+    .clone()
+}
+
+fn executable() -> IdeResult<PathBuf> {
+    adb_executable().ok_or_else(|| {
+        IdeError::unavailable(
+            "adb was not found: install the Android SDK platform-tools, or set ANDROID_HOME (or OPENIDEA_ADB)",
+        )
+    })
+}
+
+/// The directory holding adb, for command lines that expect `adb` on `PATH`.
+pub fn platform_tools_dir() -> Option<&'static Path> {
+    static DIR: OnceLock<Option<PathBuf>> = OnceLock::new();
+    DIR.get_or_init(|| adb_executable().as_deref().and_then(Path::parent).map(Path::to_path_buf)).as_deref()
+}
+
+/// Connected devices, online ones first; starting the adb daemon when needed.
+pub fn devices() -> IdeResult<Vec<AndroidDevice>> {
+    let adb = executable()?;
+    let mut cmd = Command::new(adb);
+    cmd.args(["devices", "-l"]);
+    let out = process::run(cmd, DEVICES, None)?;
+    if !out.success {
+        let message = out.stderr.trim();
+        return Err(IdeError::unavailable(if message.is_empty() {
+            "adb devices failed".to_owned()
+        } else {
+            format!("adb devices failed: {message}")
+        }));
+    }
+    Ok(parse_devices(&out.stdout))
+}
+
+/// Empties the device's log buffers (`adb logcat -c`).
+pub fn clear_log(serial: &str, cancel: &CancellationToken) -> IdeResult<()> {
+    let adb = executable()?;
+    let mut cmd = Command::new(adb);
+    cmd.args(["-s", serial, "logcat", "-c"]);
+    let out = process::run(cmd, CLEAR, Some(cancel))?;
+    if out.success {
+        Ok(())
+    } else {
+        Err(IdeError::unavailable(format!("adb logcat -c failed: {}", out.stderr.trim())))
+    }
+}
+
+fn command(adb: &Path, serial: &str, tail: Option<u32>) -> Command {
+    let mut cmd = Command::new(adb);
+    cmd.args(["-s", serial, "logcat", "-v", "threadtime"]);
+    if let Some(lines) = tail {
+        // Recent history first, then follow: `-T <count>` is lines, not an exit.
+        cmd.arg("-T").arg(lines.to_string());
+    }
+    cmd
+}
+
+/// Follows `serial`'s log until `cancel` fires, handing lines over in batches.
+/// With `clear`, the buffers are emptied first so the window starts clean.
+pub fn logcat(
+    serial: &str,
+    clear: bool,
+    cancel: &CancellationToken,
+    on_batch: &mut dyn FnMut(Vec<LogcatLine>),
+) -> IdeResult<()> {
+    let adb = executable()?;
+    if clear {
+        clear_log(serial, cancel)?;
+    }
+    let mut parse = |line: &str| Some(parse_line(line));
+    let (ok, stderr) = match process::stream_batched(
+        command(&adb, serial, Some(TAIL_LINES)),
+        cancel,
+        BATCH_IDLE,
+        BATCH_MAX,
+        &mut parse,
+        on_batch,
+    ) {
+        Ok(result) => result,
+        // The window closed or switched devices: stopping is the expected end.
+        Err(e) if e.kind == ide_core::error::ErrorKind::Cancelled => return Ok(()),
+        Err(e) => return Err(e),
+    };
+    if ok || cancel.is_cancelled() {
+        return Ok(());
+    }
+    // `-T` is old (API 21) but adb forwards logcat options it does not know on
+    // very old devices; retry without the history rather than showing nothing.
+    let unsupported = stderr.iter().any(|line| {
+        line.contains("Unrecognized option") || line.contains("unknown option") || line.contains("Invalid option")
+    });
+    if unsupported {
+        let (ok, stderr) = match process::stream_batched(
+            command(&adb, serial, None),
+            cancel,
+            BATCH_IDLE,
+            BATCH_MAX,
+            &mut parse,
+            on_batch,
+        ) {
+            Ok(result) => result,
+            Err(e) if e.kind == ide_core::error::ErrorKind::Cancelled => return Ok(()),
+            Err(e) => return Err(e),
+        };
+        if ok || cancel.is_cancelled() {
+            return Ok(());
+        }
+        return Err(failure(serial, &stderr));
+    }
+    Err(failure(serial, &stderr))
+}
+
+fn failure(serial: &str, stderr: &[String]) -> IdeError {
+    let message = stderr.join("\n");
+    IdeError::unavailable(if message.trim().is_empty() {
+        format!("adb logcat on {serial} stopped")
+    } else {
+        format!("adb logcat on {serial} stopped: {message}")
+    })
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    #[test]
+    fn adb_candidates_are_absolute() {
+        for root in sdk_roots() {
+            assert!(root.is_absolute(), "{root:?}");
+        }
+    }
+
+    #[test]
+    fn executable_is_absolute_when_found() {
+        if let Some(adb) = adb_executable() {
+            assert!(adb.is_absolute());
+            assert!(adb.is_file());
+        }
+    }
+}
@@ -0,0 +1,276 @@
+//! What the Logcat tool window shows: the devices `adb` reports and the lines
+//! `adb logcat` prints, parsed from its `threadtime` format.
+
+use serde::{Deserialize, Serialize};
+use specta::Type;
+
+/// One entry of `adb devices -l`.
+#[derive(Clone, Debug, PartialEq, Eq, Serialize, Deserialize, Type)]
+#[serde(rename_all = "camelCase")]
+pub struct AndroidDevice {
+    /// `adb -s` value: a USB serial number, `emulator-5554`, or `host:port`.
+    pub serial: String,
+    /// `device` (usable), `offline`, `unauthorized` or `no permissions`.
+    pub state: String,
+    pub model: Option<String>,
+    pub product: Option<String>,
+    /// The device's own name from the build (`ro.product.device`).
+    pub device: Option<String>,
+    pub transport_id: Option<String>,
+}
+
+impl AndroidDevice {
+    /// Ready for `logcat` / `install`.
+    pub fn is_online(&self) -> bool {
+        self.state == "device"
+    }
+
+    /// What the picker calls it: the model when known, the serial otherwise.
+    pub fn label(&self) -> &str {
+        self.model.as_deref().filter(|m| !m.trim().is_empty()).unwrap_or(&self.serial)
+    }
+}
+
+/// The single-letter logcat priority, in increasing severity.
+#[derive(Clone, Copy, Debug, PartialEq, Eq, PartialOrd, Ord, Serialize, Deserialize, Type)]
+#[serde(rename_all = "camelCase")]
+pub enum LogcatLevel {
+    Verbose,
+    Debug,
+    Info,
+    Warn,
+    Error,
+    Fatal,
+    /// A line logcat prints outside the message format (`--------- beginning of main`).
+    Unknown,
+}
+
+impl LogcatLevel {
+    pub fn letter(self) -> char {
+        match self {
+            Self::Verbose => 'V',
+            Self::Debug => 'D',
+            Self::Info => 'I',
+            Self::Warn => 'W',
+            Self::Error => 'E',
+            Self::Fatal => 'F',
+            Self::Unknown => '?',
+        }
+    }
+
+    fn parse(c: char) -> Self {
+        match c.to_ascii_uppercase() {
+            'V' => Self::Verbose,
+            'D' => Self::Debug,
+            'I' => Self::Info,
+            'W' => Self::Warn,
+            'E' => Self::Error,
+            'F' | 'A' => Self::Fatal,
+            _ => Self::Unknown,
+        }
+    }
+}
+
+/// One [`LogcatLevel`]-tagged line of `adb logcat -v threadtime`.
+#[derive(Clone, Debug, PartialEq, Eq, Serialize, Deserialize, Type)]
+#[serde(rename_all = "camelCase")]
+pub struct LogcatLine {
+    /// `MM-DD HH:MM:SS.mmm`, as logcat prints it (no year, device time zone).
+    pub time: String,
+    pub pid: i32,
+    pub tid: i32,
+    pub level: LogcatLevel,
+    pub tag: String,
+    pub message: String,
+}
+
+impl LogcatLine {
+    /// A line logcat printed outside the message format, kept so nothing is lost.
+    fn unparsed(text: &str) -> Self {
+        Self {
+            time: String::new(),
+            pid: 0,
+            tid: 0,
+            level: LogcatLevel::Unknown,
+            tag: String::new(),
+            message: text.to_owned(),
+        }
+    }
+}
+
+/// Parses `adb devices -l` output; the daemon's chatter on stderr is not included.
+pub fn parse_devices(output: &str) -> Vec<AndroidDevice> {
+    let mut devices: Vec<AndroidDevice> = Vec::new();
+    for line in output.lines() {
+        let line = line.trim_end();
+        if line.trim().is_empty() || line.starts_with("List of devices") || line.starts_with('*') {
+            continue;
+        }
+        let mut fields = line.split_whitespace();
+        let (Some(serial), Some(state)) = (fields.next(), fields.next()) else {
+            continue;
+        };
+        // "no permissions (user in plugdev group; are your udev rules wrong?)"
+        // is the one state that carries spaces; the rest is a `key:value` list.
+        let mut device = AndroidDevice {
+            serial: serial.to_owned(),
+            state: state.to_owned(),
+            model: None,
+            product: None,
+            device: None,
+            transport_id: None,
+        };
+        if device.state == "no" {
+            device.state = "no permissions".to_owned();
+            devices.push(device);
+            continue;
+        }
+        for field in fields {
+            let Some((key, value)) = field.split_once(':') else {
+                continue;
+            };
+            match key {
+                "model" => device.model = Some(value.to_owned()),
+                "product" => device.product = Some(value.to_owned()),
+                "device" => device.device = Some(value.to_owned()),
+                "transport_id" => device.transport_id = Some(value.to_owned()),
+                _ => {}
+            }
+        }
+        devices.push(device);
+    }
+    // Online first, then by name, so the picker's default is the device in hand.
+    devices.sort_by(|a, b| b.is_online().cmp(&a.is_online()).then_with(|| a.serial.cmp(&b.serial)));
+    devices
+}
+
+/// Parses one `logcat -v threadtime` line:
+///
+/// ```text
+/// 11-04 12:52:39.123  3048  3059 I WindowManager: displayed
+/// ```
+///
+/// Text that does not follow the format still becomes a line, so a device that
+/// prints something unexpected does not look like a dead stream.
+pub fn parse_line(text: &str) -> LogcatLine {
+    let Some(line) = parse_formatted(text) else {
+        return LogcatLine::unparsed(text);
+    };
+    line
+}
+
+fn parse_formatted(text: &str) -> Option<LogcatLine> {
+    // "MM-DD HH:MM:SS.mmm" is 18 bytes; logcat pads the rest with spaces.
+    let stamp = text.get(..18)?;
+    if !looks_like_stamp(stamp) {
+        return None;
+    }
+    let mut rest = text.get(18..)?;
+    let pid: i32 = take_field(&mut rest)?.parse().ok()?;
+    let tid: i32 = take_field(&mut rest)?.parse().ok()?;
+    let level = LogcatLevel::parse(take_field(&mut rest)?.chars().next()?);
+    let tail = rest.trim_start();
+    // "Tag            : message": logcat pads the tag to 8 columns, and the tag
+    // itself never contains a colon followed by a space.
+    let (tag, message) = match tail.split_once(": ") {
+        Some((tag, message)) => (tag.trim_end(), message),
+        None => (tail.trim_end(), ""),
+    };
+    Some(LogcatLine { time: stamp.to_owned(), pid, tid, level, tag: tag.to_owned(), message: message.to_owned() })
+}
+
+/// Consumes the next space-separated field of `rest`, leaving the remainder.
+fn take_field<'a>(rest: &mut &'a str) -> Option<&'a str> {
+    *rest = rest.trim_start();
+    if rest.is_empty() {
+        return None;
+    }
+    let end = rest.find(char::is_whitespace).unwrap_or(rest.len());
+    let field = &rest[..end];
+    *rest = &rest[end..];
+    Some(field)
+}
+
+fn looks_like_stamp(s: &str) -> bool {
+    let bytes = s.as_bytes();
+    bytes.len() == 18
+        && bytes[2] == b'-'
+        && bytes[5] == b' '
+        && bytes[8] == b':'
+        && bytes[11] == b':'
+        && bytes[14] == b'.'
+        && bytes.iter().enumerate().all(|(i, b)| matches!(i, 2 | 5 | 8 | 11 | 14) || b.is_ascii_digit())
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    #[test]
+    fn reads_adb_devices_with_attributes() {
+        let out = "\
+List of devices attached
+HT7A1B2C3D4           device product:generic model:Generic_Phone device:generic transport_id:1
+emulator-5554          offline transport_id:2
+0123456789ABCDEF       unauthorized usb:1-1 transport_id:3
+
+";
+        let devices = parse_devices(out);
+        assert_eq!(devices.len(), 3);
+        // Online first, then by serial.
+        assert_eq!(devices[0].serial, "HT7A1B2C3D4");
+        assert_eq!(devices[0].state, "device");
+        assert_eq!(devices[0].model.as_deref(), Some("Generic_Phone"));
+        assert_eq!(devices[0].transport_id.as_deref(), Some("1"));
+        assert!(devices[0].is_online());
+        assert_eq!(devices[1].serial, "0123456789ABCDEF");
+        assert_eq!(devices[1].state, "unauthorized");
+        assert_eq!(devices[1].label(), "0123456789ABCDEF");
+        assert_eq!(devices[2].serial, "emulator-5554");
+        assert!(!devices[2].is_online());
+    }
+
+    #[test]
+    fn reads_adb_devices_when_the_list_is_empty() {
+        assert!(parse_devices("List of devices attached\n\n").is_empty());
+    }
+
+    #[test]
+    fn reads_no_permissions() {
+        let devices = parse_devices("ABC\tno permissions (user in plugdev group; are your udev rules wrong?)\n");
+        assert_eq!(devices.len(), 1);
+        assert_eq!(devices[0].state, "no permissions");
+    }
+
+    #[test]
+    fn parses_a_threadtime_line() {
+        let line = parse_line("11-04 12:52:39.123  3048  3059 I WindowManager: Displayed activity");
+        assert_eq!(line.time, "11-04 12:52:39.123");
+        assert_eq!(line.pid, 3048);
+        assert_eq!(line.tid, 3059);
+        assert_eq!(line.level, LogcatLevel::Info);
+        assert_eq!(line.tag, "WindowManager");
+        assert_eq!(line.message, "Displayed activity");
+    }
+
+    #[test]
+    fn keeps_colons_in_the_message() {
+        let line = parse_line("11-04 12:52:39.123  3048  3059 E flutter : java.lang.IllegalStateException: boom");
+        assert_eq!(line.tag, "flutter");
+        assert_eq!(line.level, LogcatLevel::Error);
+        assert_eq!(line.message, "java.lang.IllegalStateException: boom");
+    }
+
+    #[test]
+    fn keeps_lines_outside_the_format() {
+        let line = parse_line("--------- beginning of main");
+        assert_eq!(line.level, LogcatLevel::Unknown);
+        assert_eq!(line.message, "--------- beginning of main");
+    }
+
+    #[test]
+    fn levels_order_by_severity() {
+        assert!(LogcatLevel::Warn > LogcatLevel::Info);
+        assert!(LogcatLevel::Fatal > LogcatLevel::Error);
+    }
+}
@@ -0,0 +1,206 @@
+//! Child processes of the `adb` CLI: bounded runs, and cancellable line streams
+//! that are handed over in batches (logcat is far too chatty for one message a line).
+
+use ide_core::process::terminate_tree;
+use ide_core::{CancellationToken, IdeError, IdeResult};
+use std::io::Read;
+use std::process::{Child, Command, Stdio};
+use std::sync::mpsc;
+use std::time::{Duration, Instant};
+
+/// How long a cancelled child gets to exit on `SIGTERM` (and flush) before `SIGKILL`.
+const KILL_GRACE: Duration = Duration::from_millis(20);
+
+pub(crate) struct Output {
+    pub stdout: String,
+    pub stderr: String,
+    pub success: bool,
+}
+
+fn prepare(cmd: &mut Command) {
+    cmd.stdin(Stdio::null()).stdout(Stdio::piped()).stderr(Stdio::piped());
+    ide_core::process::prepare(ide_core::process::own_group(cmd));
+}
+
+fn spawn(cmd: &mut Command) -> IdeResult<Child> {
+    cmd.spawn().map_err(|e| IdeError::unavailable(format!("could not run adb: {e}")))
+}
+
+fn read_all(mut pipe: impl Read + Send + 'static) -> std::thread::JoinHandle<String> {
+    std::thread::spawn(move || {
+        let mut buf = Vec::new();
+        let _ = pipe.read_to_end(&mut buf);
+        ide_core::output_encoding::decode_tool_output(&buf)
+    })
+}
+
+/// Runs `cmd` to completion. Fails when it outlives `timeout` or `cancel` fires;
+/// a non-zero exit is reported in [`Output::success`], not as an error.
+pub(crate) fn run(mut cmd: Command, timeout: Duration, cancel: Option<&CancellationToken>) -> IdeResult<Output> {
+    prepare(&mut cmd);
+    let mut child = spawn(&mut cmd)?;
+    let out = child.stdout.take().map(read_all);
+    let err = child.stderr.take().map(read_all);
+    let deadline = Instant::now() + timeout;
+    let status = loop {
+        if let Some(status) = child.try_wait()? {
+            break status;
+        }
+        if cancel.is_some_and(CancellationToken::is_cancelled) {
+            terminate_tree(&mut child, KILL_GRACE);
+            return Err(IdeError::cancelled());
+        }
+        if Instant::now() >= deadline {
+            terminate_tree(&mut child, KILL_GRACE);
+            return Err(IdeError::unavailable("adb did not respond in time"));
+        }
+        std::thread::sleep(Duration::from_millis(10));
+    };
+    Ok(Output {
+        stdout: out.map(|t| t.join().unwrap_or_default()).unwrap_or_default(),
+        stderr: err.map(|t| t.join().unwrap_or_default()).unwrap_or_default(),
+        success: status.success(),
+    })
+}
+
+enum Event {
+    Line(bool, String),
+    Closed,
+}
+
+fn spawn_reader(mut pipe: impl Read + Send + 'static, tx: mpsc::Sender<Event>, stdout: bool) {
+    std::thread::spawn(move || {
+        let mut buf = [0u8; 8192];
+        let mut pending: Vec<u8> = Vec::new();
+        let flush = |pending: &mut Vec<u8>| {
+            if !pending.is_empty() {
+                let line = ide_core::output_encoding::decode_tool_output(pending);
+                pending.clear();
+                let _ = tx.send(Event::Line(stdout, line.trim_end().to_string()));
+            }
+        };
+        loop {
+            match pipe.read(&mut buf) {
+                Ok(0) | Err(_) => break,
+                Ok(n) => {
+                    for &b in &buf[..n] {
+                        if b == b'\n' {
+                            flush(&mut pending);
+                        } else if b != b'\r' {
+                            pending.push(b);
+                        }
+                    }
+                }
+            }
+        }
+        flush(&mut pending);
+        let _ = tx.send(Event::Closed);
+    });
+}
+
+fn flush<T>(batch: &mut Vec<T>, on_batch: &mut dyn FnMut(Vec<T>)) {
+    if !batch.is_empty() {
+        on_batch(std::mem::take(batch));
+    }
+}
+
+/// Runs `cmd`, parsing every stdout line with `parse` and handing the results to
+/// `on_batch` — as soon as `max` are ready, or once the oldest waiting line is `idle`
+/// old, so neither a quiet nor a steady stream holds lines back. Stderr is kept as a
+/// tail for the error message. Returns whether the child exited successfully.
+pub(crate) fn stream_batched<T>(
+    mut cmd: Command,
+    cancel: &CancellationToken,
+    idle: Duration,
+    max: usize,
+    mut parse: impl FnMut(&str) -> Option<T>,
+    on_batch: &mut dyn FnMut(Vec<T>),
+) -> IdeResult<(bool, Vec<String>)> {
+    if cancel.is_cancelled() {
+        return Err(IdeError::cancelled());
+    }
+    prepare(&mut cmd);
+    let mut child = spawn(&mut cmd)?;
+    let (tx, rx) = mpsc::channel::<Event>();
+    let mut open = 0;
+    if let Some(out) = child.stdout.take() {
+        spawn_reader(out, tx.clone(), true);
+        open += 1;
+    }
+    if let Some(err) = child.stderr.take() {
+        spawn_reader(err, tx.clone(), false);
+        open += 1;
+    }
+    drop(tx);
+    let mut stderr_tail: Vec<String> = Vec::new();
+    let mut batch: Vec<T> = Vec::with_capacity(max);
+    // When the first line of the waiting batch arrived.
+    let mut since = Instant::now();
+    while open > 0 {
+        if cancel.is_cancelled() {
+            terminate_tree(&mut child, KILL_GRACE);
+            return Err(IdeError::cancelled());
+        }
+        let wait = if batch.is_empty() { idle } else { idle.saturating_sub(since.elapsed()) };
+        match rx.recv_timeout(wait) {
+            Ok(Event::Line(true, line)) => {
+                if let Some(item) = parse(&line) {
+                    if batch.is_empty() {
+                        since = Instant::now();
+                    }
+                    batch.push(item);
+                    if batch.len() >= max || since.elapsed() >= idle {
+                        flush(&mut batch, on_batch);
+                    }
+                }
+            }
+            Ok(Event::Line(false, line)) => {
+                if !line.trim().is_empty() {
+                    stderr_tail.push(line);
+                    if stderr_tail.len() > 20 {
+                        stderr_tail.remove(0);
+                    }
+                }
+            }
+            Ok(Event::Closed) => open -= 1,
+            Err(mpsc::RecvTimeoutError::Timeout) => flush(&mut batch, on_batch),
+            Err(mpsc::RecvTimeoutError::Disconnected) => break,
+        }
+    }
+    flush(&mut batch, on_batch);
+    let status = loop {
+        if let Some(status) = child.try_wait()? {
+            break status;
+        }
+        if cancel.is_cancelled() {
+            terminate_tree(&mut child, KILL_GRACE);
+            return Err(IdeError::cancelled());
+        }
+        std::thread::sleep(Duration::from_millis(10));
+    };
+    Ok((status.success(), stderr_tail))
+}
+
+#[cfg(all(test, unix))]
+mod tests {
+    use super::*;
+
+    #[test]
+    fn a_steady_stream_is_handed_over_while_it_runs() {
+        let mut cmd = Command::new("sh");
+        cmd.args(["-c", "for i in $(seq 1 20); do echo $i; sleep 0.02; done"]);
+        let mut sizes = Vec::new();
+        let (ok, _) = stream_batched(
+            cmd,
+            &CancellationToken::new(),
+            Duration::from_millis(60),
+            300,
+            |line| Some(line.to_owned()),
+            &mut |batch| sizes.push(batch.len()),
+        )
+        .unwrap();
+        assert!(ok);
+        assert_eq!(sizes.iter().sum::<usize>(), 20);
+        assert!(sizes.len() >= 3, "lines arriving every 20 ms waited for the end: {sizes:?}");
+    }
+}
@@ -0,0 +1,65 @@
+//! Drives a real device through `adb`, checking what the Logcat tool window does:
+//! that the device list parses, that the stream delivers batches, and that
+//! cancelling stops both the stream and its `adb` process.
+//!
+//! Ignored by default (needs a connected device). Run with
+//! `OPENIDEA_ADB_DEVICE=<serial> cargo test -p ide-android --test device -- --ignored --nocapture`
+//! — without the variable, the connected device is used when there is exactly one.
+
+use ide_android::*;
+use ide_core::CancellationToken;
+use std::sync::{Arc, Mutex};
+use std::time::{Duration, Instant};
+
+fn serial() -> Option<String> {
+    if let Ok(serial) = std::env::var("OPENIDEA_ADB_DEVICE") {
+        return Some(serial);
+    }
+    let online = devices().ok()?.into_iter().filter(AndroidDevice::is_online).collect::<Vec<_>>();
+    (online.len() == 1).then(|| online[0].serial.clone())
+}
+
+#[test]
+#[ignore]
+fn finds_the_adb_executable() {
+    let adb = adb_executable().expect("adb (set ANDROID_HOME or OPENIDEA_ADB)");
+    println!("adb: {}", adb.display());
+    assert!(adb.is_file());
+}
+
+#[test]
+#[ignore]
+fn lists_connected_devices() {
+    let devices = devices().expect("adb devices");
+    for device in &devices {
+        println!("{:<16} {:<14} {} ({:?})", device.serial, device.state, device.label(), device.transport_id);
+    }
+    assert!(!devices.is_empty(), "no devices connected");
+}
+
+#[test]
+#[ignore]
+fn streams_batches_and_stops_on_cancel() {
+    let serial = serial().expect("a single connected device, or OPENIDEA_ADB_DEVICE");
+    let cancel = CancellationToken::new();
+    let stop = cancel.clone();
+    let received = Arc::new(Mutex::new(Vec::<LogcatLine>::new()));
+    let sink = received.clone();
+    let started = Instant::now();
+    let stream = std::thread::spawn(move || {
+        ide_android::logcat(&serial, false, &stop, &mut |batch| {
+            sink.lock().unwrap().extend(batch);
+        })
+    });
+    // Enough to see the tail seed and a few live lines from a device that idles.
+    std::thread::sleep(Duration::from_secs(4));
+    cancel.cancel();
+    stream.join().unwrap().expect("logcat stops cleanly when cancelled");
+    let lines = received.lock().unwrap();
+    println!("{} lines in {:?}", lines.len(), started.elapsed());
+    for line in lines.iter().rev().take(5) {
+        println!("{:<14} {:>6} {}", line.tag, line.pid, line.message);
+    }
+    assert!(!lines.is_empty(), "no lines within 4s");
+    assert!(lines.iter().any(|l| l.level != LogcatLevel::Unknown), "every line failed to parse");
+}
@@ -40,7 +40,7 @@ pub fn plan(root: &Path, model: &BuildModel, module: &Path, cache: &Path) -> Ide
            kind: "maven",
        });
    }
-    if let Some(g) = &model.gradle
+    if let Some(g) = model.gradle_for_module(root, &module)
        && let Some(p) = g.projects.iter().find(|p| root.join(&p.dir) == module)
    {
        let script = cache.join("resources.init.gradle");
@@ -163,11 +163,11 @@ mod tests {
        assert!(maven.args.contains(&"-Dexpression=project.build.outputDirectory".into()));
        assert_eq!(maven.env["JAVA_HOME"], "/jdk");
        model.maven = None;
-        model.gradle = Some(crate::GradleModel {
+        model.gradle = vec![crate::GradleModel {
            command: "/tools/gradlew".into(),
            projects: vec![crate::GradleProject { path: ":app".into(), dir: "app".into(), ..Default::default() }],
            ..Default::default()
-        });
+        }];
        let gradle = plan(&root, &model, Path::new("app"), &cache).unwrap();
        assert_eq!(gradle.command, "/tools/gradlew");
        assert_eq!(gradle.args.last().unwrap(), ":app:openideaUpdateResources");
@@ -147,7 +147,9 @@ fn detect_dir(dir: &Path, model: &BuildModel, root: &Path) -> Option<BuildSystem
    let rel = rel_str(root, dir);
    if model.maven.as_ref().is_some_and(|m| m.projects.iter().any(|p| p.dir == rel)) || has(dir, &["pom.xml"]) {
        Some(BuildSystem::Maven)
-    } else if has(dir, &["build.gradle", "build.gradle.kts", "settings.gradle", "settings.gradle.kts"]) {
+    } else if model.gradle_for_module(root, dir).is_some()
+        || has(dir, &["build.gradle", "build.gradle.kts", "settings.gradle", "settings.gradle.kts"])
+    {
        Some(BuildSystem::Gradle)
    } else if has(dir, &["Cargo.toml"]) {
        Some(BuildSystem::Cargo)
@@ -162,16 +164,13 @@ fn detect_dir(dir: &Path, model: &BuildModel, root: &Path) -> Option<BuildSystem
    }
 }

-/// `root/rel`, without a trailing separator for the root itself.
-/// `root` / `rel`, joined per `/`-separated component: on Windows a single join of
-/// `a/b` keeps the `/`, and such a path does not compare equal to the same directory
-/// as other tools (JDT LS) spell it.
+/// Resolves a workspace-relative or absolute directory with native path separators.
 fn subdir(root: &Path, rel: &str) -> PathBuf {
-    rel.split('/').filter(|part| !part.is_empty()).fold(root.to_path_buf(), |path, part| path.join(part))
+    root.join(rel).components().collect()
 }

 fn rel_str(root: &Path, dir: &Path) -> String {
-    dir.strip_prefix(root).map(|r| r.to_string_lossy().replace('\\', "/")).unwrap_or_default()
+    dir.strip_prefix(root).unwrap_or(dir).to_string_lossy().replace('\\', "/")
 }

 /// Directories from `file`'s folder up to `root` (inclusive).
@@ -192,7 +191,14 @@ pub fn plan(
    let project_name = root.file_name().map_or_else(|| "project".to_owned(), |n| n.to_string_lossy().into_owned());
    let module_dir = match file {
        Some(f) => {
-            let dir = ancestors_within(root, f)
+            let scope = model
+                .gradle
+                .iter()
+                .flat_map(|g| std::iter::once(root.join(&g.dir)).chain(g.projects.iter().map(|p| root.join(&p.dir))))
+                .filter(|dir| f.starts_with(dir))
+                .max_by_key(|dir| dir.components().count())
+                .unwrap_or_else(|| root.to_path_buf());
+            let dir = ancestors_within(&scope, f)
                .find(|d| detect_dir(d, model, root).is_some())
                .ok_or_else(|| IdeError::not_found(format!("{} is not in a module", f.display())))?;
            Some(dir.to_path_buf())
@@ -202,7 +208,7 @@ pub fn plan(
    let dir = module_dir.clone().unwrap_or_else(|| root.to_path_buf());
    // A folder of sibling projects has no build file itself; its Maven projects are built one by one.
    let system = detect_dir(&dir, model, root)
-        .or_else(|| if model.gradle.is_some() { Some(BuildSystem::Gradle) } else { None })
+        .or((!model.gradle.is_empty()).then_some(BuildSystem::Gradle))
        .or_else(|| model.maven.as_ref().filter(|m| !m.projects.is_empty()).map(|_| BuildSystem::Maven))
        .ok_or_else(|| {
            IdeError::not_found("no supported build system (Maven, Gradle, Cargo, Go, TypeScript, CMake) found")
@@ -270,14 +276,16 @@ fn maven_steps(root: &Path, model: &BuildModel, kind: BuildKind, module: Option<
 }

 fn gradle_steps(root: &Path, model: &BuildModel, kind: BuildKind, module: Option<&Path>) -> IdeResult<Vec<BuildStep>> {
-    let fallback;
-    let g = match &model.gradle {
-        Some(g) => g,
-        None => {
-            fallback = crate::gradle::load(root).ok_or_else(|| IdeError::not_found("no Gradle build found"))?;
-            &fallback
-        }
-    };
+    if module.is_none() && !model.gradle.is_empty() {
+        return Ok(model.gradle.iter().flat_map(|g| gradle_step(root, g, kind, None)).collect());
+    }
+    let g = module
+        .and_then(|m| model.gradle_for_module(root, m))
+        .ok_or_else(|| IdeError::not_found("module does not belong to a linked Gradle build"))?;
+    Ok(gradle_step(root, g, kind, module))
+}
+
+fn gradle_step(root: &Path, g: &crate::GradleModel, kind: BuildKind, module: Option<&Path>) -> Vec<BuildStep> {
    let prefix = module
        .and_then(|m| {
            let rel = rel_str(root, m);
@@ -296,7 +304,7 @@ fn gradle_steps(root: &Path, model: &BuildModel, kind: BuildKind, module: Option
    let mut s = BuildStep::new(&g.command, &["--console=plain"], &subdir(root, &g.dir), Format::Gradle);
    s.args.extend(tasks);
    s.env = g.env.clone();
-    Ok(vec![s])
+    vec![s]
 }

 fn cargo_steps(dir: &Path, kind: BuildKind) -> Vec<BuildStep> {
@@ -811,6 +819,79 @@ fn launch_class_dirs(system: BuildSystem, module: &Path, test: bool) -> Vec<Path

 #[cfg(test)]
 mod tests {
+    #[test]
+    fn independent_gradle_builds_keep_their_launchers_and_task_paths() {
+        let wrapper = if cfg!(windows) { "gradlew.bat" } else { "gradlew" };
+        let temp = tempfile::tempdir().unwrap();
+        let root = temp.path();
+        for dir in ["a", "b"] {
+            std::fs::create_dir_all(root.join(dir).join("app/src/main/java")).unwrap();
+            std::fs::write(root.join(dir).join("settings.gradle"), "include 'app'").unwrap();
+            std::fs::write(root.join(dir).join("app/build.gradle"), "plugins { id 'java' }").unwrap();
+            std::fs::write(root.join(dir).join(wrapper), "").unwrap();
+        }
+        let settings = ide_core::settings::GradleSettings {
+            linked_projects: Some(vec!["a".into(), "b".into()]),
+            ..Default::default()
+        };
+        let mut model = crate::load_linked(root, &root.join("cache"), None, &Default::default(), &settings);
+        model.gradle[0].env.insert("JAVA_HOME".into(), "/jdk-a".into());
+        model.gradle[1].env.insert("JAVA_HOME".into(), "/jdk-b".into());
+        let all = super::plan(root, &model, super::BuildKind::Build, None, None).unwrap();
+        assert_eq!(all.steps.len(), 2);
+        assert_eq!(all.steps[0].cwd, root.join("a"));
+        assert_eq!(all.steps[1].cwd, root.join("b"));
+        let module = super::plan(root, &model, super::BuildKind::Rebuild, Some(&root.join("b/app")), None).unwrap();
+        assert_eq!(module.steps.len(), 1);
+        assert_eq!(module.steps[0].program, root.join("b").join(wrapper).to_string_lossy());
+        assert_eq!(module.steps[0].cwd, root.join("b"));
+        assert_eq!(module.steps[0].env["JAVA_HOME"], "/jdk-b");
+        assert_eq!(module.steps[0].args, ["--console=plain", ":app:clean", ":app:classes", ":app:testClasses"]);
+        // A directly linked build owns its module even when another composite reports it too.
+        let direct = model.gradle[1].projects[0].clone();
+        model.gradle[0].projects.push(direct);
+        assert_eq!(model.gradle_for_module(root, &root.join("b")).unwrap().dir, "b");
+        let mut nested = model.gradle[1].projects[1].clone();
+        nested.path = ":b:app".into();
+        model.gradle[0].projects.push(nested);
+        let nested = super::plan(root, &model, super::BuildKind::Build, Some(&root.join("b/app")), None).unwrap();
+        assert_eq!(nested.steps[0].program, root.join("b").join(wrapper).to_string_lossy());
+        assert_eq!(nested.steps[0].args, ["--console=plain", ":app:classes", ":app:testClasses"]);
+        model.gradle.clear();
+        assert!(super::plan(root, &model, super::BuildKind::Build, Some(&root.join("b/app")), None).is_err());
+    }
+
+    #[test]
+    fn absolute_linked_roots_build_the_project_and_external_source_module() {
+        let wrapper = if cfg!(windows) { "gradlew.bat" } else { "gradlew" };
+        let temp = tempfile::tempdir().unwrap();
+        let base = dunce::canonicalize(temp.path()).unwrap();
+        let root = base.join("workspace");
+        let external = base.join("external");
+        std::fs::create_dir(&root).unwrap();
+        std::fs::create_dir_all(external.join("app/src/main/java")).unwrap();
+        std::fs::write(external.join("settings.gradle"), "include 'app'").unwrap();
+        let source = external.join("app/src/main/java/App.java");
+        std::fs::write(&source, "class App {}").unwrap();
+        std::fs::write(external.join(wrapper), "").unwrap();
+        let settings = ide_core::settings::GradleSettings {
+            linked_projects: Some(vec![external.to_string_lossy().into_owned()]),
+            ..Default::default()
+        };
+        let mut model = crate::load_linked(&root, &base.join("cache"), None, &Default::default(), &settings);
+        model.gradle[0].env.insert("JAVA_HOME".into(), "/external-jdk".into());
+        let all = super::plan(&root, &model, super::BuildKind::Build, None, None).unwrap();
+        assert_eq!(all.steps[0].cwd, external);
+        assert_eq!(all.steps[0].program, external.join(wrapper).to_string_lossy());
+        let module = super::plan(&root, &model, super::BuildKind::Rebuild, Some(&source), None).unwrap();
+        assert_eq!(module.steps[0].cwd, external);
+        assert_eq!(module.steps[0].env["JAVA_HOME"], "/external-jdk");
+        assert_eq!(module.steps[0].args, ["--console=plain", ":app:clean", ":app:classes", ":app:testClasses"]);
+        let other = base.join("unlinked");
+        std::fs::create_dir(&other).unwrap();
+        std::fs::write(other.join("build.gradle"), "").unwrap();
+        assert!(super::plan(&root, &model, super::BuildKind::Build, Some(&other), None).is_err());
+    }
    use super::*;

    /// Launch outputs use the platform separator throughout, so they compare equal to
@@ -435,6 +435,17 @@ pub fn external_roots<'a>(root: &Path, dirs: impl IntoIterator<Item = &'a str>)

 pub fn load(root: &Path) -> Option<GradleModel> {
    let dir = build_dir(root)?;
+    load_build(root, dir.strip_prefix(root).unwrap_or(&dir))
+}
+
+/// Loads exactly this build, without searching its child folders.
+pub fn load_build(root: &Path, dir: &Path) -> Option<GradleModel> {
+    // Linked builds are saved with forward slashes; rebuild the path so the launcher
+    // and module folders use the platform's separators.
+    let dir: PathBuf = root.join(dir).components().collect();
+    if !SETTINGS_FILES.iter().chain(BUILD_FILES).any(|name| dir.join(name).is_file()) {
+        return None;
+    }
    let settings = read_first(&dir, SETTINGS_FILES).map(|(_, t)| parse_settings(&t)).unwrap_or_default();
    let root_name =
        settings.name.unwrap_or_else(|| dir.file_name().map(|n| n.to_string_lossy().into_owned()).unwrap_or_default());
@@ -455,6 +466,65 @@ pub fn load(root: &Path) -> Option<GradleModel> {
    Some(GradleModel { dir: rel(root, &dir), projects, java_version, command: wrapper(&dir), ..GradleModel::default() })
 }

+/// Validates user-selected build folders and stores a stable, deduplicated identity.
+pub fn normalize_linked_projects(root: &Path, dirs: &[String]) -> ide_core::IdeResult<Vec<String>> {
+    let root = dunce::canonicalize(root)?;
+    let mut out = Vec::new();
+    for dir in dirs {
+        let path = dunce::canonicalize(root.join(dir))?;
+        if !path.is_dir() || !SETTINGS_FILES.iter().chain(BUILD_FILES).any(|name| path.join(name).is_file()) {
+            return Err(ide_core::IdeError::invalid(format!("No Gradle build in {}", path.display())));
+        }
+        let dir = rel(&root, &path);
+        if !out.contains(&dir) {
+            out.push(dir);
+        }
+    }
+    Ok(out)
+}
+
+/// The form `normalize_linked_projects` saves `dir` in, also for a folder that no longer
+/// exists, so a path the UI sends (`C:\…` on Windows) matches the saved entry.
+pub fn linked_project_key(root: &Path, dir: &str) -> String {
+    match (dunce::canonicalize(root), dunce::canonicalize(root.join(dir))) {
+        (Ok(root), Ok(path)) => rel(&root, &path),
+        _ => dir.replace('\\', "/"),
+    }
+}
+
+/// Linked build identities without reading their scripts (also used by index hot paths).
+pub(crate) fn linked_dirs(root: &Path, settings: &ide_core::settings::GradleSettings) -> Vec<String> {
+    match &settings.linked_projects {
+        None => build_dir(root).map(|dir| rel(root, &dir)).into_iter().collect(),
+        Some(dirs) => {
+            let mut out = Vec::new();
+            for dir in dirs {
+                if let Ok(dirs) = normalize_linked_projects(root, std::slice::from_ref(dir)) {
+                    for dir in dirs {
+                        if !out.contains(&dir) {
+                            out.push(dir);
+                        }
+                    }
+                }
+            }
+            out
+        }
+    }
+}
+
+pub fn load_linked(root: &Path, settings: &ide_core::settings::GradleSettings) -> Vec<GradleModel> {
+    linked_dirs(root, settings).iter().filter_map(|dir| load_build(root, Path::new(dir))).collect()
+}
+
+/// A build's task paths are local to it, so sync caches must be local to its identity too.
+pub fn cache_dir(cache: &Path, build_dir: &str) -> PathBuf {
+    if build_dir.is_empty() {
+        return cache.to_path_buf();
+    }
+    let hash = build_dir.bytes().fold(0xcbf29ce484222325u64, |h, b| (h ^ u64::from(b)).wrapping_mul(0x100000001b3));
+    cache.join("gradle").join(format!("{hash:016x}"))
+}
+
 /// `JavaLanguageVersion.of(21)` / `sourceCompatibility = JavaVersion.VERSION_17` in a build script.
 pub fn script_java_version(text: &str) -> Option<u32> {
    let number = |s: &str| -> Option<u32> {
@@ -616,6 +686,65 @@ pub(crate) fn has_war_plugin(script: &str) -> bool {

 #[cfg(test)]
 mod tests {
+    #[test]
+    fn a_path_from_the_ui_finds_the_saved_link() {
+        let temp = tempfile::tempdir().unwrap();
+        let root = temp.path().join("workspace");
+        let external = temp.path().join("external");
+        for dir in [root.join("a"), external.clone()] {
+            std::fs::create_dir_all(&dir).unwrap();
+            std::fs::write(dir.join("settings.gradle"), "").unwrap();
+        }
+        let native = |p: &std::path::Path| p.to_string_lossy().into_owned();
+        // Saved by linking; unlinking may send a native, absolute or non-canonical spelling.
+        for (dir, sent) in [
+            ("a", native(&root.join("a"))),
+            ("a", "a".to_owned()),
+            ("a", native(&root.join("a").join("..").join("a"))),
+            ("../external", native(&external)),
+        ] {
+            let saved = super::normalize_linked_projects(&root, &[dir.into()]).unwrap();
+            assert_eq!(super::linked_project_key(&root, &sent), saved[0], "{sent}");
+        }
+        // A folder deleted since it was linked still matches its saved entry.
+        assert_eq!(super::linked_project_key(&root, r"gone\build"), "gone/build");
+    }
+
+    #[test]
+    fn explicit_linkage_preserves_default_discovery_and_can_unlink_every_build() {
+        let temp = tempfile::tempdir().unwrap();
+        let root = temp.path();
+        for dir in ["a", "b"] {
+            std::fs::create_dir(root.join(dir)).unwrap();
+            std::fs::write(root.join(dir).join("settings.gradle"), format!("rootProject.name = '{dir}'")).unwrap();
+        }
+        assert_eq!(super::load_linked(root, &Default::default())[0].dir, "a");
+        let mut settings = ide_core::settings::GradleSettings {
+            linked_projects: Some(vec!["b".into(), "./b".into(), "a".into()]),
+            ..Default::default()
+        };
+        let models = super::load_linked(root, &settings);
+        assert_eq!(models.iter().map(|g| g.dir.as_str()).collect::<Vec<_>>(), ["b", "a"]);
+        settings.linked_projects = Some(vec![]);
+        assert!(super::load_linked(root, &settings).is_empty());
+        assert!(super::normalize_linked_projects(root, &["missing".into()]).is_err());
+        assert!(super::normalize_linked_projects(root, &["".into()]).is_err());
+        assert!(super::load_build(root, root).is_none(), "exact loading never picks a child");
+    }
+
+    #[cfg(unix)]
+    #[test]
+    fn linked_directories_deduplicate_symlinks_and_keep_external_builds() {
+        let temp = tempfile::tempdir().unwrap();
+        let root = temp.path().join("workspace");
+        let external = temp.path().join("external");
+        std::fs::create_dir(&root).unwrap();
+        std::fs::create_dir(&external).unwrap();
+        std::fs::write(external.join("build.gradle"), "").unwrap();
+        std::os::unix::fs::symlink(&external, root.join("alias")).unwrap();
+        let dirs = super::normalize_linked_projects(&root, &["alias".into(), "../external".into()]).unwrap();
+        assert_eq!(dirs, [external.canonicalize().unwrap().to_string_lossy().to_string()]);
+    }
    #[test]
    fn script_dependencies_read_string_and_map_notations() {
        let script = r#"
@@ -0,0 +1,268 @@
+//! A Gradle project's resolved dependencies for the Dependency Analyzer:
+//! `gradle <project>:dependencies --configuration <name>`, parsed from its tree report.
+
+use crate::gradle;
+use crate::process;
+use crate::sync::{SyncOptions, error_summary};
+use ide_core::{CancellationToken, IdeError, IdeResult};
+use serde::{Deserialize, Serialize};
+use specta::Type;
+use std::path::Path;
+
+/// One line of the report: an occurrence of a dependency where it is requested.
+#[derive(Clone, Debug, Default, PartialEq, Eq, Serialize, Deserialize, Type)]
+#[serde(rename_all = "camelCase")]
+pub struct GradleDependency {
+    /// `group`, empty for a project dependency.
+    pub group: String,
+    /// Artifact name, or the project path (`:core`) of a project dependency.
+    pub name: String,
+    /// The version asked for here; `None` when a platform or constraint supplies it.
+    pub requested: Option<String>,
+    /// The version Gradle selected (`-> 1.2`), when it differs from the request.
+    pub selected: Option<String>,
+    /// A project of the build (`project :core`, or a module substituted by one).
+    pub project: bool,
+    /// `(*)`: listed with its dependencies earlier in the tree.
+    pub repeated: bool,
+    /// `(c)`: a dependency constraint rather than a dependency.
+    pub constraint: bool,
+    /// `(n)` / `FAILED`: not resolved.
+    pub unresolved: bool,
+    pub children: Vec<GradleDependency>,
+}
+
+/// Parses the tree of a `dependencies --configuration` report (lines `+--- g:a:1.0 -> 1.1 (*)`).
+pub fn parse_report(output: &str) -> Vec<GradleDependency> {
+    let mut roots: Vec<GradleDependency> = Vec::new();
+    // Path of child indexes from the roots to the last node of each depth.
+    let mut path: Vec<usize> = Vec::new();
+    for line in output.lines() {
+        let Some((depth, text)) = tree_line(line) else { continue };
+        let node = parse_entry(text);
+        path.truncate(depth);
+        if depth > path.len() {
+            continue; // A line deeper than its parent allows: not part of a well-formed tree.
+        }
+        let siblings = if depth == 0 {
+            &mut roots
+        } else {
+            let mut list = &mut roots;
+            for &i in &path[..depth - 1] {
+                list = &mut list[i].children;
+            }
+            let Some(parent) = list.get_mut(path[depth - 1]) else { continue };
+            &mut parent.children
+        };
+        siblings.push(node);
+        path.push(siblings.len() - 1);
+    }
+    roots
+}
+
+/// `|    \--- g:a:1.0` → (1, "g:a:1.0").
+fn tree_line(line: &str) -> Option<(usize, &str)> {
+    let mut rest = line;
+    let mut depth = 0;
+    loop {
+        if let Some(r) = rest.strip_prefix("+--- ").or_else(|| rest.strip_prefix("\\--- ")) {
+            return Some((depth, r.trim()));
+        }
+        rest = rest.strip_prefix("|    ").or_else(|| rest.strip_prefix("     "))?;
+        depth += 1;
+    }
+}
+
+fn parse_entry(text: &str) -> GradleDependency {
+    let mut d = GradleDependency::default();
+    let mut text = text.trim();
+    loop {
+        if let Some(t) = text.strip_suffix(" (*)") {
+            d.repeated = true;
+            text = t;
+        } else if let Some(t) = text.strip_suffix(" (c)") {
+            d.constraint = true;
+            text = t;
+        } else if let Some(t) = text.strip_suffix(" (n)").or_else(|| text.strip_suffix(" FAILED")) {
+            d.unresolved = true;
+            text = t;
+        } else {
+            break;
+        }
+        text = text.trim_end();
+    }
+    let (left, right) = match text.split_once(" -> ") {
+        Some((l, r)) => (l.trim(), Some(r.trim())),
+        None => (text, None),
+    };
+    if let Some(project) = left.strip_prefix("project ") {
+        d.project = true;
+        d.name = project_path(project);
+    } else {
+        let mut parts = left.splitn(3, ':');
+        d.group = parts.next().unwrap_or_default().to_owned();
+        d.name = parts.next().unwrap_or_default().to_owned();
+        d.requested = parts.next().filter(|v| !v.is_empty()).map(str::to_owned);
+    }
+    if let Some(right) = right {
+        if let Some(project) = right.strip_prefix("project ") {
+            // A module substituted by a project of the build.
+            d.project = true;
+            d.selected = Some(project_path(project));
+        } else {
+            d.selected = Some(right.to_owned());
+        }
+    }
+    d
+}
+
+/// `:core`, or `':core'` as Gradle 9 quotes it.
+fn project_path(text: &str) -> String {
+    let t = text.trim();
+    t.strip_prefix('\'').and_then(|t| t.strip_suffix('\'')).unwrap_or(t).to_owned()
+}
+
+/// Runs the `dependencies` report of `project` (a Gradle path, `:` for the root) for
+/// `configuration` and returns its tree.
+pub fn gradle_dependencies(
+    root: &Path,
+    model: &gradle::GradleModel,
+    options: &SyncOptions,
+    project: &str,
+    configuration: &str,
+    cancel: &CancellationToken,
+) -> IdeResult<Vec<GradleDependency>> {
+    if !configuration.chars().all(|c| c.is_ascii_alphanumeric() || c == '_' || c == '-') || configuration.is_empty() {
+        return Err(IdeError::invalid(format!("not a configuration name: {configuration}")));
+    }
+    if !project.starts_with(':') || project.chars().any(char::is_whitespace) {
+        return Err(IdeError::invalid(format!("not a Gradle project path: {project}")));
+    }
+    let task = if project == ":" { ":dependencies".to_owned() } else { format!("{project}:dependencies") };
+    let mut args: Vec<String> =
+        vec!["--console=plain".into(), "-q".into(), task, "--configuration".into(), configuration.into()];
+    if options.offline {
+        args.push("--offline".into());
+    }
+    let out = process::run(
+        options.gradle_command.as_deref().unwrap_or(&model.command),
+        &args,
+        &root.join(&model.dir),
+        &options.env,
+        cancel,
+        |_, _| {},
+    )?;
+    if !out.success {
+        return Err(IdeError::unavailable(error_summary(&out.text)));
+    }
+    Ok(parse_report(&out.text))
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    fn dep(group: &str, name: &str, requested: Option<&str>) -> GradleDependency {
+        GradleDependency {
+            group: group.into(),
+            name: name.into(),
+            requested: requested.map(Into::into),
+            ..Default::default()
+        }
+    }
+
+    #[test]
+    fn parses_the_tree_with_selected_versions_and_markers() {
+        let report = "\
+------------------------------------------------------------
+Project ':app'
+------------------------------------------------------------
+
+runtimeClasspath - Runtime classpath of source set 'main'.
+--- org.springframework.boot:spring-boot-starter-web -> 3.2.0
+|    +--- org.springframework.boot:spring-boot-starter:3.2.0
+|    |    \\--- org.yaml:snakeyaml:2.2
+|    \\--- com.fasterxml.jackson.core:jackson-databind:2.15.0 -> 2.15.3 (*)
+--- project ':core'
+|    \\--- com.google.guava:guava:{strictly 32.1.3-jre} -> 32.1.3-jre (c)
+--- org.example:legacy:1.0 -> project :legacy
+\\--- org.missing:gone:9 FAILED
+
+(c) - A dependency constraint, not a dependency. The dependency affected by the constraint occurs elsewhere in the tree.
+(*) - Indicates repeated occurrences of a transitive dependency subtree. Gradle expands transitive dependency subtrees only once per project; repeat occurrences only display the root of the subtree, followed by this annotation.
+";
+        let tree = parse_report(report);
+        assert_eq!(tree.len(), 4);
+        let web = &tree[0];
+        assert_eq!((web.group.as_str(), web.name.as_str()), ("org.springframework.boot", "spring-boot-starter-web"));
+        assert_eq!((web.requested.as_deref(), web.selected.as_deref()), (None, Some("3.2.0")));
+        assert_eq!(web.children.len(), 2);
+        assert_eq!(web.children[0].children, vec![dep("org.yaml", "snakeyaml", Some("2.2"))]);
+        let databind = &web.children[1];
+        assert_eq!((databind.requested.as_deref(), databind.selected.as_deref()), (Some("2.15.0"), Some("2.15.3")));
+        assert!(databind.repeated);
+        let core = &tree[1];
+        assert!(core.project && core.group.is_empty());
+        assert_eq!(core.name, ":core");
+        let guava = &core.children[0];
+        assert!(guava.constraint);
+        assert_eq!(guava.requested.as_deref(), Some("{strictly 32.1.3-jre}"));
+        let legacy = &tree[2];
+        assert!(legacy.project);
+        assert_eq!((legacy.name.as_str(), legacy.selected.as_deref()), ("legacy", Some(":legacy")));
+        assert!(tree[3].unresolved);
+        assert_eq!(tree[3].requested.as_deref(), Some("9"));
+    }
+
+    #[test]
+    fn an_empty_configuration_has_no_dependencies() {
+        assert!(
+            parse_report("compileClasspath - Compile classpath for source set 'main'.\nNo dependencies\n").is_empty()
+        );
+    }
+
+    #[test]
+    fn rejects_names_that_are_not_configurations_or_projects() {
+        let tmp = tempfile::tempdir().unwrap();
+        let options = SyncOptions::default();
+        let cancel = CancellationToken::new();
+        assert!(
+            gradle_dependencies(tmp.path(), &Default::default(), &options, ":", "x --init-script y", &cancel).is_err()
+        );
+        assert!(
+            gradle_dependencies(tmp.path(), &Default::default(), &options, "app", "runtimeClasspath", &cancel).is_err()
+        );
+    }
+
+    #[cfg(unix)]
+    #[test]
+    fn runs_the_report_of_the_project_and_configuration() {
+        use std::os::unix::fs::PermissionsExt;
+        let tmp = tempfile::tempdir().unwrap();
+        let root = tmp.path();
+        std::fs::write(root.join("settings.gradle"), "include 'app'").unwrap();
+        std::fs::write(root.join("build.gradle"), "").unwrap();
+        let launcher = root.join("fake-gradle");
+        std::fs::write(&launcher, "#!/bin/sh\necho \"$@\" > args\necho '\\--- org.a:b:1.0'\n").unwrap();
+        std::fs::set_permissions(&launcher, std::fs::Permissions::from_mode(0o755)).unwrap();
+        let options = SyncOptions {
+            gradle_command: Some(launcher.to_string_lossy().into_owned()),
+            offline: true,
+            ..Default::default()
+        };
+        let tree = gradle_dependencies(
+            root,
+            &gradle::load(root).unwrap(),
+            &options,
+            ":app",
+            "testRuntimeClasspath",
+            &CancellationToken::new(),
+        )
+        .unwrap();
+        assert_eq!(tree, vec![dep("org.a", "b", Some("1.0"))]);
+        assert_eq!(
+            std::fs::read_to_string(root.join("args")).unwrap().trim(),
+            "--console=plain -q :app:dependencies --configuration testRuntimeClasspath --offline"
+        );
+    }
+}
@@ -8,6 +8,7 @@
 pub mod application_update;
 pub mod compile;
 pub mod gradle;
+mod gradle_deps;
 pub mod kotlin_bridge;
 pub mod maven;
 pub mod pom_edit;
@@ -17,8 +18,11 @@ pub mod web;
 mod xml;

 pub use gradle::{GradleModel, GradleProject, GradleTask};
+pub use gradle_deps::{GradleDependency, gradle_dependencies};
 pub use maven::{MavenDependency, MavenModel, MavenPlugin, MavenProfile, MavenProject, Omission};
-pub use sync::{SyncOptions, SyncProgress, maven_profiles, save_maven_profiles, sync_gradle, sync_maven};
+pub use sync::{
+    SyncOptions, SyncProgress, maven_profiles, save_maven_profiles, sync_gradle, sync_gradle_model, sync_maven,
+};

 use serde::{Deserialize, Serialize};
 use specta::Type;
@@ -36,13 +40,31 @@ pub enum BuildTool {
 #[serde(rename_all = "camelCase")]
 pub struct BuildModel {
    pub maven: Option<MavenModel>,
-    pub gradle: Option<GradleModel>,
+    #[serde(default)]
+    pub gradle: Vec<GradleModel>,
+}
+
+impl BuildModel {
+    /// Prefer the deepest linked build owning the module over a composite including it.
+    pub fn gradle_for_module(&self, root: &Path, module: &Path) -> Option<&GradleModel> {
+        let module = root.join(module);
+        self.gradle.iter().filter(|g| g.projects.iter().any(|p| root.join(&p.dir) == module)).min_by_key(|g| {
+            let dir = root.join(&g.dir);
+            std::cmp::Reverse(if module.starts_with(&dir) { dir.components().count() } else { 0 })
+        })
+    }
 }

 /// Static model of the builds under `root`, merged with the sync results cached in `cache_dir`.
 /// Parent POMs are looked up in `maven_repo` (the configured local repository), else the default one.
 pub fn load(root: &Path, cache_dir: &Path, maven_repo: Option<PathBuf>) -> BuildModel {
-    load_linked(root, cache_dir, maven_repo, &ide_core::settings::MavenSettings::default())
+    load_linked(
+        root,
+        cache_dir,
+        maven_repo,
+        &ide_core::settings::MavenSettings::default(),
+        &ide_core::settings::GradleSettings::default(),
+    )
 }

 /// Loads only linked Maven reactors, retaining an empty model so projects can be re-added.
@@ -51,31 +73,66 @@ pub fn load_linked(
    cache_dir: &Path,
    maven_repo: Option<PathBuf>,
    settings: &ide_core::settings::MavenSettings,
+    gradle_settings: &ide_core::settings::GradleSettings,
 ) -> BuildModel {
-    let maven = maven::is_maven_project(root).then(|| {
+    let maven = maven::has_projects(root, settings).then(|| {
        let profiles = sync::maven_profiles(cache_dir);
-        let mut m = maven::load_with(root, maven_repo.or_else(maven::default_local_repo), &profiles);
+        let repo = maven_repo.or_else(maven::default_local_repo);
+        let mut m = maven::load_with_linked(root, repo, &profiles, &settings.linked_projects);
        maven::UnlinkedProjects::from_model(&m, settings).filter(&mut m);
+        // The user settings' profiles can be chosen too (`-P` applies to them as well).
+        for p in maven::user_settings_file(root, settings).map(|f| maven::settings_profiles(&f)).unwrap_or_default() {
+            if !m.profiles.iter().any(|x| x.id == p.id) {
+                m.profiles.push(p);
+            }
+        }
        sync::apply_maven_cache(root, cache_dir, &mut m);
        m
    });
-    let gradle = gradle::load(root).map(|mut g| {
-        sync::apply_gradle_cache(root, cache_dir, &mut g);
-        g
-    });
+    let gradle = gradle::load_linked(root, gradle_settings)
+        .into_iter()
+        .map(|mut g| {
+            sync::apply_gradle_cache(root, &gradle::cache_dir(cache_dir, &g.dir), &mut g);
+            g
+        })
+        .collect();
    BuildModel { maven, gradle }
 }

 /// Gradle project folders outside `root` as of the last sync (`includeFlat` siblings):
 /// extra content roots, as IDEA lists module roots beside the project folder.
 /// Reads only the sync's cached projects (no build script), so it is cheap enough for hot paths.
-pub fn gradle_external_roots(root: &Path, cache_dir: &Path) -> Vec<PathBuf> {
-    gradle::external_roots(root, sync::reported_gradle_projects(cache_dir).iter().map(|p| p.dir.as_str()))
+pub fn gradle_external_roots(
+    root: &Path,
+    cache_dir: &Path,
+    settings: &ide_core::settings::GradleSettings,
+) -> Vec<PathBuf> {
+    let builds = gradle::linked_dirs(root, settings);
+    let dirs: Vec<String> = builds
+        .iter()
+        .flat_map(|dir| {
+            std::iter::once(root.join(dir).to_string_lossy().into_owned()).chain(
+                sync::reported_gradle_projects(&gradle::cache_dir(cache_dir, dir))
+                    .iter()
+                    .map(|p| p.dir.clone())
+                    .collect::<Vec<_>>(),
+            )
+        })
+        .collect();
+    gradle::external_roots(root, dirs.iter().map(String::as_str))
 }

 /// Source, resource and build folders of the last Gradle sync, absolute.
-pub fn gradle_source_roots(cache_dir: &Path) -> Vec<(PathBuf, gradle::ReportedRoot)> {
-    gradle::reported_source_roots(&sync::reported_gradle_projects(cache_dir))
+pub fn gradle_source_roots(
+    root: &Path,
+    cache_dir: &Path,
+    settings: &ide_core::settings::GradleSettings,
+) -> Vec<(PathBuf, gradle::ReportedRoot)> {
+    let reported = gradle::linked_dirs(root, settings)
+        .iter()
+        .flat_map(|dir| sync::reported_gradle_projects(&gradle::cache_dir(cache_dir, dir)).as_ref().clone())
+        .collect::<Vec<_>>();
+    gradle::reported_source_roots(&reported)
 }

 /// A library the project depends on, as `groupId:artifactId:version`.
@@ -119,7 +176,7 @@ pub fn dependency_coordinates(root: &Path, model: &BuildModel) -> Vec<Dependency
            });
        }
    }
-    if let Some(g) = &model.gradle {
+    for g in &model.gradle {
        for script in g.projects.iter().filter_map(|p| p.build_file.as_ref()) {
            let Ok(text) = std::fs::read_to_string(root.join(script)) else { continue };
            out.extend(gradle::script_dependencies(&text).into_iter().map(|(group_id, artifact_id, version)| {
@@ -145,6 +202,26 @@ pub fn affects_build(rel: &Path) -> bool {
 mod tests {
    use super::*;

+    #[test]
+    fn external_linked_build_is_indexed_before_sync_and_disappears_when_unlinked() {
+        let temp = tempfile::tempdir().unwrap();
+        let root = temp.path().join("workspace");
+        let external = temp.path().join("external");
+        std::fs::create_dir(&root).unwrap();
+        std::fs::create_dir(&external).unwrap();
+        std::fs::write(external.join("settings.gradle"), "").unwrap();
+        let mut settings = ide_core::settings::GradleSettings {
+            linked_projects: Some(vec![external.to_string_lossy().into_owned()]),
+            ..Default::default()
+        };
+        assert_eq!(
+            gradle_external_roots(&root, &temp.path().join("cache"), &settings),
+            [dunce::canonicalize(&external).unwrap()]
+        );
+        settings.linked_projects = Some(vec![]);
+        assert!(gradle_external_roots(&root, &temp.path().join("cache"), &settings).is_empty());
+    }
+
    #[test]
    fn detects_build_systems_and_build_files() {
        let tmp = tempfile::tempdir().unwrap();
@@ -156,7 +233,7 @@ mod tests {
        std::fs::write(root.join("build.gradle"), "").unwrap();
        let m = load(&root, &cache, None);
        assert_eq!(m.maven.unwrap().projects[0].pom, "svc/pom.xml");
-        assert_eq!(m.gradle.unwrap().projects[0].path, ":");
+        assert_eq!(m.gradle[0].projects[0].path, ":");
        assert!(affects_build(Path::new("a/pom.xml")) && affects_build(Path::new("settings.gradle.kts")));
        assert!(!affects_build(Path::new("src/Main.java")));
    }
@@ -203,7 +280,7 @@ mod tests {
            ],
            ..Default::default()
        };
-        let gradle = gradle::load(root);
+        let gradle = gradle::load(root).into_iter().collect();
        let model = BuildModel { maven: Some(maven), gradle };
        let names: Vec<String> = dependency_coordinates(root, &model)
            .into_iter()
@@ -472,6 +472,41 @@ pub(crate) fn default_local_repo() -> Option<PathBuf> {
    local_repository_of(&m2.join("settings.xml")).or(Some(m2.join("repository")))
 }

+/// The user `settings.xml` a build reads: the configured one (`~/` and project-relative
+/// paths allowed), else `~/.m2/settings.xml`.
+pub fn user_settings_file(root: &Path, settings: &ide_core::settings::MavenSettings) -> Option<PathBuf> {
+    let configured = settings.user_settings.trim();
+    if configured.is_empty() {
+        return Some(dirs::home_dir()?.join(".m2").join("settings.xml"));
+    }
+    let path = match configured.strip_prefix("~/") {
+        Some(rest) => dirs::home_dir()?.join(rest),
+        None => PathBuf::from(configured),
+    };
+    Some(if path.is_absolute() { path } else { root.join(path) })
+}
+
+/// The profiles a `settings.xml` defines, for the Profiles list beside the POMs' own (as
+/// IDEA lists them): checked by default when `<activeProfiles>` names them or they are
+/// `activeByDefault`.
+pub fn settings_profiles(settings: &Path) -> Vec<MavenProfile> {
+    let Some(root) = std::fs::read_to_string(settings).ok().and_then(|text| xml::parse(&text)) else {
+        return Vec::new();
+    };
+    let active: Vec<String> =
+        root.list("activeProfiles", "activeProfile").iter().map(|e| e.text.trim().to_owned()).collect();
+    let mut profiles: Vec<MavenProfile> = Vec::new();
+    for profile in root.list("profiles", "profile") {
+        let Some(id) = profile.text_of("id") else { continue };
+        if profiles.iter().any(|p| p.id == id) {
+            continue;
+        }
+        let by_default = profile.at("activation/activeByDefault").is_some_and(|e| e.text.trim() == "true");
+        profiles.push(MavenProfile { active_by_default: by_default || active.contains(&id), id });
+    }
+    profiles
+}
+
 /// `<localRepository>` of a settings file, when it names one: the repository a build
 /// with `-s <file>` resolves into, which is not necessarily the user's default.
 pub fn local_repository_of(settings: &Path) -> Option<PathBuf> {
@@ -1065,10 +1100,9 @@ pub fn load(root: &Path) -> MavenModel {
    load_with_repo(root, default_local_repo())
 }

-/// [`load`] with the chosen `profiles` (`-P` entries; `!id` deactivates): their modules,
-/// dependencies and properties are part of the model, those turned off are not.
-pub fn load_with_profiles(root: &Path, profiles: &[String]) -> MavenModel {
-    load_with(root, default_local_repo(), profiles)
+/// [`load`] with the POMs `settings` link (Add Maven Projects).
+pub fn load_linked(root: &Path, settings: &ide_core::settings::MavenSettings) -> MavenModel {
+    load_with_linked(root, default_local_repo(), &[], &settings.linked_projects)
 }

 pub(crate) fn load_with_repo(root: &Path, local_repo: Option<PathBuf>) -> MavenModel {
@@ -1090,11 +1124,53 @@ fn profile_choice(chosen: &[String], id: &str) -> Option<bool> {
 }

 pub(crate) fn load_with(root: &Path, local_repo: Option<PathBuf>, profiles: &[String]) -> MavenModel {
+    load_with_linked(root, local_repo, profiles, &[])
+}
+
+/// The POMs of `linked` (project-relative, from Settings) that exist inside `root`.
+fn linked_poms(root: &Path, linked: &[String]) -> Vec<PathBuf> {
+    let base = dunce::canonicalize(root).unwrap_or_else(|_| root.to_path_buf());
+    let mut out: Vec<PathBuf> = Vec::new();
+    for pom in linked {
+        let pom = normalized_pom(pom);
+        if pom.is_empty() || pom.starts_with("../") || pom == ".." {
+            continue;
+        }
+        let path = root.join(&pom);
+        let inside = dunce::canonicalize(&path).is_ok_and(|p| p.starts_with(&base));
+        if path.is_file() && inside && !out.contains(&path) {
+            out.push(path);
+        }
+    }
+    out
+}
+
+/// Whether `root` holds a Maven build or the settings link one inside it.
+pub fn has_projects(root: &Path, settings: &ide_core::settings::MavenSettings) -> bool {
+    is_maven_project(root) || !linked_poms(root, &settings.linked_projects).is_empty()
+}
+
+/// The model with the chosen `profiles` (`-P` entries; `!id` deactivates: their modules,
+/// dependencies and properties are part of the model, those turned off are not) and the
+/// `linked` POMs (Add Maven Projects): builds that no reactor lists, shown as independent
+/// top-level projects. A linked POM that turns out to be a module of the root reactor stays that module.
+pub fn load_with_linked(
+    root: &Path,
+    local_repo: Option<PathBuf>,
+    profiles: &[String],
+    linked: &[String],
+) -> MavenModel {
    let mut resolver = Resolver::new(local_repo, profiles);
    let mut model = MavenModel::default();
    let mut seen: HashSet<PathBuf> = HashSet::new();
-    // (pom, aggregated)
-    let mut stack: Vec<(PathBuf, bool)> = top_level_poms(root).into_iter().rev().map(|p| (p, false)).collect();
+    let mut tops = top_level_poms(root);
+    for pom in linked_poms(root, linked) {
+        if !tops.contains(&pom) {
+            tops.push(pom);
+        }
+    }
+    // (pom, aggregated); the root reactor and its modules come before linked POMs.
+    let mut stack: Vec<(PathBuf, bool)> = tops.into_iter().rev().map(|p| (p, false)).collect();
    while let Some((path, aggregated)) = stack.pop() {
        if model.projects.len() >= MAX_PROJECTS {
            break;
@@ -1216,7 +1292,7 @@ impl UnlinkedProjects {
        if settings.unlinked_projects.is_empty() {
            return Self::default();
        }
-        Self::from_model(&load(root), settings)
+        Self::from_model(&load_linked(root, settings), settings)
    }

    pub fn from_model(model: &MavenModel, settings: &ide_core::settings::MavenSettings) -> Self {
@@ -1495,6 +1571,37 @@ mod tests {
        assert_eq!(p.prefix, "checkstyle");
    }

+    #[test]
+    fn settings_profiles_are_listed_with_the_active_ones_checked() {
+        let tmp = tempfile::tempdir().unwrap();
+        let file = tmp.path().join("settings.xml");
+        std::fs::write(
+            &file,
+            r#"<settings>
+  <profiles>
+    <profile><id>nexus</id></profile>
+    <profile><id>jdk21</id><activation><activeByDefault>true</activeByDefault></activation></profile>
+    <profile><id>release</id></profile>
+    <profile><id>nexus</id></profile>
+    <profile><activation/></profile>
+  </profiles>
+  <activeProfiles><activeProfile>nexus</activeProfile></activeProfiles>
+</settings>"#,
+        )
+        .unwrap();
+        let p = |id: &str, active| MavenProfile { id: id.into(), active_by_default: active };
+        assert_eq!(settings_profiles(&file), [p("nexus", true), p("jdk21", true), p("release", false)]);
+        assert!(settings_profiles(&tmp.path().join("missing.xml")).is_empty());
+
+        let mut s = ide_core::settings::MavenSettings::default();
+        let home = dirs::home_dir().unwrap();
+        assert_eq!(user_settings_file(tmp.path(), &s), Some(home.join(".m2/settings.xml")));
+        s.user_settings = "conf/settings.xml".into();
+        assert_eq!(user_settings_file(tmp.path(), &s), Some(tmp.path().join("conf/settings.xml")));
+        s.user_settings = "~/work/settings.xml".into();
+        assert_eq!(user_settings_file(tmp.path(), &s), Some(home.join("work/settings.xml")));
+    }
+
    #[test]
    fn a_settings_file_names_the_repository_to_read_goals_from() {
        let tmp = tempfile::tempdir().unwrap();
@@ -1733,6 +1840,49 @@ mod tests {
        assert!(model.projects.iter().all(|p| p.command == if cfg!(windows) { "mvn.cmd" } else { "mvn" }));
    }

+    /// Add Maven Projects: a POM inside the project that no reactor lists becomes an
+    /// independent top-level project; one the root reactor lists stays its module.
+    #[test]
+    fn linked_poms_outside_the_reactor_are_top_level_projects() {
+        let tmp = tempfile::tempdir().unwrap();
+        let root = tmp.path();
+        write(
+            root,
+            "pom.xml",
+            "<project><groupId>demo</groupId><artifactId>main</artifactId><version>1.0</version><packaging>pom</packaging><modules><module>core</module></modules></project>",
+        );
+        write(
+            root,
+            "core/pom.xml",
+            "<project><groupId>demo</groupId><artifactId>core</artifactId><version>1.0</version></project>",
+        );
+        write(
+            root,
+            "stub/pom.xml",
+            "<project><groupId>demo</groupId><artifactId>stub</artifactId><version>1.0</version></project>",
+        );
+        let top = |m: &MavenModel| m.projects.iter().map(|p| (p.dir.clone(), p.aggregated)).collect::<Vec<_>>();
+
+        assert_eq!(top(&load_with_linked(root, None, &[], &[])), [("".into(), false), ("core".into(), true)]);
+        let linked: Vec<String> =
+            ["stub/pom.xml", "./core/pom.xml", "../outside/pom.xml", "missing/pom.xml"].map(String::from).into();
+        assert_eq!(
+            top(&load_with_linked(root, None, &[], &linked)),
+            [("".into(), false), ("core".into(), true), ("stub".into(), false)]
+        );
+
+        // Deeper than the folder search reaches: only the link makes it a Maven project.
+        let deep = tempfile::tempdir().unwrap();
+        write(deep.path(), "a/b/c/tool/pom.xml", "<project><artifactId>tool</artifactId></project>");
+        let settings = ide_core::settings::MavenSettings {
+            linked_projects: vec!["a/b/c/tool/pom.xml".into()],
+            ..Default::default()
+        };
+        assert!(!has_projects(deep.path(), &Default::default()));
+        assert!(has_projects(deep.path(), &settings));
+        assert_eq!(top(&load_linked(deep.path(), &settings)), [("a/b/c/tool".into(), false)]);
+    }
+
    #[test]
    fn chosen_profiles_bring_their_modules_and_dependencies() {
        let tmp = tempfile::tempdir().unwrap();
@@ -283,7 +283,12 @@ pub fn sync_maven(
    cancel: &CancellationToken,
    progress: &dyn Fn(SyncProgress),
 ) -> IdeResult<()> {
-    let mut model = maven::load_with_profiles(root, &options.profiles);
+    let mut model = maven::load_with_linked(
+        root,
+        maven::default_local_repo(),
+        &options.profiles,
+        &options.maven_settings.linked_projects,
+    );
    maven::UnlinkedProjects::from_model(&model, &options.maven_settings).filter(&mut model);
    std::fs::create_dir_all(cache_dir)?;
    let mut cache = MavenCache {
@@ -315,7 +320,10 @@ pub fn sync_maven(
    for (n, top) in model.projects.iter().filter(|p| !p.aggregated).enumerate() {
        let effective = cache_dir.join(format!("effective-pom-{n}.xml"));
        let _ = std::fs::remove_file(&effective);
-        let mut args: Vec<String> = vec!["-B".into(), "-fae".into(), "-Dstyle.color=never".into()];
+        // `-T1` keeps mvnd serial: its default parallel build interleaves the
+        // `dependency:tree` output of concurrent modules, which the sync parses
+        // as one stream. mvn is serial anyway, so this only pins the daemon.
+        let mut args: Vec<String> = vec!["-B".into(), "-fae".into(), "-Dstyle.color=never".into(), "-T1".into()];
        args.extend(options.maven_options.iter().cloned());
        if options.offline {
            args.push("-o".into());
@@ -370,8 +378,25 @@ pub fn sync_gradle(
    cancel: &CancellationToken,
    progress: &dyn Fn(SyncProgress),
 ) -> IdeResult<()> {
-    let mut model = gradle::load(root).ok_or_else(|| IdeError::not_found("no Gradle build in this project"))?;
-    std::fs::create_dir_all(cache_dir)?;
+    let model = gradle::load(root).ok_or_else(|| IdeError::not_found("no Gradle build in this project"))?;
+    sync_gradle_model(root, cache_dir, &model, options, cancel, progress)
+}
+
+/// Syncs this exact linked build; another build's task paths and cache cannot interfere.
+pub fn sync_gradle_model(
+    root: &Path,
+    cache_dir: &Path,
+    model: &GradleModel,
+    options: &SyncOptions,
+    cancel: &CancellationToken,
+    progress: &dyn Fn(SyncProgress),
+) -> IdeResult<()> {
+    if cancel.is_cancelled() {
+        return Err(IdeError::cancelled());
+    }
+    let mut model = model.clone();
+    let cache_dir = gradle::cache_dir(cache_dir, &model.dir);
+    std::fs::create_dir_all(&cache_dir)?;
    let init_script = cache_dir.join("openidea-model.gradle");
    std::fs::write(&init_script, MODEL_INIT_SCRIPT)?;
    let mut args: Vec<String> = vec![
@@ -386,14 +411,24 @@ pub fn sync_gradle(
        args.push("--offline".into());
    }
    progress(SyncProgress { message: "Loading Gradle tasks".into(), fraction: None });
-    let out = run(
+    let out = match run(
        options.gradle_command.as_deref().unwrap_or(&model.command),
        &args,
        &root.join(&model.dir),
        &options.env,
        cancel,
        |_| {},
-    )?;
+    ) {
+        Ok(out) => out,
+        Err(_) if cancel.is_cancelled() => return Err(IdeError::cancelled()),
+        Err(error) if error.kind == ide_core::error::ErrorKind::Unavailable => {
+            Output { success: false, text: error.message }
+        }
+        Err(error) => return Err(error),
+    };
+    if cancel.is_cancelled() {
+        return Err(IdeError::cancelled());
+    }
    let projects = if out.success { parse_reported_projects(&out.text) } else { Vec::new() };
    // Hash the build files of the reported projects, or the model is stale right after the sync.
    gradle::merge_reported_projects(root, &mut model, &projects);
@@ -404,13 +439,128 @@ pub fn sync_gradle(
        tasks: if out.success { gradle::parse_tasks(&out.text) } else { Vec::new() },
        projects,
    };
-    write_cache(cache_dir, GRADLE_CACHE, &cache)
+    write_cache(&cache_dir, GRADLE_CACHE, &cache)
 }

 #[cfg(test)]
 mod tests {
    use super::*;

+    #[cfg(unix)]
+    #[test]
+    fn unavailable_gradle_launchers_are_cached_without_stopping_other_builds() {
+        use std::os::unix::fs::PermissionsExt;
+        let temp = tempfile::tempdir().unwrap();
+        let root = temp.path();
+        for dir in ["a", "b"] {
+            std::fs::create_dir(root.join(dir)).unwrap();
+            std::fs::write(root.join(dir).join("build.gradle"), "").unwrap();
+        }
+        let wrapper = root.join("b/gradlew");
+        std::fs::write(&wrapper, "#!/bin/sh\nprintf '%s\\n' 'Build tasks' '-----------' 'healthy - ok'\n").unwrap();
+        std::fs::set_permissions(&wrapper, std::fs::Permissions::from_mode(0o755)).unwrap();
+        let settings = ide_core::settings::GradleSettings {
+            linked_projects: Some(vec!["a".into(), "b".into()]),
+            ..Default::default()
+        };
+        let mut models = gradle::load_linked(root, &settings);
+        models[0].command = root.join("a/missing-gradlew").to_string_lossy().into_owned();
+        let cache = root.join("cache");
+        let run = |model: &GradleModel| {
+            sync_gradle_model(root, &cache, model, &SyncOptions::default(), &CancellationToken::new(), &|_| {})
+        };
+        for model in &models {
+            run(model).unwrap();
+        }
+        let loaded = crate::load_linked(root, &cache, None, &Default::default(), &settings);
+        assert!(loaded.gradle[0].sync_error.as_deref().unwrap().contains("cannot start"));
+        assert!(loaded.gradle[1].sync_error.is_none());
+        assert_eq!(loaded.gradle[1].projects[0].tasks[0].name, "healthy");
+        let bad_wrapper = root.join("a/gradlew");
+        std::fs::write(&bad_wrapper, "#!/bin/sh\nexit 0\n").unwrap();
+        std::fs::set_permissions(&bad_wrapper, std::fs::Permissions::from_mode(0o644)).unwrap();
+        models[0].command = bad_wrapper.to_string_lossy().into_owned();
+        run(&models[0]).unwrap();
+        let loaded = crate::load_linked(root, &cache, None, &Default::default(), &settings);
+        assert!(loaded.gradle[0].sync_error.as_deref().unwrap().contains("cannot start"));
+        assert!(loaded.gradle[1].sync_error.is_none());
+        let blocked_cache = root.join("blocked-cache");
+        std::fs::write(&blocked_cache, "a file cannot contain sync caches").unwrap();
+        assert!(
+            sync_gradle_model(
+                root,
+                &blocked_cache,
+                &models[0],
+                &SyncOptions::default(),
+                &CancellationToken::new(),
+                &|_| {}
+            )
+            .is_err()
+        );
+    }
+
+    #[cfg(unix)]
+    #[test]
+    fn independent_syncs_do_not_share_tasks_launchers_environments_or_failures() {
+        use std::os::unix::fs::PermissionsExt;
+        let temp = tempfile::tempdir().unwrap();
+        let root = temp.path();
+        for dir in ["a", "b"] {
+            let build = root.join(dir);
+            std::fs::create_dir_all(build.join("app")).unwrap();
+            std::fs::write(build.join("settings.gradle"), "include 'app'").unwrap();
+            std::fs::write(build.join("app/build.gradle"), "").unwrap();
+            let report = serde_json::json!({"path": ":app", "dir": build.join("app")});
+            let launcher = build.join("gradlew");
+            std::fs::write(
+                &launcher,
+                format!("#!/bin/sh\npwd > actual-cwd\nprintf '%s' \"$JAVA_HOME\" > actual-env\nprintf '%s\\n' '@openidea-model\t{report}' 'Build tasks' '-----------' 'app:custom{dir} - custom task'\n"),
+            ).unwrap();
+            std::fs::set_permissions(launcher, std::fs::Permissions::from_mode(0o755)).unwrap();
+        }
+        let settings = ide_core::settings::GradleSettings {
+            linked_projects: Some(vec!["a".into(), "b".into()]),
+            ..Default::default()
+        };
+        let cache = root.join("cache");
+        let models = gradle::load_linked(root, &settings);
+        for model in &models {
+            let options = SyncOptions {
+                env: BTreeMap::from([("JAVA_HOME".into(), format!("/jdk-{}", model.dir))]),
+                ..Default::default()
+            };
+            sync_gradle_model(root, &cache, model, &options, &CancellationToken::new(), &|_| {}).unwrap();
+            assert_eq!(
+                std::fs::read_to_string(root.join(&model.dir).join("actual-env")).unwrap(),
+                format!("/jdk-{}", model.dir)
+            );
+            assert_eq!(
+                std::fs::read_to_string(root.join(&model.dir).join("actual-cwd")).unwrap().trim(),
+                root.join(&model.dir).canonicalize().unwrap().to_string_lossy()
+            );
+        }
+        let load = || crate::load_linked(root, &cache, None, &Default::default(), &settings);
+        let model = load();
+        assert_eq!(model.gradle[0].projects[0].tasks[0].name, "customa");
+        assert_eq!(model.gradle[1].projects[0].tasks[0].name, "customb");
+        assert_ne!(gradle::cache_dir(&cache, "a"), gradle::cache_dir(&cache, "b"));
+        let before = std::fs::read(gradle::cache_dir(&cache, "a").join(GRADLE_CACHE)).unwrap();
+        std::fs::write(root.join("b/gradlew"), "#!/bin/sh\nprintf 'FAILURE: broken b\\n'\nexit 1\n").unwrap();
+        sync_gradle_model(root, &cache, &models[1], &SyncOptions::default(), &CancellationToken::new(), &|_| {})
+            .unwrap();
+        let model = load();
+        assert!(model.gradle[0].sync_error.is_none());
+        assert!(model.gradle[1].sync_error.is_some());
+        assert_eq!(std::fs::read(gradle::cache_dir(&cache, "a").join(GRADLE_CACHE)).unwrap(), before);
+        let cancel = CancellationToken::new();
+        cancel.cancel();
+        assert!(sync_gradle_model(root, &cache, &models[0], &SyncOptions::default(), &cancel, &|_| {}).is_err());
+        assert_eq!(std::fs::read(gradle::cache_dir(&cache, "a").join(GRADLE_CACHE)).unwrap(), before);
+        let unlinked = ide_core::settings::GradleSettings { linked_projects: Some(vec![]), ..Default::default() };
+        assert!(crate::load_linked(root, &cache, None, &Default::default(), &unlinked).gradle.is_empty());
+        assert!(crate::gradle_source_roots(root, &cache, &unlinked).is_empty());
+    }
+
    #[cfg(unix)]
    #[test]
    fn gradle_sync_uses_resolved_command_and_environment() {
@@ -598,7 +748,7 @@ mod tests {
        write(&projects);
        let first = reported_gradle_projects(&cache_dir);
        assert!(Arc::ptr_eq(&first, &reported_gradle_projects(&cache_dir)), "unchanged: not parsed again");
-        assert_eq!(crate::gradle_external_roots(&root, &cache_dir), [billing]);
+        assert_eq!(crate::gradle_external_roots(&root, &cache_dir, &Default::default()), [billing]);
        write(&projects[..1]);
        assert_eq!(reported_gradle_projects(&cache_dir).len(), 1, "a new sync is read");
        std::fs::remove_file(cache_dir.join(GRADLE_CACHE)).unwrap();
@@ -680,4 +830,25 @@ mod tests {
        assert_eq!(error_summary(text), "Failed to execute goal");
        assert_eq!(error_summary("one\nlast line\n\n"), "last line");
    }
+
+    #[cfg(unix)]
+    #[test]
+    fn maven_sync_runs_the_daemon_command_serially() {
+        use std::os::unix::fs::PermissionsExt;
+        let tmp = tempfile::tempdir().unwrap();
+        let root = tmp.path().join("p");
+        std::fs::create_dir_all(&root).unwrap();
+        std::fs::write(root.join("pom.xml"), "<project><groupId>g</groupId><artifactId>a</artifactId></project>")
+            .unwrap();
+        let launcher = tmp.path().join("fake-mvnd");
+        std::fs::write(&launcher, "#!/bin/sh\nprintf '%s\\n' \"$@\" > mvnd-args\n").unwrap();
+        std::fs::set_permissions(&launcher, std::fs::Permissions::from_mode(0o755)).unwrap();
+        let options =
+            SyncOptions { maven_command: Some(launcher.to_string_lossy().into_owned()), ..Default::default() };
+        sync_maven(&root, &tmp.path().join("cache"), &options, &CancellationToken::new(), &|_| {}).unwrap();
+        let args = std::fs::read_to_string(root.join("mvnd-args")).unwrap();
+        // `-T1` pins the daemon serial so the dependency trees stay parseable.
+        assert!(args.contains("-T1"), "args: {args}");
+        assert!(args.contains("help:effective-pom"), "args: {args}");
+    }
 }
@@ -26,12 +26,12 @@ pub fn artifacts(root: &Path, model: &BuildModel) -> Vec<WebArtifact> {
            });
        }
    }
-    if let Some(gradle) = &model.gradle {
+    for gradle in &model.gradle {
        for p in &gradle.projects {
            let script = p.build_file.as_ref().and_then(|f| fs::read_to_string(root.join(f)).ok()).unwrap_or_default();
            if p.tasks.iter().any(|t| t.name == "war") || crate::gradle::has_war_plugin(&script) {
                out.push(WebArtifact {
-                    id: format!("gradle:{}", p.path),
+                    id: gradle_artifact_id(gradle, &p.path),
                    name: p.name.clone(),
                    module: p.dir.clone(),
                    tool: "gradle".into(),
@@ -42,6 +42,14 @@ pub fn artifacts(root: &Path, model: &BuildModel) -> Vec<WebArtifact> {
    out
 }

+fn gradle_artifact_id(build: &crate::GradleModel, path: &str) -> String {
+    if build.dir.is_empty() {
+        format!("gradle:{path}")
+    } else {
+        format!("gradle:{}", serde_json::to_string(&(&build.dir, path)).unwrap())
+    }
+}
+
 pub struct WebBuild {
    pub command: String,
    pub args: Vec<String>,
@@ -150,9 +158,14 @@ pub fn build(root: &Path, model: &BuildModel, id: &str, cache: &Path) -> IdeResu
            maven_project: Some((probe, output)),
        });
    }
-    if let Some(path) = id.strip_prefix("gradle:") {
-        let g = model.gradle.as_ref().ok_or_else(|| IdeError::invalid("Choose a Gradle WAR module"))?;
-        if !artifacts(root, model).iter().any(|a| a.id == id) {
+    if let Some(legacy_path) = id.strip_prefix("gradle:") {
+        let identity = serde_json::from_str::<(String, String)>(legacy_path).ok();
+        let (g, path) = match &identity {
+            Some((dir, path)) => (model.gradle.iter().find(|g| g.dir == *dir), path.as_str()),
+            None => (model.gradle.first(), legacy_path),
+        };
+        let g = g.ok_or_else(|| IdeError::invalid("Choose a Gradle WAR module"))?;
+        if !artifacts(root, model).iter().any(|a| a.id == gradle_artifact_id(g, path)) {
            return Err(IdeError::invalid("Choose a Gradle WAR module"));
        }
        let script = cache.join("war.init.gradle");
@@ -186,6 +199,28 @@ pub fn build(root: &Path, model: &BuildModel, id: &str, cache: &Path) -> IdeResu

 #[cfg(test)]
 mod tests {
+    #[test]
+    fn independent_war_modules_have_distinct_ids_and_build_in_their_own_directory() {
+        let temp = tempfile::tempdir().unwrap();
+        let root = temp.path();
+        for dir in ["a", "b"] {
+            std::fs::create_dir(root.join(dir)).unwrap();
+            std::fs::write(root.join(dir).join("build.gradle"), "plugins { id 'war' }").unwrap();
+        }
+        let settings = ide_core::settings::GradleSettings {
+            linked_projects: Some(vec!["a".into(), "b".into()]),
+            ..Default::default()
+        };
+        let model = crate::load_linked(root, &root.join("cache"), None, &Default::default(), &settings);
+        let artifacts = super::artifacts(root, &model);
+        assert_eq!(artifacts.len(), 2);
+        assert_ne!(artifacts[0].id, artifacts[1].id);
+        for (artifact, dir) in artifacts.iter().zip(["a", "b"]) {
+            let plan = super::build(root, &model, &artifact.id, &root.join(format!("cache/{dir}"))).unwrap();
+            assert_eq!(plan.cwd, dir);
+        }
+        assert_eq!(super::build(root, &model, "gradle::", &root.join("legacy")).unwrap().cwd, "a");
+    }
    use super::*;
    #[test]
    fn maven_war_modules_use_resolved_artifact_file() {
@@ -22,4 +22,4 @@ tempfile.workspace = true
 libc = "0.2"

 [target.'cfg(windows)'.dependencies]
-windows-sys = { version = "0.61", features = ["Win32_Globalization", "Win32_Security", "Win32_System_Registry", "Win32_Foundation"] }
+windows-sys = { version = "0.61", features = ["Win32_Globalization", "Win32_Security", "Win32_System_Registry", "Win32_Foundation", "Win32_System_Diagnostics_ToolHelp", "Win32_System_Threading"] }
@@ -2,6 +2,18 @@
 //! treats as nonexistent — hidden from the project view and navigation, never
 //! indexed or searched, never offered as unversioned changes.

+use std::path::Path;
+
+/// Whether `dir` lies in a Git (or jj) working tree: it or an ancestor holds `.git` / `.jj`.
+///
+/// Walkers pass it to `ignore::WalkBuilder::require_git`: inside a repository, `.gitignore`
+/// rules then stop at a nested repository's root as in git, so an outer repository's
+/// `.gitignore` does not hide a project that is its own repository. A folder outside any
+/// repository still honours its `.gitignore`.
+pub fn inside_git_repo(dir: &Path) -> bool {
+    dir.ancestors().any(|d| d.join(".git").exists() || d.join(".jj").exists())
+}
+
 /// IDEA's default list, plus `.jj` and the Windows shell files.
 pub const DEFAULT_IGNORED_NAMES: &[&str] = &[
    "*.pyc",
@@ -103,4 +115,15 @@ mod tests {
        assert!(m.is_ignored_path("pkg/__pycache__/mod.cpython-312.pyc"));
        assert!(!m.is_ignored_path("src/main.rs"));
    }
+
+    #[test]
+    fn finds_the_repository_at_or_above_a_directory() {
+        let dir = tempfile::tempdir().unwrap();
+        let sub = dir.path().join("a/b");
+        std::fs::create_dir_all(&sub).unwrap();
+        assert!(!inside_git_repo(&sub));
+        std::fs::create_dir(dir.path().join("a/.git")).unwrap();
+        assert!(inside_git_repo(&sub));
+        assert!(inside_git_repo(&dir.path().join("a")));
+    }
 }
@@ -36,6 +36,23 @@ impl Default for InspectionSettings {
    }
 }

+impl InspectionSettings {
+    /// Overrides of the profile in effect; `Default`'s when `profile` names none that exists.
+    pub fn active(&self) -> &BTreeMap<String, InspectionOverride> {
+        let custom = |level: &str, key: &str| match level {
+            "ide" => self.ide_profiles.get(key),
+            "project" => self.project_profiles.get(key),
+            _ => None,
+        };
+        match self.profile.as_str() {
+            "project" => &self.project,
+            id => {
+                id.split_once(':').and_then(|(level, key)| custom(level, key)).map_or(&self.default, |p| &p.overrides)
+            }
+        }
+    }
+}
+
 /// A named profile made with Copy.
 #[derive(Clone, Debug, Default, PartialEq, Eq, Serialize, Deserialize, Type)]
 #[serde(default, rename_all = "camelCase")]
@@ -111,4 +128,20 @@ mod tests {
        let back: InspectionSettings = serde_json::from_str(&serde_json::to_string(&s).unwrap()).unwrap();
        assert_eq!(back, s);
    }
+
+    #[test]
+    fn active_profile_falls_back_to_default() {
+        let off = |id: &str| {
+            BTreeMap::from([(id.to_owned(), InspectionOverride { enabled: Some(false), ..Default::default() })])
+        };
+        let mut s = InspectionSettings { default: off("a"), project: off("b"), ..Default::default() };
+        s.ide_profiles.insert("strict".into(), CustomInspectionProfile { name: "Strict".into(), overrides: off("c") });
+        assert!(s.active().contains_key("a"));
+        s.profile = "project".into();
+        assert!(s.active().contains_key("b"));
+        s.profile = "ide:strict".into();
+        assert!(s.active().contains_key("c"));
+        s.profile = "project:gone".into();
+        assert!(s.active().contains_key("a"));
+    }
 }
@@ -24,6 +24,7 @@ pub mod text;
 pub mod tool_path;
 pub mod version_managers;
 pub mod workflow_settings;
+pub mod wsl;

 pub use error::{IdeError, IdeResult};
 pub use event::{EventSink, IdeEvent, NullSink, SharedSink};
@@ -43,19 +43,21 @@ pub fn own_group(cmd: &mut Command) -> &mut Command {
 /// Kills the child and everything it started, then reaps it.
 ///
 /// - Unix: `SIGKILL` to its process group, so spawn it with [`own_group`].
-/// - Windows: `taskkill /T /F`, which walks the tree from the child's process id.
+/// - Windows: `taskkill /T /F`, which walks the tree from the child's process id, then a
+///   wait for what the child started to be gone.
 pub fn kill_tree(child: &mut Child) {
    #[cfg(unix)]
    signal_group(child, libc::SIGKILL);
    #[cfg(windows)]
-    taskkill_tree(child);
+    taskkill_tree_of(child.id());
    let _ = child.kill();
    let _ = child.wait();
 }

 /// [`kill_tree`] for a child known by its process id (a `tokio` child): `SIGKILL` to its
-/// process group (spawn it with [`own_group`]) or `taskkill /T /F`. Call it before the child
-/// is reaped, so the id still names it. The child itself is left to its owner to kill and reap.
+/// process group (spawn it with [`own_group`]) or `taskkill /T /F` and a wait for what the
+/// child started to be gone. Call it before the child is reaped, so the id still names it.
+/// The child itself is left to its owner to kill and reap.
 pub fn kill_tree_of(pid: u32) {
    #[cfg(unix)]
    if let Ok(pid) = libc::pid_t::try_from(pid) {
@@ -65,15 +67,7 @@ pub fn kill_tree_of(pid: u32) {
        }
    }
    #[cfg(windows)]
-    {
-        let mut taskkill = Command::new("taskkill");
-        prepare(&mut taskkill)
-            .args(["/T", "/F", "/PID", &pid.to_string()])
-            .stdin(Stdio::null())
-            .stdout(Stdio::null())
-            .stderr(Stdio::null());
-        let _ = taskkill.status();
-    }
+    taskkill_tree_of(pid);
    #[cfg(not(any(unix, windows)))]
    let _ = pid;
 }
@@ -106,15 +100,107 @@ fn signal_group(child: &Child, signal: libc::c_int) {
    }
 }

+/// How long killing a tree waits for the processes the child started to be gone.
 #[cfg(windows)]
-fn taskkill_tree(child: &Child) {
+const TREE_EXIT_WAIT: Duration = Duration::from_secs(5);
+
+/// `taskkill /T /F` from `pid`, then waits (up to [`TREE_EXIT_WAIT`]) until what the child
+/// started is gone: termination is asynchronous, and until a process is gone the files it
+/// holds open can't be opened or deleted. The child itself is left to its owner to reap.
+#[cfg(windows)]
+fn taskkill_tree_of(pid: u32) {
+    let started = windows_tree::descendants(pid);
    let mut taskkill = Command::new("taskkill");
    prepare(&mut taskkill)
-        .args(["/T", "/F", "/PID", &child.id().to_string()])
+        .args(["/T", "/F", "/PID", &pid.to_string()])
        .stdin(Stdio::null())
        .stdout(Stdio::null())
        .stderr(Stdio::null());
    let _ = taskkill.status();
+    windows_tree::wait_all(&started, TREE_EXIT_WAIT);
+}
+
+#[cfg(windows)]
+mod windows_tree {
+    use std::collections::HashSet;
+    use std::os::windows::io::{AsRawHandle, FromRawHandle, OwnedHandle};
+    use std::time::{Duration, Instant};
+    use windows_sys::Win32::Foundation::{FILETIME, INVALID_HANDLE_VALUE};
+    use windows_sys::Win32::System::Diagnostics::ToolHelp::{
+        CreateToolhelp32Snapshot, PROCESSENTRY32W, Process32FirstW, Process32NextW, TH32CS_SNAPPROCESS,
+    };
+    use windows_sys::Win32::System::Threading::{
+        GetProcessTimes, OpenProcess, PROCESS_QUERY_LIMITED_INFORMATION, PROCESS_SYNCHRONIZE, WaitForSingleObject,
+    };
+
+    /// Every process `root` started, directly or not, opened so it can be waited for. A
+    /// parent's id is reused once it is gone, so a process counts only if it started after
+    /// its parent.
+    pub(super) fn descendants(root: u32) -> Vec<OwnedHandle> {
+        let Some(root_started) = open(root).as_ref().and_then(started) else { return Vec::new() };
+        let processes = processes();
+        let mut seen = HashSet::from([root]);
+        let mut parents = vec![(root, root_started)];
+        let mut found = Vec::new();
+        while let Some((parent, parent_started)) = parents.pop() {
+            for &(pid, ppid) in &processes {
+                if ppid != parent || !seen.insert(pid) {
+                    continue;
+                }
+                let Some(handle) = open(pid) else { continue };
+                if let Some(at) = started(&handle).filter(|&at| at >= parent_started) {
+                    parents.push((pid, at));
+                    found.push(handle);
+                }
+            }
+        }
+        found
+    }
+
+    pub(super) fn wait_all(processes: &[OwnedHandle], within: Duration) {
+        let until = Instant::now() + within;
+        for process in processes {
+            let left = until.saturating_duration_since(Instant::now());
+            // SAFETY: a live process handle opened with SYNCHRONIZE access.
+            unsafe { WaitForSingleObject(process.as_raw_handle(), left.as_millis().min(u32::MAX as u128 - 1) as u32) };
+        }
+    }
+
+    /// (process id, parent process id) of every running process.
+    fn processes() -> Vec<(u32, u32)> {
+        let mut out = Vec::new();
+        // SAFETY: a snapshot handle owned here and an entry sized as the API requires.
+        unsafe {
+            let snapshot = CreateToolhelp32Snapshot(TH32CS_SNAPPROCESS, 0);
+            if snapshot.is_null() || snapshot == INVALID_HANDLE_VALUE {
+                return out;
+            }
+            let snapshot = OwnedHandle::from_raw_handle(snapshot);
+            let mut entry = PROCESSENTRY32W { dwSize: size_of::<PROCESSENTRY32W>() as u32, ..Default::default() };
+            let mut more = Process32FirstW(snapshot.as_raw_handle(), &mut entry);
+            while more != 0 {
+                out.push((entry.th32ProcessID, entry.th32ParentProcessID));
+                more = Process32NextW(snapshot.as_raw_handle(), &mut entry);
+            }
+        }
+        out
+    }
+
+    fn open(pid: u32) -> Option<OwnedHandle> {
+        // SAFETY: plain call; a non-null result is a process handle owned by the caller.
+        let handle = unsafe { OpenProcess(PROCESS_SYNCHRONIZE | PROCESS_QUERY_LIMITED_INFORMATION, 0, pid) };
+        // SAFETY: as above.
+        (!handle.is_null()).then(|| unsafe { OwnedHandle::from_raw_handle(handle) })
+    }
+
+    /// When the process started, in 100 ns ticks since 1601.
+    fn started(process: &OwnedHandle) -> Option<u64> {
+        let (mut created, mut exited, mut kernel, mut user) =
+            (FILETIME::default(), FILETIME::default(), FILETIME::default(), FILETIME::default());
+        // SAFETY: a live process handle opened with query access; four out-parameters.
+        let ok = unsafe { GetProcessTimes(process.as_raw_handle(), &mut created, &mut exited, &mut kernel, &mut user) };
+        (ok != 0).then(|| (u64::from(created.dwHighDateTime) << 32) | u64::from(created.dwLowDateTime))
+    }
 }

 /// Gives `cmd` the host's environment back when the IDE runs from an AppImage. `AppRun` and
@@ -123,12 +209,14 @@ fn taskkill_tree(child: &Child) {
 /// inherits them loads the image's (older) libraries and plugins next to its own, e.g.
 /// `curl: symbol lookup error ... nghttp2_...`. The IDE process keeps its environment
 /// (WebKit and GTK still need it). Then applies the [`set_env_overlay`] variables and
-/// those of a manual HTTP proxy ([`crate::proxy_settings::ProxySettings::child_env`]).
-/// Variables the call site has already set are kept. A no-op outside an AppImage
-/// without an overlay.
+/// those of a manual HTTP proxy ([`crate::proxy_settings::ProxySettings::child_env`]),
+/// and the login shell's variables this process lacks ([`shell_env`]: an app started from
+/// Finder/Dock doesn't have what rc files export, such as `GOPATH`, `JAVA_HOME` or
+/// `MAVEN_OPTS`). Variables the call site has already set are kept.
 pub fn host_env(cmd: &mut Command) -> &mut Command {
    let fixes = child_env_changes();
-    if fixes.is_empty() {
+    let shell: Vec<_> = shell_env().collect();
+    if fixes.is_empty() && shell.is_empty() {
        return cmd;
    }
    let explicit: Vec<OsString> = cmd.get_envs().map(|(k, _)| k.to_owned()).collect();
@@ -138,6 +226,9 @@ pub fn host_env(cmd: &mut Command) -> &mut Command {
            None => cmd.env_remove(key),
        };
    }
+    for (key, value) in shell.into_iter().filter(|(k, _)| !explicit.contains(k)) {
+        cmd.env(key, value);
+    }
    cmd
 }

@@ -154,12 +245,13 @@ pub fn host_vars() -> impl Iterator<Item = (OsString, OsString)> {
    apply_changes(std::env::vars_os().collect(), &child_env_changes()).into_iter()
 }

-/// [`std::env::var_os`] as a child should see it (see [`host_env`]).
+/// [`std::env::var_os`] as a child should see it (see [`host_env`]), the login shell's value
+/// included when this process lacks the variable.
 pub fn host_var_os(key: impl AsRef<OsStr>) -> Option<OsString> {
    let key = key.as_ref();
    match child_env_changes().into_iter().find(|(k, _)| k == key) {
        Some((_, fixed)) => fixed,
-        None => std::env::var_os(key),
+        None => std::env::var_os(key).or_else(|| shell_env().find(|(k, _)| k == key).map(|(_, v)| v)),
    }
 }

@@ -572,6 +664,15 @@ mod tests {
        assert_eq!(get("HOME"), Some(None));
        let shell: Vec<_> = shell_env().map(|(k, _)| k).collect();
        assert_eq!(shell, [OsString::from("OPENIDEA_OVERLAY_B")]);
+        // Every child gets what the login shell exports and the IDE process lacks (a Finder
+        // launch: `GOPATH`, `JAVA_HOME`...), unless the call site sets it.
+        assert_eq!(get("OPENIDEA_OVERLAY_B"), Some(Some("b".into())));
+        let mut own = Command::new("true");
+        own.env("OPENIDEA_OVERLAY_B", "call site");
+        host_env(&mut own);
+        let value = own.get_envs().find(|(n, _)| *n == "OPENIDEA_OVERLAY_B").and_then(|(_, v)| v);
+        assert_eq!(value, Some(OsStr::new("call site")));
+        assert_eq!(host_var_os("OPENIDEA_OVERLAY_B"), Some("b".into()));
        assert_eq!(host_var_os("PATH"), Some("/reloaded".into()));
        assert!(host_vars().all(|(k, _)| k != "HOME"));
        assert!(host_vars().any(|(k, v)| k == "OPENIDEA_OVERLAY_A" && v == "project"));
@@ -351,6 +351,7 @@ pub struct AppearanceSettings {
    pub preferred_dark_theme: String,
    /// A plugin's file icon theme (`<plugin-id>/<theme-id>`); empty = the built-in icons.
    pub file_icon_theme: String,
+    pub file_icon_theme_options: BTreeMap<String, FileIconThemeOptions>,
    /// IDE zoom in percent (50–300).
    pub zoom: u32,
    /// Apply `ui_font_family` / `ui_font_size` (otherwise the theme's).
@@ -386,6 +387,24 @@ pub struct AppearanceSettings {
 /// Main toolbar entries per side, in order: title widget ids (`project`,
 /// `vcs.branch`…) or `action:<id>`. Widgets in neither list nor `hidden`
 /// (registered later) keep their default place.
+#[derive(Clone, Debug, Default, PartialEq, Eq, Serialize, Deserialize, Type)]
+#[serde(default, rename_all = "camelCase")]
+pub struct FileIconThemeOptions {
+    pub groups: BTreeMap<String, bool>,
+    pub choices: BTreeMap<String, String>,
+    pub hide_files: bool,
+    pub hide_folders: bool,
+    pub hollow_folders: bool,
+    pub hide_ui_icons: bool,
+    pub hide_psi_icons: bool,
+    pub monochrome: Option<String>,
+    pub saturation: Option<u8>,
+    pub opacity: Option<u8>,
+    pub icon_size: Option<u8>,
+    pub row_height: Option<u8>,
+    pub accent: Option<String>,
+}
+
 #[derive(Clone, Debug, Default, PartialEq, Eq, Serialize, Deserialize, Type)]
 #[serde(default, rename_all = "camelCase")]
 pub struct MainToolbarSettings {
@@ -406,6 +425,7 @@ impl Default for AppearanceSettings {
            preferred_light_theme: "light".into(),
            preferred_dark_theme: "dark".into(),
            file_icon_theme: String::new(),
+            file_icon_theme_options: BTreeMap::new(),
            zoom: 100,
            use_custom_font: false,
            ui_font_family: "Inter".into(),
@@ -693,6 +713,19 @@ impl Default for PythonSettings {
 pub struct PhpSettings {
    /// `php` CLI executable; empty = the one on `PATH`.
    pub interpreter: String,
+    /// PHP version the language server checks the code against (`7.4`); empty = from
+    /// `composer.json` (`config.platform.php`, else the lowest version `require.php` allows).
+    pub language_level: String,
+    /// Folders outside the project whose code the language server indexes too (a platform a
+    /// module extends); absolute, `~/`, or relative to the project.
+    pub include_paths: Vec<String>,
+    /// Intelephense stub sets loaded on top of its defaults and the `ext-*` entries of
+    /// `composer.json` (`wordpress`).
+    pub stubs: Vec<String>,
+    /// PHPStan configuration file for checking saved files; empty = the `phpstan.neon`,
+    /// `phpstan.neon.dist` or `phpstan.dist.neon` PHPStan finds in the project root. Absolute,
+    /// `~/`, or relative to the project.
+    pub phpstan_config: String,
 }

 #[derive(Clone, Debug, Default, PartialEq, Serialize, Deserialize, Type)]
@@ -799,6 +832,8 @@ pub struct JavaSettings {
 #[derive(Clone, Debug, Default, PartialEq, Serialize, Deserialize, Type)]
 #[serde(default, rename_all = "camelCase")]
 pub struct GradleSettings {
+    /// Linked build directories; absent preserves automatic discovery, empty unlinks all builds.
+    pub linked_projects: Option<Vec<String>>,
    /// Empty = Project JDK; otherwise a JDK home.
    pub jvm: String,
    pub distribution: GradleDistribution,
@@ -835,12 +870,20 @@ pub enum GradleDistribution {
 pub struct MavenSettings {
    /// Project-relative root POMs removed from the Maven project model.
    pub unlinked_projects: Vec<String>,
+    /// Project-relative POMs outside the root reactor added as independent top-level projects.
+    pub linked_projects: Vec<String>,
    /// Maven home (or its `mvn` executable); empty = the project's `mvnw`, else `mvn` on `PATH`.
    pub home: String,
    /// User `settings.xml` (`-s`); empty = `~/.m2/settings.xml`.
    pub user_settings: String,
    /// Local repository (`-Dmaven.repo.local`); empty = from `settings.xml`.
    pub local_repository: String,
+    /// Run Maven through the Maven Daemon (`mvnd`) for faster builds. mvnd embeds
+    /// its own Maven, so `home` and the project's `mvnw` are bypassed when it is on.
+    pub daemon: bool,
+    /// Maven Daemon home (or its `mvnd` executable); empty = `$MVND_HOME`, else
+    /// `mvnd` on `PATH` / common install dirs. Only used when `daemon` is on.
+    pub mvnd_home: String,
 }

 #[derive(Clone, Debug, PartialEq, Serialize, Deserialize, Type)]
@@ -931,6 +974,36 @@ mod tests {
        assert_eq!(serde_json::from_value::<Settings>(value).unwrap(), settings);
    }

+    #[test]
+    fn file_icon_theme_options_default_empty_and_round_trip() {
+        let old: Settings = serde_json::from_str(r#"{"appearance":{"fileIconTheme":"p/t"}}"#).unwrap();
+        assert!(old.appearance.file_icon_theme_options.is_empty());
+        let json = serde_json::json!({"appearance":{"fileIconThemeOptions":{"p/t":{
+            "groups":{"tests":true},"choices":{"arrows":"plusminus"},"hideFiles":true,"hideFolders":false,"hollowFolders":true,"hideUiIcons":true,"hidePsiIcons":false,
+            "monochrome":"#546e7a","saturation":5,"opacity":80,"iconSize":20,"rowHeight":30,"accent":"#009688"}}}});
+        let settings: Settings = serde_json::from_value(json.clone()).unwrap();
+        let options = &settings.appearance.file_icon_theme_options["p/t"];
+        assert!(options.hide_files && options.hollow_folders && !options.hide_folders);
+        assert!(options.hide_ui_icons && !options.hide_psi_icons);
+        assert!(options.groups["tests"]);
+        assert_eq!(options.choices["arrows"], "plusminus");
+        assert_eq!(
+            (options.saturation, options.opacity, options.icon_size, options.row_height),
+            (Some(5), Some(80), Some(20), Some(30))
+        );
+        assert_eq!(options.monochrome.as_deref(), Some("#546e7a"));
+        assert_eq!(options.accent.as_deref(), Some("#009688"));
+        let value = serde_json::to_value(&settings).unwrap();
+        let restored: Settings = serde_json::from_value(value).unwrap();
+        assert_eq!(restored, settings);
+        let plain = serde_json::to_value(FileIconThemeOptions::default()).unwrap();
+        assert_eq!(plain["hideFiles"], false);
+        assert_eq!(plain["hideUiIcons"], false);
+        assert_eq!(plain["hidePsiIcons"], false);
+        assert_eq!(plain["monochrome"], serde_json::Value::Null);
+        assert_eq!(plain["groups"], serde_json::json!({}));
+    }
+
    #[test]
    fn ui_font_fallback_defaults_empty_and_round_trips() {
        let old: Settings = serde_json::from_str(r#"{"appearance":{"useCustomFont":true}}"#).unwrap();
@@ -1042,12 +1115,33 @@ mod maven_linkage_tests {
        assert!(encoded.contains("unlinkedProjects"));
        assert_eq!(serde_json::from_str::<MavenSettings>(&encoded).unwrap(), settings);
    }
+
+    #[test]
+    fn daemon_settings_round_trip() {
+        // Old settings files predate the daemon fields; `serde(default)` keeps them loadable.
+        let old: MavenSettings = serde_json::from_str(r#"{"home":"/opt/maven"}"#).unwrap();
+        assert!(!old.daemon && old.mvnd_home.is_empty());
+        let settings = MavenSettings { daemon: true, mvnd_home: "/opt/mvnd".into(), ..old };
+        let encoded = serde_json::to_string(&settings).unwrap();
+        assert!(encoded.contains("\"daemon\":true") && encoded.contains("mvndHome"));
+        assert_eq!(serde_json::from_str::<MavenSettings>(&encoded).unwrap(), settings);
+    }
 }

 #[cfg(test)]
 mod gradle_settings_tests {
    use super::*;

+    #[test]
+    fn absent_and_explicitly_empty_gradle_links_remain_distinct() {
+        let automatic: GradleSettings = serde_json::from_str("{}").unwrap();
+        let unlinked: GradleSettings = serde_json::from_str(r#"{"linkedProjects":[]}"#).unwrap();
+        assert_eq!(automatic.linked_projects, None);
+        assert_eq!(unlinked.linked_projects, Some(vec![]));
+        let restored: GradleSettings = serde_json::from_str(&serde_json::to_string(&unlinked).unwrap()).unwrap();
+        assert_eq!(restored.linked_projects, Some(vec![]));
+    }
+
    #[test]
    fn defaults_and_round_trip() {
        let old: JavaSettings = serde_json::from_str(r#"{"jdk":"/jdk"}"#).unwrap();
@@ -1060,6 +1154,7 @@ mod gradle_settings_tests {
                home: "/gradle".into(),
                user_home: "/cache/gradle".into(),
                run_using: GradleRunUsing::Ide,
+                linked_projects: Some(vec!["backend".into(), "../shared".into()]),
            };
            let restored: Settings = serde_json::from_str(&serde_json::to_string(&settings).unwrap()).unwrap();
            assert_eq!(restored.languages.java.gradle, settings.languages.java.gradle);
@@ -30,6 +30,21 @@ pub fn search_path() -> OsString {
    std::env::join_paths(dirs).unwrap_or_default()
 }

+/// Ruby code printing where `gem install` puts executables: the Ruby's own `Gem.bindir`, which
+/// Homebrew's Ruby keeps off `PATH`, and the `--user-install` one.
+pub const RUBY_GEM_BIN_SCRIPT: &str = "puts Gem.bindir, File.join(Gem.user_dir, 'bin')";
+
+/// The directories [`RUBY_GEM_BIN_SCRIPT`] printed that exist.
+pub fn gem_bin_dirs(output: &str) -> Vec<PathBuf> {
+    let mut dirs: Vec<PathBuf> = Vec::new();
+    for dir in output.lines().map(str::trim).map(PathBuf::from) {
+        if dir.is_absolute() && dir.is_dir() && !dirs.contains(&dir) {
+            dirs.push(dir);
+        }
+    }
+    dirs
+}
+
 /// Resolves a command on the shared path, or an explicit path relative to `root`.
 pub fn find_command(command: &str, search: &OsStr, root: &Path) -> Option<PathBuf> {
    let path = Path::new(command);
@@ -0,0 +1,137 @@
+//! Projects that live inside a WSL distro are reached from Windows through the
+//! `\\wsl.localhost\<distro>` (or legacy `\\wsl$\<distro>`) share.
+
+use std::path::Path;
+
+/// The WSL launcher on Windows.
+pub const EXE: &str = "wsl.exe";
+
+/// A location inside a WSL distro.
+#[derive(Clone, Debug, PartialEq, Eq)]
+pub struct WslPath {
+    pub distro: String,
+    /// Absolute Linux path, e.g. `/home/me/app`.
+    pub path: String,
+}
+
+/// Splits a WSL share path into distro and Linux path. Pure string work, so it
+/// accepts every spelling the UI and the OS produce: `\\wsl.localhost\X\a`,
+/// `//wsl$/X/a` and the verbatim `\\?\UNC\wsl.localhost\X\a`.
+pub fn parse(path: &Path) -> Option<WslPath> {
+    let s = path.to_string_lossy().replace('\\', "/");
+    let s = match s.strip_prefix("//?/UNC/") {
+        Some(rest) => format!("//{rest}"),
+        None => s,
+    };
+    let rest = s.strip_prefix("//")?;
+    let (host, rest) = rest.split_once('/')?;
+    if !host.eq_ignore_ascii_case("wsl.localhost") && !host.eq_ignore_ascii_case("wsl$") {
+        return None;
+    }
+    let (distro, tail) = rest.split_once('/').unwrap_or((rest, ""));
+    if distro.is_empty() {
+        return None;
+    }
+    Some(WslPath { distro: distro.to_owned(), path: format!("/{}", tail.trim_end_matches('/')) })
+}
+
+/// A distro name `wsl.exe -d` can be given safely: Windows creates them from letters, digits,
+/// `.`, `_` and `-`. A leading `-` would be read as an option, so it is refused too.
+pub fn is_valid_distro(name: &str) -> bool {
+    !name.is_empty()
+        && name.len() <= 64
+        && !name.starts_with('-')
+        && name.chars().all(|c| c.is_ascii_alphanumeric() || matches!(c, '.' | '_' | '-'))
+}
+
+/// Text of `wsl.exe`'s own output: UTF-16LE (with or without BOM) for its management commands
+/// and its error messages, UTF-8 for what a command inside the distro prints.
+pub fn decode_output(raw: &[u8]) -> String {
+    if raw.starts_with(&[0xff, 0xfe]) || raw.get(1) == Some(&0) {
+        let units: Vec<u16> = raw.as_chunks::<2>().0.iter().map(|c| u16::from_le_bytes(*c)).collect();
+        String::from_utf16_lossy(&units)
+    } else {
+        String::from_utf8_lossy(raw).into_owned()
+    }
+}
+
+/// Distro names from the output of `wsl.exe -l -q`. That output is UTF-16LE (UTF-8 when
+/// `WSL_UTF8=1`), one name per line; names that fail [`is_valid_distro`] are dropped, which also
+/// removes the localized "no installed distributions" message `wsl.exe` prints when there are none.
+pub fn parse_distro_list(raw: &[u8]) -> Vec<String> {
+    let text = decode_output(raw);
+    let mut names: Vec<String> = Vec::new();
+    for line in text.lines() {
+        let name = line.trim_matches(|c: char| c.is_whitespace() || c == '\u{feff}');
+        if is_valid_distro(name) && !names.iter().any(|n| n == name) {
+            names.push(name.to_owned());
+        }
+    }
+    names
+}
+
+/// Installed WSL distros. Empty off Windows, when WSL is not installed or when `wsl.exe` fails.
+pub fn list_distros() -> Vec<String> {
+    #[cfg(windows)]
+    {
+        let mut cmd = std::process::Command::new(EXE);
+        cmd.args(["-l", "-q"]);
+        crate::process::prepare(&mut cmd);
+        match cmd.output() {
+            Ok(out) if out.status.success() => parse_distro_list(&out.stdout),
+            _ => Vec::new(),
+        }
+    }
+    #[cfg(not(windows))]
+    Vec::new()
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    fn p(s: &str) -> Option<(String, String)> {
+        parse(Path::new(s)).map(|w| (w.distro, w.path))
+    }
+
+    #[test]
+    fn every_spelling_of_the_share_is_recognised() {
+        let want = Some(("Ubuntu-24.04".to_owned(), "/home/me/app".to_owned()));
+        assert_eq!(p(r"\\wsl.localhost\Ubuntu-24.04\home\me\app"), want);
+        assert_eq!(p("//wsl.localhost/Ubuntu-24.04/home/me/app"), want);
+        assert_eq!(p(r"\\wsl$\Ubuntu-24.04\home\me\app\"), want);
+        assert_eq!(p(r"\\?\UNC\WSL.LOCALHOST\Ubuntu-24.04\home\me\app"), want);
+    }
+
+    #[test]
+    fn distro_root_and_foreign_paths() {
+        assert_eq!(p(r"\\wsl.localhost\Debian"), Some(("Debian".to_owned(), "/".to_owned())));
+        assert_eq!(p(r"\\server\share\a"), None);
+        assert_eq!(p(r"\\wsl.localhost\"), None);
+        assert_eq!(p("C:/Users/me"), None);
+        assert_eq!(p("/home/me"), None);
+    }
+
+    fn utf16(s: &str) -> Vec<u8> {
+        std::iter::once(0xfeffu16).chain(s.encode_utf16()).flat_map(u16::to_le_bytes).collect()
+    }
+
+    #[test]
+    fn distro_list_is_decoded_from_utf16_and_utf8() {
+        let want = vec!["Ubuntu-24.04".to_owned(), "Debian".to_owned()];
+        assert_eq!(parse_distro_list(&utf16("Ubuntu-24.04\r\nDebian\r\n\r\n")), want);
+        assert_eq!(parse_distro_list(b"Ubuntu-24.04\nDebian\nDebian\n"), want);
+        assert!(
+            parse_distro_list(&utf16("Windows Subsystem for Linux has no installed distributions.\r\n")).is_empty()
+        );
+        assert!(parse_distro_list(b"").is_empty());
+    }
+
+    #[test]
+    fn distro_names_cannot_smuggle_options_or_paths() {
+        for bad in ["", "-d", "--exec", "a b", "a/b", r"a\b", "a;b", "a$(x)", "a\"b"] {
+            assert!(!is_valid_distro(bad), "{bad}");
+        }
+        assert!(is_valid_distro("Ubuntu-22.04") && is_valid_distro("docker_desktop"));
+    }
+}
@@ -1,8 +1,8 @@
 //! "Import a report collected in CI from disk": the format is sniffed from the
-//! content (lcov, Go cover profile, JaCoCo XML) and paths recorded on another
+//! content (lcov, Go cover profile, JaCoCo XML, SimpleCov resultset) and paths recorded on another
 //! machine are mapped into the project by their longest existing suffix.

-use crate::{Accumulator, CoverageSuite, goprofile, jacoco, lcov};
+use crate::{Accumulator, CoverageSuite, goprofile, jacoco, lcov, simplecov};
 use ide_core::{IdeError, IdeResult};
 use std::path::{Component, Path, PathBuf};

@@ -11,6 +11,7 @@ pub(crate) enum Format {
    Lcov,
    GoProfile,
    Jacoco,
+    SimpleCov,
 }

 pub(crate) fn detect(text: &str) -> Option<Format> {
@@ -18,6 +19,9 @@ pub(crate) fn detect(text: &str) -> Option<Format> {
    if head.starts_with('<') {
        return head.contains("<report").then_some(Format::Jacoco);
    }
+    if head.starts_with('{') {
+        return head.contains("\"coverage\"").then_some(Format::SimpleCov);
+    }
    let first = head.lines().next().unwrap_or_default();
    if first.starts_with("mode:") {
        return Some(Format::GoProfile);
@@ -30,6 +34,7 @@ pub fn import(path: &Path, root: &Path) -> IdeResult<CoverageSuite> {
    let text = std::fs::read_to_string(path)?;
    let mut suite = match detect(&text) {
        Some(Format::Lcov) => lcov::parse(&text, root).finish("lcov"),
+        Some(Format::SimpleCov) => simplecov::parse(&text, root)?.finish("SimpleCov"),
        Some(Format::GoProfile) => {
            let (module, module_dir) = go_module_for(root, &text);
            goprofile::parse(&text, &module, &module_dir).finish("go test -cover")
@@ -50,7 +55,7 @@ pub fn import(path: &Path, root: &Path) -> IdeResult<CoverageSuite> {
        }
        None => {
            return Err(IdeError::invalid(format!(
-                "{} is not an lcov tracefile, Go cover profile or JaCoCo XML report",
+                "{} is not an lcov tracefile, Go cover profile, JaCoCo XML report or SimpleCov resultset",
                path.display()
            )));
        }
@@ -125,9 +130,29 @@ mod tests {
            Some(Format::Jacoco)
        );
        assert_eq!(detect("<?xml version=\"1.0\"?><coverage/>"), None);
+        assert_eq!(detect("{\"RSpec\": {\"coverage\": {}}}"), Some(Format::SimpleCov));
+        assert_eq!(detect("{\"name\": \"package.json\"}"), None);
        assert_eq!(detect("hello"), None);
    }

+    #[test]
+    fn imports_ci_simplecov_with_foreign_paths() {
+        let tmp = tempfile::tempdir().unwrap();
+        let root = tmp.path().join("app");
+        std::fs::create_dir_all(root.join("lib")).unwrap();
+        std::fs::write(root.join("lib/a.rb"), "").unwrap();
+        let report = tmp.path().join(".resultset.json");
+        std::fs::write(
+            &report,
+            r#"{"RSpec":{"coverage":{"/home/runner/work/app/app/lib/a.rb":{"lines":[null,1,0]}}}}"#,
+        )
+        .unwrap();
+        let suite = import(&report, &root).unwrap();
+        assert_eq!(suite.runner, "SimpleCov");
+        assert_eq!(suite.files[0].path.as_ref() as &Path, root.join("lib/a.rb"));
+        assert_eq!((suite.files[0].lines_total, suite.files[0].lines_covered), (2, 1));
+    }
+
    #[test]
    fn imports_ci_lcov_with_foreign_paths() {
        let tmp = tempfile::tempdir().unwrap();
@@ -10,6 +10,7 @@
 //! | JS / TS (vitest, jest scripts) | the runner's `--coverage` | lcov |
 //! | Node.js scripts | `c8` | lcov |
 //! | Python (pytest, scripts) | coverage.py (`coverage run`, then `coverage lcov`) | lcov |
+//! | Ruby (rspec, minitest, rake, scripts) | SimpleCov (`coverage/.resultset.json`) | SimpleCov resultset |
 //! | Go (`go test`) | `-coverprofile` | Go cover profile |
 //! | Maven / Gradle tests | JaCoCo (plugin goals / an init script) | JaCoCo XML |
 //!
@@ -20,6 +21,7 @@ mod import;
 mod jacoco;
 mod lcov;
 mod plan;
+mod simplecov;

 pub use import::import;
 pub use plan::prepare;
@@ -83,6 +85,8 @@ pub enum CoverageReportSpec {
    Lcov { runner: String, path: IpcPath, base: IpcPath },
    /// `go test -coverprofile`; import paths under `module` map to `module_dir`.
    GoProfile { path: IpcPath, module: String, module_dir: IpcPath },
+    /// SimpleCov's `.resultset.json`; relative paths resolve against `base`.
+    SimpleCov { path: IpcPath, base: IpcPath },
    /// Every JaCoCo XML report (Maven `target/site/jacoco`, Gradle `build/reports/jacoco`) under `dir`.
    Jacoco { dir: IpcPath },
    /// The tool's raw data is exported to lcov by `argv` first (coverage.py: `… -m coverage lcov -o <lcov>`).
@@ -185,6 +189,10 @@ pub fn collect(spec: &CoverageReportSpec) -> IdeResult<CoverageSuite> {
            let text = read_report(path)?;
            Ok(lcov::parse(&text, base).finish(runner))
        }
+        CoverageReportSpec::SimpleCov { path, base } => {
+            let text = read_report(path)?;
+            Ok(simplecov::parse(&text, base)?.finish("SimpleCov"))
+        }
        CoverageReportSpec::GoProfile { path, module, module_dir } => {
            let text = read_report(path)?;
            Ok(goprofile::parse(&text, module, module_dir).finish("go test -cover"))
@@ -67,6 +67,7 @@ pub fn prepare(root: &Path, config: &RunConfig, out: &Path) -> CoveragePrepared
        "gradle" | "gradlew" => gradle(config, &dir, out),
        "npm" | "pnpm" | "yarn" | "bun" => npm(root, config, &dir, out),
        "node" | "npx" | "tsx" | "ts-node" => c8(root, config, &dir, out),
+        "ruby" | "bundle" | "rake" | "rspec" | "rails" => ruby(root, config, &dir, out),
        "deno" => unsupported("Coverage of Deno tasks is not supported yet."),
        "java" => unsupported(
            "Coverage of Java applications needs the JaCoCo agent; run a Maven or Gradle test configuration with coverage.",
@@ -234,6 +235,65 @@ fn c8(root: &Path, config: &RunConfig, dir: &Path, out: &Path) -> CoveragePrepar
    ready("c8", config, path(&c8), args, report)
 }

+/// Loaded first (`ide_run::ruby_preload`) when the project never starts SimpleCov itself.
+const SIMPLECOV_PRELOAD: &str = r#"# Written by OpenIDEA for Run with Coverage.
+begin
+  require "simplecov"
+rescue LoadError
+  # `bundle exec` is a Ruby process too and loads this before Bundler puts the project's gems on
+  # the load path; the Ruby it starts loads bundler/setup first and finds SimpleCov.
+  return
+end
+SimpleCov.coverage_dir(ENV.fetch("OPENIDEA_COVERAGE_DIR"))
+SimpleCov.start do
+  add_filter %r{^/(test|spec|features)/}
+  enable_coverage :branch
+end
+"#;
+
+/// Files where a project conventionally starts SimpleCov.
+const SIMPLECOV_STARTERS: &[&str] =
+    &[".simplecov", "spec/spec_helper.rb", "spec/rails_helper.rb", "test/test_helper.rb", "test/minitest_helper.rb"];
+
+fn ruby(root: &Path, config: &RunConfig, dir: &Path, out: &Path) -> CoveragePrepared {
+    let bundled = [dir, root].iter().any(|d| d.join("Gemfile").is_file());
+    let mentions = |file: &str| {
+        [dir, root].iter().any(|d| std::fs::read_to_string(d.join(file)).is_ok_and(|t| t.contains("simplecov")))
+    };
+    if bundled && !mentions("Gemfile.lock") && !mentions("Gemfile") {
+        return missing(
+            "simplecov",
+            "Ruby coverage needs the simplecov gem in the project's Gemfile.",
+            Some((vec![s("bundle"), s("add"), s("simplecov"), s("--group"), s("test")], dir)),
+        );
+    }
+    let starts = |d: &Path| {
+        SIMPLECOV_STARTERS.iter().any(|f| {
+            std::fs::read_to_string(d.join(f))
+                .is_ok_and(|t| t.contains("SimpleCov.start") || f.starts_with(".simplecov"))
+        })
+    };
+    let mut config = config.clone();
+    let resultset = if [dir, root].iter().any(|d| starts(d)) {
+        // The project's own configuration decides where the report goes (default `coverage/`).
+        // Drop the previous run's data: SimpleCov merges into it.
+        let results = dir.join("coverage");
+        let _ = std::fs::remove_file(results.join(".resultset.json"));
+        results.join(".resultset.json")
+    } else {
+        let preload = out.join("openidea_simplecov.rb");
+        if let Err(e) = std::fs::write(&preload, SIMPLECOV_PRELOAD) {
+            return unsupported(format!("Cannot write the SimpleCov preload: {e}"));
+        }
+        config.env.insert(s("OPENIDEA_COVERAGE_DIR"), path(out));
+        // `out` lives under the IDE's data directory, which may have spaces (RUBYOPT cannot take them).
+        ide_run::ruby_preload::add(&mut config.env, out, "openidea_simplecov", true);
+        out.join(".resultset.json")
+    };
+    let report = CoverageReportSpec::SimpleCov { path: resultset.into(), base: dir.to_path_buf().into() };
+    ready("SimpleCov", &config, config.command.clone(), config.args.clone(), report)
+}
+
 fn python(config: &RunConfig, dir: &Path, out: &Path, py: wrap::PythonCommand) -> CoveragePrepared {
    if py.target.is_empty() {
        return unsupported("Coverage needs a Python script or module to run.");
@@ -398,6 +458,74 @@ mod tests {
        ));
    }

+    /// `bundle exec` loads the preload before Bundler sets up the project's gems: without SimpleCov
+    /// on the load path it must step aside instead of failing the launcher.
+    #[test]
+    fn simplecov_preload_tolerates_a_ruby_without_the_gem() {
+        let dir = tempfile::tempdir().unwrap();
+        let out = dir.path().join("out dir");
+        std::fs::create_dir_all(&out).unwrap();
+        std::fs::write(out.join("openidea_simplecov.rb"), SIMPLECOV_PRELOAD).unwrap();
+        let status = std::process::Command::new("ruby")
+            .args(["-e", "exit 0"])
+            .env("RUBYLIB", &out)
+            .env("RUBYOPT", "-ropenidea_simplecov")
+            .env("OPENIDEA_COVERAGE_DIR", &out)
+            .env("GEM_HOME", dir.path().join("empty gems"))
+            .env("GEM_PATH", dir.path().join("empty gems"))
+            .status();
+        // No Ruby on this machine: nothing to check.
+        let Ok(status) = status else { return };
+        assert!(status.success());
+    }
+
+    #[test]
+    fn ruby_runs_get_simplecov() {
+        let dir = tempfile::tempdir().unwrap();
+        let root = dir.path();
+        // The IDE's data directory has spaces on macOS (`Application Support`).
+        let out = root.join("out dir");
+        std::fs::create_dir_all(&out).unwrap();
+        std::fs::write(root.join("Gemfile"), "source 'https://rubygems.org'\n").unwrap();
+        let config = cfg("rspec", "bundle", &["exec", "rspec"]);
+        // Bundler project without the gem: install hint.
+        match prepare(root, &config, &out) {
+            CoveragePrepared::MissingTool { tool, install: Some(i), .. } => {
+                assert_eq!(tool, "simplecov");
+                assert_eq!(i.args, ["add", "simplecov", "--group", "test"]);
+            }
+            other => panic!("{other:?}"),
+        }
+        // Gem present, never started: preloaded through RUBYOPT, report in `out`.
+        std::fs::write(root.join("Gemfile"), "gem 'simplecov'\n").unwrap();
+        let p = prepare(root, &config, &out);
+        let (l, report) = launch(&p);
+        assert_eq!(
+            (l.command.as_str(), l.args.as_slice()),
+            ("bundle", ["exec".to_owned(), "rspec".to_owned()].as_slice())
+        );
+        assert!(l.env["RUBYOPT"].contains("-ropenidea_simplecov"));
+        assert!(std::env::split_paths(&l.env["RUBYLIB"]).any(|d| d == out));
+        assert_eq!(l.env["OPENIDEA_COVERAGE_DIR"], out.to_string_lossy());
+        assert!(out.join("openidea_simplecov.rb").is_file());
+        assert!(
+            matches!(report, CoverageReportSpec::SimpleCov { path, .. } if (path.as_ref() as &Path).starts_with(&out))
+        );
+        // Started by the project: untouched environment, stale data dropped, report in `coverage/`.
+        std::fs::create_dir_all(root.join("test")).unwrap();
+        std::fs::create_dir_all(root.join("coverage")).unwrap();
+        std::fs::write(root.join("coverage/.resultset.json"), "{}").unwrap();
+        std::fs::write(root.join("test/test_helper.rb"), "require 'simplecov'\nSimpleCov.start\n").unwrap();
+        let p = prepare(root, &cfg("ruby", "ruby", &["-Ilib", "test/a_test.rb"]), &out);
+        let (l, report) = launch(&p);
+        assert!(!l.env.contains_key("RUBYOPT"));
+        assert_eq!(l.args, ["-Ilib", "test/a_test.rb"]);
+        assert!(!root.join("coverage/.resultset.json").exists());
+        assert!(
+            matches!(report, CoverageReportSpec::SimpleCov { path, .. } if (path.as_ref() as &Path).ends_with("coverage/.resultset.json"))
+        );
+    }
+
    #[test]
    fn unknown_commands_are_unsupported() {
        let dir = tempfile::tempdir().unwrap();
@@ -0,0 +1,74 @@
+//! SimpleCov's `coverage/.resultset.json`:
+//!
+//! ```json
+//! { "RSpec": { "timestamp": 1, "coverage": {
+//!     "/abs/lib/a.rb": { "lines": [null, 1, 0],
+//!                        "branches": { "[:if, 0, 3, 4, 3, 20]": { "[:then, 1, 4, 6, 4, 9]": 1, "[:else, 2, 6, 6, 6, 9]": 0 } } },
+//!     "/abs/lib/legacy.rb": [null, 1] } } }
+//! ```
+//!
+//! `lines[i]` is line `i + 1` (`null` = not relevant), so the index is already 0-based.
+//! A branch belongs to the line its condition starts on (third number of its key).
+
+use crate::Accumulator;
+use ide_core::{IdeError, IdeResult};
+use serde_json::Value;
+use std::path::Path;
+
+/// Start line (1-based) of a `"[:if, 0, 3, 4, 3, 20]"` branch key.
+fn start_line(key: &str) -> Option<u32> {
+    key.trim_matches(['[', ']']).split(',').nth(2)?.trim().parse().ok()
+}
+
+pub(crate) fn parse(text: &str, base: &Path) -> IdeResult<Accumulator> {
+    let json: Value = serde_json::from_str(text).map_err(|e| IdeError::invalid(format!("SimpleCov resultset: {e}")))?;
+    let mut acc = Accumulator::default();
+    // One entry per test command ("RSpec", "Minitest", …); their coverage is merged.
+    for suite in json.as_object().into_iter().flat_map(|o| o.values()) {
+        let Some(files) = suite.get("coverage").and_then(Value::as_object) else { continue };
+        for (name, data) in files {
+            let p = Path::new(name);
+            let path = if p.is_absolute() { p.to_path_buf() } else { base.join(p) };
+            acc.file(&path);
+            let lines = data.get("lines").or(Some(data)).and_then(Value::as_array);
+            for (i, hits) in lines.into_iter().flatten().enumerate() {
+                if let Some(hits) = hits.as_u64() {
+                    acc.line(&path, i as u32, hits);
+                }
+            }
+            for (cond, branches) in data.get("branches").and_then(Value::as_object).into_iter().flatten() {
+                let Some(line) = start_line(cond) else { continue };
+                for (branch, hits) in branches.as_object().into_iter().flatten() {
+                    acc.has_branches = true;
+                    acc.branch(&path, line.saturating_sub(1), format!("{cond}/{branch}"), hits.as_u64() > Some(0));
+                }
+            }
+        }
+    }
+    Ok(acc)
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    #[test]
+    fn reads_lines_branches_and_merges_suites() {
+        let text = r#"{
+          "RSpec": {"coverage": {"/p/lib/a.rb": {"lines": [null, 1, 0],
+            "branches": {"[:if, 0, 2, 4, 2, 20]": {"[:then, 1, 2, 6, 2, 9]": 1, "[:else, 2, 2, 6, 2, 9]": 0}}}}},
+          "Minitest": {"coverage": {"/p/lib/a.rb": {"lines": [null, 2, 3]}, "lib/old.rb": [1, null]}}
+        }"#;
+        let suite = parse(text, Path::new("/p")).unwrap().finish("SimpleCov");
+        assert_eq!(suite.files.len(), 2);
+        let a = suite.files.iter().find(|f| (f.path.as_ref() as &Path).ends_with("a.rb")).unwrap();
+        assert_eq!(a.lines.iter().map(|l| (l.line, l.hits)).collect::<Vec<_>>(), [(1, 3), (2, 3)]);
+        assert_eq!((a.branches_total, a.branches_covered), (2, 1));
+        assert_eq!(a.lines[0].branches_total, 2);
+        let old = suite.files.iter().find(|f| (f.path.as_ref() as &Path).ends_with("lib/old.rb")).unwrap();
+        assert_eq!(old.path.as_ref() as &Path, Path::new("/p/lib/old.rb"));
+        assert_eq!(old.lines[0].hits, 1);
+        assert!(suite.has_branches);
+        assert!(parse("nope", Path::new("/p")).is_err());
+    }
+}
@@ -72,7 +72,13 @@ fn builtin(adapter: &str) -> Option<DebuggerConfig> {
            "stdio",
            "Install the Kotlin Debug Adapter from Settings > Language Servers",
        ),
-        "debugpy" => cfg("python3", &["-m", "debugpy.adapter"], "stdio", "pip install debugpy"),
+        // Windows installs `python.exe`; `python3.exe` there is at most a Store alias.
+        "debugpy" => cfg(
+            if cfg!(windows) { "python" } else { "python3" },
+            &["-m", "debugpy.adapter"],
+            "stdio",
+            "pip install debugpy",
+        ),
        "js-debug" => cfg(
            "js-debug-adapter",
            // Without a host it listens on `localhost`, which may resolve to ::1 only.
@@ -302,6 +302,23 @@ pub struct DebugManager {
    data_breakpoints: Mutex<Vec<DataBreakpoint>>,
 }

+/// Whether the debugged project depends on the Flutter SDK, so it must go
+/// through `flutter debug_adapter` instead of the plain Dart one.
+///
+/// `dart debug_adapter` cannot start a program that imports `dart:ui`, and only
+/// the Flutter adapter answers `hotReload` / `hotRestart`. `dir` is the launch
+/// `cwd`; the program's own directory is tried first because a module inside a
+/// larger repository has its `pubspec.yaml` above the program, not above `cwd`.
+fn is_flutter_project(dir: &Path, program: Option<&Path>) -> bool {
+    let mut start: Vec<&Path> = program.and_then(Path::parent).into_iter().collect();
+    start.push(dir);
+    start
+        .iter()
+        .filter_map(|d| d.ancestors().take(6).find(|a| a.join("pubspec.yaml").is_file()))
+        .filter_map(|root| std::fs::read_to_string(root.join("pubspec.yaml")).ok())
+        .any(|s| s.contains("sdk: flutter"))
+}
+
 fn no_session(s: DebugSessionId) -> IdeError {
    IdeError::not_found(format!("no debug session {}", s.0))
 }
@@ -570,6 +587,10 @@ impl DebugManager {
        custom_command: impl FnOnce(&str) -> Option<String>,
    ) -> IdeResult<DebugSessionId> {
        let mut arguments = launch_arguments(&config)?;
+        // An IDE-side marker (never sent to the adapter): the session is a Flutter
+        // one regardless of what the working directory holds.
+        let force_flutter =
+            arguments.as_object_mut().and_then(|o| o.remove("__flutter")).and_then(|v| v.as_bool()).unwrap_or(false);
        let cwd = config
            .cwd
            .clone()
@@ -589,17 +610,27 @@ impl DebugManager {
        if let Some(command) = custom_command(&spec.command) {
            spec.command = command;
        }
-        // debugpy: run the adapter with the debuggee's interpreter (venvs carry their own debugpy).
+        // debugpy: run the adapter with the debuggee's interpreter (venvs carry their own debugpy),
+        // or with the launcher's when the debuggee runs through a manager (`uv run python`).
        if config.adapter == "debugpy" {
-            let python = match arguments.get("python") {
-                Some(Value::String(p)) => Some(p.clone()),
-                Some(Value::Array(a)) => a.first().and_then(Value::as_str).map(str::to_owned),
+            let python = match (arguments.get("debugLauncherPython"), arguments.get("python")) {
+                (Some(Value::String(p)), _) | (_, Some(Value::String(p))) => Some(p.clone()),
+                (_, Some(Value::Array(a))) => a.first().and_then(Value::as_str).map(str::to_owned),
                _ => None,
            };
            if let Some(python) = python {
                spec.command = python;
            }
        }
+        // Flutter: a project depending on the Flutter SDK needs `flutter debug_adapter`
+        // (the Dart adapter cannot start a program importing `dart:ui`, and hot reload
+        // is Flutter-only). Plain Dart projects keep the configured `dart`.
+        if config.adapter == "dart" && spec.command == "dart" {
+            let program = arguments.get("program").and_then(Value::as_str).map(Path::new);
+            if force_flutter || is_flutter_project(&cwd, program) {
+                spec.command = "flutter".into();
+            }
+        }
        let id = DebugSessionId::next();
        let debug_server = take_debug_server(&mut arguments)?;
        if let Some(server) = &debug_server {
@@ -651,8 +682,19 @@ impl DebugManager {
        {
            arguments["project"] = json!(real);
        }
-        if config.adapter == "codelldb" && arguments.get("sourceLanguages").is_none() {
-            arguments["sourceLanguages"] = json!(["rust"]);
+        if config.adapter == "codelldb" {
+            if arguments.get("sourceLanguages").is_none() {
+                arguments["sourceLanguages"] = json!(["rust"]);
+            }
+            // The Debug Console and Evaluate Expression take expressions, as with every other
+            // debugger; LLDB commands still run with a leading backtick.
+            match arguments.get_mut("_adapterSettings") {
+                None => arguments["_adapterSettings"] = json!({"consoleMode": "evaluate"}),
+                Some(Value::Object(settings)) => {
+                    settings.entry("consoleMode").or_insert_with(|| json!("evaluate"));
+                }
+                Some(_) => {}
+            }
        }
        let port = debug_server.map(|s| s.port);
        self.start_session(id, owner, config.name, config.adapter, None, config.request, arguments, spec, port).await
@@ -1224,6 +1266,19 @@ impl DebugManager {
        Ok(())
    }

+    /// Flutter's DAP adapter: injects the changed sources into the running app.
+    /// Not part of the DAP standard; adapters that do not know the request reject it.
+    pub async fn hot_reload(&self, s: DebugSessionId) -> IdeResult<()> {
+        self.session(s)?.conn.request_timeout("hotReload", json!({ "reason": "manual" }), REQUEST_TIMEOUT).await?;
+        Ok(())
+    }
+
+    /// Flutter's DAP adapter: restarts the app without preserving state.
+    pub async fn hot_restart(&self, s: DebugSessionId) -> IdeResult<()> {
+        self.session(s)?.conn.request_timeout("hotRestart", json!({ "reason": "manual" }), REQUEST_TIMEOUT).await?;
+        Ok(())
+    }
+
    pub async fn step(&self, s: DebugSessionId, thread_id: i64, kind: StepKind) -> IdeResult<()> {
        let command = match kind {
            StepKind::Over => "next",
@@ -111,8 +111,8 @@ impl Session {
        if let Some(path) = self.kotlin_mirror.lock().as_ref().and_then(|m| m.adapter_path(path)) {
            return path;
        }
-        if self.adapter == "java-debug" {
-            let native = java_source_path(&path.to_string_lossy());
+        if self.adapter == "java-debug" || (cfg!(windows) && self.adapter == "netcoredbg") {
+            let native = windows_source_path(&path.to_string_lossy());
            self.resolved_paths.lock().insert(native.clone(), path.to_path_buf());
            return native;
        }
@@ -133,7 +133,11 @@ impl Session {
        if let Some(real) = self.kotlin_mirror.lock().as_ref().and_then(|m| m.client_path(Path::new(path))) {
            return Some(real);
        }
-        let key = if self.adapter == "java-debug" { java_source_path(path) } else { PathBuf::from(path) };
+        let key = if self.adapter == "java-debug" || (cfg!(windows) && self.adapter == "netcoredbg") {
+            windows_source_path(path)
+        } else {
+            PathBuf::from(path)
+        };
        self.resolved_paths.lock().get(&key).cloned().or_else(|| {
            (self.adapter == "java-debug" && is_windows_source_path(path))
                .then(|| PathBuf::from(path.replace('\\', "/")))
@@ -265,8 +269,8 @@ impl Session {
    }
 }

-// java-debug treats a forward-slash drive path as a URI (scheme "C").
-// Keep DAP path mode, but use native Windows separators for Java source lookup.
+// java-debug and Windows netcoredbg need native separators for source lookup.
+// Keep DAP path mode, but normalize Windows drive and UNC paths.
 fn is_windows_source_path(path: &str) -> bool {
    let bytes = path.as_bytes();
    (bytes.len() >= 3 && bytes[0].is_ascii_alphabetic() && bytes[1] == b':' && matches!(bytes[2], b'/' | b'\\'))
@@ -274,7 +278,7 @@ fn is_windows_source_path(path: &str) -> bool {
        || path.starts_with(r"\\")
 }

-fn java_source_path(path: &str) -> PathBuf {
+fn windows_source_path(path: &str) -> PathBuf {
    if is_windows_source_path(path) { PathBuf::from(path.replace('/', r"\")) } else { PathBuf::from(path) }
 }

@@ -698,6 +698,37 @@ async fn js_debug_launch_gets_port_and_workspace_folder() {
    assert_eq!(launch["type"], "pwa-node");
 }

+/// CodeLLDB treats console input as LLDB commands unless told otherwise: Evaluate Expression
+/// and the Debug Console send expressions, so its console evaluates them. A launch
+/// configuration that picks a console mode keeps it.
+#[tokio::test]
+async fn codelldb_console_evaluates_expressions() {
+    let launch_with = |extra: Value| async move {
+        let h = harness(Script::default());
+        let config = LaunchConfig {
+            name: "demo".into(),
+            adapter: "codelldb".into(),
+            request: "launch".into(),
+            program: Some("/p/target/debug/demo".into()),
+            args: vec![],
+            cwd: Some("/p".into()),
+            env: BTreeMap::new(),
+            extra_json: Some(extra.to_string()),
+        };
+        h.start(config).await.unwrap();
+        h.request("launch")["arguments"].clone()
+    };
+    let launch = launch_with(json!({})).await;
+    assert_eq!(launch["_adapterSettings"]["consoleMode"], "evaluate");
+    assert_eq!(launch["sourceLanguages"], json!(["rust"]));
+
+    let launch =
+        launch_with(json!({"_adapterSettings": {"consoleMode": "commands", "showDisassembly": "never"}})).await;
+    assert_eq!(launch["_adapterSettings"], json!({"consoleMode": "commands", "showDisassembly": "never"}));
+    let launch = launch_with(json!({"_adapterSettings": {"showDisassembly": "never"}})).await;
+    assert_eq!(launch["_adapterSettings"], json!({"consoleMode": "evaluate", "showDisassembly": "never"}));
+}
+
 /// An adapter that is already listening (java-debug inside jdtls): the client
 /// connects over TCP to the `debugServer` port instead of spawning anything.
 #[tokio::test]
@@ -923,6 +954,7 @@ fn godot_registry(port: u16, command: &str, args: &[&str]) -> Arc<LanguageRegist
        ui_mode: None,
        framework_ui_modes: Vec::new(),
        formatter: None,
+        scratch_template: None,
        tree_sitter: None,
        language_servers: vec![],
        debugger: Some(ide_language::DebuggerConfig {
@@ -1109,6 +1141,23 @@ async fn kotlin_official_release_ten_no_delay_runs() {
    }
 }

+#[cfg(windows)]
+#[tokio::test]
+async fn netcoredbg_windows_source_paths_round_trip() {
+    let client = "D:/work/LoginController.cs";
+    let native = r"D:\work\LoginController.cs";
+    let h = harness(Script { source_path: Some(native.into()), ..Script::default() });
+    let path = PathBuf::from(client);
+    h.manager.set_breakpoints(path.clone(), vec![bp(25)]).await.unwrap();
+    let mut cfg = config();
+    cfg.adapter = "netcoredbg".into();
+    let id = h.start(cfg).await.unwrap();
+    assert_eq!(h.request("setBreakpoints")["arguments"]["source"]["path"], native);
+    let frames = h.manager.stack_trace(id, 1).await.unwrap();
+    assert_eq!(frames[0].path.as_deref(), Some(path.as_path()));
+    h.manager.stop(id).await.unwrap();
+}
+
 #[tokio::test]
 async fn java_windows_source_paths_for_launch_and_attach() {
    for request in ["launch", "attach"] {
@@ -1220,3 +1269,19 @@ async fn a_plugin_language_runs_its_debug_adapter_from_the_approved_program() {
    assert_eq!(err.kind, ide_core::error::ErrorKind::PermissionDenied, "{}", err.message);
    let _ = std::fs::remove_dir_all(&dir);
 }
+
+#[test]
+fn flutter_projects_are_found_from_the_program_or_the_working_directory() {
+    let root = std::env::temp_dir().join(format!("openidea-flutter-{}", std::process::id()));
+    let app = root.join("app");
+    let tool = root.join("tool");
+    std::fs::create_dir_all(app.join("lib")).unwrap();
+    std::fs::create_dir_all(tool.join("bin")).unwrap();
+    std::fs::write(app.join("pubspec.yaml"), "name: app\ndependencies:\n  flutter:\n    sdk: flutter\n").unwrap();
+    std::fs::write(tool.join("pubspec.yaml"), "name: tool\ndependencies:\n  args: ^2.0.0\n").unwrap();
+    assert!(is_flutter_project(&app, None));
+    assert!(is_flutter_project(&root, Some(&app.join("lib/main.dart"))));
+    assert!(!is_flutter_project(&tool, Some(&tool.join("bin/main.dart"))));
+    assert!(!is_flutter_project(&root, None));
+    std::fs::remove_dir_all(&root).unwrap();
+}
@@ -8,7 +8,7 @@ license.workspace = true
 [dependencies]
 ide-core.workspace = true
 serde.workspace = true
-serde_json.workspace = true
+serde_json = { workspace = true, features = ["raw_value"] }
 specta.workspace = true
 toml.workspace = true
 tokio.workspace = true
@@ -21,7 +21,12 @@ bb8.workspace = true
 tokio-util = { workspace = true, features = ["compat"] }
 dirs.workspace = true
 ide-ssh.workspace = true
+ide-http.workspace = true
+reqwest = { workspace = true, features = ["query"] }
+rustls.workspace = true
+uuid.workspace = true

 [dev-dependencies]
 tokio = { workspace = true, features = ["rt-multi-thread", "macros"] }
 tempfile.workspace = true
+ide-ssh = { workspace = true, features = ["testing"] }
@@ -0,0 +1,889 @@
+use crate::conn::{QueryResult, ResultColumn, Setup};
+use crate::source::{DataSource, DbSslMode, DbTxMode};
+use ide_core::{CancellationToken, IdeError, IdeResult, error::ErrorKind};
+use parking_lot::RwLock;
+use reqwest::{Client, RequestBuilder, StatusCode, Url};
+use std::sync::Arc;
+use std::time::{Duration, Instant};
+use tokio::sync::Mutex;
+
+#[derive(Clone)]
+pub struct ClickhousePool(Arc<State>);
+
+struct State {
+    client: RwLock<Option<Client>>,
+    endpoint: Url,
+    user: String,
+    password: String,
+    database: String,
+    settings: Vec<(String, String)>,
+    read_only: bool,
+    session_id: String,
+    session: Mutex<bool>,
+    closed: CancellationToken,
+}
+
+/// The response format: a names line, a types line, then one JSON array per row, so rows past
+/// the grid's limit are skipped without being parsed.
+const FORMAT: &str = "JSONCompactEachRowWithNamesAndTypes";
+
+pub(crate) fn transaction_error() -> IdeError {
+    IdeError::invalid("ClickHouse HTTP does not support SQL transactions; use auto-commit and run writes directly")
+}
+
+impl ClickhousePool {
+    pub(crate) async fn connect(source: &DataSource, password: Option<&str>, setup: Setup) -> IdeResult<Self> {
+        if source.options.transaction == DbTxMode::Manual {
+            return Err(transaction_error());
+        }
+        for (name, _) in &setup.params {
+            if reserved_setting(name) {
+                return Err(IdeError::invalid(format!("ClickHouse HTTP manages the {name} setting")));
+            }
+        }
+        let secure = matches!(source.ssl, DbSslMode::Require | DbSslMode::VerifyCa | DbSslMode::VerifyFull);
+        let tls_files = [&source.ssl_ca_file, &source.ssl_cert_file, &source.ssl_key_file];
+        if !secure && tls_files.iter().any(|p| !p.trim().is_empty()) {
+            return Err(IdeError::invalid(
+                "ClickHouse TLS certificate files require an SSL mode of Require, Verify CA, or Verify Full",
+            ));
+        }
+        let host = source.host.trim();
+        if host.is_empty() || host.contains(['/', '@', '?', '#']) {
+            return Err(IdeError::invalid("ClickHouse host must contain only a hostname or IP address"));
+        }
+        let host = if host.contains(':') && !host.starts_with('[') { format!("[{host}]") } else { host.to_owned() };
+        let scheme = if secure { "https" } else { "http" };
+        let port = source.port.unwrap_or(if secure { 8443 } else { 8123 });
+        let endpoint = Url::parse(&format!("{scheme}://{host}:{port}/"))
+            .map_err(|_| IdeError::invalid("invalid ClickHouse HTTP host or port"))?;
+        let timeout = setup.connect_timeout.unwrap_or(Duration::from_secs(30));
+        let _ = rustls::crypto::ring::default_provider().install_default();
+        let mut builder = Client::builder()
+            .connect_timeout(timeout)
+            .pool_max_idle_per_host(4)
+            .redirect(reqwest::redirect::Policy::none())
+            .user_agent(concat!("OpenIDEA/", env!("CARGO_PKG_VERSION")));
+        let ca = source.ssl_ca_file.trim();
+        if !ca.is_empty() {
+            let pem = read_pem(ca, "CA certificate")?;
+            let certificates = reqwest::Certificate::from_pem_bundle(&pem)
+                .map_err(|_| IdeError::invalid("invalid ClickHouse CA certificate PEM"))?;
+            if certificates.is_empty() {
+                return Err(IdeError::invalid("ClickHouse CA certificate PEM contains no certificates"));
+            }
+            builder = builder.tls_certs_only(certificates);
+        }
+        if source.ssl == DbSslMode::VerifyCa {
+            if ca.is_empty() {
+                return Err(IdeError::invalid("ClickHouse Verify CA requires a CA certificate file"));
+            }
+            builder = builder.tls_danger_accept_invalid_hostnames(true);
+        }
+        let cert = source.ssl_cert_file.trim();
+        let key = source.ssl_key_file.trim();
+        if cert.is_empty() != key.is_empty() {
+            return Err(IdeError::invalid("ClickHouse client TLS requires both certificate and key files"));
+        }
+        if !cert.is_empty() {
+            let mut pem = read_pem(cert, "client certificate")?;
+            pem.push(b'\n');
+            pem.extend(read_pem(key, "client key")?);
+            let identity = reqwest::Identity::from_pem(&pem)
+                .map_err(|_| IdeError::invalid("invalid ClickHouse client certificate or key PEM"))?;
+            builder = builder.identity(identity);
+        }
+        let proxy = ide_core::proxy_settings::proxy();
+        let client = ide_http::client::with_proxy(builder, &proxy).build().map_err(http_error)?;
+        let database = if source.options.default_schema.trim().is_empty() {
+            source.database.trim()
+        } else {
+            source.options.default_schema.trim()
+        };
+        let pool = Self(Arc::new(State {
+            client: RwLock::new(Some(client)),
+            endpoint,
+            user: if source.user.is_empty() { "default".into() } else { source.user.clone() },
+            password: password.unwrap_or_default().to_owned(),
+            database: if database.is_empty() { "default".into() } else { database.into() },
+            settings: setup.params,
+            read_only: source.read_only,
+            session_id: uuid::Uuid::new_v4().to_string(),
+            session: Mutex::new(false),
+            closed: CancellationToken::new(),
+        }));
+        let cancel = CancellationToken::new();
+        let initialize = async {
+            pool.execute("SELECT 1", 1, &cancel).await?;
+            for sql in setup.statements {
+                pool.execute(&sql, 0, &cancel).await?;
+            }
+            Ok(pool.clone())
+        };
+        tokio::pin!(initialize);
+        tokio::select! {
+            result = &mut initialize => {
+                if result.is_err() {
+                    pool.close();
+                }
+                result
+            },
+            () = tokio::time::sleep(timeout) => {
+                cancel.cancel();
+                let _ = initialize.await;
+                pool.close();
+                Err(IdeError::new(ErrorKind::TimedOut, "timed out connecting to ClickHouse HTTP"))
+            }
+        }
+    }
+
+    pub fn close(&self) {
+        self.0.closed.cancel();
+        self.0.client.write().take();
+    }
+
+    pub fn is_closed(&self) -> bool {
+        self.0.closed.is_cancelled()
+    }
+
+    fn client(&self) -> IdeResult<Client> {
+        self.0.client.read().clone().ok_or_else(|| IdeError::new(ErrorKind::Io, "ClickHouse connection is closed"))
+    }
+
+    /// `max_rows`: the rows the server may send (the skipped ones included).
+    fn request(&self, client: &Client, query_id: &str, max_rows: usize, initialized: bool) -> RequestBuilder {
+        let mut request = client
+            .post(self.0.endpoint.clone())
+            .basic_auth(&self.0.user, Some(&self.0.password))
+            .header(reqwest::header::CONTENT_TYPE, "text/plain; charset=utf-8")
+            .query(&self.0.settings)
+            .query(&[
+                ("session_id", self.0.session_id.clone()),
+                ("session_timeout", "3600".into()),
+                ("query_id", query_id.to_owned()),
+                ("default_format", FORMAT.into()),
+                ("output_format_json_quote_denormals", "1".into()),
+                ("max_result_rows", max_rows.saturating_add(1).to_string()),
+                ("result_overflow_mode", "break".into()),
+            ]);
+        if initialized {
+            request = request.query(&[("session_check", "1")]);
+        } else {
+            request = request.query(&[("database", &self.0.database)]);
+        }
+        if self.0.read_only {
+            request = request.query(&[("readonly", "1")]);
+        }
+        request
+    }
+
+    pub async fn execute(&self, sql: &str, max_rows: usize, cancel: &CancellationToken) -> IdeResult<QueryResult> {
+        self.execute_from(sql, 0, max_rows, cancel).await
+    }
+
+    /// [`execute`](Self::execute), reading past the first `skip` rows without parsing or keeping them.
+    pub async fn execute_from(
+        &self,
+        sql: &str,
+        skip: usize,
+        max_rows: usize,
+        cancel: &CancellationToken,
+    ) -> IdeResult<QueryResult> {
+        if transaction_statement(sql) {
+            return Err(transaction_error());
+        }
+        let mut session = tokio::select! {
+            biased;
+            () = cancel.cancelled() => return Err(IdeError::cancelled()),
+            () = self.0.closed.cancelled() => return Err(IdeError::new(ErrorKind::Io, "ClickHouse connection is closed")),
+            session = self.0.session.lock() => session,
+        };
+        let client = self.client()?;
+        let query_id = uuid::Uuid::new_v4().to_string();
+        let request = self.request(&client, &query_id, skip.saturating_add(max_rows), *session).body(sql.to_owned());
+        let started = Instant::now();
+        let fetch = async {
+            let mut response = request.send().await.map_err(http_error)?;
+            let execution_ms = started.elapsed().as_secs_f64() * 1000.0;
+            let status = response.status();
+            let header = |name: &str| response.headers().get(name).and_then(|v| v.to_str().ok()).map(str::to_owned);
+            let exception_code = header("X-ClickHouse-Exception-Code");
+            let format = header("X-ClickHouse-Format");
+            let affected = header("X-ClickHouse-Summary")
+                .and_then(|v| serde_json::from_str::<serde_json::Value>(&v).ok())
+                .and_then(|v| {
+                    v.get("written_rows")
+                        .and_then(|n| n.as_str().and_then(|n| n.parse::<u64>().ok()).or_else(|| n.as_u64()))
+                });
+            if !status.is_success() || exception_code.as_deref().is_some_and(|code| code != "0") {
+                let body = response.bytes().await.map_err(http_error)?;
+                return Err(self.server_error(status, exception_code.as_deref(), &body));
+            }
+            let (columns, rows, has_more) = if format.as_deref().is_some_and(|f| f != FORMAT) {
+                let body = response.bytes().await.map_err(http_error)?;
+                if !body.iter().all(u8::is_ascii_whitespace) {
+                    return Err(IdeError::invalid(
+                        "ClickHouse result grids need the default output format; remove the query's FORMAT clause",
+                    ));
+                }
+                (Vec::new(), Vec::new(), false)
+            } else {
+                let mut reader = RowReader::new(skip, max_rows);
+                while let Some(chunk) = response.chunk().await.map_err(http_error)? {
+                    reader.push(&chunk)?;
+                }
+                reader.finish().map_err(|error| self.redact_error(error))?
+            };
+            let affected = if columns.is_empty() { affected.map(|n| n as f64) } else { None };
+            Ok(QueryResult {
+                statement: sql.to_owned(),
+                columns,
+                rows,
+                affected,
+                has_more,
+                elapsed_ms: started.elapsed().as_secs_f64() * 1000.0,
+                execution_ms,
+            })
+        };
+        let result = tokio::select! {
+            biased;
+            () = cancel.cancelled() => None,
+            () = self.0.closed.cancelled() => None,
+            result = fetch => Some(result),
+        };
+        match result {
+            Some(result) => {
+                if result.is_ok() {
+                    *session = true;
+                }
+                result
+            }
+            None => {
+                let killed = self.kill(&client, &query_id).await;
+                match killed {
+                    Ok(()) => Err(IdeError::cancelled()),
+                    Err(error) => Err(IdeError::new(
+                        ErrorKind::Cancelled,
+                        format!("cancelled locally; ClickHouse server cancellation failed: {}", error.message),
+                    )),
+                }
+            }
+        }
+    }
+
+    async fn kill(&self, client: &Client, query_id: &str) -> IdeResult<()> {
+        let response = client
+            .post(self.0.endpoint.clone())
+            .basic_auth(&self.0.user, Some(&self.0.password))
+            .timeout(Duration::from_secs(3))
+            .body(format!("KILL QUERY WHERE query_id = '{query_id}' SYNC"))
+            .send()
+            .await
+            .map_err(http_error)?;
+        let status = response.status();
+        let code = response
+            .headers()
+            .get("X-ClickHouse-Exception-Code")
+            .and_then(|value| value.to_str().ok())
+            .map(str::to_owned);
+        let body = response.bytes().await.map_err(http_error)?;
+        if status.is_success() && !code.as_deref().is_some_and(|code| code != "0") && !body.starts_with(b"Code:") {
+            Ok(())
+        } else {
+            Err(self.server_error(status, code.as_deref(), &body))
+        }
+    }
+
+    fn redact_error(&self, mut error: IdeError) -> IdeError {
+        if !self.0.password.is_empty() {
+            error.message = error.message.replace(&self.0.password, "[redacted]");
+        }
+        error
+    }
+
+    fn server_error(&self, status: StatusCode, code: Option<&str>, body: &[u8]) -> IdeError {
+        let message = String::from_utf8_lossy(body);
+        let message: String = exception_text(&message).chars().take(16_384).collect();
+        let auth = matches!(status, StatusCode::UNAUTHORIZED | StatusCode::FORBIDDEN)
+            || matches!(code, Some("193" | "194" | "195" | "516" | "497"));
+        let detail = if message.is_empty() { status.canonical_reason().unwrap_or("request failed") } else { &message };
+        let detail = if detail.contains("SESSION_NOT_FOUND") || detail.contains("Session not found") {
+            "ClickHouse HTTP session expired; reconnect to restore session settings"
+        } else {
+            detail
+        };
+        self.redact_error(IdeError::new(
+            if auth { ErrorKind::PermissionDenied } else { ErrorKind::InvalidInput },
+            format!("ClickHouse HTTP {}: {detail}", status.as_u16()),
+        ))
+    }
+}
+
+type DecodedResult = (Vec<ResultColumn>, Vec<Vec<Option<String>>>, bool);
+
+/// Decodes a streamed [`FORMAT`] body. Reads past the first `skip` rows unparsed (a later
+/// page), then keeps `max_rows` rows; later rows only set `has_more` and are read past
+/// unparsed, so a grid limit bounds memory however large the block
+/// `result_overflow_mode=break` lets the server send. A line that is not a JSON array
+/// starts the exception ClickHouse writes when a query fails mid-stream.
+struct RowReader {
+    skip: usize,
+    max_rows: usize,
+    pending: Vec<u8>,
+    names: Option<Vec<String>>,
+    types: Option<Vec<String>>,
+    rows: Vec<Vec<Option<String>>>,
+    more: bool,
+    exception: Option<String>,
+}
+
+impl RowReader {
+    fn new(skip: usize, max_rows: usize) -> Self {
+        Self {
+            skip,
+            max_rows,
+            pending: Vec::new(),
+            names: None,
+            types: None,
+            rows: Vec::new(),
+            more: false,
+            exception: None,
+        }
+    }
+
+    fn push(&mut self, chunk: &[u8]) -> IdeResult<()> {
+        self.pending.extend_from_slice(chunk);
+        let buffer = std::mem::take(&mut self.pending);
+        let mut start = 0;
+        while let Some(end) = buffer[start..].iter().position(|&b| b == b'\n') {
+            self.line(&buffer[start..start + end])?;
+            start += end + 1;
+        }
+        self.pending = buffer[start..].to_vec();
+        Ok(())
+    }
+
+    fn line(&mut self, line: &[u8]) -> IdeResult<()> {
+        if let Some(exception) = &mut self.exception {
+            if exception.len() < 16_384 {
+                exception.push_str(&String::from_utf8_lossy(line));
+                exception.push('\n');
+            }
+            return Ok(());
+        }
+        let text = line.trim_ascii();
+        if text.is_empty() {
+            return Ok(());
+        }
+        if text[0] != b'[' {
+            self.exception = Some(format!("{}\n", String::from_utf8_lossy(line)));
+            return Ok(());
+        }
+        if self.names.is_some() && self.types.is_some() {
+            if self.skip > 0 {
+                self.skip -= 1;
+                return Ok(());
+            }
+            if self.rows.len() >= self.max_rows {
+                self.more = true;
+                return Ok(());
+            }
+        }
+        let Ok(values) = serde_json::from_slice::<Vec<Box<serde_json::value::RawValue>>>(text) else {
+            self.exception = Some(format!("{}\n", String::from_utf8_lossy(line)));
+            return Ok(());
+        };
+        let protocol = |message: String| IdeError::new(ErrorKind::Protocol, message);
+        let header = |values: Vec<Box<serde_json::value::RawValue>>| {
+            values
+                .iter()
+                .map(|v| serde_json::from_str::<String>(v.get()))
+                .collect::<Result<Vec<_>, _>>()
+                .map_err(|e| protocol(format!("invalid ClickHouse result header: {e}")))
+        };
+        let Some(names) = &self.names else {
+            self.names = Some(header(values)?);
+            return Ok(());
+        };
+        if self.types.is_none() {
+            self.types = Some(header(values)?);
+            return Ok(());
+        }
+        if values.len() != names.len() {
+            return Err(protocol("ClickHouse result row width does not match its metadata".into()));
+        }
+        let row = values
+            .into_iter()
+            .map(|value| {
+                let text = value.get();
+                if text == "null" {
+                    Ok(None)
+                } else if text.starts_with('"') {
+                    serde_json::from_str::<String>(text).map(Some).map_err(|e| protocol(e.to_string()))
+                } else {
+                    Ok(Some(text.to_owned()))
+                }
+            })
+            .collect::<IdeResult<_>>()?;
+        self.rows.push(row);
+        Ok(())
+    }
+
+    fn finish(mut self) -> IdeResult<DecodedResult> {
+        let rest = std::mem::take(&mut self.pending);
+        self.line(&rest)?;
+        if let Some(exception) = self.exception {
+            return Err(IdeError::invalid(format!("ClickHouse: {}", exception_text(&exception))));
+        }
+        let Some(names) = self.names else { return Ok((Vec::new(), Vec::new(), false)) };
+        let types = self.types.unwrap_or_default();
+        if types.len() != names.len() {
+            return Err(IdeError::new(ErrorKind::Protocol, "ClickHouse result types do not match its columns"));
+        }
+        let columns = names.into_iter().zip(types).map(|(name, type_name)| ResultColumn { name, type_name }).collect();
+        Ok((columns, self.rows, self.more))
+    }
+}
+
+/// The server's message in a failed response: rows already streamed and the
+/// `__exception__` block markers ClickHouse wraps a mid-stream error in are dropped.
+fn exception_text(body: &str) -> &str {
+    let Some(at) = body.find("Code:") else { return body.trim() };
+    let text = &body[at..];
+    match text.find("\n__exception__") {
+        // The line before the closing marker is `<length> <tag>`.
+        Some(end) => text[..end].trim_end().rsplit_once('\n').map_or(text[..end].trim(), |(message, _)| message.trim()),
+        None => text.trim(),
+    }
+}
+
+fn http_error(error: reqwest::Error) -> IdeError {
+    use std::error::Error;
+    let kind = if error.is_timeout() { ErrorKind::TimedOut } else { ErrorKind::Io };
+    let error = error.without_url();
+    let mut message = error.to_string();
+    let mut source = error.source();
+    while let Some(error) = source {
+        let detail = error.to_string();
+        if !message.contains(&detail) {
+            message.push_str(": ");
+            message.push_str(&detail);
+        }
+        source = error.source();
+    }
+    IdeError::new(kind, format!("ClickHouse HTTP: {message}"))
+}
+
+fn read_pem(path: &str, label: &str) -> IdeResult<Vec<u8>> {
+    std::fs::read(ide_ssh::expand(path))
+        .map_err(|error| IdeError::new(ErrorKind::Io, format!("cannot read ClickHouse {label}: {error}")))
+}
+
+fn reserved_setting(name: &str) -> bool {
+    let name = name.to_ascii_lowercase();
+    name.starts_with("output_format_json_")
+        || matches!(
+            name.as_str(),
+            "user"
+                | "password"
+                | "query"
+                | "database"
+                | "session_id"
+                | "session_check"
+                | "session_timeout"
+                | "query_id"
+                | "default_format"
+                | "max_result_rows"
+                | "result_overflow_mode"
+                | "readonly"
+        )
+}
+
+fn transaction_statement(sql: &str) -> bool {
+    let mut sql = sql.trim_start();
+    loop {
+        if let Some(rest) = sql.strip_prefix("--").or_else(|| sql.strip_prefix('#')) {
+            sql = rest.split_once('\n').map_or("", |(_, rest)| rest).trim_start();
+        } else if let Some(rest) = sql.strip_prefix("/*") {
+            sql = rest.split_once("*/").map_or("", |(_, rest)| rest).trim_start();
+        } else {
+            break;
+        }
+    }
+    let mut words = sql.split(|c: char| !c.is_ascii_alphanumeric() && c != '_').filter(|s| !s.is_empty());
+    let first = words.next().unwrap_or_default();
+    ["BEGIN", "COMMIT", "ROLLBACK", "SAVEPOINT", "RELEASE"].iter().any(|s| first.eq_ignore_ascii_case(s))
+        || (first.eq_ignore_ascii_case("START") && words.next().is_some_and(|s| s.eq_ignore_ascii_case("TRANSACTION")))
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+    use crate::conn::Pool;
+    use crate::source::{DbDriver, DbOptions, DbProperty};
+    use tokio::io::{AsyncReadExt, AsyncWriteExt};
+
+    const ONE: &str = "[\"1\"]\n[\"UInt8\"]\n[1]\n";
+
+    async fn read_request(stream: &mut tokio::net::TcpStream) -> String {
+        let mut bytes = Vec::new();
+        let mut buffer = [0; 4096];
+        loop {
+            let count = tokio::time::timeout(Duration::from_secs(5), stream.read(&mut buffer)).await.unwrap().unwrap();
+            assert!(count > 0, "request ended early");
+            bytes.extend_from_slice(&buffer[..count]);
+            if let Some(end) = bytes.windows(4).position(|s| s == b"\r\n\r\n") {
+                let header = String::from_utf8_lossy(&bytes[..end]);
+                let length: usize = header
+                    .lines()
+                    .find_map(|line| {
+                        line.to_ascii_lowercase().strip_prefix("content-length:").map(|v| v.trim().parse().unwrap())
+                    })
+                    .unwrap_or(0);
+                if bytes.len() >= end + 4 + length {
+                    return String::from_utf8(bytes).unwrap();
+                }
+            }
+        }
+    }
+
+    async fn reply(stream: &mut tokio::net::TcpStream, status: &str, headers: &str, body: &str) {
+        let response =
+            format!("HTTP/1.1 {status}\r\nContent-Length: {}\r\nConnection: close\r\n{headers}\r\n{body}", body.len());
+        stream.write_all(response.as_bytes()).await.unwrap();
+    }
+
+    async fn server(
+        responses: Vec<(&'static str, &'static str, &'static str)>,
+    ) -> (u16, tokio::task::JoinHandle<Vec<String>>) {
+        let listener = tokio::net::TcpListener::bind("127.0.0.1:0").await.unwrap();
+        let port = listener.local_addr().unwrap().port();
+        let task = tokio::spawn(async move {
+            let mut requests = Vec::new();
+            for (status, headers, body) in responses {
+                let (mut stream, _) =
+                    tokio::time::timeout(Duration::from_secs(5), listener.accept()).await.unwrap().unwrap();
+                requests.push(read_request(&mut stream).await);
+                reply(&mut stream, status, headers, body).await;
+            }
+            requests
+        });
+        (port, task)
+    }
+
+    fn source(port: u16) -> DataSource {
+        DataSource { driver: DbDriver::Clickhouse, host: "127.0.0.1".into(), port: Some(port), ..Default::default() }
+    }
+
+    fn decode(body: &[u8], max_rows: usize, chunk: usize) -> IdeResult<DecodedResult> {
+        decode_from(body, 0, max_rows, chunk)
+    }
+
+    fn decode_from(body: &[u8], skip: usize, max_rows: usize, chunk: usize) -> IdeResult<DecodedResult> {
+        let mut reader = RowReader::new(skip, max_rows);
+        for part in body.chunks(chunk) {
+            reader.push(part)?;
+        }
+        reader.finish()
+    }
+
+    #[test]
+    fn rows_preserve_precision_nulls_and_strings_across_chunks() {
+        let body = concat!(
+            r#"["n", "d", "v", "v", "v"]"#,
+            "\n",
+            r#"["UInt64", "Decimal(38, 9)", "Nullable(String)", "Nullable(String)", "Nullable(String)"]"#,
+            "\n",
+            r#"[18446744073709551615, 12345678901234567890.123456789, null, "null", "ᴺᵁᴸᴸ"]"#,
+        );
+        for chunk in [1, 7, body.len()] {
+            let (columns, rows, more) = decode(body.as_bytes(), 1, chunk).unwrap();
+            assert_eq!(columns.len(), 5);
+            assert_eq!(columns[1].type_name, "Decimal(38, 9)");
+            assert_eq!(
+                rows[0],
+                vec![
+                    Some("18446744073709551615".into()),
+                    Some("12345678901234567890.123456789".into()),
+                    None,
+                    Some("null".into()),
+                    Some("ᴺᵁᴸᴸ".into()),
+                ]
+            );
+            assert!(!more);
+        }
+        let (columns, rows, more) = decode(b"[\"x\"]\n[\"String\"]\n", 0, 64).unwrap();
+        assert_eq!(columns[0].name, "x");
+        assert!(rows.is_empty() && !more);
+        assert_eq!(decode(b"", 5, 64).unwrap().0.len(), 0);
+        assert!(decode(b"[\"x\"]\n[\"UInt8\"]\n[1, 2]\n", 1, 64).is_err());
+    }
+
+    #[test]
+    fn a_later_page_skips_rows_without_keeping_them() {
+        let body = b"[\"n\"]\n[\"UInt8\"]\n[1]\n[2]\n[3]\n[4]\n[5]\n";
+        let page = |skip, max| {
+            let (_, rows, more) = decode_from(body, skip, max, 3).unwrap();
+            (rows.into_iter().map(|r| r[0].clone().unwrap()).collect::<Vec<_>>(), more)
+        };
+        assert_eq!(page(2, 2), (vec!["3".to_owned(), "4".to_owned()], true));
+        assert_eq!(page(4, 2), (vec!["5".to_owned()], false));
+        assert_eq!(page(9, 2), (Vec::<String>::new(), false));
+    }
+
+    #[test]
+    fn rows_past_the_limit_are_skipped_but_a_later_exception_still_fails() {
+        let mut body = String::from("[\"n\"]\n[\"UInt64\"]\n");
+        for n in 0..1000 {
+            body.push_str(&format!("[{n}]\n"));
+        }
+        let (_, rows, more) = decode(body.as_bytes(), 2, 4096).unwrap();
+        assert_eq!(rows, vec![vec![Some("0".into())], vec![Some("1".into())]]);
+        assert!(more);
+        body.push_str("\n__exception__\nabcdefgh\nCode: 395. DB::Exception: Value passed to 'throwIf' is non-zero\n");
+        body.push_str("62 abcdefgh\n__exception__\n");
+        let error = decode(body.as_bytes(), 2, 4096).unwrap_err();
+        assert_eq!(error.message, "ClickHouse: Code: 395. DB::Exception: Value passed to 'throwIf' is non-zero");
+        let multiline = "Code: 62. DB::Exception: Syntax error\nat line 2";
+        assert_eq!(exception_text(multiline), multiline);
+    }
+
+    #[tokio::test]
+    async fn http_requests_use_auth_settings_limits_and_a_shared_session() {
+        let (port, requests) = server(vec![
+            ("200 OK", "X-ClickHouse-Format: JSONCompactEachRowWithNamesAndTypes\r\n", ONE),
+            ("200 OK", "", ""),
+            (
+                "200 OK",
+                "X-ClickHouse-Format: JSONCompactEachRowWithNamesAndTypes\r\n",
+                "[\"n\"]\n[\"UInt64\"]\n[\"1\"]\n[\"2\"]\n[\"3\"]\n",
+            ),
+        ])
+        .await;
+        let source = DataSource {
+            user: "reader".into(),
+            read_only: true,
+            options: DbOptions { default_schema: "analytics".into(), time_zone: "UTC".into(), ..Default::default() },
+            properties: vec![DbProperty { name: "max_threads".into(), value: "2".into() }],
+            ..source(port)
+        };
+        let pool = Pool::connect(&source, Some("mock-password"), None).await.unwrap();
+        pool.execute("USE other", 0, &CancellationToken::new()).await.unwrap();
+        let result = pool.execute("SELECT number FROM numbers(3)", 1, &CancellationToken::new()).await.unwrap();
+        assert_eq!(result.rows, vec![vec![Some("1".into())]]);
+        assert!(result.has_more && result.affected.is_none());
+        let requests = requests.await.unwrap();
+        let target = |request: &String| {
+            Url::parse(&format!(
+                "http://localhost{}",
+                request.lines().next().unwrap().split_whitespace().nth(1).unwrap()
+            ))
+            .unwrap()
+        };
+        let urls: Vec<_> = requests.iter().map(target).collect();
+        let value = |url: &Url, key: &str| url.query_pairs().find(|(k, _)| k == key).map(|(_, v)| v.into_owned());
+        assert_eq!(value(&urls[0], "database").as_deref(), Some("analytics"));
+        assert_eq!(value(&urls[1], "database"), None);
+        assert_eq!(value(&urls[1], "session_check").as_deref(), Some("1"));
+        assert_eq!(value(&urls[0], "session_id"), value(&urls[2], "session_id"));
+        assert_ne!(value(&urls[0], "query_id"), value(&urls[2], "query_id"));
+        assert_eq!(value(&urls[2], "max_result_rows").as_deref(), Some("2"));
+        for (request, url) in requests.iter().zip(&urls) {
+            assert!(request.starts_with("POST /?"));
+            assert!(request.contains("Basic cmVhZGVyOm1vY2stcGFzc3dvcmQ="));
+            assert!(!url.as_str().contains("reader") && !url.as_str().contains("mock-password"));
+            assert_eq!(value(url, "readonly").as_deref(), Some("1"));
+            assert_eq!(value(url, "session_timezone").as_deref(), Some("UTC"));
+            assert_eq!(value(url, "max_threads").as_deref(), Some("2"));
+        }
+        assert!(requests[0].ends_with("SELECT 1"));
+        assert!(pool.transaction(&[]).await.is_err());
+        let cancel = CancellationToken::new();
+        cancel.cancel();
+        assert_eq!(pool.execute("SELECT 1", 1, &cancel).await.unwrap_err().kind, ErrorKind::Cancelled);
+        pool.close().await;
+        assert!(pool.is_closed());
+        assert!(pool.execute("SELECT 1", 1, &CancellationToken::new()).await.is_err());
+    }
+
+    #[tokio::test]
+    async fn sequential_queries_reuse_the_http_connection() {
+        let listener = tokio::net::TcpListener::bind("127.0.0.1:0").await.unwrap();
+        let port = listener.local_addr().unwrap().port();
+        let task = tokio::spawn(async move {
+            let (mut stream, _) = listener.accept().await.unwrap();
+            for _ in 0..2 {
+                read_request(&mut stream).await;
+                let response = format!("HTTP/1.1 200 OK\r\nContent-Length: {}\r\n\r\n{ONE}", ONE.len());
+                stream.write_all(response.as_bytes()).await.unwrap();
+            }
+        });
+        let pool = Pool::connect(&source(port), None, None).await.unwrap();
+        assert_eq!(
+            pool.execute("SELECT 1", 1, &CancellationToken::new()).await.unwrap().rows,
+            vec![vec![Some("1".into())]]
+        );
+        task.await.unwrap();
+    }
+
+    #[tokio::test]
+    async fn server_errors_keep_details_and_hide_passwords() {
+        let (port, requests) = server(vec![(
+            "403 Forbidden",
+            "X-ClickHouse-Exception-Code: 516\r\n",
+            "Code: 516. DB::Exception: bad mock-password",
+        )])
+        .await;
+        let error = match Pool::connect(&source(port), Some("mock-password"), None).await {
+            Ok(_) => panic!("expected login failure"),
+            Err(error) => error,
+        };
+        assert_eq!(error.kind, ErrorKind::PermissionDenied);
+        assert!(error.message.contains("516") && error.message.contains("[redacted]"));
+        assert!(!error.message.contains("mock-password"));
+        requests.await.unwrap();
+        let (port, requests) = server(vec![("200 OK", "", "Code: 241. DB::Exception: memory limit")]).await;
+        let error = match Pool::connect(&source(port), None, None).await {
+            Ok(_) => panic!("expected late query failure"),
+            Err(error) => error,
+        };
+        assert!(error.message.contains("memory limit"));
+        requests.await.unwrap();
+        let (port, requests) = server(vec![(
+            "500 Internal Server Error",
+            "X-ClickHouse-Exception-Code: 395\r\n",
+            "[\"1\"]\n[\"UInt8\"]\n[1]\n\n__exception__\ntag\nCode: 395. DB::Exception: thrown\n32 tag\n__exception__\n",
+        )])
+        .await;
+        let error = match Pool::connect(&source(port), None, None).await {
+            Ok(_) => panic!("expected mid-stream failure"),
+            Err(error) => error,
+        };
+        assert_eq!(error.message, "ClickHouse HTTP 500: Code: 395. DB::Exception: thrown");
+        requests.await.unwrap();
+    }
+
+    #[tokio::test]
+    async fn cancellation_sends_kill_outside_the_busy_session() {
+        let listener = tokio::net::TcpListener::bind("127.0.0.1:0").await.unwrap();
+        let port = listener.local_addr().unwrap().port();
+        let (started, received) = tokio::sync::oneshot::channel();
+        let server = tokio::spawn(async move {
+            let (mut health, _) = listener.accept().await.unwrap();
+            read_request(&mut health).await;
+            reply(&mut health, "200 OK", "", ONE).await;
+            drop(health);
+            let (mut query, _) = listener.accept().await.unwrap();
+            let request = read_request(&mut query).await;
+            started.send(()).unwrap();
+            let (mut kill, _) = tokio::time::timeout(Duration::from_secs(5), listener.accept()).await.unwrap().unwrap();
+            let kill_request = read_request(&mut kill).await;
+            reply(&mut kill, "200 OK", "", "").await;
+            (request, kill_request)
+        });
+        let pool = Pool::connect(&source(port), None, None).await.unwrap();
+        let cancel = CancellationToken::new();
+        let query = pool.execute("SELECT sleep(30)", 1, &cancel);
+        let cancelled = async {
+            received.await.unwrap();
+            cancel.cancel();
+        };
+        let (result, ()) = tokio::join!(query, cancelled);
+        assert_eq!(result.unwrap_err().kind, ErrorKind::Cancelled);
+        let (query, kill) = server.await.unwrap();
+        let target = query.lines().next().unwrap().split_whitespace().nth(1).unwrap();
+        let url = Url::parse(&format!("http://localhost{target}")).unwrap();
+        let query_id = url.query_pairs().find(|(k, _)| k == "query_id").unwrap().1.into_owned();
+        assert!(kill.ends_with(&format!("KILL QUERY WHERE query_id = '{query_id}' SYNC")));
+        assert!(!kill.contains("session_id="));
+    }
+
+    #[tokio::test]
+    async fn unsupported_settings_and_transactions_fail_before_connecting() {
+        for statement in ["BEGIN", "-- comment\n COMMIT", "/* comment */ ROLLBACK", "START TRANSACTION", "SAVEPOINT s"]
+        {
+            assert!(transaction_statement(statement));
+        }
+        assert!(!transaction_statement("SELECT 'BEGIN'"));
+        let sources = [
+            DataSource { options: DbOptions { transaction: DbTxMode::Manual, ..Default::default() }, ..source(1) },
+            DataSource {
+                properties: vec![DbProperty { name: "statement_cache_capacity".into(), value: "4".into() }],
+                ..source(1)
+            },
+            DataSource { properties: vec![DbProperty { name: "password".into(), value: "x".into() }], ..source(1) },
+            DataSource { ssl_ca_file: "unused.pem".into(), ..source(1) },
+            DataSource { ssl: DbSslMode::VerifyCa, ..source(1) },
+            DataSource { ssl: DbSslMode::Require, ssl_cert_file: "unused.pem".into(), ..source(1) },
+        ];
+        for source in sources {
+            let error = match Pool::connect(&source, None, None).await {
+                Ok(_) => panic!("unsupported settings were accepted"),
+                Err(error) => error,
+            };
+            assert_eq!(error.kind, ErrorKind::InvalidInput);
+        }
+    }
+
+    #[tokio::test]
+    #[ignore = "requires CLICKHOUSE_TEST_HOST, CLICKHOUSE_TEST_USER, and CLICKHOUSE_TEST_PASSWORD"]
+    async fn clickhouse_cloud_transport() {
+        let source = DataSource {
+            driver: DbDriver::Clickhouse,
+            host: std::env::var("CLICKHOUSE_TEST_HOST").expect("CLICKHOUSE_TEST_HOST"),
+            port: Some(std::env::var("CLICKHOUSE_TEST_PORT").ok().and_then(|v| v.parse().ok()).unwrap_or(8443)),
+            user: std::env::var("CLICKHOUSE_TEST_USER").expect("CLICKHOUSE_TEST_USER"),
+            ssl: DbSslMode::Require,
+            options: DbOptions {
+                time_zone: "UTC".into(),
+                startup_script: "SET max_threads = 2".into(),
+                ..Default::default()
+            },
+            properties: vec![DbProperty { name: "max_block_size".into(), value: "50".into() }],
+            ..Default::default()
+        };
+        let password = std::env::var("CLICKHOUSE_TEST_PASSWORD").expect("CLICKHOUSE_TEST_PASSWORD");
+        let pool = Pool::connect(&source, Some(&password), None).await.unwrap();
+        let cancel = CancellationToken::new();
+        let settings = pool
+            .execute("SELECT getSetting('max_threads'), getSetting('max_block_size'), timezone()", 1, &cancel)
+            .await
+            .unwrap();
+        assert_eq!(settings.rows, vec![vec![Some("2".into()), Some("50".into()), Some("UTC".into())]]);
+        let result = pool.execute("SELECT toUInt64('18446744073709551615') AS n, CAST(NULL AS Nullable(String)) AS missing, CAST('ᴺᵁᴸᴸ' AS Nullable(String)) AS text, 'a\\nb' AS lines", 1, &cancel).await.unwrap();
+        assert_eq!(
+            result.rows,
+            vec![vec![Some("18446744073709551615".into()), None, Some("ᴺᵁᴸᴸ".into()), Some("a\nb".into())]]
+        );
+        assert_eq!(result.columns[1].type_name, "Nullable(String)");
+        let limited = pool.execute("SELECT number FROM numbers(100)", 2, &cancel).await.unwrap();
+        assert_eq!(limited.rows.len(), 2);
+        assert!(limited.has_more);
+        let marker = format!("transport_cancel_{}", uuid::Uuid::new_v4().simple());
+        let sql = format!("SELECT sleepEachRow(0.05) FROM numbers(50) /* {marker} */");
+        let stop = CancellationToken::new();
+        let query = pool.execute(&sql, 1, &stop);
+        let cancel_query = async {
+            tokio::time::sleep(Duration::from_millis(500)).await;
+            stop.cancel();
+        };
+        let (cancelled, ()) = tokio::join!(query, cancel_query);
+        let cancelled = cancelled.unwrap_err();
+        assert_eq!(cancelled.kind, ErrorKind::Cancelled);
+        assert_eq!(cancelled.message, "cancelled");
+        let active = pool.execute(&format!("SELECT count() FROM system.processes WHERE position(query, '{marker}') > 0 AND query_id != currentQueryID()"), 1, &cancel).await.unwrap();
+        assert_eq!(active.rows, vec![vec![Some("0".into())]]);
+        let table = format!("transport_test_{}", uuid::Uuid::new_v4().simple());
+        pool.execute(&format!("CREATE TEMPORARY TABLE {table} (n UInt8)"), 0, &cancel).await.unwrap();
+        let continuity = async {
+            pool.execute(&format!("INSERT INTO {table} VALUES (7)"), 0, &cancel).await?;
+            pool.execute(&format!("SELECT n FROM {table}"), 1, &cancel).await
+        }
+        .await;
+        let cleanup = pool.execute(&format!("DROP TEMPORARY TABLE {table}"), 0, &cancel).await;
+        assert_eq!(continuity.unwrap().rows, vec![vec![Some("7".into())]]);
+        cleanup.unwrap();
+        pool.close().await;
+        assert!(pool.is_closed());
+    }
+}
@@ -106,6 +106,7 @@ pub enum Pool {
    Postgres(PgPool),
    Mysql(MySqlPool),
    SqlServer(Bb8Pool<MssqlConnectionManager>),
+    Clickhouse(crate::clickhouse::ClickhousePool),
 }

 /// Runs `$body` with `$p` bound to the concrete pool of each driver.
@@ -115,7 +116,7 @@ macro_rules! with_pool {
            Pool::Sqlite($p) => $body,
            Pool::Postgres($p) => $body,
            Pool::Mysql($p) => $body,
-            Pool::SqlServer(_) => unreachable!(),
+            Pool::SqlServer(_) | Pool::Clickhouse(_) => unreachable!(),
        }
    };
 }
@@ -336,10 +337,13 @@ fn result_columns<R: Row>(row: &R) -> Vec<ResultColumn> {
        .collect()
 }

-/// Streams the results of `$sql` on executor `$exec`, keeping at most `$max` rows
-/// with their cells read as `$mode`.
+/// Streams the results of `$sql` on executor `$exec`, reading past the first `$skip`
+/// rows without decoding them, then keeping at most `$max` rows with their cells read as `$mode`.
 macro_rules! fetch {
-    ($exec:expr, $sql:expr, $max:expr, $mode:expr) => {{
+    ($exec:expr, $sql:expr, $max:expr, $mode:expr) => {
+        fetch!($exec, $sql, 0usize, $max, $mode)
+    };
+    ($exec:expr, $sql:expr, $skip:expr, $max:expr, $mode:expr) => {{
        use futures::StreamExt;
        let mut stream = sqlx::raw_sql(sqlx::AssertSqlSafe($sql.to_owned())).fetch_many($exec);
        let mut columns: Vec<ResultColumn> = Vec::new();
@@ -348,6 +352,7 @@ macro_rules! fetch {
        let mut has_more = false;
        let mut failure = None;
        let mut first: Option<Instant> = None;
+        let mut to_skip: usize = $skip;
        while let Some(item) = stream.next().await {
            first.get_or_insert_with(Instant::now);
            match item {
@@ -356,6 +361,10 @@ macro_rules! fetch {
                    if columns.is_empty() {
                        columns = result_columns(&row);
                    }
+                    if to_skip > 0 {
+                        to_skip -= 1;
+                        continue;
+                    }
                    if rows.len() >= $max {
                        has_more = true;
                        break;
@@ -385,7 +394,8 @@ async fn mssql_command(conn: &mut MssqlClient, sql: &str) -> IdeResult<()> {
    Ok(())
 }

-async fn mssql_fetch(conn: &mut MssqlClient, sql: &str, max: usize) -> IdeResult<Fetched> {
+/// Like [`fetch!`] for SQL Server: the first `skip` rows are read past without decoding.
+async fn mssql_fetch(conn: &mut MssqlClient, sql: &str, skip: usize, max: usize) -> IdeResult<Fetched> {
    let mut stream = conn.simple_query(sql).await.map_err(mssql_err)?;
    let first = Some(Instant::now());
    let columns = stream
@@ -398,8 +408,13 @@ async fn mssql_fetch(conn: &mut MssqlClient, sql: &str, max: usize) -> IdeResult
        .collect();
    let mut rows = Vec::new();
    let mut has_more = false;
+    let mut to_skip = skip;
    while let Some(item) = stream.next().await {
        if let tiberius::QueryItem::Row(row) = item.map_err(mssql_err)? {
+            if to_skip > 0 {
+                to_skip -= 1;
+                continue;
+            }
            if rows.len() >= max {
                has_more = true;
                break;
@@ -503,6 +518,9 @@ impl Setup {
                value.parse::<u64>().map_err(|_| IdeError::invalid(format!("{what} must be a whole number: {value}")))
            };
            match (source.driver, name.to_ascii_lowercase().as_str()) {
+                (DbDriver::Clickhouse, "statement_cache_capacity") => {
+                    return Err(IdeError::invalid("ClickHouse HTTP does not support statement caching"));
+                }
                (_, "statement_cache_capacity") => s.statement_cache = Some(number(&name)? as usize),
                (_, "connect_timeout") => s.connect_timeout = Some(Duration::from_secs(number(&name)?)),
                (DbDriver::Postgres, "application_name") => s.application_name = Some(value.to_owned()),
@@ -512,6 +530,9 @@ impl Setup {
                _ => s.params.push((name, value.to_owned())),
            }
        }
+        if source.driver == DbDriver::Clickhouse && !o.time_zone.trim().is_empty() {
+            s.params.push(("session_timezone".into(), o.time_zone.trim().into()));
+        }
        let script = o.startup_script.trim();
        if !script.is_empty() {
            s.statements.extend(crate::split::split(script, source.driver).into_iter().map(|st| st.text));
@@ -527,6 +548,7 @@ impl Pool {
            Pool::Postgres(_) => DbDriver::Postgres,
            Pool::Mysql(_) => DbDriver::Mysql,
            Pool::SqlServer(_) => DbDriver::SqlServer,
+            Pool::Clickhouse(_) => DbDriver::Clickhouse,
        }
    }

@@ -534,6 +556,9 @@ impl Pool {
    pub async fn connect(source: &DataSource, password: Option<&str>, root: Option<&Path>) -> IdeResult<Self> {
        const MAX: u32 = 4;
        let setup = Setup::of(source)?;
+        if source.driver == DbDriver::Clickhouse {
+            return crate::clickhouse::ClickhousePool::connect(source, password, setup).await.map(Pool::Clickhouse);
+        }
        let timeout = setup.connect_timeout.unwrap_or(Duration::from_secs(30));
        let init = Arc::new(setup.statements);
        // Runs the session statements (startup script…) on every new connection.
@@ -695,12 +720,14 @@ impl Pool {
                conn.query("SELECT 1", &[]).await.map_err(mssql_err)?.into_results().await.map_err(mssql_err)?;
                Ok(Pool::SqlServer(pool))
            }
+            DbDriver::Clickhouse => unreachable!(),
        }
    }

    pub async fn close(&self) {
        match self {
            Pool::SqlServer(_) => {}
+            Pool::Clickhouse(p) => p.close(),
            _ => with_pool!(self, p => p.close().await),
        }
    }
@@ -708,16 +735,20 @@ impl Pool {
    pub fn is_closed(&self) -> bool {
        match self {
            Pool::SqlServer(_) => false,
+            Pool::Clickhouse(p) => p.is_closed(),
            _ => with_pool!(self, p => p.is_closed()),
        }
    }

    /// Runs `sql` (no row limit beyond `max`), for introspection: cells are text (see [`Cells::Text`]).
    pub async fn rows(&self, sql: &str, max: usize) -> IdeResult<Vec<Vec<Option<String>>>> {
+        if let Pool::Clickhouse(p) = self {
+            return Ok(p.execute(sql, max, &CancellationToken::new()).await?.rows);
+        }
        let fetched: IdeResult<Fetched> = match self {
            Pool::SqlServer(p) => {
                let mut conn = p.get_owned().await.map_err(mssql_pool_err)?;
-                mssql_fetch(&mut conn, sql, max).await
+                mssql_fetch(&mut conn, sql, 0, max).await
            }
            _ => with_pool!(self, p => fetch!(p, sql, max, Cells::Text)),
        };
@@ -727,8 +758,23 @@ impl Pool {
    /// Runs one statement and keeps at most `max_rows` rows. Cancelling stops
    /// the statement on the server (PostgreSQL, MySQL) and drops the connection.
    pub async fn execute(&self, sql: &str, max_rows: usize, cancel: &CancellationToken) -> IdeResult<QueryResult> {
+        self.execute_from(sql, 0, max_rows, cancel).await
+    }
+
+    /// [`execute`](Self::execute), reading past the first `skip` rows without keeping them
+    /// (a later page of a result: only that page is decoded and returned).
+    pub async fn execute_from(
+        &self,
+        sql: &str,
+        skip: usize,
+        max_rows: usize,
+        cancel: &CancellationToken,
+    ) -> IdeResult<QueryResult> {
+        if let Pool::Clickhouse(p) = self {
+            return p.execute_from(sql, skip, max_rows, cancel).await;
+        }
        let mut conn = Held::acquire(self).await?;
-        let r = conn.execute(self, sql, max_rows, cancel).await;
+        let r = conn.execute_from(self, sql, skip, max_rows, cancel).await;
        if cancel.is_cancelled() {
            conn.discard().await;
            return Err(IdeError::cancelled());
@@ -740,6 +786,7 @@ impl Pool {
    /// row when flagged (table editor submits).
    pub async fn transaction(&self, statements: &[(String, bool)]) -> IdeResult<u64> {
        match self {
+            Pool::Clickhouse(_) => Err(crate::clickhouse::transaction_error()),
            Pool::SqlServer(p) => {
                let mut conn = p.get_owned().await.map_err(mssql_pool_err)?;
                let result = async {
@@ -790,6 +837,7 @@ pub enum Held {
    Postgres(PoolConnection<Postgres>),
    Mysql(PoolConnection<MySql>),
    SqlServer(Box<bb8::PooledConnection<'static, MssqlConnectionManager>>),
+    Clickhouse(crate::clickhouse::ClickhousePool),
 }

 impl Held {
@@ -799,6 +847,12 @@ impl Held {
            Pool::Postgres(p) => Held::Postgres(p.acquire().await.map_err(db_err)?),
            Pool::Mysql(p) => Held::Mysql(p.acquire().await.map_err(db_err)?),
            Pool::SqlServer(p) => Held::SqlServer(Box::new(p.get_owned().await.map_err(mssql_pool_err)?)),
+            Pool::Clickhouse(p) => {
+                if p.is_closed() {
+                    return Err(IdeError::new(ErrorKind::Io, "ClickHouse connection is closed"));
+                }
+                Held::Clickhouse(p.clone())
+            }
        })
    }

@@ -806,13 +860,14 @@ impl Held {
    pub async fn command(&mut self, sql: &str) -> IdeResult<()> {
        match self {
            Held::SqlServer(c) => mssql_command(c, sql).await,
+            Held::Clickhouse(_) => Err(crate::clickhouse::transaction_error()),
            other => {
                let sql = sqlx::AssertSqlSafe(sql.to_owned());
                match other {
                    Held::Sqlite(c) => sqlx::raw_sql(sql).execute(&mut **c).await.map(drop),
                    Held::Postgres(c) => sqlx::raw_sql(sql).execute(&mut **c).await.map(drop),
                    Held::Mysql(c) => sqlx::raw_sql(sql).execute(&mut **c).await.map(drop),
-                    Held::SqlServer(_) => unreachable!(),
+                    Held::SqlServer(_) | Held::Clickhouse(_) => unreachable!(),
                }
                .map_err(db_err)
            }
@@ -833,6 +888,7 @@ impl Held {
            Held::SqlServer(mut c) => {
                c.0.take();
            }
+            Held::Clickhouse(_) => {}
        }
    }

@@ -845,6 +901,22 @@ impl Held {
        max_rows: usize,
        cancel: &CancellationToken,
    ) -> IdeResult<QueryResult> {
+        self.execute_from(pool, sql, 0, max_rows, cancel).await
+    }
+
+    /// [`execute`](Self::execute), reading past the first `skip` rows without keeping them
+    /// (see [`Pool::execute_from`]).
+    pub async fn execute_from(
+        &mut self,
+        pool: &Pool,
+        sql: &str,
+        skip: usize,
+        max_rows: usize,
+        cancel: &CancellationToken,
+    ) -> IdeResult<QueryResult> {
+        if let Held::Clickhouse(c) = self {
+            return c.execute_from(sql, skip, max_rows, cancel).await;
+        }
        let started = Instant::now();
        // `$id`: the query naming the server process, `$kill`: how another connection stops it.
        macro_rules! run {
@@ -854,7 +926,7 @@ impl Held {
                    None => None,
                };
                let r = tokio::select! {
-                    r = async { fetch!(&mut **$conn, sql, max_rows, Cells::Display) } => r,
+                    r = async { fetch!(&mut **$conn, sql, skip, max_rows, Cells::Display) } => r,
                    () = cancel.cancelled() => Err(IdeError::cancelled()),
                };
                if cancel.is_cancelled() {
@@ -883,10 +955,11 @@ impl Held {
            Held::SqlServer(c) => {
                // Tiberius has no attention/cancel API; stop reading and discard the connection.
                tokio::select! {
-                    r = mssql_fetch(c, sql, max_rows) => r?,
+                    r = mssql_fetch(c, sql, skip, max_rows) => r?,
                    () = cancel.cancelled() => return Err(IdeError::cancelled()),
                }
            }
+            Held::Clickhouse(_) => unreachable!(),
        };
        let (columns, rows, affected, has_more, first) = fetched;
        let elapsed_ms = started.elapsed().as_secs_f64() * 1000.0;
@@ -907,7 +980,7 @@ pub fn begin_statement(driver: DbDriver) -> &'static str {
    match driver {
        DbDriver::Mysql => "START TRANSACTION",
        DbDriver::SqlServer => "BEGIN TRAN",
-        DbDriver::Sqlite | DbDriver::Postgres => "BEGIN",
+        DbDriver::Sqlite | DbDriver::Postgres | DbDriver::Clickhouse => "BEGIN",
    }
 }

@@ -2,6 +2,7 @@
 //! execution ([`conn`]), introspection, table data paging / editing ([`sql`])
 //! and statement splitting ([`split`]), for SQLite, PostgreSQL and MySQL/MariaDB.

+mod clickhouse;
 pub mod conn;
 pub mod history;
 pub mod plan;
@@ -212,6 +213,8 @@ pub struct DbManager {
    /// App-wide SSH connections and host-key trust.
    ssh: Arc<SshManager>,
    saved_passwords: SecretStore,
+    /// Directory of the global data sources and their saved passwords ([`DbManager::with_global_sources`]).
+    global: Option<(PathBuf, SecretStore)>,
    history: Arc<HistoryStore>,
    /// Records executed statements in the history off the async threads, in order.
    recorder: std::sync::mpsc::Sender<(String, String, f64)>,
@@ -338,6 +341,7 @@ impl DbManager {
        }
        Self {
            saved_passwords: SecretStore::new(passwords, &root),
+            global: None,
            history,
            recorder,
            root,
@@ -350,8 +354,42 @@ impl DbManager {
        }
    }

+    /// Also lists the global data sources stored in `dir` (the app data directory).
+    pub fn with_global_sources(mut self, dir: PathBuf) -> Self {
+        let passwords = self.saved_passwords.scoped(&dir);
+        self.global = Some((dir, passwords));
+        self
+    }
+
+    /// The project's data sources, then the global ones (a project one wins on the same id).
    pub fn sources(&self) -> IdeResult<Vec<DataSource>> {
-        source::load(&self.root)
+        let mut all = source::load(&self.root)?;
+        let global: Vec<_> = self.global_sources().into_iter().filter(|g| all.iter().all(|s| s.id != g.id)).collect();
+        all.extend(global);
+        Ok(all)
+    }
+
+    fn global_sources(&self) -> Vec<DataSource> {
+        let Some((dir, _)) = &self.global else { return Vec::new() };
+        source::load_global(dir).unwrap_or_else(|e| {
+            tracing::warn!("global data sources: {}", e.message);
+            Vec::new()
+        })
+    }
+
+    /// Where the saved passwords of data source `id` live: app-wide for a global one.
+    fn saved_for(&self, id: &str) -> &SecretStore {
+        match &self.global {
+            Some((_, store)) if self.global_sources().iter().any(|s| s.id == id) => store,
+            _ => &self.saved_passwords,
+        }
+    }
+
+    fn store_of(&self, source: &DataSource) -> &SecretStore {
+        match &self.global {
+            Some((_, store)) if source.global => store,
+            _ => &self.saved_passwords,
+        }
    }

    /// The connection settings of target `target` ([`DataSource::resolved`]), with
@@ -371,18 +409,43 @@ impl DbManager {
    }

    /// Saves the data source list; connections of removed or changed sources are closed.
+    /// Global ones (`global`) go to the app-wide list, the others to the project's.
    pub async fn save_sources(&self, sources: Vec<DataSource>) -> IdeResult<()> {
        let old = self.sources().unwrap_or_default();
-        source::save(&self.root, &sources)?;
+        let (global, project): (Vec<_>, Vec<_>) = sources.iter().cloned().partition(|s| s.global);
+        match &self.global {
+            // Rewritten only when it changes: other projects' windows edit the same file.
+            Some((dir, _)) => {
+                if global != old.iter().filter(|s| s.global).cloned().collect::<Vec<_>>() {
+                    source::save_global(dir, &global)?;
+                }
+            }
+            None if !global.is_empty() => return Err(IdeError::invalid("global data sources are not available here")),
+            None => {}
+        }
+        source::save(&self.root, &project)?;
        for o in old {
            match sources.iter().find(|s| s.id == o.id) {
                Some(n) if *n == o => {}
                gone_or_changed => {
-                    if gone_or_changed.is_none() {
-                        for k in [o.id.clone(), secrets::ssh_key(&o.id)] {
-                            self.session_passwords.lock().remove(&k);
-                            self.saved_passwords.delete(&k);
+                    let keys = [o.id.clone(), secrets::ssh_key(&o.id)];
+                    match gone_or_changed {
+                        None => {
+                            for k in &keys {
+                                self.session_passwords.lock().remove(k);
+                                self.store_of(&o).delete(k);
+                            }
                        }
+                        // Made global or project-level: its saved passwords move along.
+                        Some(n) if n.global != o.global => {
+                            for k in &keys {
+                                if let Some(p) = self.store_of(&o).get(k) {
+                                    self.store_of(n).set(k, &p)?;
+                                    self.store_of(&o).delete(k);
+                                }
+                            }
+                        }
+                        Some(_) => {}
                    }
                    self.disconnect_source(&o.id).await;
                }
@@ -394,7 +457,7 @@ impl DbManager {
    /// Remembers `password` for the session, and in the saved passwords when
    /// the data source saves passwords (`None` forgets it).
    pub async fn set_password(&self, id: &str, password: Option<String>, save: bool) -> IdeResult<()> {
-        self.remember(id.to_owned(), password, save).await
+        self.remember(id, id.to_owned(), password, save).await
    }

    /// [`DbManager::set_password`] for the SSH password / key passphrase.
@@ -406,10 +469,10 @@ impl DbManager {
            self.ssh.set_secret(&c, secret, save);
            return Ok(());
        }
-        self.remember(secrets::ssh_key(id), secret, save).await
+        self.remember(id, secrets::ssh_key(id), secret, save).await
    }

-    async fn remember(&self, key: String, secret: Option<String>, save: bool) -> IdeResult<()> {
+    async fn remember(&self, id: &str, key: String, secret: Option<String>, save: bool) -> IdeResult<()> {
        match &secret {
            Some(p) => {
                self.session_passwords.lock().insert(key.clone(), p.clone());
@@ -418,10 +481,11 @@ impl DbManager {
                self.session_passwords.lock().remove(&key);
            }
        }
+        let store = self.saved_for(id);
        let result = match (secret, save) {
-            (Some(p), true) => self.saved_passwords.set(&key, &p),
+            (Some(p), true) => store.set(&key, &p),
            _ => {
-                self.saved_passwords.delete(&key);
+                store.delete(&key);
                Ok(())
            }
        };
@@ -432,18 +496,18 @@ impl DbManager {
        Ok(())
    }

-    async fn secret(&self, key: String, saved: bool) -> Option<String> {
+    async fn secret(&self, source: &DataSource, key: String, saved: bool) -> Option<String> {
        if let Some(p) = self.session_passwords.lock().get(&key) {
            return Some(p.clone());
        }
        if !saved {
            return None;
        }
-        self.saved_passwords.get(&key)
+        self.store_of(source).get(&key)
    }

    async fn password(&self, source: &DataSource) -> Option<String> {
-        match self.secret(source.id.clone(), source.driver != DbDriver::Sqlite && source.save_password).await {
+        match self.secret(source, source.id.clone(), source.driver != DbDriver::Sqlite && source.save_password).await {
            Some(p) => Some(p),
            None => source.url_password(),
        }
@@ -499,7 +563,7 @@ impl DbManager {
        let session = if config.is_empty() {
            let secret = match ssh_secret {
                Some(s) => Some(s),
-                None => self.secret(secrets::ssh_key(&source.id), ssh.save_secret).await,
+                None => self.secret(source, secrets::ssh_key(&source.id), ssh.save_secret).await,
            };
            let target = SshTarget {
                host: ssh.host.clone(),
@@ -547,12 +611,14 @@ impl DbManager {
        })?;
        let version = match source.driver {
            DbDriver::Sqlite => "SELECT 'SQLite ' || sqlite_version()",
-            DbDriver::Postgres => "SELECT version()",
+            DbDriver::Postgres | DbDriver::Clickhouse => "SELECT version()",
            DbDriver::Mysql => "SELECT CONCAT(@@version_comment, ' ', VERSION())",
            DbDriver::SqlServer => "SELECT @@VERSION",
        };
-        let v = pool.rows(version, 1).await.ok().and_then(|r| r.into_iter().next()?.into_iter().next()?);
+        let result = pool.rows(version, 1).await;
        pool.close().await;
+        let rows = if source.driver == DbDriver::Clickhouse { result? } else { result.unwrap_or_default() };
+        let v = rows.into_iter().next().and_then(|r| r.into_iter().next().flatten());
        Ok(v.unwrap_or_else(|| "Connected".into()))
    }

@@ -701,8 +767,11 @@ impl DbManager {
                _ => indexes.push(IndexInfo { name, unique: flag(&unique), columns: vec![col] }),
            }
        }
-        let fk_rows =
-            pool.rows(&sql::table_foreign_keys(driver, schema, table), MAX_META_ROWS).await.unwrap_or_default();
+        let fk_rows = if driver == DbDriver::Clickhouse {
+            Vec::new()
+        } else {
+            pool.rows(&sql::table_foreign_keys(driver, schema, table), MAX_META_ROWS).await.unwrap_or_default()
+        };
        let mut foreign_keys = group_foreign_keys(fk_rows, &[]);
        // SQLite keys that reference the primary key implicitly: look it up.
        for k in foreign_keys.iter_mut().filter(|k| k.ref_columns.is_empty()) {
@@ -715,13 +784,15 @@ impl DbManager {
                .collect();
        }
        foreign_keys.retain(|k| k.columns.len() == k.ref_columns.len());
-        let triggers = pool
-            .rows(&sql::triggers(driver, schema, table), MAX_META_ROWS)
-            .await
-            .unwrap_or_else(|e| {
+        let trigger_rows = if driver == DbDriver::Clickhouse {
+            Vec::new()
+        } else {
+            pool.rows(&sql::triggers(driver, schema, table), MAX_META_ROWS).await.unwrap_or_else(|e| {
                tracing::warn!("triggers: {}", e.message);
                Vec::new()
            })
+        };
+        let triggers = trigger_rows
            .into_iter()
            .filter_map(|r| {
                let mut it = r.into_iter();
@@ -822,6 +893,11 @@ impl DbManager {
                let ddl = cells(pool.rows(&q, 1).await?, 1).into_iter().next();
                ddl.map(|d| format!("{d};\n")).ok_or_else(missing)
            }
+            DbDriver::Clickhouse => {
+                let q = format!("SHOW CREATE TABLE {}", sql::qualified(driver, schema, name));
+                let ddl = cells(pool.rows(&q, 1).await?, 0).into_iter().next();
+                ddl.map(|d| format!("{};\n", d.trim_end().trim_end_matches(';'))).ok_or_else(missing)
+            }
            DbDriver::SqlServer => {
                let obj = format!("{}.{}", schema, name).replace('\'', "''");
                let ddl = cells(pool.rows(&format!("SELECT OBJECT_DEFINITION(OBJECT_ID('{}'))", obj), 1).await?, 0)
@@ -902,10 +978,14 @@ impl DbManager {
            }
        }
        // Foreign keys are a nicety (JOIN completion): a server that refuses the catalog query still completes.
-        let fk_rows = pool.rows(sql::foreign_keys(driver), MAX_META_ROWS).await.unwrap_or_else(|e| {
-            tracing::warn!("foreign keys: {}", e.message);
+        let fk_rows = if driver == DbDriver::Clickhouse {
            Vec::new()
-        });
+        } else {
+            pool.rows(sql::foreign_keys(driver), MAX_META_ROWS).await.unwrap_or_else(|e| {
+                tracing::warn!("foreign keys: {}", e.message);
+                Vec::new()
+            })
+        };
        let foreign_keys = group_foreign_keys(fk_rows, &tables);
        let default_schema = match sql::current_schema(driver) {
            None => "main".to_owned(),
@@ -929,7 +1009,20 @@ impl DbManager {
        max_rows: usize,
        cancel: &CancellationToken,
    ) -> IdeResult<QueryResult> {
-        let r = self.run(id, statement, max_rows, cancel).await;
+        self.execute_from(id, statement, 0, max_rows, cancel).await
+    }
+
+    /// [`execute`](Self::execute), reading past the first `skip` rows without keeping
+    /// them: a later page of a result, where only that page is decoded and returned.
+    pub async fn execute_from(
+        &self,
+        id: &str,
+        statement: &str,
+        skip: usize,
+        max_rows: usize,
+        cancel: &CancellationToken,
+    ) -> IdeResult<QueryResult> {
+        let r = self.run(id, statement, skip, max_rows, cancel).await;
        let ran = match &r {
            Ok(_) => true,
            Err(e) => !matches!(e.kind, ErrorKind::Cancelled | ErrorKind::PermissionDenied),
@@ -964,7 +1057,7 @@ impl DbManager {
    /// The execution plan of `statement` (explained, not run).
    pub async fn explain(&self, id: &str, statement: &str, cancel: &CancellationToken) -> IdeResult<Vec<PlanNode>> {
        let driver = self.pool(id).await?.driver();
-        let result = self.run(id, &plan::explain_statement(driver, statement), MAX_META_ROWS, cancel).await?;
+        let result = self.run(id, &plan::explain_statement(driver, statement), 0, MAX_META_ROWS, cancel).await?;
        plan::parse(driver, &result)
    }

@@ -972,14 +1065,18 @@ impl DbManager {
        &self,
        id: &str,
        statement: &str,
+        skip: usize,
        max_rows: usize,
        cancel: &CancellationToken,
    ) -> IdeResult<QueryResult> {
        let pool = self.pool(id).await?;
        let session = self.sessions.lock().get(id).cloned();
        let Some(session) = session else {
-            return pool.execute(statement, max_rows, cancel).await;
+            return pool.execute_from(statement, skip, max_rows, cancel).await;
        };
+        if pool.driver() == DbDriver::Clickhouse {
+            return Err(IdeError::invalid("ClickHouse manual transactions are unsupported"));
+        }
        let mut held = session.lock().await;
        if held.is_none() {
            let mut conn = Held::acquire(&pool).await?;
@@ -987,7 +1084,7 @@ impl DbManager {
            *held = Some(conn);
        }
        let conn = held.as_mut().expect("opened above");
-        let r = conn.execute(&pool, statement, max_rows, cancel).await;
+        let r = conn.execute_from(&pool, statement, skip, max_rows, cancel).await;
        if cancel.is_cancelled() {
            // The server rolls the transaction back with the connection.
            held.take().expect("opened above").discard().await;
@@ -998,8 +1095,11 @@ impl DbManager {

    /// Switches `id` between auto-commit and manual commit. Leaving manual
    /// mode rolls back what was not committed.
-    pub async fn set_manual_commit(&self, id: &str, manual: bool) {
+    pub async fn set_manual_commit(&self, id: &str, manual: bool) -> IdeResult<()> {
        if manual {
+            if self.source(id)?.driver == DbDriver::Clickhouse {
+                return Err(IdeError::invalid("ClickHouse manual transactions are unsupported"));
+            }
            self.sessions.lock().entry(id.to_owned()).or_default();
        } else {
            let session = self.sessions.lock().remove(id);
@@ -1007,10 +1107,14 @@ impl DbManager {
                end_session(&s).await;
            }
        }
+        Ok(())
    }

    /// Commits (or rolls back) the open transaction of a manual-commit data source.
    pub async fn finish_transaction(&self, id: &str, commit: bool) -> IdeResult<()> {
+        if self.source(id).is_ok_and(|s| s.driver == DbDriver::Clickhouse) {
+            return Err(IdeError::invalid("ClickHouse manual transactions are unsupported"));
+        }
        let session = self.sessions.lock().get(id).cloned();
        let Some(session) = session else { return Ok(()) };
        let mut held = session.lock().await;
@@ -1052,6 +1156,9 @@ impl DbManager {

    /// Applies the table editor's pending changes in one transaction.
    pub async fn apply_edits(&self, id: &str, schema: &str, table: &str, edits: &[DbRowEdit]) -> IdeResult<u64> {
+        if self.source(id)?.driver == DbDriver::Clickhouse {
+            return Err(IdeError::invalid("ClickHouse table editing is unsupported"));
+        }
        let pool = self.pool(id).await?;
        let driver = pool.driver();
        let statements = edits
@@ -1064,3 +1171,112 @@ impl DbManager {
        pool.transaction(&statements).await
    }
 }
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+    use ide_ssh::secrets::testing::files_containing;
+    use std::path::Path;
+
+    fn manager(dir: &Path) -> DbManager {
+        ide_ssh::secrets::testing::use_memory_store();
+        let data = dir.join("data");
+        let ssh = Arc::new(SshManager::new(data.join("ssh-passwords.json")));
+        DbManager::new(dir.join("project"), data.join("db-passwords.json"), data.join("db-history.json"), ssh)
+    }
+
+    #[tokio::test]
+    async fn saved_passwords_stay_off_disk() {
+        let tmp = tempfile::tempdir().unwrap();
+        manager(tmp.path()).set_password("s1", Some("hunter2-db".into()), true).await.unwrap();
+        manager(tmp.path()).set_ssh_secret("s1", Some("hunter2-tunnel".into()), true).await.unwrap();
+        assert_eq!(files_containing(tmp.path(), "hunter2-db"), Vec::<PathBuf>::new());
+        assert_eq!(files_containing(tmp.path(), "hunter2-tunnel"), Vec::<PathBuf>::new());
+        let reopened = manager(tmp.path());
+        assert_eq!(reopened.secret(&DataSource::default(), "s1".into(), true).await.as_deref(), Some("hunter2-db"));
+        assert_eq!(
+            reopened.secret(&DataSource::default(), secrets::ssh_key("s1"), true).await.as_deref(),
+            Some("hunter2-tunnel")
+        );
+    }
+
+    #[tokio::test]
+    async fn moves_plaintext_passwords_of_older_versions_off_disk() {
+        let tmp = tempfile::tempdir().unwrap();
+        let project = tmp.path().join("project").to_string_lossy().into_owned();
+        let legacy = serde_json::json!({ project: { "s1": "old-db-pw" }, "/other": { "s2": "other-pw" } });
+        std::fs::create_dir_all(tmp.path().join("data")).unwrap();
+        std::fs::write(tmp.path().join("data/db-passwords.json"), legacy.to_string()).unwrap();
+        let m = manager(tmp.path());
+        assert_eq!(m.secret(&DataSource::default(), "s1".into(), true).await.as_deref(), Some("old-db-pw"));
+        assert_eq!(files_containing(tmp.path(), "old-db-pw"), Vec::<PathBuf>::new());
+        assert_eq!(files_containing(tmp.path(), "other-pw"), Vec::<PathBuf>::new());
+        let other = SecretStore::new(tmp.path().join("data/db-passwords.json"), Path::new("/other"));
+        assert_eq!(other.get("s2").as_deref(), Some("other-pw"));
+    }
+
+    #[tokio::test]
+    async fn global_data_sources_are_shared_by_projects_with_their_passwords() {
+        ide_ssh::secrets::testing::use_memory_store();
+        let tmp = tempfile::tempdir().unwrap();
+        let (app, one, two) = (tmp.path().join("app"), tmp.path().join("one"), tmp.path().join("two"));
+        let manager = |root: &std::path::Path| {
+            let ssh = Arc::new(SshManager::new(app.join("ssh-passwords.json")));
+            DbManager::new(root.to_path_buf(), app.join("passwords.json"), app.join("history.json"), ssh)
+                .with_global_sources(app.clone())
+        };
+        let (a, b) = (manager(&one), manager(&two));
+        let source = |id: &str, global: bool| DataSource {
+            id: id.into(),
+            name: id.into(),
+            driver: DbDriver::Postgres,
+            save_password: true,
+            global,
+            ..Default::default()
+        };
+        a.save_sources(vec![source("local", false), source("shared", false)]).await.unwrap();
+        a.set_password("shared", Some("pw".into()), true).await.unwrap();
+        // Made global: listed in the other project too, with its saved password.
+        a.save_sources(vec![source("local", false), source("shared", true)]).await.unwrap();
+        let ids = |m: &DbManager| m.sources().unwrap().into_iter().map(|s| (s.id, s.global)).collect::<Vec<_>>();
+        assert_eq!(ids(&a), [("local".into(), false), ("shared".into(), true)]);
+        assert_eq!(ids(&b), [("shared".into(), true)]);
+        assert_eq!(b.password(&b.source("shared").unwrap()).await.as_deref(), Some("pw"));
+        let project_file = std::fs::read_to_string(one.join(".openidea/data-sources.toml")).unwrap();
+        assert!(!project_file.contains("shared") && !project_file.contains("global"), "{project_file}");
+        assert!(!std::fs::read_to_string(app.join("data-sources.toml")).unwrap().contains("global"));
+        // Made project-level again: gone from the other project, the password stays with it.
+        a.save_sources(vec![source("local", false), source("shared", false)]).await.unwrap();
+        assert!(b.sources().unwrap().is_empty());
+        assert_eq!(a.password(&a.source("shared").unwrap()).await.as_deref(), Some("pw"));
+    }
+
+    #[tokio::test]
+    async fn clickhouse_rejects_manual_transactions_and_table_edits_without_connecting() {
+        let tmp = tempfile::tempdir().unwrap();
+        let root = tmp.path().to_path_buf();
+        let ssh = Arc::new(SshManager::new(root.join("ssh-passwords.json")));
+        let db = DbManager::new(root.clone(), root.join("passwords.json"), root.join("history.json"), ssh);
+        db.save_sources(vec![DataSource {
+            id: "clickhouse".into(),
+            name: "clickhouse".into(),
+            driver: DbDriver::Clickhouse,
+            host: "127.0.0.1".into(),
+            port: Some(1),
+            ..Default::default()
+        }])
+        .await
+        .unwrap();
+        let error = db.set_manual_commit("clickhouse", true).await.unwrap_err();
+        assert!(error.message.contains("manual transactions are unsupported"));
+        assert!(db.sessions.lock().is_empty());
+        for commit in [false, true] {
+            let error = db.finish_transaction("clickhouse", commit).await.unwrap_err();
+            assert!(error.message.contains("manual transactions are unsupported"));
+        }
+        let error = db.apply_edits("clickhouse", "default", "events", &[]).await.unwrap_err();
+        assert!(error.message.contains("table editing is unsupported"));
+        assert!(!db.is_connected("clickhouse"));
+        db.set_manual_commit("clickhouse", false).await.unwrap();
+    }
+}
@@ -35,6 +35,7 @@ pub fn explain_statement(driver: DbDriver, statement: &str) -> String {
    match driver {
        DbDriver::Sqlite => format!("EXPLAIN QUERY PLAN {s}"),
        DbDriver::Postgres => format!("EXPLAIN (FORMAT JSON) {s}"),
+        DbDriver::Clickhouse => format!("EXPLAIN json = 1 {s}"),
        DbDriver::Mysql => format!("EXPLAIN {s}"),
        DbDriver::SqlServer => format!("SET SHOWPLAN_TEXT ON; {s}"),
    }
@@ -44,7 +45,7 @@ pub fn explain_statement(driver: DbDriver, statement: &str) -> String {
 pub fn parse(driver: DbDriver, result: &QueryResult) -> IdeResult<Vec<PlanNode>> {
    match driver {
        DbDriver::Sqlite => Ok(sqlite(&result.rows)),
-        DbDriver::Postgres => {
+        DbDriver::Postgres | DbDriver::Clickhouse => {
            let text: String =
                result.rows.iter().filter_map(|r| r.first().cloned().flatten()).collect::<Vec<_>>().join("\n");
            let json: Value = serde_json::from_str(&text).map_err(|e| IdeError::invalid(format!("plan: {e}")))?;
@@ -199,6 +200,7 @@ mod tests {
        assert_eq!(explain_statement(DbDriver::Sqlite, "select 1;"), "EXPLAIN QUERY PLAN select 1");
        assert_eq!(explain_statement(DbDriver::Postgres, " select 1 "), "EXPLAIN (FORMAT JSON) select 1");
        assert_eq!(explain_statement(DbDriver::Mysql, "select 1"), "EXPLAIN select 1");
+        assert_eq!(explain_statement(DbDriver::Clickhouse, " select 1;"), "EXPLAIN json = 1 select 1");
        assert_eq!(explain_statement(DbDriver::SqlServer, "select 1"), "SET SHOWPLAN_TEXT ON; select 1");
    }

@@ -254,6 +256,21 @@ mod tests {
        assert_eq!((plan[3].parent, plan[3].operation.as_str()), (Some(2), "Seq Scan"));
    }

+    #[test]
+    fn reads_clickhouse_json_plans_and_rejects_invalid_json() {
+        let json = r#"[{"Plan": {"Node Type": "Expression", "Node Id": "Expression_5",
+            "Description": "Project names", "Plans": [
+                {"Node Type": "ReadFromMergeTree", "Node Id": "ReadFromMergeTree_0",
+                 "Description": "default.events"}
+            ]}}]"#;
+        let plan = parse(DbDriver::Clickhouse, &result(&["explain"], vec![vec![Some(json)]])).unwrap();
+        assert_eq!(plan.len(), 2);
+        assert_eq!((plan[0].parent, plan[0].operation.as_str()), (None, "Expression"));
+        assert_eq!((plan[1].parent, plan[1].operation.as_str()), (Some(0), "ReadFromMergeTree"));
+        assert!(plan[1].properties.iter().any(|p| p.name == "Description" && p.value == "default.events"));
+        assert!(parse(DbDriver::Clickhouse, &result(&["explain"], vec![vec![Some("invalid")]])).is_err());
+    }
+
    #[test]
    fn reads_mysql_rows() {
        let r = result(
@@ -1,20 +1,15 @@
-//! Saved data source passwords, in the app's data directory rather than the OS
-//! credential store (no system prompts). One JSON file for all projects, keyed
-//! by project root, then credential key; owner-only on Unix.
+//! Saved data source passwords, in the OS credential store like the other saved
+//! passwords ([`SecretFile`]). One index file for all projects; each credential is
+//! keyed by project root, then credential key.

-use ide_core::{IdeError, IdeResult};
-use parking_lot::Mutex;
+use ide_core::IdeResult;
+use ide_ssh::secrets::SecretFile;
 use std::collections::BTreeMap;
 use std::path::{Path, PathBuf};

-/// Project root → credential key → secret.
-type Contents = BTreeMap<String, BTreeMap<String, String>>;
-
-/// Serialises read-modify-write across the projects sharing the file.
-static LOCK: Mutex<()> = Mutex::new(());
-
 pub struct SecretStore {
    path: PathBuf,
+    file: SecretFile,
    project: String,
 }

@@ -23,61 +18,41 @@ pub fn ssh_key(id: &str) -> String {
    format!("{id}#ssh")
 }

+fn file_key(project: &str, key: &str) -> String {
+    format!("{project}|{key}")
+}
+
+/// Older versions' file: project root → credential key → secret.
+fn legacy(value: serde_json::Value) -> Option<BTreeMap<String, String>> {
+    let all: BTreeMap<String, BTreeMap<String, String>> = serde_json::from_value(value).ok()?;
+    Some(
+        all.into_iter()
+            .flat_map(|(project, keys)| keys.into_iter().map(move |(k, s)| (file_key(&project, &k), s)))
+            .collect(),
+    )
+}
+
 impl SecretStore {
    pub fn new(path: PathBuf, root: &Path) -> Self {
-        Self { path, project: root.to_string_lossy().into_owned() }
+        let file = SecretFile::with_legacy(path.clone(), legacy);
+        Self { path, file, project: root.to_string_lossy().into_owned() }
+    }
+
+    /// The same file, keyed by `scope` instead (global data sources: the app data directory).
+    pub fn scoped(&self, scope: &Path) -> Self {
+        Self::new(self.path.clone(), scope)
    }

    pub fn get(&self, key: &str) -> Option<String> {
-        let _g = LOCK.lock();
-        self.read().remove(&self.project)?.remove(key)
+        self.file.get(&file_key(&self.project, key))
    }

    pub fn set(&self, key: &str, secret: &str) -> IdeResult<()> {
-        let _g = LOCK.lock();
-        let mut all = self.read();
-        all.entry(self.project.clone()).or_default().insert(key.to_owned(), secret.to_owned());
-        self.write(&all)
+        self.file.set(&file_key(&self.project, key), secret)
    }

    pub fn delete(&self, key: &str) {
-        let _g = LOCK.lock();
-        let mut all = self.read();
-        let Some(project) = all.get_mut(&self.project) else { return };
-        if project.remove(key).is_none() {
-            return;
-        }
-        if project.is_empty() {
-            all.remove(&self.project);
-        }
-        if let Err(e) = self.write(&all) {
-            tracing::warn!("saved passwords: {}", e.message);
-        }
-    }
-
-    fn read(&self) -> Contents {
-        match std::fs::read(&self.path) {
-            Ok(bytes) => serde_json::from_slice(&bytes).unwrap_or_else(|e| {
-                tracing::warn!("saved passwords: {}: {e}", self.path.display());
-                Contents::new()
-            }),
-            Err(_) => Contents::new(),
-        }
-    }
-
-    fn write(&self, all: &Contents) -> IdeResult<()> {
-        let err = |e: std::io::Error| IdeError::unavailable(format!("saved passwords: {e}"));
-        if let Some(dir) = self.path.parent() {
-            std::fs::create_dir_all(dir).map_err(err)?;
-        }
-        let tmp = self.path.with_extension("json.tmp");
-        let mut options = std::fs::OpenOptions::new();
-        options.write(true).create(true).truncate(true);
-        #[cfg(unix)]
-        std::os::unix::fs::OpenOptionsExt::mode(&mut options, 0o600);
-        let bytes = serde_json::to_vec_pretty(all).map_err(|e| IdeError::internal(e.to_string()))?;
-        std::io::Write::write_all(&mut options.open(&tmp).map_err(err)?, &bytes).map_err(err)?;
-        std::fs::rename(&tmp, &self.path).map_err(err)
+        self.file.delete(&file_key(&self.project, key))
    }
 }

@@ -87,6 +62,7 @@ mod tests {

    #[test]
    fn keeps_projects_apart_and_drops_empty_ones() {
+        ide_ssh::secrets::testing::use_memory_store();
        let tmp = tempfile::tempdir().unwrap();
        let file = tmp.path().join("db-passwords.json");
        let a = SecretStore::new(file.clone(), Path::new("/p/a"));
@@ -1,6 +1,7 @@
-//! Data sources: per-project connection settings in `.openidea/data-sources.toml`.
-//! Passwords never go there: saved ones live in [`crate::secrets`], the others
-//! only in memory for the session.
+//! Data sources: per-project connection settings in `.openidea/data-sources.toml`, and
+//! global ones (IDEA's Make Global: listed in every project) in `data-sources.toml` of the
+//! app data directory. Passwords never go there: saved ones live in [`crate::secrets`],
+//! the others only in memory for the session.

 use ide_core::{IdeError, IdeResult, IpcPath, project_dir};
 use serde::{Deserialize, Serialize};
@@ -18,6 +19,7 @@ pub enum DbDriver {
    Mysql,
    /// Microsoft SQL Server.
    SqlServer,
+    Clickhouse,
 }

 impl DbDriver {
@@ -27,6 +29,7 @@ impl DbDriver {
            DbDriver::Postgres => Some(5432),
            DbDriver::Mysql => Some(3306),
            DbDriver::SqlServer => Some(1433),
+            DbDriver::Clickhouse => Some(8123),
        }
    }
 }
@@ -179,6 +182,9 @@ pub struct DataSource {
    pub options: DbOptions,
    pub introspection: DbIntrospection,
    pub properties: Vec<DbProperty>,
+    /// Stored app-wide and listed in every project. Implied by the file it is read from,
+    /// so not written to it.
+    pub global: bool,
 }

 impl Default for DataSource {
@@ -207,6 +213,7 @@ impl Default for DataSource {
            options: DbOptions::default(),
            introspection: DbIntrospection::default(),
            properties: Vec::new(),
+            global: false,
        }
    }
 }
@@ -253,6 +260,7 @@ pub fn scheme_driver(scheme: &str) -> Option<DbDriver> {
        "mysql" | "mariadb" | "tidb" | "singlestore" | "memsql" | "oceanbase" => Some(DbDriver::Mysql),
        "sqlserver" | "mssql" | "mssqlserver" => Some(DbDriver::SqlServer),
        "sqlite" | "sqlite3" => Some(DbDriver::Sqlite),
+        "clickhouse" | "http" | "https" => Some(DbDriver::Clickhouse),
        _ => None,
    }
 }
@@ -260,7 +268,7 @@ pub fn scheme_driver(scheme: &str) -> Option<DbDriver> {
 /// Parses `scheme://[user[:password]@]host[:port][/database][?k=v&…]`, `jdbc:` forms
 /// included, and `sqlite:path`.
 pub fn parse_url(raw: &str) -> IdeResult<ParsedUrl> {
-    let bad = || IdeError::invalid(format!("not a database URL: {raw}"));
+    let bad = || IdeError::invalid("invalid database URL");
    let url = raw.trim();
    let url = url.strip_prefix("jdbc:").or_else(|| url.strip_prefix("JDBC:")).unwrap_or(url);
    let (scheme, rest) = url.split_once(':').ok_or_else(bad)?;
@@ -367,6 +375,15 @@ impl DataSource {
        }
        properties.append(&mut s.properties);
        s.properties = properties;
+        if s.driver == DbDriver::Clickhouse {
+            let raw_url = self.url.trim().to_ascii_lowercase();
+            let url = raw_url.strip_prefix("jdbc:").unwrap_or(&raw_url);
+            if url.starts_with("https://") {
+                s.ssl = DbSslMode::VerifyFull;
+            } else if url.starts_with("http://") {
+                s.ssl = DbSslMode::Disable;
+            }
+        }
        Ok(s)
    }

@@ -385,9 +402,32 @@ struct SourcesFile {
    sources: Vec<DataSource>,
 }

+/// The project's data sources.
 pub fn load(root: &Path) -> IdeResult<Vec<DataSource>> {
-    let path = project_dir::path(root, FILE);
-    let text = match std::fs::read_to_string(&path) {
+    read(&project_dir::path(root, FILE))
+}
+
+/// Saves the project's data sources.
+pub fn save(root: &Path, sources: &[DataSource]) -> IdeResult<()> {
+    write(&project_dir::path(root, FILE), sources)
+}
+
+/// The global data sources stored in `dir` (the app data directory).
+pub fn load_global(dir: &Path) -> IdeResult<Vec<DataSource>> {
+    let mut sources = read(&dir.join(FILE))?;
+    for s in &mut sources {
+        s.global = true;
+    }
+    Ok(sources)
+}
+
+/// Saves the global data sources in `dir`.
+pub fn save_global(dir: &Path, sources: &[DataSource]) -> IdeResult<()> {
+    write(&dir.join(FILE), sources)
+}
+
+fn read(path: &Path) -> IdeResult<Vec<DataSource>> {
+    let text = match std::fs::read_to_string(path) {
        Ok(t) => t,
        Err(e) if e.kind() == std::io::ErrorKind::NotFound => return Ok(Vec::new()),
        Err(e) => return Err(e.into()),
@@ -396,19 +436,23 @@ pub fn load(root: &Path) -> IdeResult<Vec<DataSource>> {
    Ok(file.sources)
 }

-pub fn save(root: &Path, sources: &[DataSource]) -> IdeResult<()> {
+fn write(path: &Path, sources: &[DataSource]) -> IdeResult<()> {
    for s in sources {
        if s.id.is_empty() || s.name.trim().is_empty() {
            return Err(IdeError::invalid("every data source needs an id and a name"));
        }
    }
-    let path = project_dir::path(root, FILE);
    if let Some(dir) = path.parent() {
        std::fs::create_dir_all(dir)?;
    }
-    let text = toml::to_string_pretty(&SourcesFile { sources: sources.to_vec() })
-        .map_err(|e| IdeError::internal(e.to_string()))?;
-    std::fs::write(path, text)?;
+    let internal = |e: &dyn std::fmt::Display| IdeError::internal(e.to_string());
+    let mut value = toml::Value::try_from(SourcesFile { sources: sources.to_vec() }).map_err(|e| internal(&e))?;
+    if let Some(list) = value.get_mut("data-source").and_then(toml::Value::as_array_mut) {
+        for table in list.iter_mut().filter_map(toml::Value::as_table_mut) {
+            table.remove("global");
+        }
+    }
+    std::fs::write(path, toml::to_string_pretty(&value).map_err(|e| internal(&e))?)?;
    Ok(())
 }

@@ -519,4 +563,31 @@ mod tests {
        assert!(DataSource { url: "mysql://h/db".into(), ..s.clone() }.resolved().is_err());
        assert_eq!(DataSource { url_only: false, ..s }.resolved().unwrap().host, "localhost");
    }
+
+    #[test]
+    fn clickhouse_urls_resolve_http_https_and_credentials() {
+        assert_eq!(DbDriver::Clickhouse.default_port(), Some(8123));
+        let source = DataSource {
+            driver: DbDriver::Clickhouse,
+            url_only: true,
+            url: "https://reader:s%[email protected]:8443/analytics?max_execution_time=30".into(),
+            ..Default::default()
+        };
+        let resolved = source.resolved().unwrap();
+        assert_eq!(resolved.host, "db.example");
+        assert_eq!(resolved.port, Some(8443));
+        assert_eq!(resolved.database, "analytics");
+        assert_eq!(resolved.user, "reader");
+        assert_eq!(resolved.ssl, DbSslMode::VerifyFull);
+        assert_eq!(source.url_password().as_deref(), Some("s@cret"));
+        assert_eq!(resolved.properties[0].name, "max_execution_time");
+        let http = DataSource { url: "http://localhost/default".into(), ..source.clone() }.resolved().unwrap();
+        assert_eq!(http.ssl, DbSslMode::Disable);
+        let jdbc = DataSource { url: "jdbc:clickhouse://localhost/analytics".into(), ..source.clone() };
+        assert_eq!(jdbc.resolved().unwrap().database, "analytics");
+        let secure = DataSource { url: "https://db.example/default?sslmode=disable".into(), ..source };
+        assert_eq!(secure.resolved().unwrap().ssl, DbSslMode::VerifyFull);
+        let error = parse_url("clickhouse://reader:[email protected]:invalid/default").unwrap_err();
+        assert!(!error.message.contains("secret"));
+    }
 }
@@ -28,6 +28,7 @@ enum State {
 /// Every statement of `text` that contains more than whitespace and comments.
 pub fn split(text: &str, driver: DbDriver) -> Vec<SqlStatement> {
    let mysql = driver == DbDriver::Mysql;
+    let clickhouse = driver == DbDriver::Clickhouse;
    let chars: Vec<(usize, char)> = text.char_indices().collect();
    // UTF-16 offset of each char index (plus the end).
    let mut u16_at = Vec::with_capacity(chars.len() + 1);
@@ -81,7 +82,7 @@ pub fn split(text: &str, driver: DbDriver) -> Vec<SqlStatement> {
                    state = State::Double;
                    has_code = true;
                }
-                '`' if mysql => {
+                '`' if mysql || clickhouse => {
                    state = State::Backtick;
                    has_code = true;
                }
@@ -117,7 +118,7 @@ pub fn split(text: &str, driver: DbDriver) -> Vec<SqlStatement> {
                _ => {}
            },
            State::Single => {
-                if mysql && c == '\\' {
+                if (mysql || clickhouse) && c == '\\' {
                    i += 1;
                } else if c == '\'' {
                    if next == Some('\'') {
@@ -128,7 +129,9 @@ pub fn split(text: &str, driver: DbDriver) -> Vec<SqlStatement> {
                }
            }
            State::Double => {
-                if c == '"' {
+                if clickhouse && c == '\\' {
+                    i += 1;
+                } else if c == '"' {
                    if next == Some('"') {
                        i += 1;
                    } else {
@@ -137,7 +140,9 @@ pub fn split(text: &str, driver: DbDriver) -> Vec<SqlStatement> {
                }
            }
            State::Backtick => {
-                if c == '`' {
+                if clickhouse && (c == '\\' || (c == '`' && next == Some('`'))) {
+                    i += 1;
+                } else if c == '`' {
                    state = State::Code;
                }
            }
@@ -224,6 +229,12 @@ mod tests {
        assert_eq!(texts(sql, DbDriver::Mysql), vec!["select `a;b`, 'it\\'s;' from t # x;y", "select 2"]);
    }

+    #[test]
+    fn clickhouse_backticks_and_escaped_quotes_keep_statements_intact() {
+        let query = r#"SELECT `a\`;b`, "c\";d", 'it\'s;safe'; SELECT 2"#;
+        assert_eq!(texts(query, DbDriver::Clickhouse), vec![r#"SELECT `a\`;b`, "c\";d", 'it\'s;safe'"#, "SELECT 2"]);
+    }
+
    #[test]
    fn postgres_dollar_quotes() {
        let sql =
@@ -7,6 +7,7 @@ use specta::Type;

 pub fn quote_ident(driver: DbDriver, name: &str) -> String {
    match driver {
+        DbDriver::Clickhouse => format!("`{}`", name.replace('\\', "\\\\").replace('`', "\\`")),
        DbDriver::Mysql => format!("`{}`", name.replace('`', "``")),
        DbDriver::SqlServer => format!("[{}]", name.replace(']', "]]")),
        _ => format!("\"{}\"", name.replace('"', "\"\"")),
@@ -15,7 +16,7 @@ pub fn quote_ident(driver: DbDriver, name: &str) -> String {

 pub fn quote_literal(driver: DbDriver, value: &str) -> String {
    let mut s = value.replace('\'', "''");
-    if driver == DbDriver::Mysql {
+    if matches!(driver, DbDriver::Mysql | DbDriver::Clickhouse) {
        s = s.replace('\\', "\\\\");
    }
    format!("'{s}'")
@@ -48,6 +49,10 @@ pub const INTERNAL_DATABASES: &[&str] = &["rdsadmin", "azure_maintenance", "azur
 pub fn schemas(driver: DbDriver, system: bool) -> &'static str {
    match driver {
        DbDriver::Sqlite => "SELECT name FROM pragma_database_list WHERE name <> 'temp' ORDER BY seq",
+        DbDriver::Clickhouse if system => "SELECT name FROM system.databases ORDER BY name",
+        DbDriver::Clickhouse => {
+            "SELECT name FROM system.databases WHERE lower(name) NOT IN ('system', 'information_schema') ORDER BY name"
+        }
        DbDriver::Postgres if system => {
            "SELECT schema_name FROM information_schema.schemata \
             WHERE schema_name NOT LIKE 'pg\\_toast%' AND schema_name NOT LIKE 'pg\\_temp%' ORDER BY 1"
@@ -73,6 +78,12 @@ pub fn schemas(driver: DbDriver, system: bool) -> &'static str {
 /// Rows: `name, kind` where kind is `table`, `view` or `materialized view`.
 pub fn tables(driver: DbDriver, schema: &str) -> String {
    match driver {
+        DbDriver::Clickhouse => format!(
+            "SELECT name, CASE engine WHEN 'View' THEN 'view' WHEN 'MaterializedView' THEN 'materialized view' \
+             WHEN 'WindowView' THEN 'view' ELSE 'table' END FROM system.tables \
+             WHERE database = {} AND is_temporary = 0 ORDER BY name",
+            quote_literal(driver, schema)
+        ),
        DbDriver::Sqlite => format!(
            "SELECT name, type FROM {}.sqlite_master WHERE type IN ('table', 'view') \
             AND name NOT LIKE 'sqlite\\_%' ESCAPE '\\' ORDER BY name",
@@ -101,6 +112,12 @@ pub fn tables(driver: DbDriver, schema: &str) -> String {
 pub fn columns(driver: DbDriver, schema: &str, table: &str) -> String {
    let (s, t) = (quote_literal(driver, schema), quote_literal(driver, table));
    match driver {
+        DbDriver::Clickhouse => format!(
+            "SELECT name, type, CASE WHEN startsWith(type, 'Nullable(') \
+             OR startsWith(type, 'LowCardinality(Nullable(') THEN 'YES' ELSE 'NO' END, \
+             if(default_kind = '', NULL, default_expression), is_in_primary_key \
+             FROM system.columns WHERE database = {s} AND table = {t} ORDER BY position"
+        ),
        DbDriver::Sqlite => format!(
            "SELECT name, type, CASE WHEN \"notnull\" = 0 THEN 'YES' ELSE 'NO' END, dflt_value, \
             CASE WHEN pk > 0 THEN 1 ELSE 0 END FROM pragma_table_info({t}, {s}) ORDER BY cid"
@@ -138,6 +155,12 @@ pub fn columns(driver: DbDriver, schema: &str, table: &str) -> String {
 pub fn indexes(driver: DbDriver, schema: &str, table: &str) -> String {
    let (s, t) = (quote_literal(driver, schema), quote_literal(driver, table));
    match driver {
+        DbDriver::Clickhouse => format!(
+            "SELECT * FROM (SELECT 'PRIMARY KEY' AS index_name, 0 AS is_unique, primary_key AS expression \
+             FROM system.tables WHERE database = {s} AND name = {t} AND primary_key != '' \
+             UNION ALL SELECT name, 0, expr FROM system.data_skipping_indices \
+             WHERE database = {s} AND table = {t}) ORDER BY index_name"
+        ),
        DbDriver::Sqlite => format!(
            "SELECT il.name, il.\"unique\", ii.name FROM pragma_index_list({t}, {s}) il \
             JOIN pragma_index_info(il.name, {s}) ii ORDER BY il.name, ii.seqno"
@@ -169,6 +192,15 @@ pub fn indexes(driver: DbDriver, schema: &str, table: &str) -> String {
 /// for SQL completion, grouped by table in column order.
 pub fn completion_columns(driver: DbDriver) -> &'static str {
    match driver {
+        DbDriver::Clickhouse => {
+            "SELECT c.database, c.table, CASE t.engine WHEN 'View' THEN 'view' \
+             WHEN 'MaterializedView' THEN 'materialized view' WHEN 'WindowView' THEN 'view' ELSE 'table' END, \
+             c.name, c.type, CASE WHEN startsWith(c.type, 'Nullable(') \
+             OR startsWith(c.type, 'LowCardinality(Nullable(') THEN 'YES' ELSE 'NO' END, c.is_in_primary_key, 1 \
+             FROM system.columns c JOIN system.tables t ON t.database = c.database AND t.name = c.table \
+             WHERE lower(c.database) NOT IN ('system', 'information_schema') AND t.is_temporary = 0 \
+             ORDER BY c.database, c.table, c.position LIMIT 50000"
+        }
        DbDriver::Sqlite => {
            "SELECT 'main', m.name, m.type, p.name, p.type, CASE WHEN p.\"notnull\" = 0 THEN 'YES' ELSE 'NO' END, \
             CASE WHEN p.pk > 0 THEN 1 ELSE 0 END, \
@@ -221,6 +253,7 @@ pub fn completion_columns(driver: DbDriver) -> &'static str {
 /// when the key references the primary key implicitly.
 pub fn foreign_keys(driver: DbDriver) -> &'static str {
    match driver {
+        DbDriver::Clickhouse => "SELECT '', '', '', '', '', '', '' WHERE 0",
        DbDriver::Sqlite => {
            "SELECT 'main', m.name, f.id, f.\"from\", 'main', f.\"table\", f.\"to\" \
             FROM sqlite_master m JOIN pragma_foreign_key_list(m.name) f \
@@ -258,6 +291,7 @@ pub fn foreign_keys(driver: DbDriver) -> &'static str {
 pub fn table_foreign_keys(driver: DbDriver, schema: &str, table: &str) -> String {
    let (s, t) = (quote_literal(driver, schema), quote_literal(driver, table));
    match driver {
+        DbDriver::Clickhouse => foreign_keys(driver).to_owned(),
        DbDriver::Sqlite => format!(
            "SELECT {s}, {t}, f.id, f.\"from\", {s}, f.\"table\", f.\"to\"              FROM pragma_foreign_key_list({t}, {s}) f ORDER BY f.id, f.seq"
        ),
@@ -276,6 +310,7 @@ pub fn table_foreign_keys(driver: DbDriver, schema: &str, table: &str) -> String
 /// The schema unqualified names resolve to (`None`: always `main`).
 pub fn current_schema(driver: DbDriver) -> Option<&'static str> {
    match driver {
+        DbDriver::Clickhouse => Some("SELECT currentDatabase()"),
        DbDriver::Sqlite => None,
        DbDriver::Postgres => Some("SELECT current_schema()"),
        DbDriver::Mysql => Some("SELECT DATABASE()"),
@@ -362,6 +397,9 @@ fn where_key(driver: DbDriver, key: &[CellValue]) -> String {
 /// The DML statement for `edit`. Values are written as quoted literals, which
 /// every supported database coerces to the column type.
 pub fn edit_statement(driver: DbDriver, schema: &str, table: &str, edit: &DbRowEdit) -> Result<String, String> {
+    if driver == DbDriver::Clickhouse {
+        return Err("ClickHouse table editing is unsupported: primary keys do not uniquely identify rows and edits require transactions".into());
+    }
    let target = qualified(driver, schema, table);
    match edit {
        DbRowEdit::Update { key, values } => {
@@ -450,6 +488,7 @@ pub fn postgres_ddl_indexes(oid: u32) -> String {
 pub fn triggers(driver: DbDriver, schema: &str, table: &str) -> String {
    let (s, t) = (quote_literal(driver, schema), quote_literal(driver, table));
    match driver {
+        DbDriver::Clickhouse => "SELECT '', '', '' WHERE 0".to_owned(),
        DbDriver::Sqlite => format!(
            "SELECT name, sql FROM {}.sqlite_master WHERE type = 'trigger' AND tbl_name = {t} ORDER BY name",
            quote_ident(driver, schema)
@@ -492,7 +531,7 @@ pub fn sqlite_trigger_event(sql: &str) -> (String, String) {
 pub fn routines(driver: DbDriver, schema: &str) -> Option<String> {
    let s = quote_literal(driver, schema);
    match driver {
-        DbDriver::Sqlite => None,
+        DbDriver::Sqlite | DbDriver::Clickhouse => None,
        // Functions of extensions are left out, as in IDEA.
        DbDriver::Postgres => Some(format!(
            "SELECT p.proname, CASE WHEN p.prokind = 'p' THEN 'procedure' ELSE 'function' END, \
@@ -625,6 +664,71 @@ mod tests {
        assert_eq!(quote_literal(DbDriver::Mysql, "it's \\"), "'it''s \\\\'");
    }

+    #[test]
+    fn clickhouse_escapes_backslashes_and_delimiters() {
+        let driver = DbDriver::Clickhouse;
+        assert_eq!(quote_literal(driver, r"path\O'Brien"), r"'path\\O''Brien'");
+        assert_eq!(quote_literal(driver, r"\' OR 1 = 1 --"), r"'\\'' OR 1 = 1 --'");
+        assert_eq!(quote_ident(driver, r"a\`b"), r"`a\\\`b`");
+        assert_eq!(qualified(driver, "data base", "event`log"), r"`data base`.`event\`log`");
+    }
+
+    #[test]
+    fn clickhouse_metadata_preserves_types_defaults_and_nonunique_keys() {
+        let driver = DbDriver::Clickhouse;
+        assert_eq!(schemas(driver, true), "SELECT name FROM system.databases ORDER BY name");
+        assert!(schemas(driver, false).contains("lower(name) NOT IN ('system', 'information_schema')"));
+        assert_eq!(current_schema(driver), Some("SELECT currentDatabase()"));
+        let relations = tables(driver, "event's\\db");
+        assert!(relations.contains("WHEN 'MaterializedView' THEN 'materialized view'"));
+        assert!(relations.contains(r"WHERE database = 'event''s\\db' AND is_temporary = 0"));
+        let fields = columns(driver, "default", "events");
+        assert!(fields.starts_with("SELECT name, type, CASE WHEN startsWith(type, 'Nullable(')"));
+        assert!(fields.contains("startsWith(type, 'LowCardinality(Nullable(')"));
+        assert!(fields.contains("if(default_kind = '', NULL, default_expression), is_in_primary_key"));
+        assert!(fields.ends_with("WHERE database = 'default' AND table = 'events' ORDER BY position"));
+        let keys = indexes(driver, "default", "events");
+        assert!(keys.contains("'PRIMARY KEY' AS index_name, 0 AS is_unique, primary_key AS expression"));
+        assert!(keys.contains("SELECT name, 0, expr FROM system.data_skipping_indices"));
+        let completion = completion_columns(driver);
+        assert!(completion.contains("c.is_in_primary_key, 1"));
+        assert!(completion.contains("ORDER BY c.database, c.table, c.position LIMIT 50000"));
+    }
+
+    #[test]
+    fn clickhouse_has_no_foreign_key_trigger_or_schema_routine_catalogs() {
+        let driver = DbDriver::Clickhouse;
+        assert_eq!(foreign_keys(driver), "SELECT '', '', '', '', '', '', '' WHERE 0");
+        assert_eq!(table_foreign_keys(driver, "default", "events"), foreign_keys(driver));
+        assert_eq!(triggers(driver, "default", "events"), "SELECT '', '', '' WHERE 0");
+        assert!(routines(driver, "default").is_none());
+        assert!(sequences(driver, "default").is_none());
+        assert!(object_ddl(driver, "default", crate::DbObjectKind::Trigger, "t").is_none());
+    }
+
+    #[test]
+    fn clickhouse_pages_quote_keys_and_fetch_one_extra_row() {
+        let sort = [SortKey { column: "event`id".into(), descending: true }];
+        assert_eq!(
+            table_page(DbDriver::Clickhouse, "default", "events", Some("WHERE id > 3"), &sort, 50, 25),
+            r"SELECT * FROM `default`.`events` WHERE id > 3 ORDER BY `event\`id` DESC LIMIT 26 OFFSET 50"
+        );
+    }
+
+    #[test]
+    fn clickhouse_keys_never_enable_transactional_table_edits() {
+        let key = vec![cv("id", Some("1"))];
+        for edit in [
+            DbRowEdit::Update { key: key.clone(), values: vec![cv("name", Some("new"))] },
+            DbRowEdit::Delete { key },
+            DbRowEdit::Insert { values: vec![cv("name", Some("new"))] },
+            DbRowEdit::Insert { values: vec![] },
+        ] {
+            let error = edit_statement(DbDriver::Clickhouse, "default", "events", &edit).unwrap_err();
+            assert!(error.contains("primary keys do not uniquely identify rows"));
+        }
+    }
+
    #[test]
    fn pages() {
        let sort = [SortKey { column: "id".into(), descending: true }];
@@ -0,0 +1,136 @@
+use ide_core::{CancellationToken, IdeError, IdeResult};
+use ide_db::{CellValue, DataSource, DbDriver, DbManager, DbRowEdit, DbSslMode, SortKey, sql};
+use std::sync::Arc;
+use std::time::{SystemTime, UNIX_EPOCH};
+
+fn check(condition: bool, message: &str) -> IdeResult<()> {
+    if condition { Ok(()) } else { Err(IdeError::invalid(message)) }
+}
+
+#[tokio::test]
+#[ignore = "requires CLICKHOUSE_TEST_HOST, CLICKHOUSE_TEST_USER, and CLICKHOUSE_TEST_PASSWORD"]
+async fn clickhouse_cloud_manager_catalogs_and_session_table() -> IdeResult<()> {
+    let tmp = tempfile::tempdir()?;
+    let root = tmp.path().to_path_buf();
+    let ssh = Arc::new(ide_ssh::SshManager::new(root.join("ssh-passwords.json")));
+    let db = DbManager::new(root.clone(), root.join("passwords.json"), root.join("history.json"), ssh);
+    let mut source = DataSource {
+        id: "clickhouse".into(),
+        name: "clickhouse".into(),
+        driver: DbDriver::Clickhouse,
+        host: std::env::var("CLICKHOUSE_TEST_HOST").expect("set CLICKHOUSE_TEST_HOST"),
+        port: Some(
+            std::env::var("CLICKHOUSE_TEST_PORT")
+                .map(|value| value.parse().expect("numeric CLICKHOUSE_TEST_PORT"))
+                .unwrap_or(8443),
+        ),
+        user: std::env::var("CLICKHOUSE_TEST_USER").expect("set CLICKHOUSE_TEST_USER"),
+        database: "default".into(),
+        ssl: DbSslMode::VerifyFull,
+        ..Default::default()
+    };
+    source.introspection.show_system = true;
+    let password = std::env::var("CLICKHOUSE_TEST_PASSWORD").expect("set CLICKHOUSE_TEST_PASSWORD");
+    check(!db.test(&source, Some(password.clone()), None).await?.is_empty(), "missing server version")?;
+    db.save_sources(vec![source]).await?;
+    db.set_password("clickhouse", Some(password), false).await?;
+    let cancel = CancellationToken::new();
+    let suffix = SystemTime::now().duration_since(UNIX_EPOCH).unwrap().as_nanos();
+    let name = format!("manager_test_{}_{suffix}", std::process::id());
+    let table = sql::quote_ident(DbDriver::Clickhouse, &name);
+    db.execute(
+        "clickhouse",
+        &format!(
+            "CREATE TEMPORARY TABLE {table} (id UInt64, label Nullable(String) DEFAULT NULL, \
+             category LowCardinality(Nullable(String)) DEFAULT NULL, items Array(Nullable(UInt8)), \
+             label_size UInt64 ALIAS length(ifNull(label, ''))) ENGINE = Memory"
+        ),
+        0,
+        &cancel,
+    )
+    .await?;
+    let checked: IdeResult<()> = async {
+        db.execute(
+            "clickhouse",
+            &format!("INSERT INTO {table} (id, label, items) VALUES (1, 'first', [1, NULL]), (1, NULL, [])"),
+            0,
+            &cancel,
+        )
+        .await?;
+        let schemas = db.schemas("clickhouse").await?;
+        check(schemas.iter().any(|schema| schema == "default"), "default database missing")?;
+        check(schemas.iter().any(|schema| schema == "system"), "system database missing")?;
+        let tables = db.tables("clickhouse", "system").await?;
+        check(tables.iter().any(|table| table.name == "one"), "system table listing missing one")?;
+        let details = db.table_details("clickhouse", "", &name).await?;
+        check(details.columns.len() == 5, "temporary table columns missing")?;
+        for (name, data_type, nullable) in [
+            ("id", "UInt64", false),
+            ("label", "Nullable(String)", true),
+            ("category", "LowCardinality(Nullable(String))", true),
+            ("items", "Array(Nullable(UInt8))", false),
+        ] {
+            check(
+                details
+                    .columns
+                    .iter()
+                    .any(|column| column.name == name && column.data_type == data_type && column.nullable == nullable),
+                "column type or nullability mismatch",
+            )?;
+        }
+        check(
+            details.columns.iter().any(|column| column.name == "label" && column.default.as_deref() == Some("NULL")),
+            "explicit default expression missing",
+        )?;
+        check(details.indexes.iter().all(|index| !index.unique), "ClickHouse index reported unique")?;
+        check(details.foreign_keys.is_empty() && details.triggers.is_empty(), "unsupported table objects returned")?;
+        let sort = [SortKey { column: "id".into(), descending: false }];
+        let first = db.table_page("clickhouse", "", &name, None, &sort, 0, 1, &cancel).await?;
+        check(first.result.rows.len() == 1 && first.result.has_more, "first page limit failed")?;
+        let second = db.table_page("clickhouse", "", &name, None, &sort, 1, 1, &cancel).await?;
+        check(second.result.rows.len() == 1 && !second.result.has_more, "page offset failed")?;
+        let ddl = db.ddl("clickhouse", "", &name).await?;
+        check(ddl.contains(&name) && ddl.contains("Memory"), "temporary table DDL missing")?;
+        let completion = db.completion("clickhouse").await?;
+        check(completion.default_schema == "default", "completion default database mismatch")?;
+        check(completion.foreign_keys.is_empty(), "completion returned unsupported foreign keys")?;
+        if let Some(table) = completion.tables.first() {
+            let details = db.table_details("clickhouse", &table.schema, &table.name).await?;
+            check(
+                table.columns.iter().all(|column| {
+                    details.columns.iter().any(|field| field.name == column.name && field.data_type == column.data_type)
+                }),
+                "completion columns differ from catalog",
+            )?;
+        }
+        let plan = db.explain("clickhouse", &format!("SELECT id FROM {table}"), &cancel).await?;
+        check(!plan.is_empty(), "query plan missing")?;
+        let value = r"path\O'Brien";
+        let result = db
+            .execute("clickhouse", &format!("SELECT {}", sql::quote_literal(DbDriver::Clickhouse, value)), 1, &cancel)
+            .await?;
+        check(result.rows == vec![vec![Some(value.to_owned())]], "quoted literal changed value")?;
+        let edits = [DbRowEdit::Update {
+            key: vec![CellValue { column: "id".into(), value: Some("1".into()) }],
+            values: vec![CellValue { column: "label".into(), value: Some("changed".into()) }],
+        }];
+        check(
+            db.apply_edits("clickhouse", "", &name, &edits)
+                .await
+                .err()
+                .is_some_and(|error| error.message.contains("table editing is unsupported")),
+            "supplied row key authorized table editing",
+        )?;
+        check(db.set_manual_commit("clickhouse", true).await.is_err(), "manual transactions were accepted")?;
+        for commit in [false, true] {
+            check(db.finish_transaction("clickhouse", commit).await.is_err(), "transaction control was accepted")?;
+        }
+        Ok(())
+    }
+    .await;
+    let cleanup = db.execute("clickhouse", &format!("DROP TEMPORARY TABLE {table}"), 0, &cancel).await;
+    db.disconnect("clickhouse").await;
+    checked?;
+    cleanup?;
+    Ok(())
+}
@@ -1,7 +1,9 @@
 //! Introspection, queries and table edits against a real SQLite file.

 use ide_core::{CancellationToken, IdeResult};
-use ide_db::{CellValue, DataSource, DbDriver, DbManager, DbOptions, DbProperty, DbRowEdit, DbTableKind, SortKey};
+use ide_db::{
+    CellValue, DataSource, DbDriver, DbManager, DbOptions, DbProperty, DbRowEdit, DbTableKind, QueryResult, SortKey,
+};

 async fn setup() -> (tempfile::TempDir, DbManager) {
    let tmp = tempfile::tempdir().unwrap();
@@ -123,6 +125,28 @@ async fn queries_with_limits_nulls_and_blobs() -> IdeResult<()> {
    Ok(())
 }

+#[tokio::test]
+async fn a_later_page_returns_only_its_rows() -> IdeResult<()> {
+    let (_tmp, db) = setup().await;
+    let c = CancellationToken::new();
+    let sql = "SELECT id FROM users ORDER BY id";
+    let ids = |r: &QueryResult| r.rows.iter().map(|row| row[0].clone().unwrap()).collect::<Vec<_>>();
+
+    let second = db.execute_from("s1", sql, 1, 1, &c).await?;
+    assert_eq!(ids(&second), vec!["2"]);
+    assert!(second.has_more);
+    assert_eq!(second.columns.len(), 1);
+
+    let last = db.execute_from("s1", sql, 2, 5, &c).await?;
+    assert_eq!(ids(&last), vec!["3"]);
+    assert!(!last.has_more);
+
+    let past = db.execute_from("s1", sql, 9, 5, &c).await?;
+    assert!(past.rows.is_empty() && !past.has_more);
+    assert_eq!(past.columns.len(), 1, "columns of a page past the end come from the prepared statement");
+    Ok(())
+}
+
 #[tokio::test]
 async fn pages_sorts_filters_and_edits_in_a_transaction() -> IdeResult<()> {
    let (_tmp, db) = setup().await;
@@ -197,7 +221,7 @@ async fn count(db: &DbManager) -> String {
 async fn manual_commit_keeps_a_transaction_until_commit_or_rollback() -> IdeResult<()> {
    let (_tmp, db) = setup().await;
    let c = CancellationToken::new();
-    db.set_manual_commit("s1", true).await;
+    db.set_manual_commit("s1", true).await.unwrap();
    db.execute("s1", "INSERT INTO users (name) VALUES ('dee')", 1, &c).await?;
    // The session sees its own change.
    assert_eq!(count(&db).await, "4");
@@ -208,10 +232,10 @@ async fn manual_commit_keeps_a_transaction_until_commit_or_rollback() -> IdeResu
    db.finish_transaction("s1", true).await?;
    // Leaving manual mode rolls back what is still open.
    db.execute("s1", "DELETE FROM users", 1, &c).await?;
-    db.set_manual_commit("s1", false).await;
+    db.set_manual_commit("s1", false).await.unwrap();
    assert_eq!(count(&db).await, "4");
    // Disconnecting with an open transaction does not hang.
-    db.set_manual_commit("s1", true).await;
+    db.set_manual_commit("s1", true).await.unwrap();
    db.execute("s1", "DELETE FROM users", 1, &c).await?;
    db.disconnect("s1").await;
    assert_eq!(count(&db).await, "4");
@@ -79,7 +79,9 @@ impl Capability {
            Self::Secrets => "Store secrets in the system keychain".into(),
            Self::Events => "Observe workbench events (files opened, saved, focus)".into(),
            Self::InputEvents => "Observe keystrokes and editor input".into(),
-            Self::Clipboard => "Read and write the clipboard from its web views".into(),
+            Self::Clipboard => {
+                "Copy to the clipboard from its commands, and read and write it from its web views".into()
+            }
            Self::Net(host) => format!("Connect to {host} (from the machine the project is on)"),
            Self::Process(bin) => format!("Run {bin} — equivalent to running arbitrary code on this machine"),
            Self::FsRead(path) => format!("Read files under {path}, outside the project"),
@@ -364,7 +364,7 @@ pub fn package_hash(dir: &Path, files: &[PathBuf]) -> std::io::Result<String> {
    sorted.dedup();
    let mut hasher = blake3::Hasher::new();
    for rel in sorted {
-        hasher.update(rel.to_string_lossy().as_bytes());
+        hasher.update(hashed_path(rel).as_bytes());
        hasher.update(&[0]);
        hasher.update_reader(std::fs::File::open(dir.join(rel))?)?;
        hasher.update(&[0]);
@@ -372,6 +372,12 @@ pub fn package_hash(dir: &Path, files: &[PathBuf]) -> std::io::Result<String> {
    Ok(hasher.finalize().to_hex().to_string())
 }

+/// A package-relative path as hashed: `/`-separated on every OS, so a package has one digest
+/// (a walked `web\index.html` on Windows is `web/index.html` everywhere else).
+fn hashed_path(rel: &Path) -> String {
+    rel.components().map(|c| c.as_os_str().to_string_lossy()).collect::<Vec<_>>().join("/")
+}
+
 #[cfg(test)]
 mod tests {
    use super::*;
@@ -480,4 +486,20 @@ mod tests {
        let groups = by_risk(&caps(&["storage", "process:git", "net:x.io"]));
        assert_eq!(groups.iter().map(|g| g.0).collect::<Vec<_>>(), [Risk::High, Risk::Medium, Risk::Low]);
    }
+
+    #[test]
+    fn hashes_paths_with_forward_slashes_on_every_os() {
+        assert_eq!(hashed_path(Path::new("web/index.html")), "web/index.html");
+        assert_eq!(hashed_path(Path::new("plugin.wasm")), "plugin.wasm");
+        #[cfg(windows)]
+        assert_eq!(hashed_path(Path::new(r"web\index.html")), "web/index.html");
+        let tmp = tempfile::tempdir().unwrap();
+        std::fs::create_dir(tmp.path().join("web")).unwrap();
+        std::fs::write(tmp.path().join("web").join("index.html"), "<p>").unwrap();
+        // A walked path (native separators) hashes like the manifest's `/` spelling.
+        assert_eq!(
+            package_hash(tmp.path(), &[Path::new("web").join("index.html")]).unwrap(),
+            package_hash(tmp.path(), &["web/index.html".into()]).unwrap()
+        );
+    }
 }
@@ -27,8 +27,8 @@ mod when;
 pub use capability::{Capability, CapabilityInfo, Risk, host_matches};
 pub use index::ContributionIndex;
 pub use manifest::{
-    ActivationEvent, Capabilities, ENGINE_VERSION, EVENT_KINDS, LEGACY_API, MANIFEST_FILE, Manifest, check_relative,
-    engine_compatible, validate_item_id, validate_plugin_id, validate_point_id,
+    ActivationEvent, CATEGORIES, Capabilities, ENGINE_VERSION, EVENT_KINDS, LEGACY_API, MANIFEST_FILE, MAX_CATEGORIES,
+    Manifest, check_relative, engine_compatible, validate_item_id, validate_plugin_id, validate_point_id,
 };
 pub use point::{Commit, Disposable, ExtensionPoint, MAX_PACKAGE_FILE, Package, Placement, Prepared, decode};
 pub use registry::{ContributionInfo, ExtensionRegistry, PreparedSet};
@@ -32,9 +32,14 @@ use std::path::{Component, Path, PathBuf};

 pub const MANIFEST_FILE: &str = "plugin.toml";
 /// The plugin API (engine) version this host implements.
-pub const ENGINE_VERSION: &str = "1.0.0";
+pub const ENGINE_VERSION: &str = "1.1.0";
 /// The 0.1 API, still accepted for contribution-only packages and 0.1 components.
 pub const LEGACY_API: &str = "0.1";
+/// Marketplace categories, in the order they are shown.
+pub const CATEGORIES: &[&str] =
+    &["languages", "themes", "icon-themes", "linters", "vcs", "ai", "frameworks", "tools", "other"];
+/// Categories a plugin is listed under; later ones are ignored.
+pub const MAX_CATEGORIES: usize = 3;

 #[derive(Clone, Debug, PartialEq)]
 pub struct Manifest {
@@ -47,6 +52,8 @@ pub struct Manifest {
    pub license: Option<String>,
    /// Release notes of this version (Settings › Plugins › What's New).
    pub change_notes: Option<String>,
+    /// Marketplace categories as declared (see [`Manifest::categories`]).
+    pub declared_categories: Vec<String>,
    /// `engines.openidea` (a semver requirement), or the legacy `openidea-api`.
    pub engine: String,
    /// Written in the 0.1 format.
@@ -166,6 +173,8 @@ struct Raw {
    #[serde(default)]
    change_notes: Option<String>,
    #[serde(default)]
+    categories: Vec<String>,
+    #[serde(default)]
    engines: Option<Engines>,
    /// 0.1 format.
    #[serde(default)]
@@ -243,6 +252,7 @@ impl Manifest {
            homepage: raw.homepage,
            license: raw.license,
            change_notes: raw.change_notes,
+            declared_categories: raw.categories,
            engine,
            legacy,
            wasm: raw.wasm,
@@ -290,6 +300,9 @@ impl Manifest {
                return Err(format!("duplicate activation event {event}"));
            }
        }
+        for c in &self.declared_categories {
+            validate_item_id(c, "category")?;
+        }
        for (point, decls) in &self.contributes {
            validate_point_id(point)?;
            if !matches!(decls, toml::Value::Array(_) | toml::Value::Table(_)) {
@@ -325,6 +338,39 @@ impl Manifest {
    }
 }

+impl Manifest {
+    /// Its marketplace categories, in [`CATEGORIES`] order: the first
+    /// [`MAX_CATEGORIES`] declared that this IDE knows; without any, those its
+    /// contributions imply (themes, icon themes, languages), else `other`.
+    pub fn categories(&self) -> Vec<String> {
+        let pick = |f: &dyn Fn(&str) -> bool| CATEGORIES.iter().filter(|c| f(c)).map(|c| c.to_string()).collect();
+        let mut known: Vec<&str> = Vec::new();
+        for d in &self.declared_categories {
+            if CATEGORIES.contains(&d.as_str()) && !known.contains(&d.as_str()) && known.len() < MAX_CATEGORIES {
+                known.push(d);
+            }
+        }
+        let mut out: Vec<String> = pick(&|c| known.contains(&c));
+        if out.is_empty() {
+            out = pick(&|c| match c {
+                "themes" => self.contributes.contains_key("themes"),
+                "icon-themes" => self.contributes.contains_key("iconThemes"),
+                "languages" => self.contributes.contains_key("languages"),
+                _ => false,
+            });
+        }
+        if out.is_empty() {
+            out.push("other".into());
+        }
+        out
+    }
+
+    /// Declared categories this IDE doesn't know (ignored).
+    pub fn unknown_categories(&self) -> Vec<&str> {
+        self.declared_categories.iter().map(String::as_str).filter(|c| !CATEGORIES.contains(c)).collect()
+    }
+}
+
 /// Whether this host can load a plugin written for `engine`.
 pub fn engine_compatible(engine: &str, legacy: bool) -> bool {
    if legacy {
@@ -417,6 +463,26 @@ mod tests {
        assert!(ActivationEvent::parse("on-event:scheduled").is_err(), "declared with on-schedule");
    }

+    #[test]
+    fn categories_are_declared_or_implied() {
+        let head = "id = \"acme.x\"\nname = \"X\"\nversion = \"1.0.0\"\nengines.openidea = \"^1.0\"\n";
+        let m = |rest: &str| Manifest::parse(&format!("{head}{rest}"));
+        // Declared, in the catalogue's order; unknown ones (a newer IDE's) are ignored.
+        let declared = m("categories = [\"tools\", \"vcs\", \"robots\"]\n").unwrap();
+        assert_eq!(declared.categories(), ["vcs", "tools"]);
+        assert_eq!(declared.unknown_categories(), ["robots"]);
+        // None declared: implied by the contributions, else `other`.
+        let theme = m("[[contributes.themes]]\nid = \"t\"\n[[contributes.languages]]\nid = \"l\"\n").unwrap();
+        assert_eq!(theme.categories(), ["languages", "themes"]);
+        let declared_wins = m("categories = [\"tools\"]\n[[contributes.languages]]\nid = \"l\"\n").unwrap();
+        assert_eq!(declared_wins.categories(), ["tools"]);
+        assert_eq!(m("").unwrap().categories(), ["other"]);
+        // At most three: the first ones declared.
+        let many = m("categories = [\"vcs\", \"ai\", \"vcs\", \"tools\", \"themes\"]\n").unwrap();
+        assert_eq!(many.categories(), ["vcs", "ai", "tools"]);
+        assert!(m("categories = [\"Bad Name\"]\n").is_err());
+    }
+
    #[test]
    fn parses_the_02_format() {
        let m = Manifest::parse(FULL).unwrap();
@@ -9,9 +9,19 @@
 //!   proves who published the bytes; whether to trust that publisher is the
 //!   index's call.
 //! - **Index** (`index.json`): the publishers and their keys (the trust root),
-//!   the published plugins, and revocations. A publisher owns the id prefix
-//!   `<publisher>.`; a revoked key invalidates everything it signed, a
-//!   revoked plugin version is disabled where it is installed.
+//!   the published plugin versions, and revocations. A publisher owns the id
+//!   prefix `<publisher>.`; a revoked key invalidates everything it signed, a
+//!   revoked plugin version is disabled where it is installed. A plugin may be
+//!   listed in several versions, each with the plugin API it needs: the IDE
+//!   offers the newest one it can load.
+//! - **Key continuity**: an installed plugin updates silently only to a
+//!   package signed with the same key, or with a key the installed one
+//!   endorsed ([`Endorsement`], a publisher rotating keys); any other signer
+//!   is the user's call. An IDE can pin a publisher to keys it was built with
+//!   ([`Index::pin_publisher`]): the index then can't replace them.
+//! - **Format**: fields are only ever added (IDEs ignore those they don't
+//!   know); `format` grows only for changes older IDEs can't read, and they
+//!   still apply such an index's revocations ([`Index::parse`]).

 use crate::MANIFEST_FILE;
 use base64::Engine as _;
@@ -40,6 +50,24 @@ fn signed_message(id: &str, version: &str, digest: &str) -> Vec<u8> {
    format!("openidea-plugin/1\n{id}\n{version}\n{digest}").into_bytes()
 }

+fn endorsement_message(publisher: &str, key: &str) -> Vec<u8> {
+    format!("openidea-key/1\n{publisher}\n{key}").into_bytes()
+}
+
+/// Whether `signature` (base64) is `key`'s (base64) Ed25519 signature of
+/// `message`; malformed keys and signatures are errors.
+fn verify_ed25519(key: &str, message: &[u8], signature: &str) -> Result<bool, String> {
+    let key: [u8; 32] = B64
+        .decode(key)
+        .ok()
+        .and_then(|b| b.try_into().ok())
+        .ok_or_else(|| "signature: malformed public key".to_owned())?;
+    let key = VerifyingKey::from_bytes(&key).map_err(|_| "signature: invalid public key".to_owned())?;
+    let sig: [u8; 64] =
+        B64.decode(signature).ok().and_then(|b| b.try_into().ok()).ok_or_else(|| "signature: malformed".to_owned())?;
+    Ok(key.verify_strict(message, &Signature::from_bytes(&sig)).is_ok())
+}
+
 /// `SIGNATURE.json` of a signed package.
 #[derive(Clone, Debug, PartialEq, Eq, Serialize, Deserialize)]
 #[serde(rename_all = "camelCase")]
@@ -74,6 +102,12 @@ impl PublisherKey {
        B64.encode(self.0.verifying_key().to_bytes())
    }

+    /// Vouches for `publisher`'s new key `key` (base64), the one that follows this one.
+    pub fn endorse(&self, publisher: &str, key: &str) -> Endorsement {
+        let sig = self.0.sign(&endorsement_message(publisher, key));
+        Endorsement { key: self.public_base64(), signature: B64.encode(sig.to_bytes()) }
+    }
+
    pub fn sign(&self, publisher: &str, id: &str, version: &str, digest: &str) -> PackageSignature {
        let sig = self.0.sign(&signed_message(id, version, digest));
        PackageSignature {
@@ -88,19 +122,11 @@ impl PackageSignature {
    /// Whether the signature is valid for `id`, `version` and `digest` (the
    /// key's validity is checked against an [`Index`]).
    pub fn check(&self, id: &str, version: &str, digest: &str) -> Result<(), String> {
-        let key: [u8; 32] = B64
-            .decode(&self.key)
-            .ok()
-            .and_then(|b| b.try_into().ok())
-            .ok_or_else(|| "signature: malformed public key".to_owned())?;
-        let key = VerifyingKey::from_bytes(&key).map_err(|_| "signature: invalid public key".to_owned())?;
-        let sig: [u8; 64] = B64
-            .decode(&self.signature)
-            .ok()
-            .and_then(|b| b.try_into().ok())
-            .ok_or_else(|| "signature: malformed".to_owned())?;
-        key.verify_strict(&signed_message(id, version, digest), &Signature::from_bytes(&sig))
-            .map_err(|_| "the signature does not match the package (it was changed after signing)".to_owned())
+        if verify_ed25519(&self.key, &signed_message(id, version, digest), &self.signature)? {
+            Ok(())
+        } else {
+            Err("the signature does not match the package (it was changed after signing)".to_owned())
+        }
    }
 }

@@ -242,6 +268,10 @@ pub struct Index {
    pub plugins: Vec<IndexEntry>,
    #[serde(default)]
    pub revoked: Vec<Revocation>,
+    /// The marketplace moved: its index is at this URL (relative to this
+    /// one, or absolute), and the IDE reads that one instead.
+    #[serde(default, skip_serializing_if = "Option::is_none")]
+    pub moved: Option<String>,
 }

 #[derive(Clone, Debug, PartialEq, Eq, Serialize, Deserialize, specta::Type)]
@@ -253,7 +283,7 @@ pub struct Publisher {
    pub keys: Vec<KeyEntry>,
 }

-#[derive(Clone, Debug, PartialEq, Eq, Serialize, Deserialize, specta::Type)]
+#[derive(Clone, Debug, Default, PartialEq, Eq, Serialize, Deserialize, specta::Type)]
 #[serde(rename_all = "camelCase")]
 pub struct KeyEntry {
    /// Ed25519 public key, base64.
@@ -261,6 +291,27 @@ pub struct KeyEntry {
    /// Packages signed with it are no longer trusted.
    #[serde(default)]
    pub revoked: bool,
+    /// The publisher's earlier key vouching for this one.
+    #[serde(default, skip_serializing_if = "Option::is_none")]
+    pub endorsement: Option<Endorsement>,
+}
+
+impl KeyEntry {
+    pub fn new(key: String) -> Self {
+        Self { key, ..Self::default() }
+    }
+}
+
+/// A publisher's earlier key vouching for a newer one: plugins installed from
+/// packages signed with the earlier key update to ones signed with the newer
+/// key without asking the user.
+#[derive(Clone, Debug, PartialEq, Eq, Serialize, Deserialize, specta::Type)]
+#[serde(rename_all = "camelCase")]
+pub struct Endorsement {
+    /// The endorsing key, base64.
+    pub key: String,
+    /// Its Ed25519 signature of `openidea-key/1\n<publisher>\n<endorsed key>`, base64.
+    pub signature: String,
 }

 /// A published plugin version.
@@ -281,6 +332,34 @@ pub struct IndexEntry {
    pub digest: String,
    #[serde(default)]
    pub capabilities: Vec<String>,
+    /// The plugin API versions it loads in (a semver requirement): its
+    /// manifest's `engines.openidea` and the API its component was built for.
+    /// Required: an entry without one is offered to no IDE.
+    #[serde(default)]
+    pub engine: String,
+    /// Marketplace categories (`CATEGORIES`); an IDE ignores those it doesn't know.
+    #[serde(default)]
+    pub categories: Vec<String>,
+}
+
+impl IndexEntry {
+    /// Whether this IDE can load the version.
+    pub fn compatible(&self) -> bool {
+        crate::engine_compatible(&self.engine, false)
+    }
+
+    fn semver(&self) -> Option<semver::Version> {
+        semver::Version::parse(&self.version).ok()
+    }
+}
+
+/// `engines.openidea` of a manifest narrowed to the API its component was built
+/// for (`major.minor`, if it has code): the requirement an index lists.
+pub fn engine_requirement(manifest_engine: &str, built_for: Option<&semver::Version>) -> String {
+    match built_for {
+        Some(v) => format!("{manifest_engine}, ^{}.{}", v.major, v.minor),
+        None => manifest_engine.to_owned(),
+    }
 }

 /// A plugin (all versions when `versions` is empty) that must not run.
@@ -294,12 +373,71 @@ pub struct Revocation {
 }

 impl Index {
+    /// Parses an index. One in a newer format keeps what must reach every IDE —
+    /// revocations, publisher keys (revoked ones) and `moved` — and lists no
+    /// plugins ([`Index::is_newer`]): the IDE needs updating to install from it.
    pub fn parse(text: &str) -> Result<Self, String> {
-        let index: Index = serde_json::from_str(text).map_err(|e| format!("index: {e}"))?;
-        if index.format != INDEX_FORMAT {
-            return Err(format!("index format {} is not supported (this IDE reads {INDEX_FORMAT})", index.format));
+        let value: serde_json::Value = serde_json::from_str(text).map_err(|e| format!("index: {e}"))?;
+        let format = value.get("format").and_then(serde_json::Value::as_u64).ok_or("index: `format` is missing")?;
+        if format == u64::from(INDEX_FORMAT) {
+            return serde_json::from_value(value).map_err(|e| format!("index: {e}"));
        }
-        Ok(index)
+        if format < u64::from(INDEX_FORMAT) {
+            return Err(format!("index format {format} is not supported (this IDE reads {INDEX_FORMAT})"));
+        }
+        fn each<T: serde::de::DeserializeOwned>(value: &serde_json::Value, field: &str) -> Vec<T> {
+            let items = value.get(field).and_then(serde_json::Value::as_array);
+            items.into_iter().flatten().filter_map(|v| serde_json::from_value(v.clone()).ok()).collect()
+        }
+        Ok(Index {
+            format: u32::try_from(format).unwrap_or(u32::MAX),
+            publishers: each(&value, "publishers"),
+            plugins: Vec::new(),
+            revoked: each(&value, "revoked"),
+            moved: value.get("moved").and_then(serde_json::Value::as_str).map(str::to_owned),
+        })
+    }
+
+    /// Written in a format newer than this IDE reads: it lists no plugins.
+    pub fn is_newer(&self) -> bool {
+        self.format > INDEX_FORMAT
+    }
+
+    /// The version of each plugin to offer, and whether this IDE can load it:
+    /// the newest it can load, else the newest. Revoked versions are skipped;
+    /// plugins come in the order they are first listed.
+    pub fn offered(&self) -> Vec<(&IndexEntry, bool)> {
+        let mut ids: Vec<&str> = Vec::new();
+        for e in &self.plugins {
+            if !ids.contains(&e.id.as_str()) {
+                ids.push(&e.id);
+            }
+        }
+        ids.into_iter()
+            .filter_map(|id| {
+                let versions: Vec<&IndexEntry> =
+                    self.plugins.iter().filter(|e| e.id == id && self.revocation(id, &e.version).is_none()).collect();
+                let newest = |loadable: bool| {
+                    versions.iter().copied().filter(|e| !loadable || e.compatible()).max_by_key(|e| e.semver())
+                };
+                newest(true).map(|e| (e, true)).or_else(|| newest(false).map(|e| (e, false)))
+            })
+            .collect()
+    }
+
+    /// Drops the versions no IDE would pick: revoked ones, and of each plugin
+    /// all but the newest version per API requirement.
+    pub fn prune_versions(&mut self) {
+        let plugins = std::mem::take(&mut self.plugins);
+        let mut kept: Vec<IndexEntry> = Vec::new();
+        for e in plugins.into_iter().filter(|e| self.revocation(&e.id, &e.version).is_none()) {
+            match kept.iter_mut().find(|k| k.id == e.id && k.engine == e.engine) {
+                Some(k) if e.semver() > k.semver() => *k = e,
+                Some(_) => {}
+                None => kept.push(e),
+            }
+        }
+        self.plugins = kept;
    }

    /// The revocation that applies to `id` at `version`.
@@ -335,6 +473,127 @@ impl Index {
        sig.check(id, version, digest)?;
        Ok(publisher.id.clone())
    }
+
+    /// Whether `to` is `from`, or a key of `publisher` that `from` endorsed,
+    /// directly or through keys it endorsed. Endorsements by revoked keys don't
+    /// count: whoever stole a key could vouch for their own.
+    pub fn succeeds(&self, publisher: &str, from: &str, to: &str) -> bool {
+        let keys = self.publishers.iter().find(|p| p.id == publisher).map_or(&[][..], |p| &p.keys[..]);
+        let mut key = to;
+        // Each step moves to an earlier key; more steps than keys is a loop.
+        for _ in 0..=keys.len() {
+            if key == from {
+                return true;
+            }
+            let Some(e) = keys.iter().find(|k| k.key == key).and_then(|k| k.endorsement.as_ref()) else {
+                return false;
+            };
+            let endorser_valid = keys.iter().any(|k| k.key == e.key && !k.revoked);
+            if !endorser_valid || verify_ed25519(&e.key, &endorsement_message(publisher, key), &e.signature) != Ok(true)
+            {
+                return false;
+            }
+            key = &e.key;
+        }
+        false
+    }
+
+    /// Makes `roots` (base64) the keys `publisher` signs with, whatever this
+    /// index says: another key it lists stays only when a root endorsed it (a
+    /// rotation the roots vouched for). Revocations of the keys are kept.
+    pub fn pin_publisher(&mut self, publisher: &str, name: &str, roots: &[String]) {
+        if roots.is_empty() {
+            return;
+        }
+        let i = match self.publishers.iter().position(|p| p.id == publisher) {
+            Some(i) => i,
+            None => {
+                self.publishers.push(Publisher { id: publisher.into(), name: name.into(), keys: Vec::new() });
+                self.publishers.len() - 1
+            }
+        };
+        for root in roots {
+            if !self.publishers[i].keys.iter().any(|k| &k.key == root) {
+                self.publishers[i].keys.push(KeyEntry::new(root.clone()));
+            }
+        }
+        let keys = self.publishers[i].keys.clone();
+        let trusted = keys
+            .into_iter()
+            .filter(|k| roots.iter().any(|r| self.succeeds(publisher, r, &k.key)))
+            .map(|k| if roots.contains(&k.key) { KeyEntry { endorsement: None, ..k } } else { k })
+            .collect();
+        self.publishers[i].keys = trusted;
+    }
+
+    /// Replaces what this index lists for every publisher but `keep` with what
+    /// `other` lists: its publishers, their plugins and their revocations
+    /// (`other`'s downloads should already be absolute). `other` may only
+    /// speak for its own publishers, and none of them may be in `keep`.
+    pub fn include(&mut self, other: Index, keep: &[&str]) -> Result<(), String> {
+        let mut theirs: Vec<&str> = Vec::new();
+        for p in &other.publishers {
+            if !publisher_id_ok(&p.id) {
+                return Err(format!("invalid publisher id {:?}: use a-z, 0-9, '-' and '_'", p.id));
+            }
+            if keep.contains(&p.id.as_str()) {
+                return Err(format!("may not list publisher {:?}", p.id));
+            }
+            if theirs.contains(&p.id.as_str()) {
+                return Err(format!("publisher {:?} is listed twice", p.id));
+            }
+            theirs.push(&p.id);
+        }
+        let owned_by = |id: &str| theirs.iter().any(|p| owns(p, id));
+        for e in &other.plugins {
+            if !theirs.contains(&e.publisher.as_str()) || !owns(&e.publisher, &e.id) {
+                return Err(format!("{}: not a plugin of publisher {:?}", e.id, e.publisher));
+            }
+            if semver::VersionReq::parse(&e.engine).is_err() {
+                return Err(format!("{} {}: `engine` must be the plugin API it needs", e.id, e.version));
+            }
+        }
+        if let Some(r) = other.revoked.iter().find(|r| !owned_by(&r.id)) {
+            return Err(format!("{}: revoked by an index that doesn't publish it", r.id));
+        }
+        let kept = |id: &str| keep.iter().any(|p| owns(p, id));
+        self.publishers.retain(|p| keep.contains(&p.id.as_str()));
+        self.plugins.retain(|e| keep.contains(&e.publisher.as_str()));
+        self.revoked.retain(|r| kept(&r.id));
+        self.publishers.extend(other.publishers);
+        self.plugins.extend(other.plugins);
+        self.revoked.extend(other.revoked);
+        Ok(())
+    }
+}
+
+/// Whether a package signed `new` (`None`: unsigned) may replace an installed
+/// one signed `installed` without asking the user: signed with the same key,
+/// or with one the installed key endorsed (per `index`). An unsigned installed
+/// copy pins nothing.
+pub fn signer_continues(
+    index: Option<&Index>,
+    installed: Option<&PackageSignature>,
+    new: Option<&PackageSignature>,
+) -> bool {
+    match (installed, new) {
+        (None, _) => true,
+        (Some(_), None) => false,
+        (Some(old), Some(new)) => {
+            old.publisher == new.publisher
+                && (old.key == new.key || index.is_some_and(|i| i.succeeds(&new.publisher, &old.key, &new.key)))
+        }
+    }
+}
+
+/// Whether the plugin `id` is in `publisher`'s namespace.
+fn owns(publisher: &str, id: &str) -> bool {
+    id.strip_prefix(publisher).is_some_and(|rest| rest.starts_with('.'))
+}
+
+/// A publisher id is a single segment of a plugin id.
+pub fn publisher_id_ok(id: &str) -> bool {
+    !id.contains('.') && crate::validate_plugin_id(id).is_ok()
 }

 #[cfg(test)]
@@ -354,7 +613,7 @@ mod tests {
            publishers: vec![Publisher {
                id: "acme".into(),
                name: "ACME".into(),
-                keys: vec![KeyEntry { key: key.public_base64(), revoked: false }],
+                keys: vec![KeyEntry::new(key.public_base64())],
            }],
            plugins: Vec::new(),
            revoked: vec![Revocation {
@@ -362,6 +621,7 @@ mod tests {
                versions: vec!["1.0.0".into()],
                reason: "malware".into(),
            }],
+            moved: None,
        }
    }

@@ -399,6 +659,138 @@ mod tests {
        assert_eq!(PublisherKey::from_base64(&key.seed_base64()).unwrap().public_base64(), key.public_base64());
    }

+    fn entry(id: &str, publisher: &str) -> IndexEntry {
+        IndexEntry {
+            id: id.into(),
+            name: id.into(),
+            version: "1.0.0".into(),
+            description: String::new(),
+            authors: Vec::new(),
+            publisher: publisher.into(),
+            download: format!("https://example.com/{id}.oiplugin"),
+            digest: "d".into(),
+            capabilities: Vec::new(),
+            engine: "^1.0".into(),
+            categories: Vec::new(),
+        }
+    }
+
+    fn version(id: &str, version: &str, engine: &str) -> IndexEntry {
+        IndexEntry { version: version.into(), engine: engine.into(), ..entry(id, "acme") }
+    }
+
+    #[test]
+    fn the_ide_is_offered_the_newest_version_it_can_load() {
+        let host = crate::ENGINE_VERSION;
+        let newer = semver::Version::parse(host).unwrap().major + 1;
+        let mut index = Index {
+            format: INDEX_FORMAT,
+            plugins: vec![
+                version("acme.a", "1.0.0", &format!("^{host}")),
+                version("acme.a", "1.2.0", &format!("^{host}")),
+                version("acme.a", "2.0.0", &format!("^{newer}.0")),
+                version("acme.b", "0.1.0", &format!("^{newer}.0")),
+                version("acme.b", "0.2.0", &format!("^{newer}.1")),
+                version("acme.c", "1.0.0", ""),
+                version("acme.c", "1.1.0", ""),
+            ],
+            revoked: vec![Revocation { id: "acme.c".into(), versions: vec!["1.1.0".into()], reason: "r".into() }],
+            ..Index::default()
+        };
+        let offered = |index: &Index| {
+            index.offered().into_iter().map(|(e, ok)| (e.id.clone(), e.version.clone(), ok)).collect::<Vec<_>>()
+        };
+        let expected = [
+            ("acme.a".to_owned(), "1.2.0".to_owned(), true),
+            ("acme.b".to_owned(), "0.2.0".to_owned(), false),
+            // No `engine`: listed, but no IDE installs it.
+            ("acme.c".to_owned(), "1.0.0".to_owned(), false),
+        ];
+        assert_eq!(offered(&index), expected);
+
+        // Pruning keeps the newest version per requirement, which changes nothing offered.
+        index.prune_versions();
+        let left: Vec<_> = index.plugins.iter().map(|e| format!("{} {}", e.id, e.version)).collect();
+        assert_eq!(left, ["acme.a 1.2.0", "acme.a 2.0.0", "acme.b 0.1.0", "acme.b 0.2.0", "acme.c 1.0.0"]);
+        assert_eq!(offered(&index), expected);
+
+        let built_for = semver::Version::new(1, 3, 0);
+        assert_eq!(engine_requirement("^1.0", Some(&built_for)), "^1.0, ^1.3");
+        assert_eq!(engine_requirement("^1.0", None), "^1.0");
+        assert!(semver::VersionReq::parse(&engine_requirement("^1.0", Some(&built_for))).is_ok());
+    }
+
+    fn publisher(id: &str) -> Publisher {
+        Publisher { id: id.into(), name: id.into(), keys: vec![KeyEntry::new(format!("{id}-key"))] }
+    }
+
+    fn revocation(id: &str) -> Revocation {
+        Revocation { id: id.into(), versions: Vec::new(), reason: "r".into() }
+    }
+
+    #[test]
+    fn including_an_index_replaces_everything_but_the_kept_publishers() {
+        let mut official = Index {
+            format: INDEX_FORMAT,
+            publishers: vec![publisher("openidea"), publisher("gone")],
+            plugins: vec![entry("openidea.a", "openidea"), entry("gone.x", "gone")],
+            revoked: vec![revocation("openidea.old"), revocation("gone.x")],
+            moved: None,
+        };
+        let community = Index {
+            format: INDEX_FORMAT,
+            publishers: vec![publisher("alice")],
+            plugins: vec![entry("alice.arthas", "alice")],
+            revoked: vec![revocation("alice.bad")],
+            moved: None,
+        };
+        official.include(community.clone(), &["openidea"]).unwrap();
+        let ids = |v: &[IndexEntry]| v.iter().map(|e| e.id.clone()).collect::<Vec<_>>();
+        assert_eq!(official.publishers.iter().map(|p| p.id.as_str()).collect::<Vec<_>>(), ["openidea", "alice"]);
+        assert_eq!(ids(&official.plugins), ["openidea.a", "alice.arthas"]);
+        assert_eq!(official.revoked.iter().map(|r| r.id.as_str()).collect::<Vec<_>>(), ["openidea.old", "alice.bad"]);
+
+        // Including again is idempotent.
+        let once = official.clone();
+        official.include(community.clone(), &["openidea"]).unwrap();
+        assert_eq!(official, once);
+    }
+
+    #[test]
+    fn an_included_index_speaks_only_for_its_own_publishers() {
+        let base = Index { format: INDEX_FORMAT, publishers: vec![publisher("openidea")], ..Index::default() };
+        let with = |publishers: Vec<Publisher>, plugins: Vec<IndexEntry>, revoked: Vec<Revocation>| Index {
+            format: INDEX_FORMAT,
+            publishers,
+            plugins,
+            revoked,
+            moved: None,
+        };
+        let cases = [
+            (with(vec![publisher("openidea")], vec![], vec![]), "may not list"),
+            (with(vec![publisher("alice"), publisher("alice")], vec![], vec![]), "listed twice"),
+            (with(vec![publisher("openidea.x")], vec![], vec![]), "invalid publisher"),
+            (with(vec![publisher("alice")], vec![entry("openidea.a", "alice")], vec![]), "not a plugin of"),
+            (with(vec![publisher("alice")], vec![entry("alice.a", "bob")], vec![]), "not a plugin of"),
+            (with(vec![publisher("alice")], vec![entry("alicex.a", "alice")], vec![]), "not a plugin of"),
+            (with(vec![publisher("alice")], vec![], vec![revocation("openidea.a")]), "doesn't publish"),
+            (
+                with(
+                    vec![publisher("alice")],
+                    vec![IndexEntry { engine: String::new(), ..entry("alice.a", "alice") }],
+                    vec![],
+                ),
+                "`engine`",
+            ),
+        ];
+        for (other, error) in cases {
+            let mut index = base.clone();
+            let err = index.include(other, &["openidea"]).unwrap_err();
+            assert!(err.contains(error), "{err}");
+            assert_eq!(index, base);
+        }
+    }
+
    #[test]
    fn unpacking_refuses_paths_leaving_the_package() {
        let tmp = tempfile::tempdir().unwrap();
@@ -413,7 +805,7 @@ mod tests {
        let err = unpack(&out, &tmp.path().join("dest")).unwrap_err();
        assert!(err.contains("invalid path"), "{err}");
        assert!(!tmp.path().join("outside.txt").exists());
-        assert!(Index::parse(r#"{"format": 2}"#).is_err());
+        assert!(Index::parse(r#"{"format": 2}"#).unwrap().is_newer());
    }

    fn zip_of(path: &Path, entries: &[(&str, &str)]) {
@@ -462,4 +854,102 @@ mod tests {
            assert!(err.contains("is not an OpenIDEA plugin"), "{name}: {err}");
        }
    }
+
+    #[test]
+    fn a_newer_index_still_revokes_and_moves() {
+        let newer = format!(
+            r#"{{"format": {}, "plugins": [{{"anything": "new"}}], "shape": "changed",
+                "publishers": [{{"id": "acme", "name": "ACME", "keys": [{{"key": "k1", "revoked": true}}]}}, {{"id": 5}}],
+                "revoked": [{{"id": "acme.bad", "reason": "malware"}}, {{"oops": 1}}],
+                "moved": "https://example.com/next.json"}}"#,
+            INDEX_FORMAT + 1
+        );
+        let index = Index::parse(&newer).unwrap();
+        assert!(index.is_newer());
+        assert!(index.plugins.is_empty() && index.offered().is_empty());
+        assert_eq!(index.revocation("acme.bad", "2.0.0").unwrap().reason, "malware");
+        assert!(index.key_revoked("k1"));
+        assert_eq!(index.moved.as_deref(), Some("https://example.com/next.json"));
+        // Fields this IDE doesn't know are ignored in its own format.
+        let current = format!(r#"{{"format": {INDEX_FORMAT}, "later": true, "plugins": []}}"#);
+        assert!(!Index::parse(&current).unwrap().is_newer());
+        assert!(Index::parse(r#"{"format": 0}"#).unwrap_err().contains("not supported"));
+        assert!(Index::parse(r#"{"plugins": []}"#).is_err());
+    }
+
+    fn keys<'a>(index: &'a mut Index, publisher: &str) -> &'a mut Vec<KeyEntry> {
+        &mut index.publishers.iter_mut().find(|p| p.id == publisher).unwrap().keys
+    }
+
+    #[test]
+    fn rotated_keys_continue_through_endorsements() {
+        let (k1, k2, k3) =
+            (PublisherKey::from_seed([1; 32]), PublisherKey::from_seed([2; 32]), PublisherKey::from_seed([3; 32]));
+        let mut index = index(&k1);
+        let endorsed = |by: &PublisherKey, key: &PublisherKey| KeyEntry {
+            endorsement: Some(by.endorse("acme", &key.public_base64())),
+            ..KeyEntry::new(key.public_base64())
+        };
+        keys(&mut index, "acme").push(endorsed(&k1, &k2));
+        keys(&mut index, "acme").push(endorsed(&k2, &k3));
+        let (p1, p2, p3) = (k1.public_base64(), k2.public_base64(), k3.public_base64());
+        assert!(index.succeeds("acme", &p1, &p1));
+        assert!(index.succeeds("acme", &p1, &p3), "through k2");
+        assert!(!index.succeeds("acme", &p3, &p1), "not backwards");
+        assert!(!index.succeeds("other", &p1, &p2));
+        // An endorsement for another publisher, or by a revoked key, doesn't count.
+        let mut foreign = index.clone();
+        keys(&mut foreign, "acme")[1].endorsement = Some(k1.endorse("evil", &p2));
+        assert!(!foreign.succeeds("acme", &p1, &p2));
+        let mut stolen = index.clone();
+        keys(&mut stolen, "acme")[0].revoked = true;
+        assert!(!stolen.succeeds("acme", &p1, &p2));
+
+        let sig = |key: &PublisherKey| key.sign("acme", "acme.tools", "1.0.0", "d");
+        assert!(signer_continues(Some(&index), Some(&sig(&k1)), Some(&sig(&k3))));
+        assert!(signer_continues(None, Some(&sig(&k1)), Some(&sig(&k1))));
+        assert!(!signer_continues(None, Some(&sig(&k1)), Some(&sig(&k2))), "no index to vouch");
+        let stranger = PublisherKey::from_seed([4; 32]);
+        assert!(!signer_continues(Some(&index), Some(&sig(&k1)), Some(&sig(&stranger))));
+        assert!(!signer_continues(Some(&index), Some(&sig(&k1)), None), "signed, then unsigned");
+        assert!(signer_continues(Some(&index), None, Some(&sig(&stranger))), "unsigned pins nothing");
+    }
+
+    #[test]
+    fn pinned_publishers_keep_their_built_in_keys() {
+        let (root, next, intruder) =
+            (PublisherKey::from_seed([1; 32]), PublisherKey::from_seed([2; 32]), PublisherKey::from_seed([5; 32]));
+        let mut index = index(&intruder);
+        index.publishers[0].id = "openidea".into();
+        keys(&mut index, "openidea").push(KeyEntry {
+            endorsement: Some(root.endorse("openidea", &next.public_base64())),
+            ..KeyEntry::new(next.public_base64())
+        });
+        let roots = [root.public_base64()];
+        let listed = |index: &Index| -> Vec<(String, bool)> {
+            let mut index = index.clone();
+            index.pin_publisher("openidea", "OpenIDEA", &roots);
+            keys(&mut index, "openidea").iter().map(|k| (k.key.clone(), k.revoked)).collect()
+        };
+        // The intruder's key goes, the successor the root endorsed stays, the root is added.
+        assert_eq!(listed(&index), [(next.public_base64(), false), (root.public_base64(), false)]);
+        let mut pinned = index.clone();
+        pinned.pin_publisher("openidea", "OpenIDEA", &roots);
+        let digest = "d";
+        let signed = |k: &PublisherKey| k.sign("openidea", "openidea.tools", "1.0.0", digest);
+        assert!(pinned.verify(&signed(&intruder), "openidea.tools", "1.0.0", digest).is_err());
+        assert!(pinned.verify(&signed(&next), "openidea.tools", "1.0.0", digest).is_ok());
+        // A revoked root stays revoked, and what it endorsed is no longer trusted.
+        keys(&mut index, "openidea").push(KeyEntry { revoked: true, ..KeyEntry::new(root.public_base64()) });
+        assert_eq!(listed(&index), [(root.public_base64(), true)]);
+
+        // A publisher missing from the index is added with its roots.
+        let mut empty = Index { format: INDEX_FORMAT, ..Index::default() };
+        empty.pin_publisher("openidea", "OpenIDEA", &[root.public_base64()]);
+        assert_eq!(empty.verify(&signed(&root), "openidea.tools", "1.0.0", digest).unwrap(), "openidea");
+        // No roots: the index decides.
+        let mut open = index.clone();
+        open.pin_publisher("openidea", "OpenIDEA", &[]);
+        assert_eq!(open, index);
+    }
 }
@@ -21,6 +21,18 @@ pub struct FontFamily {
    pub monospaced: bool,
 }

+/// PANOSE bProportion value 9 means "Monospaced"; DirectWrite's
+/// `IsMonospacedFont` alone misses fonts that only carry this classification.
+const PANOSE_MONOSPACED: u8 = 9;
+
+/// One face counts as monospaced when the font system flags it fixed pitch, its
+/// PANOSE proportion is "Monospaced", or its glyph advances are uniform
+/// (fonts with wrong/missing metadata, e.g. bitmap-style TTFs).
+#[cfg_attr(not(windows), allow(dead_code))]
+fn face_is_mono(is_monospaced_font: bool, panose_proportion: u8, advances_equal: bool) -> bool {
+    is_monospaced_font || panose_proportion == PANOSE_MONOSPACED || advances_equal
+}
+
 type Cache = Mutex<Option<Arc<[FontFamily]>>>;

 /// The installed families, sorted case-insensitively, read on first use and
@@ -195,7 +207,9 @@ mod imp {
        // SAFETY: CoreText descriptors carry documented CFString, CFURL and trait dictionary values.
        unsafe {
            let collection = CTFontCollection::from_available_fonts(None);
-            let Some(descriptors) = collection.matching_font_descriptors() else { return Vec::new() };
+            let Some(descriptors) = collection.matching_font_descriptors() else {
+                return Vec::new();
+            };
            let mut seen = std::collections::BTreeSet::new();
            descriptors
                .cast_unchecked::<CTFontDescriptor>()
@@ -271,14 +285,16 @@ mod imp {

 #[cfg(windows)]
 mod imp {
+    use std::os::windows::ffi::OsStrExt;
+    use windows::Win32::Graphics::DirectWrite::IDWriteFontFace1;
    use windows::Win32::Graphics::DirectWrite::{
-        DWRITE_FACTORY_TYPE_SHARED, DWRITE_FONT_STRETCH_NORMAL, DWRITE_FONT_STYLE_NORMAL, DWRITE_FONT_WEIGHT_NORMAL,
-        DWriteCreateFactory, IDWriteFactory, IDWriteFont1, IDWriteLocalizedStrings,
+        DWRITE_FACTORY_TYPE_SHARED, DWriteCreateFactory, IDWriteFactory, IDWriteFactory3, IDWriteFactory5, IDWriteFont,
+        IDWriteFont1, IDWriteFontCollection, IDWriteFontFamily, IDWriteLocalizedStrings,
    };
-    use windows::core::{BOOL, Interface, w};
+    use windows::core::{BOOL, Interface, PCWSTR, w};

-    /// The system font collection's families, named in English when the
-    /// family has an English name (what CSS matches), else its first name.
+    /// The installed families, named in English when the family has an
+    /// English name (what CSS matches), else its first name.
    pub(crate) fn list(refresh: bool) -> Vec<(String, bool)> {
        // SAFETY: plain DirectWrite COM calls on interfaces we own.
        unsafe { read(refresh) }.unwrap_or_default()
@@ -286,11 +302,85 @@ mod imp {

    unsafe fn read(refresh: bool) -> windows::core::Result<Vec<(String, bool)>> {
        let factory: IDWriteFactory = unsafe { DWriteCreateFactory(DWRITE_FACTORY_TYPE_SHARED) }?;
+        let mut faces = Vec::new();
+        // Windows 10+: the newer collection covers registered per-user fonts.
+        // Exclude downloadable fonts that are not installed on this machine.
+        // Bitmap .FON fonts (e.g. the stock raster Fixedsys) are invisible to
+        // DirectWrite either way: it only reads TrueType/OpenType files.
        let mut collection = None;
-        unsafe { factory.GetSystemFontCollection(&mut collection, refresh) }?;
-        let Some(collection) = collection else {
-            return Ok(Vec::new());
+        if let Ok(factory3) = factory.cast::<IDWriteFactory3>() {
+            let mut local = None;
+            if unsafe { factory3.GetSystemFontCollection(false, &mut local, refresh) }.is_ok() {
+                collection = local.map(Into::into);
+            }
+        }
+        if collection.is_none() {
+            unsafe { factory.GetSystemFontCollection(&mut collection, refresh) }?;
+        }
+        if let Some(collection) = collection {
+            faces.extend(collect(&collection));
+        }
+        // DirectWrite enumerates via the font registry, so font files copied
+        // into the per-user directory without registering (no HKCU entry)
+        // are invisible to the calls above; scan the directory directly.
+        faces.extend(unsafe { user_dir_faces(&factory) });
+        Ok(faces)
+    }
+
+    /// Families from `%LOCALAPPDATA%\Microsoft\Windows\Fonts` files, registered
+    /// or not, via a font set built from the files on disk.
+    unsafe fn user_dir_faces(factory: &IDWriteFactory) -> Vec<(String, bool)> {
+        let Some(local_app_data) = std::env::var_os("LOCALAPPDATA") else {
+            return Vec::new();
        };
+        let dir = std::path::Path::new(&local_app_data).join(r"Microsoft\Windows\Fonts");
+        let Ok(entries) = std::fs::read_dir(&dir) else {
+            return Vec::new();
+        };
+        let files: Vec<_> = entries
+            .filter_map(|e| e.ok())
+            .map(|e| e.path())
+            .filter(|p| {
+                matches!(
+                    p.extension().and_then(|e| e.to_str()).map(|e| e.to_ascii_lowercase()).as_deref(),
+                    Some("ttf" | "otf" | "ttc" | "otc")
+                )
+            })
+            .collect();
+        unsafe { file_faces(factory, &files) }
+    }
+
+    unsafe fn file_faces(factory: &IDWriteFactory, files: &[std::path::PathBuf]) -> Vec<(String, bool)> {
+        if files.is_empty() {
+            return Vec::new();
+        }
+        let Ok(factory3) = factory.cast::<IDWriteFactory3>() else {
+            return Vec::new();
+        };
+        let Ok(factory5) = factory.cast::<IDWriteFactory5>() else {
+            return Vec::new();
+        };
+        let Ok(builder) = (unsafe { factory5.CreateFontSetBuilder() }) else {
+            return Vec::new();
+        };
+        for path in files {
+            let wide: Vec<u16> = path.as_os_str().encode_wide().chain(Some(0)).collect();
+            // SAFETY: wide is a valid NUL-terminated string for the calls.
+            let Ok(file) = (unsafe { factory.CreateFontFileReference(PCWSTR(wide.as_ptr()), None) }) else {
+                continue;
+            };
+            let _ = unsafe { builder.AddFontFile(&file) };
+        }
+        let Ok(set) = (unsafe { builder.CreateFontSet() }) else {
+            return Vec::new();
+        };
+        let Ok(collection) = (unsafe { factory3.CreateFontCollectionFromFontSet(&set) }) else {
+            return Vec::new();
+        };
+        collect(&collection)
+    }
+
+    fn collect(collection: &IDWriteFontCollection) -> Vec<(String, bool)> {
        let mut out = Vec::new();
        for i in 0..unsafe { collection.GetFontFamilyCount() } {
            let Ok(family) = (unsafe { collection.GetFontFamily(i) }) else {
@@ -299,19 +389,120 @@ mod imp {
            let Some(name) = unsafe { family.GetFamilyNames() }.ok().and_then(|n| unsafe { english(&n) }) else {
                continue;
            };
-            let mono = unsafe {
-                family.GetFirstMatchingFont(
-                    DWRITE_FONT_WEIGHT_NORMAL,
-                    DWRITE_FONT_STRETCH_NORMAL,
-                    DWRITE_FONT_STYLE_NORMAL,
-                )
-            }
-            .ok()
-            .and_then(|f| f.cast::<IDWriteFont1>().ok())
-            .is_some_and(|f| unsafe { f.IsMonospacedFont() }.as_bool());
-            out.push((name, mono));
+            out.push((name, unsafe { family_is_mono(&family) }));
+        }
+        out
+    }
+
+    /// A family is monospaced when any face reports fixed pitch, PANOSE
+    /// proportion 9, or uniform glyph advances; probing every face matches
+    /// `normalize`'s any-face merge (macOS and Linux already flag every face,
+    /// not just the regular one).
+    unsafe fn family_is_mono(family: &IDWriteFontFamily) -> bool {
+        (0..unsafe { family.GetFontCount() }).any(|i| {
+            let Ok(font) = (unsafe { family.GetFont(i) }) else {
+                return false;
+            };
+            if let Ok(font1) = font.cast::<IDWriteFont1>() {
+                let is_monospaced = unsafe { font1.IsMonospacedFont() }.as_bool();
+                // The proportion byte is defined for text/display fonts only.
+                let panose = unsafe { font1.GetPanose().values };
+                let panose_proportion = if panose[0] == 2 { panose[3] } else { 0 };
+                if super::face_is_mono(is_monospaced, panose_proportion, false) {
+                    return true;
+                }
+            }
+            unsafe { advances_equal(&font) }
+        })
+    }
+
+    /// Some monospaced fonts carry no fixed-pitch metadata at all (bitmap-style
+    /// TTFs like Fixedsys Excelsior): compare the advance widths of 'i' and
+    /// 'W'. Dual-width CJK monospace fonts pass too (both half-width).
+    unsafe fn advances_equal(font: &IDWriteFont) -> bool {
+        let Ok(face) = (unsafe { font.CreateFontFace() }) else {
+            return false;
+        };
+        let Ok(face1) = face.cast::<IDWriteFontFace1>() else {
+            return false;
+        };
+        let codepoints = ['i' as u32, 'W' as u32];
+        let mut indices = [0u16; 2];
+        if unsafe { face.GetGlyphIndices(codepoints.as_ptr(), 2, indices.as_mut_ptr()) }.is_err()
+            || indices.contains(&0)
+        {
+            return false;
+        }
+        let mut advances = [0i32; 2];
+        unsafe { face1.GetDesignGlyphAdvances(2, indices.as_ptr(), advances.as_mut_ptr(), false) }.is_ok()
+            && advances[0] > 0
+            && advances[0] == advances[1]
+    }
+
+    #[test]
+    fn glyph_probe_distinguishes_monospace_proportional_and_symbol_fonts() {
+        unsafe {
+            let factory: IDWriteFactory = DWriteCreateFactory(DWRITE_FACTORY_TYPE_SHARED).unwrap();
+            let mut collection = None;
+            factory.GetSystemFontCollection(&mut collection, false).unwrap();
+            let collection = collection.unwrap();
+            for (name, expected) in [
+                ("Consolas", true),
+                ("Arial", false),
+                ("Times New Roman", false),
+                ("Wingdings", false),
+                ("Webdings", false),
+                ("Segoe MDL2 Assets", false),
+            ] {
+                let wide: Vec<_> = name.encode_utf16().chain(Some(0)).collect();
+                let mut index = 0;
+                let mut exists = BOOL(0);
+                collection.FindFamilyName(PCWSTR(wide.as_ptr()), &mut index, &mut exists).unwrap();
+                assert!(exists.as_bool(), "{name} ships with Windows");
+                let family = collection.GetFontFamily(index).unwrap();
+                for i in 0..family.GetFontCount() {
+                    let font = family.GetFont(i).unwrap();
+                    assert_eq!(advances_equal(&font), expected, "{name} face {i}");
+                }
+            }
+        }
+    }
+
+    #[test]
+    fn font_files_include_every_family_in_a_collection() {
+        let path = std::path::PathBuf::from(std::env::var_os("WINDIR").unwrap()).join(r"Fonts\cambria.ttc");
+        unsafe {
+            let factory: IDWriteFactory = DWriteCreateFactory(DWRITE_FACTORY_TYPE_SHARED).unwrap();
+            let faces = file_faces(&factory, &[path]);
+            for name in ["Cambria", "Cambria Math"] {
+                assert!(faces.iter().any(|(family, _)| family == name), "missing {name}: {faces:?}");
+            }
+        }
+    }
+
+    #[test]
+    fn excludes_families_available_only_as_downloads() {
+        use windows::Win32::Graphics::DirectWrite::{DWRITE_E_REMOTEFONT, DWRITE_LOCALITY_LOCAL, IDWriteFont3};
+
+        unsafe {
+            let factory: IDWriteFactory = DWriteCreateFactory(DWRITE_FACTORY_TYPE_SHARED).unwrap();
+            let factory3: IDWriteFactory3 = factory.cast().unwrap();
+            let set = factory3.GetSystemFontSet().unwrap();
+            let collection = factory3.CreateFontCollectionFromFontSet(&set).unwrap();
+            let listed = super::normalize(read(false).unwrap());
+            let user = super::normalize(user_dir_faces(&factory));
+            for i in 0..collection.GetFontFamilyCount() {
+                let family = collection.GetFontFamily(i).unwrap();
+                let name = english(&family.GetFamilyNames().unwrap()).unwrap();
+                let remote_only = (0..family.GetFontCount()).all(|j| match family.GetFont(j) {
+                    Ok(font) => font.cast::<IDWriteFont3>().unwrap().GetLocality() != DWRITE_LOCALITY_LOCAL,
+                    Err(error) => error.code() == DWRITE_E_REMOTEFONT,
+                });
+                if remote_only && !user.iter().any(|f| f.name == name) {
+                    assert!(!listed.iter().any(|f| f.name == name), "{name} is not installed locally");
+                }
+            }
        }
-        Ok(out)
    }

    unsafe fn english(names: &IDWriteLocalizedStrings) -> Option<String> {
@@ -476,6 +667,15 @@ mod tests {
        );
    }

+    #[test]
+    fn panose_monospaced_proportion_counts_as_mono() {
+        assert!(face_is_mono(true, 0, false));
+        assert!(face_is_mono(false, PANOSE_MONOSPACED, false));
+        assert!(face_is_mono(false, 0, true));
+        assert!(!face_is_mono(false, 0, false));
+        assert!(!face_is_mono(false, 3, false));
+    }
+
    #[test]
    fn fc_list_spacing_marks_monospace() {
        let out = "DejaVu Sans Mono\t100\nDejaVu Sans\t\nNoto Sans Mono CJK SC\t90\nTerminus\t110\nCantarell\nFira\\-Code\tmono\n\t100\n";
@@ -0,0 +1,145 @@
+//! The signed-in GitHub account, independent of any project: its repositories for
+//! "Get from Version Control" › GitHub.
+
+use crate::{GhAvailability, QUICK, classify_failure, command, gh_executable, process};
+use serde::{Deserialize, Serialize};
+use specta::Type;
+
+/// A repository of the signed-in account (owned, collaborator, or organization member).
+#[derive(Clone, Debug, PartialEq, Eq, Serialize, Deserialize, Type)]
+#[serde(rename_all = "camelCase")]
+pub struct GhAccountRepo {
+    /// `owner/name`.
+    pub name_with_owner: String,
+    pub description: Option<String>,
+    pub private: bool,
+    pub fork: bool,
+    pub archived: bool,
+    /// What `git clone` takes: HTTPS, or SSH when gh's `git_protocol` is `ssh`.
+    pub clone_url: String,
+}
+
+/// The account's repositories, or why they can't be listed.
+#[derive(Clone, Debug, PartialEq, Eq, Serialize, Deserialize, Type)]
+#[serde(rename_all = "camelCase", tag = "kind")]
+pub enum GhAccountRepos {
+    Ready {
+        login: String,
+        repos: Vec<GhAccountRepo>,
+    },
+    /// No `gh` executable was found.
+    NotInstalled,
+    /// `gh auth login` has not been run (or the token expired).
+    NotLoggedIn {
+        message: String,
+    },
+    Error {
+        message: String,
+    },
+}
+
+#[derive(Deserialize)]
+struct RestRepo {
+    full_name: String,
+    description: Option<String>,
+    #[serde(default)]
+    private: bool,
+    #[serde(default)]
+    fork: bool,
+    #[serde(default)]
+    archived: bool,
+    clone_url: String,
+    ssh_url: String,
+}
+
+/// `gh api --paginate --slurp user/repos` output: one array per page.
+pub fn parse_account_repos(slurped: &str, ssh: bool) -> Result<Vec<GhAccountRepo>, serde_json::Error> {
+    let pages: Vec<Vec<RestRepo>> = serde_json::from_str(slurped)?;
+    Ok(pages
+        .into_iter()
+        .flatten()
+        .map(|r| GhAccountRepo {
+            name_with_owner: r.full_name,
+            description: r.description.filter(|d| !d.trim().is_empty()),
+            private: r.private,
+            fork: r.fork,
+            archived: r.archived,
+            clone_url: if ssh { r.ssh_url } else { r.clone_url },
+        })
+        .collect())
+}
+
+/// Lists the repositories of the account gh is signed in to, most recently pushed first.
+pub fn account_repositories() -> GhAccountRepos {
+    if gh_executable().is_none() {
+        return GhAccountRepos::NotInstalled;
+    }
+    let dir = std::env::temp_dir();
+    let gh = |args: &[&str]| -> Result<String, GhAccountRepos> {
+        let out = command(&dir, args)
+            .and_then(|cmd| process::run(cmd, QUICK, None))
+            .map_err(|e| GhAccountRepos::Error { message: e.message })?;
+        if out.success {
+            return Ok(out.stdout);
+        }
+        let message = if out.stderr.trim().is_empty() { out.stdout } else { out.stderr };
+        Err(match classify_failure(&message) {
+            GhAvailability::NotLoggedIn { message } => GhAccountRepos::NotLoggedIn { message },
+            _ => GhAccountRepos::Error { message: message.trim().to_owned() },
+        })
+    };
+    let result = (|| {
+        let login = gh(&["api", "user", "--jq", ".login"])?.trim().to_owned();
+        let ssh = gh(&["config", "get", "git_protocol", "--host", "github.com"]).is_ok_and(|p| p.trim() == "ssh");
+        let pages = gh(&[
+            "api",
+            "user/repos?per_page=100&sort=pushed&affiliation=owner,collaborator,organization_member",
+            "--paginate",
+            "--slurp",
+        ])?;
+        let repos = parse_account_repos(&pages, ssh)
+            .map_err(|e| GhAccountRepos::Error { message: format!("unexpected gh output: {e}") })?;
+        Ok(GhAccountRepos::Ready { login, repos })
+    })();
+    result.unwrap_or_else(|e| e)
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    #[test]
+    fn reads_every_page_and_picks_the_configured_protocol() {
+        let pages = r#"[
+          [{"full_name":"me/app","description":"An app","private":true,"fork":false,"archived":false,
+            "clone_url":"https://github.com/me/app.git","ssh_url":"[email protected]:me/app.git"}],
+          [{"full_name":"org/lib","description":"","fork":true,
+            "clone_url":"https://github.com/org/lib.git","ssh_url":"[email protected]:org/lib.git"}]
+        ]"#;
+        let https = parse_account_repos(pages, false).unwrap();
+        assert_eq!(
+            https,
+            vec![
+                GhAccountRepo {
+                    name_with_owner: "me/app".into(),
+                    description: Some("An app".into()),
+                    private: true,
+                    fork: false,
+                    archived: false,
+                    clone_url: "https://github.com/me/app.git".into(),
+                },
+                GhAccountRepo {
+                    name_with_owner: "org/lib".into(),
+                    description: None,
+                    private: false,
+                    fork: true,
+                    archived: false,
+                    clone_url: "https://github.com/org/lib.git".into(),
+                },
+            ]
+        );
+        let ssh = parse_account_repos(pages, true).unwrap();
+        assert_eq!(ssh[1].clone_url, "[email protected]:org/lib.git");
+        assert!(parse_account_repos("[]", false).unwrap().is_empty());
+    }
+}
@@ -3,9 +3,11 @@
 //!
 //! Every function blocks; callers run them off the UI / command threads.

+mod account;
 mod model;
 mod process;

+pub use account::{GhAccountRepo, GhAccountRepos, account_repositories, parse_account_repos};
 pub use model::*;

 use ide_core::{CancellationToken, IdeError, IdeResult};
@@ -14,6 +14,7 @@ encoding_rs.workspace = true
 ide-core.workspace = true
 ide-text.workspace = true
 ide-vfs.workspace = true
+regex-syntax.workspace = true
 ide-workspace.workspace = true
 ide-language.workspace = true
 ide-index.workspace = true
@@ -45,6 +46,7 @@ ide-extension.workspace = true
 ide-plugin.workspace = true
 ide-tools = { path = "../ide-tools" }
 ide-docker = { path = "../ide-docker" }
+semver = "1"
 serde.workspace = true
 serde_json.workspace = true
 toml.workspace = true
@@ -58,12 +60,13 @@ dunce.workspace = true
 dirs.workspace = true
 uuid.workspace = true
 tempfile.workspace = true
+zip.workspace = true
+quick-xml = "0.42"

 [dev-dependencies]
 ide-ssh = { workspace = true, features = ["testing"] }
 tokio = { workspace = true, features = ["rt-multi-thread", "macros", "io-util", "test-util"] }
 criterion = { version = "0.5", default-features = false }
-zip.workspace = true

 [target.'cfg(unix)'.dependencies]
 rustix = { version = "1.1", features = ["fs", "process"] }
@@ -3,13 +3,15 @@
 //! ```text
 //! openidea-plugin new <dir> [--template command|theme|icon-theme|language] [--id ID] [--name NAME] [--sdk PATH]
 //! openidea-plugin build [dir] [--debug]   # cargo → dist/plugin.wasm, then `check`
-//! openidea-plugin check [dir]             # validate the package as the IDE would install it
+//! openidea-plugin check [dir|package]     # validate the package as the IDE would install it
 //! openidea-plugin link [dir]              # load the folder in the IDE without installing it
 //! openidea-plugin unlink [dir]
 //! openidea-plugin links                   # list linked folders
 //! openidea-plugin keygen <key-file>       # a publisher's Ed25519 key
+//! openidea-plugin endorse <new-public-key> --key OLD --publisher ID   # vouch for a new key
 //! openidea-plugin pack [dir] [--key F --publisher ID] [--out FILE]   # <id>-<version>.oiplugin
-//! openidea-plugin index <dir> --publisher ID --name NAME --key F     # marketplace index.json
+//! openidea-plugin index <dir> [--publisher ID --name NAME --key F [--previous-key F]]   # marketplace index.json
+//! openidea-plugin merge <index> <other-index> --keep ID               # list another index's publishers
 //! ```
 //!
 //! `link` writes `links.json` in the IDE's plugins directory
@@ -20,7 +22,7 @@
 mod templates;

 use ide_extension::{Manifest, validate_plugin_id};
-use ide_host::plugins::PluginHost;
+use ide_host::plugins::{PluginHost, read_market_url, resolve_market_href};
 use ide_plugin::{Limits, PluginEngine};
 use std::path::{Path, PathBuf};
 use std::process::{Command, ExitCode};
@@ -31,17 +33,31 @@ usage: openidea-plugin <command> [options]

 commands:
  new <dir> [--template T] [--id ID] [--name NAME] [--sdk PATH]
-        create a plugin; T = command (default), theme, icon-theme, language
+        create a plugin; T = command (default), theme, icon-theme, language. A Rust
+        plugin depends on the SDK of this tool's release (git); --sdk PATH uses a
+        local sdk/rust/openidea-plugin instead
  build [dir] [--debug]   compile a Rust plugin to dist/plugin.wasm and check it
-  check [dir]             validate the package as the IDE would install it
+  check [dir|package]     validate the package (folder or .oiplugin) as the IDE would install it
  link [dir]              load the folder in the IDE without installing it
  unlink [dir]            stop loading a linked folder
  links                   list linked folders
  keygen <key-file>       create a publisher signing key (keep the file secret)
+  endorse <new-public-key> --key F --publisher ID
+                          print an earlier key's endorsement of a new one (JSON), for an
+                          index the publisher doesn't write with `index --previous-key`
  pack [dir] [--key F --publisher ID] [--out FILE]
                          write <id>-<version>.oiplugin, signed with the key
-  index <dir> --publisher ID --name NAME --key F [--out FILE]
-                          write the marketplace index.json for the packages in dir
+  index <dir> [--publisher ID --name NAME --key F [--previous-key F]] [--out FILE]
+        [--download-base URL]
+                          write the marketplace index.json for the packages in dir: with a
+                          key, register it and list that publisher's plugins (earlier
+                          versions stay for older IDEs); without, list only these packages,
+                          each checked against the index's publishers. A new key replacing
+                          an earlier one is endorsed with --previous-key, so installed
+                          plugins update to it without asking
+  merge <index> <other-index> --keep ID [--out FILE]
+                          replace every publisher but ID in index with those of other-index
+                          (a path or URL), their plugins and revocations

 environment:
  OPENIDEA_PLUGINS_DIR    the IDE's plugins directory (default: the app data directory)";
@@ -51,13 +67,15 @@ fn main() -> ExitCode {
    let result = match args.first().map(String::as_str) {
        Some("new") => cmd_new(&args[1..]),
        Some("build") => cmd_build(&args[1..]),
-        Some("check") => dir_arg(&args[1..]).and_then(|d| check(&d)),
+        Some("check") => dir_arg(&args[1..]).and_then(|d| check_path(&d)),
        Some("link") => dir_arg(&args[1..]).and_then(|d| link(&d, true)),
        Some("unlink") => dir_arg(&args[1..]).and_then(|d| link(&d, false)),
        Some("links") => list_links(),
        Some("keygen") => cmd_keygen(&args[1..]),
+        Some("endorse") => cmd_endorse(&args[1..]),
        Some("pack") => cmd_pack(&args[1..]),
        Some("index") => cmd_index(&args[1..]),
+        Some("merge") => cmd_merge(&args[1..]),
        Some("--version" | "-V") => {
            println!("openidea-plugin {} (plugin API {})", env!("CARGO_PKG_VERSION"), ide_extension::ENGINE_VERSION);
            Ok(())
@@ -161,7 +179,7 @@ fn cmd_new(args: &[String]) -> Result<(), String> {
    std::fs::create_dir_all(&dir).map_err(|e| format!("{}: {e}", dir.display()))?;
    let dir = canonical(&dir)?;
    let sdk = match template {
-        templates::Template::Command => Some(sdk_path(a.value("sdk"), &dir)?),
+        templates::Template::Command => Some(sdk_dependency(a.value("sdk"), &dir)?),
        _ => None,
    };
    let vars = templates::Vars { id: &id, name: &name, sdk: sdk.as_deref() };
@@ -216,12 +234,16 @@ fn title_case(s: &str) -> String {
        .join(" ")
 }

-/// The SDK dependency path written into a new plugin's Cargo.toml: `--sdk`,
-/// or the SDK of the source tree this tool was built from.
-fn sdk_path(explicit: Option<&str>, plugin_dir: &Path) -> Result<String, String> {
+/// The SDK dependency written into a new plugin's Cargo.toml: by path with `--sdk`, or
+/// when the plugin is inside the source tree this tool was built from; otherwise the
+/// repository at this tool's release tag.
+fn sdk_dependency(explicit: Option<&str>, plugin_dir: &Path) -> Result<String, String> {
    let sdk = match explicit {
        Some(p) => PathBuf::from(p),
-        None => PathBuf::from(concat!(env!("CARGO_MANIFEST_DIR"), "/../../sdk/rust/openidea-plugin")),
+        None => match dunce::canonicalize(concat!(env!("CARGO_MANIFEST_DIR"), "/../..")) {
+            Ok(tree) if plugin_dir.starts_with(&tree) => tree.join("sdk/rust/openidea-plugin"),
+            _ => return Ok(format!("{{ git = \"{REPOSITORY}\", tag = \"v{}\" }}", env!("CARGO_PKG_VERSION"))),
+        },
    };
    let sdk = dunce::canonicalize(&sdk).map_err(|_| {
        format!("the plugin SDK was not found at {}; pass --sdk <path to sdk/rust/openidea-plugin>", sdk.display())
@@ -230,9 +252,11 @@ fn sdk_path(explicit: Option<&str>, plugin_dir: &Path) -> Result<String, String>
        return Err(format!("{} is not the openidea-plugin SDK (no Cargo.toml)", sdk.display()));
    }
    let path = relative(plugin_dir, &sdk).unwrap_or(sdk);
-    Ok(path.to_string_lossy().replace('\\', "/"))
+    Ok(format!("{{ path = \"{}\" }}", path.to_string_lossy().replace('\\', "/")))
 }

+const REPOSITORY: &str = "https://github.com/l0ng-ai/openidea";
+
 /// `to` relative to `from` when they share a root (keeps packages in a repo movable).
 fn relative(from: &Path, to: &Path) -> Option<PathBuf> {
    let (f, t): (Vec<_>, Vec<_>) = (from.components().collect(), to.components().collect());
@@ -323,10 +347,21 @@ fn ensure_wasm_target() {

 /// Validates `dir` exactly as Install from Disk would, and checks the
 /// component imports only the plugin API.
+/// [`check`] of a folder, or of a package file unpacked as installing would.
+fn check_path(path: &Path) -> Result<(), String> {
+    if !path.is_file() {
+        return check(path);
+    }
+    let tmp = scratch_dir("unpack")?;
+    let dir = tmp.path().join("package");
+    package::unpack(path, &dir).and_then(|_| check(&dir))
+}
+
 fn check(dir: &Path) -> Result<(), String> {
    let dir = canonical(dir)?;
-    let scratch = std::env::temp_dir().join(format!("openidea-plugin-check-{}", std::process::id()));
-    let result = (|| {
+    let tmp = scratch_dir("check")?;
+    let scratch = tmp.path().join("host");
+    (|| {
        let host = PluginHost::new(scratch.clone(), Arc::new(|_: Option<&str>, _| {}), Limits::default())
            .map_err(|e| e.to_string())?;
        let preview = host.preview_install(&dir).map_err(|e| e.to_string())?;
@@ -345,6 +380,17 @@ fn check(dir: &Path) -> Result<(), String> {
        } else {
            println!("  code: none (contributions only)");
        }
+        println!("  categories: {}", manifest.categories().join(", "));
+        for c in manifest.unknown_categories() {
+            println!("  warning: unknown category {c:?} (ignored); use {}", ide_extension::CATEGORIES.join(", "));
+        }
+        if manifest.declared_categories.len() > ide_extension::MAX_CATEGORIES {
+            println!(
+                "  warning: only the first {} known categories are used; {} are declared",
+                ide_extension::MAX_CATEGORIES,
+                manifest.declared_categories.len()
+            );
+        }
        if !manifest.activation.is_empty() {
            let events: Vec<String> = manifest.activation.iter().map(ToString::to_string).collect();
            println!("  activation: {}", events.join(", "));
@@ -361,9 +407,7 @@ fn check(dir: &Path) -> Result<(), String> {
        }
        println!("ok");
        Ok(())
-    })();
-    let _ = std::fs::remove_dir_all(&scratch);
-    result
+    })()
 }

 fn human_size(bytes: u64) -> String {
@@ -479,14 +523,31 @@ fn cmd_keygen(args: &[String]) -> Result<(), String> {
    Ok(())
 }

+fn cmd_endorse(args: &[String]) -> Result<(), String> {
+    let a = Args::parse(args, &[], &["key", "publisher"])?;
+    let usage = "usage: openidea-plugin endorse <new-public-key> --key <earlier-key-file> --publisher ID";
+    let ([new], Some(key), Some(publisher)) = (a.positional.as_slice(), a.value("key"), a.value("publisher")) else {
+        return Err(usage.into());
+    };
+    if !package::publisher_id_ok(publisher) {
+        return Err(format!("invalid publisher id {publisher:?}"));
+    }
+    let endorsement = read_key(key)?.endorse(publisher, new.trim());
+    println!("{}", serde_json::to_string_pretty(&endorsement).map_err(|e| e.to_string())?);
+    Ok(())
+}
+
+/// A fresh scratch directory, removed when dropped.
+fn scratch_dir(what: &str) -> Result<tempfile::TempDir, String> {
+    tempfile::Builder::new().prefix(&format!("openidea-plugin-{what}-")).tempdir().map_err(|e| e.to_string())
+}
+
 /// A scratch host to list a package's files as the IDE would.
 fn with_scratch_host<T>(f: impl FnOnce(&PluginHost) -> Result<T, String>) -> Result<T, String> {
-    let scratch = std::env::temp_dir().join(format!("openidea-plugin-pack-{}", std::process::id()));
-    let result = PluginHost::new(scratch.clone(), Arc::new(|_: Option<&str>, _| {}), Limits::default())
+    let tmp = scratch_dir("host")?;
+    PluginHost::new(tmp.path().join("host"), Arc::new(|_: Option<&str>, _| {}), Limits::default())
        .map_err(|e| e.to_string())
-        .and_then(|h| f(&h));
-    let _ = std::fs::remove_dir_all(&scratch);
-    result
+        .and_then(|h| f(&h))
 }

 fn cmd_pack(args: &[String]) -> Result<(), String> {
@@ -522,29 +583,28 @@ fn cmd_pack(args: &[String]) -> Result<(), String> {
 }

 fn cmd_index(args: &[String]) -> Result<(), String> {
-    let a = Args::parse(args, &[], &["publisher", "name", "key", "out"])?;
+    let a = Args::parse(args, &[], &["publisher", "name", "key", "previous-key", "out", "download-base"])?;
    let dir = canonical(&a.dir()?)?;
-    let publisher = a.value("publisher").ok_or("--publisher is required")?;
-    let name = a.value("name").unwrap_or(publisher);
-    let key = read_key(a.value("key").ok_or("--key is required")?)?;
    let out = a.value("out").map(PathBuf::from).unwrap_or_else(|| dir.join("index.json"));
+    let base = a.value("download-base").map(|b| b.trim_end_matches('/'));
    // Revocations and other publishers of an existing index are kept.
    let mut index = match std::fs::read_to_string(&out) {
-        Ok(text) => Index::parse(&text)?,
+        Ok(text) => current_format(Index::parse(&text)?, &out.to_string_lossy())?,
        Err(_) => Index { format: package::INDEX_FORMAT, ..Index::default() },
    };
-    // Earlier keys of the publisher stay listed (packages they signed remain valid until revoked).
-    let current = key.public_base64();
-    let earlier: Vec<KeyEntry> = index
-        .publishers
-        .iter()
-        .filter(|p| p.id == publisher)
-        .flat_map(|p| p.keys.iter().filter(|k| k.key != current).cloned())
-        .collect();
-    index.publishers.retain(|p| p.id != publisher);
-    let keys: Vec<KeyEntry> = std::iter::once(KeyEntry { key: current, revoked: false }).chain(earlier).collect();
-    index.publishers.push(package::Publisher { id: publisher.into(), name: name.into(), keys });
-    index.plugins.clear();
+    let publisher = match (a.value("publisher"), a.value("key")) {
+        (Some(publisher), Some(key)) => {
+            let key = read_key(key)?;
+            let name = a.value("name").unwrap_or(publisher);
+            let previous = a.value("previous-key").map(read_key).transpose()?;
+            index.publishers =
+                register_key(std::mem::take(&mut index.publishers), publisher, name, &key, previous.as_ref())?;
+            Some(publisher)
+        }
+        (None, None) if a.has("previous-key") => return Err("--previous-key goes with --publisher and --key".into()),
+        (None, None) => None,
+        _ => return Err("--publisher and --key go together".into()),
+    };
    let mut packages: Vec<PathBuf> = std::fs::read_dir(&dir)
        .map_err(|e| e.to_string())?
        .flatten()
@@ -552,35 +612,144 @@ fn cmd_index(args: &[String]) -> Result<(), String> {
        .filter(|p| p.extension().is_some_and(|e| e == package::PACKAGE_EXTENSION))
        .collect();
    packages.sort();
+    let engine = PluginEngine::new()?;
+    let mut added: Vec<IndexEntry> = Vec::new();
    for path in packages {
-        let scratch = std::env::temp_dir().join(format!("openidea-plugin-index-{}", std::process::id()));
-        let _ = std::fs::remove_dir_all(&scratch);
-        let unpacked = package::unpack(&path, &scratch)?;
+        let tmp = scratch_dir("index")?;
+        let scratch = tmp.path().join("package");
        let entry = (|| {
+            let unpacked = package::unpack(&path, &scratch)?;
            let m = Manifest::load(&scratch)?;
            let files = with_scratch_host(|h| h.package_files_of(&scratch).map_err(|e| e.to_string()))?;
            let digest = package::package_digest(&scratch, &files).map_err(|e| e.to_string())?;
-            let sig = unpacked.signature.as_ref().ok_or_else(|| format!("{}: not signed", path.display()))?;
-            sig.check(&m.id, &m.version, &digest).map_err(|e| format!("{}: {e}", path.display()))?;
+            let sig = unpacked.signature.as_ref().ok_or("not signed")?;
+            let signer = index.verify(sig, &m.id, &m.version, &digest)?;
+            if publisher.is_some_and(|p| p != signer) {
+                return Err(format!("signed by {signer}, not {}", publisher.unwrap_or_default()));
+            }
+            if added.iter().any(|e| (&e.id, &e.version) == (&m.id, &m.version)) {
+                return Err(format!("another package of {} {} is in the folder", m.id, m.version));
+            }
+            if m.legacy {
+                return Err("plugin.toml uses the 0.1 format; see plugins/README.md".into());
+            }
+            let built_for = match &m.wasm {
+                Some(wasm) => engine.check_component(&engine.compile(&scratch.join(wasm))?)?,
+                None => None,
+            };
+            let file = path.file_name().map(|n| n.to_string_lossy().into_owned()).unwrap_or_default();
            Ok::<_, String>(IndexEntry {
                id: m.id.clone(),
                name: m.name.clone(),
                version: m.version.clone(),
                description: m.description.clone(),
                authors: m.authors.clone(),
-                publisher: sig.publisher.clone(),
-                download: path.file_name().map(|n| n.to_string_lossy().into_owned()).unwrap_or_default(),
+                publisher: signer,
+                download: base.map_or_else(|| file.clone(), |b| format!("{b}/{file}")),
                digest,
                capabilities: m.capabilities.all().map(|c| c.to_string()).collect(),
+                engine: package::engine_requirement(&m.engine, built_for.as_ref()),
+                categories: m.categories(),
            })
        })();
-        let _ = std::fs::remove_dir_all(&scratch);
-        let entry = entry?;
-        println!("  {} {}", entry.id, entry.version);
-        index.plugins.push(entry);
+        let entry = entry.map_err(|e| format!("{}: {e}", path.display()))?;
+        println!("  {} {} (plugin API {})", entry.id, entry.version, entry.engine);
+        added.push(entry);
    }
-    let json = serde_json::to_string_pretty(&index).map_err(|e| e.to_string())?;
-    std::fs::write(&out, json).map_err(|e| format!("{}: {e}", out.display()))?;
+    // A publisher's earlier versions of these plugins stay for IDEs that can't load the new
+    // ones (pruned below); plugins no longer in the folder go.
+    index.plugins.retain(|e| match publisher {
+        Some(p) => {
+            e.publisher != p
+                || (added.iter().any(|n| n.id == e.id)
+                    && !added.iter().any(|n| (&n.id, &n.version) == (&e.id, &e.version)))
+        }
+        None => false,
+    });
+    index.plugins.extend(added);
+    index.prune_versions();
+    write_index(&index, &out)
+}
+
+/// `publishers` with `key` as `publisher`'s current key. Earlier keys stay listed
+/// (packages they signed remain valid until revoked); a key new to the
+/// publisher is endorsed by `previous`, one of them, so installed plugins
+/// signed with it update without asking.
+fn register_key(
+    mut publishers: Vec<package::Publisher>,
+    publisher: &str,
+    name: &str,
+    key: &PublisherKey,
+    previous: Option<&PublisherKey>,
+) -> Result<Vec<package::Publisher>, String> {
+    let current = key.public_base64();
+    let earlier: Vec<KeyEntry> = publishers.iter().filter(|p| p.id == publisher).flat_map(|p| p.keys.clone()).collect();
+    let entry = match earlier.iter().find(|k| k.key == current) {
+        Some(listed) => listed.clone(),
+        None => {
+            let endorsement = match previous {
+                Some(prev) => {
+                    let prev_key = prev.public_base64();
+                    if !earlier.iter().any(|k| k.key == prev_key && !k.revoked) {
+                        return Err(format!("--previous-key is not one of {publisher}'s valid keys in the index"));
+                    }
+                    Some(prev.endorse(publisher, &current))
+                }
+                None => {
+                    if earlier.iter().any(|k| !k.revoked) {
+                        println!(
+                            "  warning: {publisher}'s new key is not endorsed (--previous-key): users who installed \
+                             its plugins will be asked to confirm the change when they update"
+                        );
+                    }
+                    None
+                }
+            };
+            KeyEntry { endorsement, ..KeyEntry::new(current.clone()) }
+        }
+    };
+    let keys = std::iter::once(entry).chain(earlier.into_iter().filter(|k| k.key != current)).collect();
+    publishers.retain(|p| p.id != publisher);
+    publishers.push(package::Publisher { id: publisher.into(), name: name.into(), keys });
+    Ok(publishers)
+}
+
+/// `index`, unless a newer `openidea-plugin` wrote it (rewriting it would drop what this one can't read).
+fn current_format(index: Index, file: &str) -> Result<Index, String> {
+    if index.is_newer() {
+        return Err(format!(
+            "{file}: index format {} is newer than this tool writes; update openidea-plugin",
+            index.format
+        ));
+    }
+    Ok(index)
+}
+
+fn cmd_merge(args: &[String]) -> Result<(), String> {
+    let a = Args::parse(args, &[], &["keep", "out"])?;
+    let [base, other] = a.positional.as_slice() else {
+        return Err("usage: openidea-plugin merge <index> <other-index> --keep ID [--out FILE]".into());
+    };
+    let keep = a.value("keep").ok_or("--keep is required")?;
+    let out = a.value("out").unwrap_or(base);
+    let mut index =
+        current_format(Index::parse(&std::fs::read_to_string(base).map_err(|e| format!("{base}: {e}"))?)?, base)?;
+    let bytes = read_market_url(other, 16 << 20)?;
+    let theirs = Index::parse(&String::from_utf8(bytes).map_err(|_| format!("{other}: not UTF-8"))?)?;
+    let mut theirs = current_format(theirs, other)?;
+    // Their downloads are relative to their index, not to ours.
+    for e in &mut theirs.plugins {
+        e.download = resolve_market_href(other, &e.download);
+    }
+    let count = theirs.plugins.len();
+    index.include(theirs, &[keep]).map_err(|e| format!("{other}: {e}"))?;
+    println!("  {count} plugins from {other}");
+    write_index(&index, Path::new(out))
+}
+
+fn write_index(index: &Index, out: &Path) -> Result<(), String> {
+    let json = serde_json::to_string_pretty(index).map_err(|e| e.to_string())?;
+    std::fs::write(out, json).map_err(|e| format!("{}: {e}", out.display()))?;
    println!("-> {} ({} plugins)", out.display(), index.plugins.len());
    Ok(())
 }
@@ -589,6 +758,25 @@ fn cmd_index(args: &[String]) -> Result<(), String> {
 mod tests {
    use super::*;

+    #[test]
+    fn a_new_key_is_endorsed_by_the_previous_one() {
+        let (k1, k2, k3) =
+            (PublisherKey::from_seed([1; 32]), PublisherKey::from_seed([2; 32]), PublisherKey::from_seed([3; 32]));
+        let first = register_key(Vec::new(), "acme", "ACME", &k1, None).unwrap();
+        let rotated = register_key(first.clone(), "acme", "ACME", &k2, Some(&k1)).unwrap();
+        let index = Index { format: package::INDEX_FORMAT, publishers: rotated.clone(), ..Index::default() };
+        assert!(index.succeeds("acme", &k1.public_base64(), &k2.public_base64()));
+        assert_eq!(rotated[0].keys.len(), 2, "the earlier key stays listed");
+        // Registering the current key again keeps its endorsement.
+        let again = register_key(rotated.clone(), "acme", "ACME", &k2, None).unwrap();
+        assert_eq!(again, rotated);
+        // Only a key the publisher has can endorse.
+        assert!(register_key(first.clone(), "acme", "ACME", &k2, Some(&k3)).unwrap_err().contains("--previous-key"));
+        // Without one the new key is listed unendorsed.
+        let unendorsed = register_key(first, "acme", "ACME", &k3, None).unwrap();
+        assert!(unendorsed[0].keys[0].endorsement.is_none());
+    }
+
    #[test]
    fn names() {
        assert_eq!(slugify("My Cool_Plugin"), "my-cool-plugin");
@@ -601,13 +789,189 @@ mod tests {
        assert_eq!(relative(Path::new("/x/y"), Path::new("/z")), None);
    }

+    #[test]
+    fn new_plugins_depend_on_the_sdk_by_path_only_in_its_source_tree() {
+        let tree = dunce::canonicalize(concat!(env!("CARGO_MANIFEST_DIR"), "/../..")).unwrap();
+        assert_eq!(
+            sdk_dependency(None, &tree.join("plugins/official/new")).unwrap(),
+            "{ path = \"../../../sdk/rust/openidea-plugin\" }"
+        );
+        let outside = dunce::canonicalize(std::env::temp_dir()).unwrap().join("my-plugin");
+        assert_eq!(
+            sdk_dependency(None, &outside).unwrap(),
+            format!("{{ git = \"https://github.com/l0ng-ai/openidea\", tag = \"v{}\" }}", env!("CARGO_PKG_VERSION"))
+        );
+        let sdk = tree.join("sdk/rust/openidea-plugin");
+        assert!(sdk_dependency(Some(sdk.to_str().unwrap()), &outside).unwrap().starts_with("{ path = "));
+        assert!(
+            sdk_dependency(Some(tree.join("wit").to_str().unwrap()), &outside)
+                .unwrap_err()
+                .contains("not the openidea-plugin SDK")
+        );
+    }
+
+    /// A theme package `id` signed by `publisher` with `key`, packed into `out`.
+    fn signed_theme(tmp: &Path, id: &str, publisher: &str, key: &str, out: &Path) {
+        signed_theme_version(tmp, id, "0.1.0", "^1.0", publisher, key, out);
+    }
+
+    fn signed_theme_version(tmp: &Path, id: &str, version: &str, engine: &str, publisher: &str, key: &str, out: &Path) {
+        let src = tmp.join("src").join(format!("{id}-{version}"));
+        let vars = templates::Vars { id, name: id, sdk: None };
+        for (rel, content) in templates::render(templates::Template::Theme, &vars) {
+            let path = src.join(rel);
+            std::fs::create_dir_all(path.parent().unwrap()).unwrap();
+            let content = content
+                .replace("version = \"0.1.0\"", &format!("version = \"{version}\""))
+                .replace("engines.openidea = \"^1.0\"", &format!("engines.openidea = \"{engine}\""));
+            std::fs::write(path, content).unwrap();
+        }
+        std::fs::create_dir_all(out).unwrap();
+        let args = [src.to_str().unwrap(), "--key", key, "--publisher", publisher, "--out"]
+            .into_iter()
+            .map(String::from)
+            .chain([out.join(format!("{id}-{version}.oiplugin")).to_string_lossy().into_owned()])
+            .collect::<Vec<_>>();
+        cmd_pack(&args).unwrap();
+    }
+
+    #[test]
+    fn a_release_keeps_the_versions_older_ides_need() {
+        let tmp = tempfile::tempdir().unwrap();
+        let t = tmp.path();
+        let key = t.join("acme.key");
+        std::fs::write(&key, PublisherKey::from_seed([5; 32]).seed_base64()).unwrap();
+        let key = key.to_string_lossy().into_owned();
+        let index_file = t.join("index.json");
+        let release = |n: usize, packages: &[(&str, &str, &str)]| {
+            let dir = t.join(format!("release-{n}"));
+            for (id, version, engine) in packages {
+                signed_theme_version(t, id, version, engine, "acme", &key, &dir);
+            }
+            let base = format!("https://example.com/download/v{n}");
+            let args = [dir.to_str().unwrap(), "--publisher", "acme", "--key", &key, "--download-base", &base];
+            cmd_index(&strings(&[&args[..], &["--out", index_file.to_str().unwrap()]].concat())).unwrap();
+            let index = Index::parse(&std::fs::read_to_string(&index_file).unwrap()).unwrap();
+            index.plugins.iter().map(|e| format!("{} {} {}", e.id, e.version, e.download)).collect::<Vec<_>>()
+        };
+        release(1, &[("acme.a", "1.0.0", "^1.0"), ("acme.b", "1.0.0", "^1.0")]);
+        // Same requirement: the newer version replaces it; acme.b is gone from the release.
+        assert_eq!(
+            release(2, &[("acme.a", "1.1.0", "^1.0")]),
+            ["acme.a 1.1.0 https://example.com/download/v2/acme.a-1.1.0.oiplugin"]
+        );
+        // Another API requirement: the last version for the earlier one stays, where it was published.
+        assert_eq!(
+            release(3, &[("acme.a", "2.0.0", ">=1.0, <2")]),
+            [
+                "acme.a 1.1.0 https://example.com/download/v2/acme.a-1.1.0.oiplugin",
+                "acme.a 2.0.0 https://example.com/download/v3/acme.a-2.0.0.oiplugin",
+            ]
+        );
+        let index = Index::parse(&std::fs::read_to_string(&index_file).unwrap()).unwrap();
+        assert_eq!(index.offered()[0].0.version, "2.0.0", "the newest this IDE can load");
+    }
+
+    fn strings(args: &[&str]) -> Vec<String> {
+        args.iter().map(|a| a.to_string()).collect()
+    }
+
+    #[test]
+    fn official_and_community_indexes_merge() {
+        let tmp = tempfile::tempdir().unwrap();
+        let t = tmp.path();
+        let mut keys = Vec::new();
+        for (name, seed) in [("openidea", 1), ("alice", 2), ("carol", 3)] {
+            let file = t.join(format!("{name}.key"));
+            let key = PublisherKey::from_seed([seed; 32]);
+            std::fs::write(&file, key.seed_base64()).unwrap();
+            keys.push((file.to_string_lossy().into_owned(), key.public_base64()));
+        }
+        let (official, community) = (t.join("official"), t.join("community"));
+        signed_theme(t, "openidea.night", "openidea", &keys[0].0, &official);
+        signed_theme(t, "alice.dawn", "alice", &keys[1].0, &community);
+        let official_index = official.join("index.json");
+        let community_index = community.join("index.json");
+        let release = strings(&[official.to_str().unwrap(), "--publisher", "openidea", "--key", &keys[0].0]);
+        cmd_index(&release).unwrap();
+
+        // The community index lists its publishers; `index` without a key checks packages against them.
+        let skeleton = Index {
+            format: package::INDEX_FORMAT,
+            publishers: vec![package::Publisher {
+                id: "alice".into(),
+                name: "Alice".into(),
+                keys: vec![KeyEntry::new(keys[1].1.clone())],
+            }],
+            ..Index::default()
+        };
+        write_index(&skeleton, &community_index).unwrap();
+        cmd_index(&strings(&[community.to_str().unwrap()])).unwrap();
+
+        cmd_merge(&strings(&[
+            official_index.to_str().unwrap(),
+            community_index.to_str().unwrap(),
+            "--keep",
+            "openidea",
+        ]))
+        .unwrap();
+        // A release rebuilds the official plugins and keeps the community's.
+        cmd_index(&release).unwrap();
+        let index = Index::parse(&std::fs::read_to_string(&official_index).unwrap()).unwrap();
+        let listed: Vec<_> = index.plugins.iter().map(|e| (e.id.as_str(), e.publisher.as_str())).collect();
+        assert_eq!(listed, [("alice.dawn", "alice"), ("openidea.night", "openidea")]);
+        assert_eq!(index.plugins[1].categories, ["themes"], "implied by the theme");
+        assert_eq!(index.plugins[1].download, "openidea.night-0.1.0.oiplugin");
+        assert!(Path::new(&index.plugins[0].download).is_absolute(), "{}", index.plugins[0].download);
+
+        // A package by a publisher the index doesn't know is refused.
+        signed_theme(t, "carol.noon", "carol", &keys[2].0, &community);
+        let err = cmd_index(&strings(&[community.to_str().unwrap()])).unwrap_err();
+        assert!(err.contains("unknown publisher"), "{err}");
+    }
+
+    /// `cargo test` of a new Rust plugin (its own tests against the mock host) with this SDK.
+    #[test]
+    fn the_command_template_builds_against_the_sdk() {
+        let dir = std::env::temp_dir().join(format!("openidea-plugin-template-build-{}", std::process::id()));
+        let _ = std::fs::remove_dir_all(&dir);
+        std::fs::create_dir_all(&dir).unwrap();
+        let dir = dunce::canonicalize(&dir).unwrap();
+        let plugin = dir.join("plugin");
+        let sdk = concat!(env!("CARGO_MANIFEST_DIR"), "/../../sdk/rust/openidea-plugin");
+        let sdk = sdk_dependency(Some(sdk), &plugin).unwrap();
+        let vars = templates::Vars { id: "acme.sample", name: "Sample", sdk: Some(&sdk) };
+        for (rel, content) in templates::render(templates::Template::Command, &vars) {
+            let path = plugin.join(rel);
+            std::fs::create_dir_all(path.parent().unwrap()).unwrap();
+            std::fs::write(path, content).unwrap();
+        }
+        // The SDK's lockfile keeps the versions its own CI builds with (the resolver also
+        // looks up the wasm-only dependencies, which may not be downloaded yet).
+        let sdk_lock = concat!(env!("CARGO_MANIFEST_DIR"), "/../../sdk/rust/openidea-plugin/Cargo.lock");
+        std::fs::copy(sdk_lock, plugin.join("Cargo.lock")).unwrap();
+        let out = Command::new(std::env::var("CARGO").unwrap_or_else(|_| "cargo".into()))
+            .args(["test", "--manifest-path"])
+            .arg(plugin.join("Cargo.toml"))
+            .env("CARGO_TARGET_DIR", dir.join("target"))
+            .output()
+            .unwrap();
+        assert!(
+            out.status.success(),
+            "{}{}",
+            String::from_utf8_lossy(&out.stdout),
+            String::from_utf8_lossy(&out.stderr)
+        );
+        std::fs::remove_dir_all(&dir).unwrap();
+    }
+
    #[test]
    fn every_template_is_a_valid_package() {
        for t in templates::Template::ALL {
            let dir =
                std::env::temp_dir().join(format!("openidea-plugin-template-{}-{}", t.label(), std::process::id()));
            let _ = std::fs::remove_dir_all(&dir);
-            let vars = templates::Vars { id: "acme.sample", name: "Sample", sdk: Some("../sdk") };
+            let vars = templates::Vars { id: "acme.sample", name: "Sample", sdk: Some("{ path = \"../sdk\" }") };
            for (rel, content) in templates::render(t, &vars) {
                let path = dir.join(rel);
                std::fs::create_dir_all(path.parent().unwrap()).unwrap();
@@ -32,6 +32,7 @@ impl Template {
 pub struct Vars<'a> {
    pub id: &'a str,
    pub name: &'a str,
+    /// The SDK dependency, as a TOML value (`{ path = "…" }`).
    pub sdk: Option<&'a str>,
 }

@@ -82,6 +83,9 @@ name = "__NAME__"
 version = "0.1.0"
 description = "Adds two sample commands."
 authors = []
+# Marketplace categories (up to 3): languages, themes, icon-themes, linters,
+# vcs, ai, frameworks, tools, other.
+categories = ["tools"]
 engines.openidea = "^1.0"
 # Built by `openidea-plugin build`. The code is loaded the first time one of
 # its commands runs; the commands below show in Find Action before that.
@@ -115,7 +119,7 @@ publish = false
 crate-type = ["cdylib", "rlib"]

 [dependencies]
-openidea-plugin = { path = "__SDK__" }
+openidea-plugin = __SDK__

 [profile.release]
 opt-level = "s"
@@ -127,7 +131,7 @@ panic = "abort"

 const COMMAND_LIB: &str = r#"//! __NAME__: an OpenIDEA plugin.

-use openidea_plugin::{Invocation, NotificationLevel, Plugin, host, register_plugin};
+use openidea_plugin::{Error, Invocation, NotificationLevel, Plugin, host, register_plugin};

 #[derive(Default)]
 pub struct Main {
@@ -135,7 +139,7 @@ pub struct Main {
 }

 impl Plugin for Main {
-    fn run_command(&mut self, id: &str, ctx: &Invocation, _arg: Option<&str>) -> Result<Option<String>, String> {
+    fn run_command(&mut self, id: &str, ctx: &Invocation, _arg: Option<&str>) -> Result<Option<String>, Error> {
        match id {
            "say-hello" => {
                // Instance state lasts until the plugin is idle for a while;
@@ -150,7 +154,7 @@ impl Plugin for Main {
                let text = editor.document()?.text;
                Ok(Some(format!("{} lines in {}", text.lines().count(), editor.path())))
            }
-            _ => Err(format!("unknown command {id}")),
+            _ => Err(format!("unknown command {id}").into()),
        }
    }
 }
@@ -10,6 +10,7 @@ mod java_runtime;
 mod kotlin_bridge;
 pub mod notebook;
 pub mod ops;
+mod phpstan;
 pub mod plugins;
 mod project;
 mod proxy;
@@ -25,7 +26,7 @@ use ide_language::{LanguageRegistry, Syntax};
 use ide_run::ProcessManager;
 use ide_terminal::TerminalManager;
 use ide_workspace::SettingsStore;
-use parking_lot::RwLock;
+use parking_lot::{Mutex, RwLock};
 use std::collections::HashMap;
 use std::path::PathBuf;
 use std::sync::{Arc, OnceLock};
@@ -74,15 +75,25 @@ pub struct Host {
    pub environment: environment::Environment,
    /// The HTTP proxy's saved password (see `proxy.rs`).
    proxy_password: ide_ssh::secrets::SecretFile,
+    /// The proxy password when it could not be saved (no credential store).
+    proxy_session_password: Mutex<Option<String>>,
    pub(crate) sink_for: SinkFactory,
    owner: fn(&str) -> &str,
    pub runtime: tokio::runtime::Handle,
    /// One project per window, keyed by window label.
    projects: RwLock<HashMap<String, Arc<Project>>>,
+    pub(crate) external_logs: RwLock<HashMap<String, Vec<Arc<ide_vcs::Repo>>>>,
    requests: requests::Requests,
    project_requests: RwLock<HashMap<String, Vec<RequestId>>>,
+    /// Shutdowns of projects closed with [`Host::close_project_detached`].
+    closing: parking_lot::Mutex<Vec<std::thread::JoinHandle<()>>>,
+    /// One open at a time per window (see [`Host::opening`]).
+    open_locks: parking_lot::Mutex<HashMap<String, Arc<parking_lot::Mutex<()>>>>,
 }

+/// How long exit waits for project shutdown before giving up.
+const EXIT_SHUTDOWN_WAIT: std::time::Duration = std::time::Duration::from_secs(10);
+
 impl Host {
    pub fn new(config: HostConfig) -> Self {
        let HostConfig {
@@ -102,6 +113,7 @@ impl Host {
        let host = Self {
            trust: trust::TrustStore::load(&config_dir, &data_dir),
            proxy_password: ide_ssh::secrets::SecretFile::new(data_dir.join("proxy-password.json")),
+            proxy_session_password: Mutex::default(),
            remote: Arc::new(ide_remote::RemoteService::new(ssh.clone(), data_dir.join("remote"))),
            ssh,
            environment: environment::Environment::new(project_environment, local_data_dir.clone()),
@@ -122,8 +134,11 @@ impl Host {
            owner,
            runtime,
            projects: RwLock::default(),
+            external_logs: RwLock::default(),
            requests: Default::default(),
            project_requests: RwLock::default(),
+            closing: Default::default(),
+            open_locks: Default::default(),
        };
        host.apply_proxy();
        host
@@ -177,45 +192,72 @@ impl Host {
        }
    }

+    /// Closes `window`'s project and waits until its language servers, kernels and
+    /// debug sessions have shut down. Never call this on the UI event-loop thread:
+    /// the shutdown runs on the async runtime, whose workers may themselves be
+    /// waiting for the event loop (IPC responses, window queries). Use
+    /// [`Self::close_project_detached`] there.
    pub fn close_project(&self, window: &str) {
-        let project = self.projects.write().remove(window);
-        if let Some(project) = project {
-            if !project.light {
-                self.environment.project_closed();
-            }
-            if let Some(bridge) = &project.kotlin_bridge {
-                bridge.stop();
-            }
-            project.documents.clear_workspace_edit_history();
-            project.agents.shutdown();
-            project.notebooks.stop_admission();
-            // What the closing window started goes with it — the builds and searches it
-            // asked for, its runs, its shells and its debug sessions — and the language
-            // servers finish shutting down before the window is gone, as IDEA closes a
-            // project's processes.
-            for request in self.project_requests.write().remove(self.owner_window(window)).unwrap_or_default() {
-                self.cancel_request(request);
-            }
-            self.processes.kill_project(&project.root);
-            self.terminals.kill_key(self.owner_window(window));
-            self.shutdown_project_workers_blocking(
-                vec![project.notebooks.clone()],
-                project.kotlin_bridge.iter().cloned().collect(),
-                Some(project.lsp.clone()),
-                Some((self.debugger.clone(), window.to_owned())),
-            );
+        if let Some(shutdown) = self.begin_close(window) {
+            self.wait_blocking(shutdown);
        }
    }

-    /// Synchronous project/window destruction must finish owned kernel cleanup,
-    /// not enqueue work which can be lost as the desktop runtime exits.
-    fn shutdown_project_workers_blocking(
+    /// Like [`Self::close_project`], but returns once the project is detached from
+    /// the window; its workers finish shutting down in the background, and
+    /// [`Self::shutdown_notebooks_on_exit`] waits for them before the process exits.
+    pub fn close_project_detached(&self, window: &str) {
+        if let Some(shutdown) = self.begin_close(window) {
+            let mut closing = self.closing.lock();
+            closing.retain(|handle| !handle.is_finished());
+            closing.push(shutdown);
+        }
+    }
+
+    /// Detaches the project from `window` and stops what it started, synchronously,
+    /// so the window can open another project at once. Returns the thread that
+    /// finishes shutting down its workers.
+    fn begin_close(&self, window: &str) -> Option<std::thread::JoinHandle<()>> {
+        self.external_logs.write().remove(self.owner_window(window));
+        for request in self.project_requests.write().remove(self.owner_window(window)).unwrap_or_default() {
+            self.cancel_request(request);
+        }
+        let project = self.projects.write().remove(window)?;
+        if !project.light {
+            self.environment.project_closed();
+        }
+        if let Some(bridge) = &project.kotlin_bridge {
+            bridge.stop();
+        }
+        if let Some(phpstan) = &project.phpstan {
+            phpstan.stop();
+        }
+        project.documents.clear_workspace_edit_history();
+        project.agents.shutdown();
+        project.notebooks.stop_admission();
+        // What the closing window started goes with it — the builds and searches it
+        // asked for, its runs, its shells and its debug sessions — and its language
+        // servers shut down.
+        self.processes.kill_project(&project.root);
+        self.terminals.kill_key(self.owner_window(window));
+        Some(self.spawn_project_shutdown(
+            vec![project.notebooks.clone()],
+            project.kotlin_bridge.iter().cloned().collect(),
+            Some(project.lsp.clone()),
+            Some((self.debugger.clone(), window.to_owned())),
+        ))
+    }
+
+    /// Project/window destruction must finish owned kernel cleanup, not enqueue
+    /// work which can be lost as the desktop runtime exits: the returned thread is
+    /// joined by the closer or, for a detached close, before exit.
+    fn spawn_project_shutdown(
        &self,
        notebooks: Vec<Arc<notebook::NotebookService>>,
        bridges: Vec<Arc<kotlin_bridge::KotlinBridge>>,
        lsp: Option<Arc<ide_lsp::LspManager>>,
        debug: Option<(Arc<ide_dap::DebugManager>, String)>,
-    ) {
+    ) -> std::thread::JoinHandle<()> {
        for bridge in &bridges {
            bridge.stop();
        }
@@ -223,25 +265,37 @@ impl Host {
            service.stop_admission();
        }
        let runtime = self.runtime.clone();
-        let wait = move || {
-            let worker = std::thread::spawn(move || {
-                runtime.block_on(async move {
-                    for bridge in bridges {
-                        bridge.shutdown().await;
-                    }
-                    for service in notebooks {
-                        service.shutdown().await;
-                    }
-                    if let Some(lsp) = lsp {
-                        lsp.shutdown_all().await;
-                    }
-                    if let Some((debug, key)) = debug {
-                        debug.stop_key(&key).await;
-                    }
-                });
+        std::thread::spawn(move || {
+            runtime.block_on(async move {
+                for bridge in bridges {
+                    bridge.shutdown().await;
+                }
+                for service in notebooks {
+                    service.shutdown().await;
+                }
+                if let Some(lsp) = lsp {
+                    lsp.shutdown_all().await;
+                }
+                if let Some((debug, key)) = debug {
+                    debug.stop_key(&key).await;
+                }
            });
-            if let Err(error) = worker.join() {
-                tracing::error!("notebook shutdown thread failed: {error:?}");
+        })
+    }
+
+    /// Waits for detached closes, so a project opened next never races the
+    /// language servers of one still shutting down (e.g. over a shared workspace).
+    pub(crate) fn wait_detached_closes(&self) {
+        let pending: Vec<_> = self.closing.lock().drain(..).collect();
+        for shutdown in pending {
+            self.wait_blocking(shutdown);
+        }
+    }
+
+    fn wait_blocking(&self, shutdown: std::thread::JoinHandle<()>) {
+        let wait = move || {
+            if let Err(error) = shutdown.join() {
+                tracing::error!("project shutdown thread failed: {error:?}");
            }
        };
        if tokio::runtime::Handle::try_current()
@@ -253,15 +307,32 @@ impl Host {
        }
    }

-    /// Called before the desktop runtime exits, including update/restart exits.
+    /// Called before the desktop runtime exits, including update/restart exits, on
+    /// the event-loop thread: waits for detached closes and the open projects'
+    /// kernels, but no longer than [`EXIT_SHUTDOWN_WAIT`], so a runtime worker
+    /// stuck on the event loop cannot keep the process from exiting.
    pub fn shutdown_notebooks_on_exit(&self) {
        let projects = self.projects();
-        self.shutdown_project_workers_blocking(
+        let mut pending: Vec<_> = self.closing.lock().drain(..).collect();
+        pending.push(self.spawn_project_shutdown(
            projects.iter().map(|project| project.notebooks.clone()).collect(),
            projects.iter().filter_map(|project| project.kotlin_bridge.clone()).collect(),
            None,
            None,
-        );
+        ));
+        let deadline = std::time::Instant::now() + EXIT_SHUTDOWN_WAIT;
+        while pending.iter().any(|handle| !handle.is_finished()) {
+            if std::time::Instant::now() >= deadline {
+                tracing::warn!("project shutdown did not finish within {EXIT_SHUTDOWN_WAIT:?}; exiting anyway");
+                return;
+            }
+            std::thread::sleep(std::time::Duration::from_millis(20));
+        }
+        for handle in pending {
+            if let Err(error) = handle.join() {
+                tracing::error!("project shutdown thread failed: {error:?}");
+            }
+        }
    }

    /// Called before desktop exit, which may bypass document destructors.
@@ -282,6 +353,9 @@ impl Host {
            if let Some(bridge) = &project.kotlin_bridge {
                bridge.stop();
            }
+            if let Some(phpstan) = &project.phpstan {
+                phpstan.stop();
+            }
            project.documents.clear_workspace_edit_history();
            project.notebooks.stop_admission();
            project.agents.shutdown();
@@ -311,14 +385,20 @@ impl Host {
    }

    pub fn begin_project_request(&self, window: &str, id: RequestId) -> CancellationToken {
-        let token = self.begin_request(id);
-        self.project_requests.write().entry(self.owner_window(window).to_owned()).or_default().push(id);
+        let token = self.begin_project_read_request(window, id);
        if self.project(window).is_ok_and(|p| !p.is_trusted()) {
            token.cancel();
        }
        token
    }

+    /// Read-only work remains cancellable/disposed with its window in restricted projects.
+    pub fn begin_project_read_request(&self, window: &str, id: RequestId) -> CancellationToken {
+        let token = self.begin_request(id);
+        self.project_requests.write().entry(self.owner_window(window).to_owned()).or_default().push(id);
+        token
+    }
+
    pub fn end_request(&self, id: RequestId) {
        for ids in self.project_requests.write().values_mut() {
            ids.retain(|entry| *entry != id);
@@ -331,6 +411,13 @@ impl Host {
        self.requests.cancel(id);
    }

+    /// The lock an open of `window` holds from its check for the current project to its
+    /// insert: two opens racing (a double click, a launch path and a restore) would each start
+    /// an index, language servers and watchers, and the second would replace the first unclosed.
+    pub(crate) fn opening(&self, window: &str) -> Arc<parking_lot::Mutex<()>> {
+        self.open_locks.lock().entry(window.to_owned()).or_default().clone()
+    }
+
    pub(crate) fn insert_project(&self, window: &str, project: Arc<Project>) {
        self.projects.write().insert(window.to_owned(), project);
    }
@@ -1,7 +1,7 @@
 //! Project-incarnation notebook ownership and whole-batch execution admission.
 use crate::ops::Channel;
 use ide_core::error::ErrorKind;
-use ide_core::{CancellationToken, IdeError, IdeEvent, IdeResult, SharedSink};
+use ide_core::{CancellationToken, IdeError, IdeEvent, IdeResult, IpcPath, SharedSink};
 use ide_notebook::kernel::{KernelManager, KernelOutput};
 use ide_notebook::{NotebookDocument, NotebookEdit, NotebookSnapshot};
 use parking_lot::Mutex;
@@ -17,7 +17,7 @@ use tokio::sync::{Mutex as AsyncMutex, watch};
 #[serde(rename_all = "camelCase")]
 pub struct NotebookOutputEvent {
    pub id: String,
-    pub path: String,
+    pub path: IpcPath,
    pub cell: String,
    pub msg_id: String,
    pub kind: String,
@@ -536,7 +536,7 @@ fn commit_output(
    };
    Ok(Some(NotebookOutputEvent {
        id: document.id.clone(),
-        path: document.path.to_string_lossy().into_owned(),
+        path: document.path.clone().into(),
        cell: cell.to_owned(),
        msg_id: output.msg_id,
        kind: output.kind,
@@ -592,6 +592,16 @@ mod tests {
        other.shutdown().await;
    }

+    #[tokio::test]
+    async fn the_notebook_path_reaches_the_ui_as_the_project_tree_names_it() {
+        let (dir, service, _) = fixture();
+        let ui_path =
+            format!("{}/session.ipynb", ide_core::ipc_path::to_ipc(&dunce::canonicalize(dir.path()).unwrap()));
+        let snapshot = service.open(Path::new(&ui_path)).unwrap();
+        assert_eq!(serde_json::to_value(&snapshot).unwrap()["path"], ui_path);
+        service.shutdown().await;
+    }
+
    #[tokio::test(start_paused = true)]
    async fn failed_close_keeps_the_incarnation_recoverable_until_a_retry_succeeds() {
        let (dir, service, initial) = fixture();
@@ -8,8 +8,11 @@ use ide_agent::{
    AgentChange, AgentCommand, AgentEntry, AgentEvent, AgentProbe, AgentPrompt, AgentProvider, AgentQueued, AgentTask,
    NewAgentTask,
 };
-use ide_core::{IdeError, IdeResult, IpcPath, RequestId};
+use ide_core::error::ErrorKind;
+use ide_core::{IdeError, IdeEvent, IdeResult, IpcPath, RequestId, SharedSink, TaskId};
 use ide_tools::InstallEvent;
+use std::collections::HashSet;
+use std::sync::{LazyLock, Mutex};

 /// Streams the project's agent events to this window; returns every task.
 pub fn subscribe(host: &Host, window: &str, on_event: Emit<AgentEvent>) -> IdeResult<Vec<AgentTask>> {
@@ -30,6 +33,17 @@ pub fn set_command(host: &Host, window: &str, id: String, command: Option<String
    host.project(window)?.agents.set_builtin_command(&id, command)
 }

+/// Environment variables built-in agent `id` starts with; empty clears them.
+pub fn set_env(
+    host: &Host,
+    window: &str,
+    id: String,
+    env: std::collections::BTreeMap<String, String>,
+) -> IdeResult<()> {
+    host.require_trust(window)?;
+    host.project(window)?.agents.set_builtin_env(&id, env)
+}
+
 /// Where ACP Registry agents are saved (`<config>/agents`, like the user's own) and installed.
 pub(crate) fn registry_paths(host: &Host) -> RegistryPaths {
    RegistryPaths::new(&host.config_dir, &host.local_data_dir)
@@ -47,7 +61,39 @@ pub async fn registry_list(host: &Host, _window: &str, request: RequestId) -> Id
    let result =
        tokio::task::spawn_blocking(move || ide_agent::registry::list(&paths, &cancel)).await.map_err(join_err);
    host.end_request(request);
-    result?
+    let mut registry = result??;
+    let installing = installing();
+    for agent in &mut registry.agents {
+        agent.installing = installing.contains(&agent.id);
+    }
+    Ok(registry)
+}
+
+/// Registry installs in progress, by agent id. An install outlives the Settings page
+/// that started it, so a second one of the same agent is refused rather than racing it
+/// for the same folder.
+static INSTALLING: LazyLock<Mutex<HashSet<String>>> = LazyLock::new(Mutex::default);
+
+fn installing() -> std::sync::MutexGuard<'static, HashSet<String>> {
+    INSTALLING.lock().unwrap_or_else(|e| e.into_inner())
+}
+
+/// Marks agent `id` as installing until dropped.
+struct Installing(String);
+
+impl Installing {
+    fn begin(id: &str) -> IdeResult<Self> {
+        if !installing().insert(id.to_owned()) {
+            return Err(IdeError::new(ErrorKind::AlreadyExists, format!("{id} is already being installed")));
+        }
+        Ok(Self(id.to_owned()))
+    }
+}
+
+impl Drop for Installing {
+    fn drop(&mut self) {
+        installing().remove(&self.0);
+    }
 }

 /// Installs the registry's current version of agent `id` (also to update it), streaming
@@ -61,11 +107,43 @@ pub async fn registry_install(
    on_event: Channel<InstallEvent>,
 ) -> IdeResult<()> {
    let paths = registry_paths(host);
+    let installing = Installing::begin(&id)?;
    let cancel = host.begin_request(request);
+    // Also a background task of every project window, so it stays visible and can be
+    // stopped there once the Settings page is closed.
+    let task = TaskId::next();
+    let title = format!("Installing {id}");
+    let sinks: Vec<SharedSink> = host.projects().iter().map(|p| p.sink.clone()).collect();
+    let report = move |message: Option<String>, fraction: Option<f32>, done: bool| {
+        for sink in &sinks {
+            sink.emit(IdeEvent::Task {
+                id: task,
+                title: title.clone(),
+                message: message.clone(),
+                fraction,
+                done,
+                cancellable: !done,
+            });
+        }
+    };
    let result = tokio::task::spawn_blocking(move || {
-        ide_agent::registry::install(&paths, &id, &cancel, &|e| {
+        let _installing = installing;
+        let _cancel = ide_core::task::on_cancel(task, {
+            let cancel = cancel.clone();
+            move || cancel.cancel()
+        });
+        report(None, None, false);
+        let result = ide_agent::registry::install(&paths, &id, &cancel, &|e| {
+            match &e {
+                InstallEvent::Line { text } => report(Some(text.clone()), None, false),
+                InstallEvent::Progress { fraction, message } => {
+                    report(Some(message.clone()), fraction.map(|f| f as f32), false)
+                }
+            }
            let _ = on_event.send(e);
-        })
+        });
+        report(None, Some(1.0), true);
+        result
    })
    .await
    .map_err(join_err);
@@ -195,6 +273,7 @@ pub(crate) fn register(d: &mut Dispatcher) {
    d.add("agent_subscribe", |c| async move { subscribe(&c.host, &c.window, c.channel("onEvent")?) });
    d.add("agent_providers", |c| async move { providers(&c.host, &c.window) });
    d.add("agent_set_command", |c| async move { set_command(&c.host, &c.window, c.arg("id")?, c.arg("command")?) });
+    d.add("agent_set_env", |c| async move { set_env(&c.host, &c.window, c.arg("id")?, c.arg("env")?) });
    d.add("agent_registry_list", |c| async move { registry_list(&c.host, &c.window, c.arg("request")?).await });
    d.add("agent_registry_install", |c| async move {
        registry_install(&c.host, &c.window, c.arg("id")?, c.arg("request")?, c.sender("onEvent")?).await
@@ -251,6 +330,20 @@ fn validate_project_root(root: &std::path::Path, requested: Option<&std::path::P
 #[cfg(test)]
 mod tests {
    use super::*;
+
+    #[test]
+    fn an_agent_installs_once_at_a_time() {
+        let first = Installing::begin("test-agent").unwrap();
+        assert!(installing().contains("test-agent"));
+        let again = Installing::begin("test-agent").err().unwrap();
+        assert_eq!(again.kind, ErrorKind::AlreadyExists);
+        let other = Installing::begin("test-other-agent").unwrap();
+        drop(first);
+        assert!(!installing().contains("test-agent"));
+        drop(Installing::begin("test-agent").unwrap());
+        drop(other);
+    }
+
    #[test]
    fn agent_roots_are_exact_window_or_workspace_members() {
        let tmp = tempfile::tempdir().unwrap();
@@ -32,6 +32,7 @@ pub fn load(root: &Path, cache: &Path, settings: &Settings) -> BuildModel {
        cache,
        ide_sdk::apply::maven_local_repository(root, settings),
        &settings.languages.java.maven,
+        &settings.languages.java.gradle,
    );
    let jdk = ide_sdk::apply::project_jdk(root, settings);
    if let Some(m) = &mut model.maven {
@@ -45,7 +46,7 @@ pub fn load(root: &Path, cache: &Path, settings: &Settings) -> BuildModel {
            p.options = options.clone();
        }
    }
-    if let Some(g) = &mut model.gradle {
+    for g in &mut model.gradle {
        g.env = ide_sdk::apply::gradle_env(root, settings, java_env(jdk.as_ref(), g.java_version));
        g.command = ide_sdk::apply::gradle_command(root, &root.join(&g.dir), settings).to_string_lossy().into_owned();
    }
@@ -65,11 +66,12 @@ pub fn load(root: &Path, cache: &Path, settings: &Settings) -> BuildModel {
        let hint = m.projects.iter().find_map(|p| missing(p.java_version));
        explain(&mut m.sync_error, hint);
    }
-    if let Some(g) = &mut model.gradle
-        && g.sync_error.is_some()
-    {
-        let hint = if settings.languages.java.gradle.jvm.trim().is_empty() { missing(g.java_version) } else { None };
-        explain(&mut g.sync_error, hint);
+    for g in &mut model.gradle {
+        if g.sync_error.is_some() {
+            let hint =
+                if settings.languages.java.gradle.jvm.trim().is_empty() { missing(g.java_version) } else { None };
+            explain(&mut g.sync_error, hint);
+        }
    }
    model
 }
@@ -94,9 +96,89 @@ pub async fn build_model(host: &Host, window: &str) -> IdeResult<BuildModel> {
    tokio::task::spawn_blocking(move || load(&root, &cache, &settings)).await.map_err(join_err)
 }

+fn linked_gradle_paths(
+    root: &Path,
+    settings: &ide_core::settings::GradleSettings,
+    paths: &[String],
+    link: bool,
+) -> IdeResult<Vec<String>> {
+    let existing = settings
+        .linked_projects
+        .clone()
+        .unwrap_or_else(|| ide_build::gradle::load_linked(root, settings).into_iter().map(|g| g.dir).collect());
+    let mut linked = Vec::new();
+    for path in existing {
+        let normalized = ide_build::gradle::normalize_linked_projects(root, std::slice::from_ref(&path))
+            .unwrap_or_else(|_| vec![path]);
+        for path in normalized {
+            if !linked.contains(&path) {
+                linked.push(path);
+            }
+        }
+    }
+    if link {
+        let directories: Vec<String> = paths
+            .iter()
+            .map(|path| {
+                let path = root.join(path);
+                let is_script = path.file_name().and_then(|n| n.to_str()).is_some_and(|name| {
+                    ide_build::gradle::SETTINGS_FILES.contains(&name) || ide_build::gradle::BUILD_FILES.contains(&name)
+                });
+                if is_script && path.is_file() {
+                    path.parent().unwrap_or(root).to_string_lossy().into_owned()
+                } else {
+                    path.to_string_lossy().into_owned()
+                }
+            })
+            .collect();
+        for path in ide_build::gradle::normalize_linked_projects(root, &directories)? {
+            if !linked.contains(&path) {
+                linked.push(path);
+            }
+        }
+    } else {
+        let unlinked: Vec<String> = paths.iter().map(|p| ide_build::gradle::linked_project_key(root, p)).collect();
+        linked.retain(|path| !paths.contains(path) && !unlinked.contains(path));
+    }
+    Ok(linked)
+}
+
+async fn set_gradle_projects(host: &Host, window: &str, paths: Vec<String>, link: bool) -> IdeResult<BuildModel> {
+    host.require_trust(window)?;
+    let project = host.project(window)?;
+    tokio::task::spawn_blocking(move || {
+        if ide_workspace::workspace::Workspace::load(&project.root)?.is_some() {
+            return Err(IdeError::invalid("Open a workspace member as a project to link Gradle builds"));
+        }
+        let linked =
+            linked_gradle_paths(&project.root, &project.settings.effective().languages.java.gradle, &paths, link)?;
+        let key = "languages.java.gradle.linkedProjects";
+        let settings =
+            project.settings.set(ide_workspace::settings::SettingsScope::Project, key, serde_json::json!(linked))?;
+        project.refresh_index_scope();
+        project.lsp.reconfigure_soon();
+        project.sink.emit(IdeEvent::SettingsChanged { key: key.into() });
+        project.sink.emit(IdeEvent::ProjectRootsChanged { root: project.root.clone().into() });
+        Ok::<BuildModel, IdeError>(load(&project.root, &project.build_cache_dir(), &settings))
+    })
+    .await
+    .map_err(join_err)?
+}
+
+/// Links independent builds without changing their Gradle scripts.
+pub async fn gradle_link_projects(host: &Host, window: &str, paths: Vec<String>) -> IdeResult<BuildModel> {
+    set_gradle_projects(host, window, paths, true).await
+}
+
+/// Stops importing the selected independent builds; files and saved run configurations stay intact.
+pub async fn gradle_unlink_projects(host: &Host, window: &str, paths: Vec<String>) -> IdeResult<BuildModel> {
+    set_gradle_projects(host, window, paths, false).await
+}
+
 /// Runs Maven (`help:effective-pom dependency:tree`) or Gradle (`tasks --all`) in the
 /// background, reporting progress on `on_progress`; cancellable with `cancel_request(request)`.
 /// Returns the refreshed model; a failed build is reported in its `syncError`.
+#[allow(clippy::too_many_arguments)]
 pub async fn build_sync(
    host: &Host,
    window: &str,
@@ -104,6 +186,7 @@ pub async fn build_sync(
    request: RequestId,
    offline: bool,
    profiles: Vec<String>,
+    build_dir: Option<String>,
    on_progress: Channel<SyncProgress>,
 ) -> IdeResult<BuildModel> {
    host.require_trust(window)?;
@@ -122,6 +205,8 @@ pub async fn build_sync(
        project.sink.emit(ide_core::IdeEvent::ProjectRootsChanged { root: project.root.clone().into() });
    }
    let token = host.begin_project_request(window, request);
+    let completion_token = token.clone();
+    let original_links = settings.languages.java.gradle.linked_projects.clone();
    let result = tokio::task::spawn_blocking(move || {
        let current = load(&root, &cache, &settings);
        let env = match tool {
@@ -131,7 +216,7 @@ pub async fn build_sync(
                .and_then(|m| m.projects.iter().find(|p| !p.env.is_empty()))
                .map(|p| p.env.clone())
                .unwrap_or_default(),
-            BuildTool::Gradle => current.gradle.as_ref().map(|g| g.env.clone()).unwrap_or_default(),
+            BuildTool::Gradle => BTreeMap::new(),
        };
        let options = SyncOptions {
            offline,
@@ -140,14 +225,31 @@ pub async fn build_sync(
            maven_command: ide_sdk::apply::maven_command(&root, &settings).map(|p| p.to_string_lossy().into_owned()),
            maven_options: ide_sdk::apply::maven_options(&root, &settings),
            maven_settings: settings.languages.java.maven.clone(),
-            gradle_command: current.gradle.as_ref().map(|g| g.command.clone()),
+            gradle_command: None,
        };
        let progress = |p: SyncProgress| {
            let _ = on_progress.send(p);
        };
        match tool {
            BuildTool::Maven => ide_build::sync_maven(&root, &cache, &options, &token, &progress)?,
-            BuildTool::Gradle => ide_build::sync_gradle(&root, &cache, &options, &token, &progress)?,
+            BuildTool::Gradle => {
+                if let Some(dir) = &build_dir
+                    && !current.gradle.iter().any(|g| &g.dir == dir)
+                {
+                    return Err(IdeError::not_found("Gradle project is no longer linked"));
+                }
+                for g in current.gradle.iter().filter(|g| build_dir.as_ref().is_none_or(|dir| dir == &g.dir)) {
+                    if token.is_cancelled() {
+                        return Err(IdeError::cancelled());
+                    }
+                    let options =
+                        SyncOptions { env: g.env.clone(), gradle_command: Some(g.command.clone()), ..options.clone() };
+                    ide_build::sync_gradle_model(&root, &cache, g, &options, &token, &progress)?;
+                }
+                if token.is_cancelled() {
+                    return Err(IdeError::cancelled());
+                }
+            }
        }
        Ok::<BuildModel, IdeError>(load(&root, &cache, &settings))
    })
@@ -155,6 +257,18 @@ pub async fn build_sync(
    .map_err(join_err);
    host.end_request(request);
    let model = result??;
+    if completion_token.is_cancelled() {
+        return Err(IdeError::cancelled());
+    }
+    if tool == BuildTool::Gradle && original_links != project.settings.effective().languages.java.gradle.linked_projects
+    {
+        // A late sync must not re-import a build that was unlinked while it ran.
+        return tokio::task::spawn_blocking(move || {
+            load(&project.root, &project.build_cache_dir(), &project.settings.effective())
+        })
+        .await
+        .map_err(join_err);
+    }
    if tool == BuildTool::Gradle {
        // The sync may report project folders outside the project (`includeFlat`): index and list them.
        project.refresh_index_scope();
@@ -222,6 +336,58 @@ fn declaring_pom(
    )))
 }

+/// The `.toml` of a version catalog the build imports as `group:artifact:version`, once a
+/// build has downloaded it (`ide_sdk::libraries::published_version_catalog`).
+pub async fn gradle_published_catalog(
+    host: &Host,
+    window: &str,
+    coordinates: String,
+) -> IdeResult<Option<ide_core::IpcPath>> {
+    let project = host.project(window)?;
+    tokio::task::spawn_blocking(move || {
+        ide_sdk::libraries::published_version_catalog(&project.root, &project.settings.effective(), &coordinates)
+            .map(Into::into)
+    })
+    .await
+    .map_err(join_err)
+}
+
+/// The resolved dependency tree of the Gradle project `gradle_path` (`:`, `:app`) for
+/// `configuration`, from Gradle's `dependencies` report; cancellable with `cancel_request(request)`.
+pub async fn gradle_dependencies(
+    host: &Host,
+    window: &str,
+    gradle_path: String,
+    configuration: String,
+    offline: bool,
+    request: RequestId,
+    build_dir: Option<String>,
+) -> IdeResult<Vec<ide_build::GradleDependency>> {
+    host.require_trust(window)?;
+    let project = host.project(window)?;
+    let (root, cache, settings) = (project.root.clone(), project.build_cache_dir(), project.settings.effective());
+    let token = host.begin_project_request(window, request);
+    let result = tokio::task::spawn_blocking(move || {
+        let model = load(&root, &cache, &settings);
+        let gradle = model
+            .gradle
+            .iter()
+            .find(|g| build_dir.as_ref().is_none_or(|dir| &g.dir == dir))
+            .ok_or_else(|| IdeError::not_found("Gradle project is no longer linked"))?;
+        let options = SyncOptions {
+            offline,
+            env: gradle.env.clone(),
+            gradle_command: Some(gradle.command.clone()),
+            ..Default::default()
+        };
+        ide_build::gradle_dependencies(&root, gradle, &options, &gradle_path, &configuration, &token)
+    })
+    .await
+    .map_err(join_err);
+    host.end_request(request);
+    result?
+}
+
 /// Where the direct dependency `dependency` of the Maven module `pom` is declared.
 pub async fn maven_dependency_declaration(
    host: &Host,
@@ -336,6 +502,11 @@ pub async fn build_run(
 /// Commands of this module the remote server answers.
 pub(crate) fn register(d: &mut Dispatcher) {
    d.add("build_model", |c| async move { build_model(&c.host, &c.window).await });
+    d.add("gradle_link_projects", |c| async move { gradle_link_projects(&c.host, &c.window, c.arg("paths")?).await });
+    d.add(
+        "gradle_unlink_projects",
+        |c| async move { gradle_unlink_projects(&c.host, &c.window, c.arg("paths")?).await },
+    );
    d.add("build_sync", |c| async move {
        build_sync(
            &c.host,
@@ -344,10 +515,26 @@ pub(crate) fn register(d: &mut Dispatcher) {
            c.arg("request")?,
            c.arg("offline")?,
            c.arg("profiles")?,
+            c.arg("buildDir")?,
            c.sender("onProgress")?,
        )
        .await
    });
+    d.add("gradle_published_catalog", |c| async move {
+        gradle_published_catalog(&c.host, &c.window, c.arg("coordinates")?).await
+    });
+    d.add("gradle_dependencies", |c| async move {
+        gradle_dependencies(
+            &c.host,
+            &c.window,
+            c.arg("gradlePath")?,
+            c.arg("configuration")?,
+            c.arg("offline")?,
+            c.arg("request")?,
+            c.arg("buildDir")?,
+        )
+        .await
+    });
    d.add("maven_dependency_declaration", |c| async move {
        maven_dependency_declaration(&c.host, &c.window, c.arg("pom")?, c.arg("dependency")?).await
    });
@@ -372,6 +559,48 @@ pub(crate) fn register(d: &mut Dispatcher) {
 mod gradle_settings_tests {
    use super::*;

+    #[test]
+    fn linking_retains_the_implicit_build_and_unlinking_all_stays_empty() {
+        let tmp = tempfile::tempdir().unwrap();
+        let root = dunce::canonicalize(tmp.path()).unwrap();
+        for name in ["a", "b"] {
+            std::fs::create_dir(root.join(name)).unwrap();
+            std::fs::write(root.join(name).join("settings.gradle"), format!("rootProject.name = '{name}'")).unwrap();
+        }
+        let mut settings = ide_core::settings::GradleSettings::default();
+        let linked = linked_gradle_paths(&root, &settings, &["b/settings.gradle".into()], true).unwrap();
+        assert_eq!(linked, ["a", "b"]);
+        settings.linked_projects = Some(linked);
+        assert_eq!(linked_gradle_paths(&root, &settings, &["b".into()], true).unwrap(), ["a", "b"]);
+        assert!(linked_gradle_paths(&root, &settings, &["missing".into()], true).is_err());
+        settings.linked_projects = Some(vec!["./a".into(), root.join("b").to_string_lossy().into_owned()]);
+        settings.linked_projects = Some(linked_gradle_paths(&root, &settings, &["a".into()], false).unwrap());
+        assert_eq!(settings.linked_projects.as_ref().unwrap(), &["b"]);
+        settings.linked_projects = Some(linked_gradle_paths(&root, &settings, &["b".into()], false).unwrap());
+        assert!(ide_build::gradle::load_linked(&root, &settings).is_empty());
+        assert!(root.join("a/settings.gradle").is_file());
+        assert!(root.join("b/settings.gradle").is_file());
+    }
+
+    #[test]
+    fn settings_resolve_each_linked_builds_own_wrapper() {
+        let tmp = tempfile::tempdir().unwrap();
+        let root = dunce::canonicalize(tmp.path()).unwrap();
+        let mut settings = Settings::default();
+        settings.languages.java.gradle.linked_projects = Some(vec!["a".into(), "b".into()]);
+        let executable = if cfg!(windows) { "gradlew.bat" } else { "gradlew" };
+        for dir in ["a", "b"] {
+            std::fs::create_dir(root.join(dir)).unwrap();
+            std::fs::write(root.join(dir).join("build.gradle"), "plugins { id 'java' }").unwrap();
+            std::fs::write(root.join(dir).join(executable), "").unwrap();
+        }
+        let model = load(&root, &root.join("cache"), &settings);
+        assert_eq!(model.gradle.len(), 2);
+        for g in model.gradle {
+            assert_eq!(g.command, root.join(&g.dir).join(executable).to_string_lossy());
+        }
+    }
+
    #[test]
    fn model_for_sync_tasks_and_compile_uses_gradle_settings() {
        let tmp = tempfile::tempdir().unwrap();
@@ -380,13 +609,13 @@ mod gradle_settings_tests {
        let wrapper = root.join(if cfg!(windows) { "gradlew.bat" } else { "gradlew" });
        std::fs::write(&wrapper, "").unwrap();
        let mut settings = Settings::default();
-        let default = load(root, &root.join("cache"), &settings).gradle.unwrap();
+        let default = load(root, &root.join("cache"), &settings).gradle.remove(0);
        assert_eq!(default.command, wrapper.to_string_lossy());
        settings.languages.java.gradle.jvm = "jdk21".into();
        settings.languages.java.gradle.user_home = "user-home".into();
        settings.languages.java.gradle.distribution = ide_core::settings::GradleDistribution::Local;
        settings.languages.java.gradle.home = "gradle-install".into();
-        let model = load(root, &root.join("cache"), &settings).gradle.unwrap();
+        let model = load(root, &root.join("cache"), &settings).gradle.remove(0);
        assert_eq!(
            model.command,
            root.join("gradle-install")
@@ -32,7 +32,7 @@ pub async fn coverage_collect(host: &Host, window: &str, report: CoverageReportS
    blocking(move || ide_coverage::collect(&report)).await
 }

-/// Reads a report collected elsewhere (CI): lcov, a Go cover profile or JaCoCo XML,
+/// Reads a report collected elsewhere (CI): lcov, a Go cover profile, JaCoCo XML or a SimpleCov resultset,
 /// with paths mapped into this project.
 pub async fn coverage_import(host: &Host, window: &str, path: IpcPath) -> IdeResult<CoverageSuite> {
    let root = host.project(window)?.root.clone();
@@ -123,13 +123,14 @@ pub(crate) fn register(d: &mut Dispatcher) {
        statements(&c.host, &c.window, &id, &text, from, to)
    });
    d.add("db_execute", |c| async move {
-        let (request, id, statements, max_rows) = (
+        let (request, id, statements, skip, max_rows) = (
            c.arg::<RequestId>("request")?,
            c.arg::<String>("id")?,
            c.arg::<Vec<SqlStatement>>("statements")?,
+            c.arg::<Option<u32>>("skip")?.unwrap_or(0),
            c.arg::<u32>("maxRows")?,
        );
-        execute(&c.host, &c.window, request, &id, statements, max_rows).await
+        execute(&c.host, &c.window, request, &id, statements, skip, max_rows).await
    });
    d.add("db_table_page", |c| async move {
        let (request, id, schema, table) = (
@@ -216,8 +217,7 @@ pub async fn connect(host: &Host, window: &str, id: &str) -> IdeResult<()> {
 /// manual mode rolls back what was not committed).
 pub async fn set_manual_commit(host: &Host, window: &str, id: &str, manual: bool) -> IdeResult<()> {
    let db = host.project(window)?.db.clone();
-    db.set_manual_commit(id, manual).await;
-    Ok(())
+    db.set_manual_commit(id, manual).await
 }

 /// Commits or rolls back the open transaction of a manual-commit data source.
@@ -326,20 +326,22 @@ pub fn statements(host: &Host, window: &str, id: &str, text: &str, from: u32, to
 }

 /// Runs `statements` in order on data source `id`, stopping at the first
-/// error. Cancel with `cancel_request(request)`.
+/// error. Each result reads past its first `skip` rows (a later page) and keeps
+/// `max_rows`. Cancel with `cancel_request(request)`.
 pub async fn execute(
    host: &Host,
    window: &str,
    request: RequestId,
    id: &str,
    statements: Vec<SqlStatement>,
+    skip: u32,
    max_rows: u32,
 ) -> IdeResult<Vec<StatementOutcome>> {
    let db = host.project(window)?.db.clone();
    let cancel = host.begin_request(request);
    let mut out = Vec::new();
    for statement in statements {
-        match db.execute(id, &statement.text, max_rows.max(1) as usize, &cancel).await {
+        match db.execute_from(id, &statement.text, skip as usize, max_rows.max(1) as usize, &cancel).await {
            Ok(result) => out.push(StatementOutcome { statement, result: Some(result), error: None }),
            Err(e) if e.kind == ide_core::error::ErrorKind::Cancelled => {
                host.end_request(request);
@@ -162,6 +162,14 @@ pub async fn debug_pause(host: &Host, _window: &str, session: DebugSessionId, th
    host.debugger.pause(session, thread_id).await
 }

+pub async fn debug_hot_reload(host: &Host, _window: &str, session: DebugSessionId) -> IdeResult<()> {
+    host.debugger.hot_reload(session).await
+}
+
+pub async fn debug_hot_restart(host: &Host, _window: &str, session: DebugSessionId) -> IdeResult<()> {
+    host.debugger.hot_restart(session).await
+}
+
 pub async fn debug_step(
    host: &Host,
    _window: &str,
@@ -18,7 +18,7 @@ pub async fn blocking<T: Send + 'static>(f: impl FnOnce() -> IdeResult<T> + Send
 /// editor buffer, so syntax features and language-server requests work in it.
 pub async fn doc_open_virtual(host: &Host, window: &str, uri: String) -> IdeResult<DocumentInfo> {
    let project = host.project(window)?;
-    let vd = project.lsp.virtual_document(&uri).await?;
+    let vd = crate::ops::lsp::lsp_virtual_document(host, window, uri).await?;
    blocking(move || project.documents.open_virtual(&vd.uri, vd.language_id, &vd.text)).await
 }

@@ -137,16 +137,23 @@ pub fn set_writable(host: &Host, window: &str, path: PathBuf, writable: bool) ->
 pub async fn delete(host: &Host, window: &str, path: PathBuf) -> IdeResult<()> {
    let history = host.project(window).ok().map(|p| p.history.clone());
    host.blocking(move || {
+        let paths = ide_workspace::file_ops::deletion_paths(&path)?;
        if let Some(h) = history {
-            h.record_deletion(&path, DELETE_SNAPSHOT_LIMIT);
+            for p in paths {
+                h.record_deletion(&p, DELETE_SNAPSHOT_LIMIT);
+            }
        }
-        ide_vfs::delete(&path)
+        ide_workspace::file_ops::delete(&path)
    })
    .await
 }

 pub async fn copy(host: &Host, from: PathBuf, to: PathBuf) -> IdeResult<()> {
-    host.blocking(move || ide_vfs::copy(&from, &to)).await
+    host.blocking(move || ide_workspace::file_ops::copy(&from, &to)).await
+}
+
+pub async fn rename(host: &Host, from: PathBuf, to: PathBuf) -> IdeResult<()> {
+    host.blocking(move || ide_workspace::file_ops::rename(&from, &to)).await
 }

 /// Reads a text file without opening it as a document; prefers the unsaved buffer.
@@ -76,9 +76,17 @@ async fn plugin_call<T: Send + 'static>(f: impl FnOnce() -> T + Send + 'static)
    tokio::task::spawn_blocking(f).await.ok()
 }

-/// Items from plugins carry no server (resolve and commands don't apply).
+/// Items from plugins carry no server: commands don't apply, and a code
+/// action is resolved by the plugin named in its `data` ([`PluginActionRef`]).
 const PLUGIN_SERVER: ServerId = ServerId(0);

+/// `data` of a plugin's code action whose edits it computes when picked.
+#[derive(serde::Serialize, serde::Deserialize)]
+struct PluginActionRef {
+    plugin: String,
+    data: String,
+}
+
 /// A plugin's `completion-item.kind` (wit/providers.wit lists them).
 fn plugin_completion_kind(kind: &str) -> Option<CompletionKind> {
    Some(match kind {
@@ -120,14 +128,14 @@ fn plugin_completion(item: ide_plugin::CompletionItem) -> CompletionItem {
        kind,
        documentation: item.documentation.map(|value| Markup { kind: "markdown".into(), value }),
        sort_text: item.sort_text,
-        filter_text: None,
+        filter_text: item.filter_text,
        preselect: false,
        deprecated: false,
        insert_text: item.insert_text,
-        is_snippet: false,
+        is_snippet: item.snippet,
        replace_range: item.replace,
        replace_range_tab: None,
-        additional_edits: Vec::new(),
+        additional_edits: item.additional_edits,
        commit_characters: Vec::new(),
        command: None,
        data: None,
@@ -252,6 +260,9 @@ pub async fn lsp_implementations(
 /// Contents of a read-only language-server document, including JDT library
 /// classes and disk class files. Cached per project.
 pub async fn lsp_virtual_document(host: &Host, window: &str, uri: String) -> IdeResult<VirtualDocument> {
+    if uri.starts_with("git-revision:") {
+        return crate::ops::vcs::revision_virtual_document(host, window, &uri).await;
+    }
    host.project(window)?.lsp.virtual_document(&uri).await
 }

@@ -314,7 +325,7 @@ pub async fn lsp_code_actions(
    };
    let plugin_actions: Vec<CodeAction> = plugin_actions
        .into_iter()
-        .map(|(_, a)| plugin_code_action(a))
+        .map(|(plugin, a)| plugin_code_action(&plugin, a))
        .filter(|a| {
            only.is_empty()
                || a.kind.as_ref().is_some_and(|k| only.iter().any(|o| k == o || k.starts_with(&format!("{o}."))))
@@ -330,24 +341,53 @@ pub async fn lsp_code_actions(
    prepare_actions(project, doc, version, actions).await
 }

-fn plugin_code_action(a: ide_plugin::CodeAction) -> CodeAction {
-    let files = a
+fn plugin_code_action(plugin: &str, a: ide_plugin::CodeAction) -> CodeAction {
+    // With `data` and no edits, the plugin computes them when the action is picked.
+    let lazy = a.edits.is_empty() && a.data.is_some();
+    let files: Vec<_> = a
        .edits
        .into_iter()
        .map(|(path, edits)| ide_core::FileEdit::Edit { path: path.into(), edits, version: None })
        .collect();
+    let data = a
+        .data
+        .filter(|_| lazy)
+        .and_then(|data| serde_json::to_value(PluginActionRef { plugin: plugin.to_owned(), data }).ok());
    CodeAction {
        title: a.title,
        kind: a.kind,
        is_preferred: a.preferred,
        disabled_reason: None,
-        edit: Some(WorkspaceEdit { files, preconditions: Vec::new() }),
+        edit: (!lazy).then(|| WorkspaceEdit { files, preconditions: Vec::new() }),
        command: None,
-        data: None,
+        data,
        server: PLUGIN_SERVER,
    }
 }

+/// A code action resolved by whoever offered it: its language server, or
+/// the plugin its `data` names.
+async fn resolve_action(host: &Host, window: &str, doc: DocId, action: CodeAction) -> IdeResult<CodeAction> {
+    if action.server != PLUGIN_SERVER {
+        return host.project(window)?.lsp.resolve_code_action(doc, action).await;
+    }
+    let Some(r) = action.data.clone().and_then(|d| serde_json::from_value::<PluginActionRef>(d).ok()) else {
+        return Ok(action);
+    };
+    let (plugins, d) = plugin_providers(host, window, doc, ProviderKind::CodeActions)
+        .ok_or_else(|| ide_core::IdeError::unavailable("the plugin that offered this action is gone"))?;
+    let pending = ide_plugin::CodeAction {
+        title: action.title.clone(),
+        kind: action.kind.clone(),
+        preferred: action.is_preferred,
+        edits: Vec::new(),
+        data: Some(r.data),
+    };
+    let plugin = r.plugin.clone();
+    let resolved = blocking(move || plugins.resolve_code_action(&plugin, &d, pending)).await?;
+    Ok(plugin_code_action(&r.plugin, ide_plugin::CodeAction { data: None, ..resolved }))
+}
+
 /// Cancellable code actions with the kinds the servers advertise (Refactor This, refactoring availability).
 pub async fn lsp_code_action_query(
    host: &Host,
@@ -381,7 +421,7 @@ pub async fn lsp_resolve_code_action(
    let project = host.project(window)?;
    let documents = project.documents.clone();
    let version = blocking(move || documents.version(doc)).await?;
-    let action = project.lsp.resolve_code_action(doc, action).await?;
+    let action = resolve_action(host, window, doc, action).await?;
    Ok(prepare_actions(project, doc, version, vec![action]).await?.remove(0))
 }

@@ -391,7 +431,7 @@ pub async fn lsp_apply_code_action(host: &Host, window: &str, doc: DocId, action
    let action = if action.edit.is_none() && action.command.is_none() {
        let documents = project.documents.clone();
        let version = blocking(move || documents.version(doc)).await?;
-        let action = project.lsp.resolve_code_action(doc, action).await?;
+        let action = resolve_action(host, window, doc, action).await?;
        prepare_actions(project.clone(), doc, version, vec![action]).await?.remove(0)
    } else {
        action
@@ -401,17 +441,85 @@ pub async fn lsp_apply_code_action(host: &Host, window: &str, doc: DocId, action
        let edit = edit.clone();
        blocking(move || apply_edit(&documents, &edit)).await?;
    }
-    if let Some(command) = action.command {
+    if let Some(command) = action.command
+        && !(action.edit.is_some() && is_client_follow_up(&project, doc, None, &command).await)
+    {
        project.lsp.execute_command(doc, command).await?;
    }
    Ok(())
 }

+/// A command after a code action's edit that no server provides: what other editors'
+/// extensions do once the edit is applied (vtsls' `_typescript.didOrganizeImports`). The edit
+/// is the action; there is nothing to run.
+async fn is_client_follow_up(
+    project: &crate::project::Project,
+    doc: DocId,
+    server: Option<ide_core::ServerId>,
+    command: &Command,
+) -> bool {
+    let provided = project.lsp.provides_command(doc, server, &command.command).await;
+    if !provided {
+        tracing::debug!("skipping `{}` after the code action's edit: no server provides it", command.command);
+    }
+    !provided
+}
+
 pub async fn lsp_prepare_rename(host: &Host, window: &str, doc: DocId, pos: Pos) -> IdeResult<Option<Range>> {
    host.project(window)?.lsp.prepare_rename(doc, pos).await
 }

 /// Computes the rename edit without applying it, so the UI can preview conflicts.
+/// The class at `pos` and the members a class-hierarchy refactoring can move.
+pub async fn lsp_hierarchy_members(
+    host: &Host,
+    window: &str,
+    request: RequestId,
+    doc: DocId,
+    pos: Pos,
+    kind: HierarchyRefactoring,
+) -> IdeResult<HierarchyMembers> {
+    let project = host.project(window)?;
+    let cancel = host.begin_request(request);
+    let result = project.lsp.hierarchy_members(doc, pos, kind, cancel).await;
+    host.end_request(request);
+    result
+}
+
+/// Checks a class-hierarchy refactoring and computes its edit without applying it.
+#[allow(clippy::too_many_arguments)]
+pub async fn lsp_hierarchy_refactor(
+    host: &Host,
+    window: &str,
+    request: RequestId,
+    doc: DocId,
+    pos: Pos,
+    kind: HierarchyRefactoring,
+    target: Option<String>,
+    choices: Vec<HierarchyChoice>,
+) -> IdeResult<HierarchyRefactored> {
+    let project = host.project(window)?;
+    let documents = project.documents.clone();
+    let version = blocking(move || documents.version(doc)).await?;
+    let cancel = host.begin_request(request);
+    let result = project.lsp.hierarchy_refactor(doc, pos, kind, target, choices, cancel).await;
+    host.end_request(request);
+    let mut refactored = result?;
+    blocking(move || {
+        if project.documents.version(doc)? != version {
+            return Err(ide_core::IdeError::new(
+                ide_core::error::ErrorKind::OutOfSync,
+                "document changed while computing the refactoring; request it again",
+            ));
+        }
+        if let Some(edit) = &mut refactored.edit {
+            project.documents.prepare_workspace_edit(edit)?;
+        }
+        Ok(refactored)
+    })
+    .await
+}
+
 pub async fn lsp_rename(
    host: &Host,
    window: &str,
@@ -589,6 +697,7 @@ pub async fn lsp_execute_code_action(
        if cancel.is_cancelled() {
            return Err(ide_core::IdeError::cancelled());
        }
+        let edited = action.edit.is_some();
        if let Some(edit) = action.edit {
            let documents = project.documents.clone();
            tokio::task::spawn_blocking(move || apply_edit(&documents, &edit))
@@ -596,6 +705,9 @@ pub async fn lsp_execute_code_action(
                .map_err(|e| ide_core::IdeError::internal(e.to_string()))??;
        }
        match action.command {
+            Some(command) if edited && is_client_follow_up(&project, doc, Some(action.server), &command).await => {
+                Ok(Vec::new())
+            }
            Some(command) => project
                .lsp
                .execute_action_command(doc, action.server, command, answers, cancel)
@@ -676,6 +788,22 @@ pub(crate) fn register(d: &mut Dispatcher) {
    d.add("lsp_rename", |c| async move {
        lsp_rename(&c.host, &c.window, c.arg("request")?, c.arg("doc")?, c.arg("pos")?, c.arg("newName")?).await
    });
+    d.add("lsp_hierarchy_members", |c| async move {
+        lsp_hierarchy_members(&c.host, &c.window, c.arg("request")?, c.arg("doc")?, c.arg("pos")?, c.arg("kind")?).await
+    });
+    d.add("lsp_hierarchy_refactor", |c| async move {
+        lsp_hierarchy_refactor(
+            &c.host,
+            &c.window,
+            c.arg("request")?,
+            c.arg("doc")?,
+            c.arg("pos")?,
+            c.arg("kind")?,
+            c.arg("target")?,
+            c.arg("choices")?,
+        )
+        .await
+    });
    d.add("lsp_format", |c| async move {
        lsp_format(&c.host, &c.window, c.arg("doc")?, c.arg("range")?, c.arg("options")?).await
    });
@@ -735,6 +863,25 @@ pub(crate) fn register(d: &mut Dispatcher) {
 mod tests {
    use super::*;

+    #[test]
+    fn a_plugin_action_with_data_and_no_edits_is_resolved_by_its_plugin() {
+        let action = |edits: Vec<(std::path::PathBuf, Vec<TextEdit>)>, data: Option<&str>| ide_plugin::CodeAction {
+            title: "Fix".into(),
+            kind: None,
+            preferred: false,
+            edits,
+            data: data.map(str::to_owned),
+        };
+        let lazy = plugin_code_action("acme.x", action(Vec::new(), Some("ref")));
+        assert!(lazy.edit.is_none());
+        let r: PluginActionRef = serde_json::from_value(lazy.data.unwrap()).unwrap();
+        assert_eq!((r.plugin.as_str(), r.data.as_str()), ("acme.x", "ref"));
+        // With edits, `data` is the plugin's business: applied as is.
+        let edit = TextEdit { range: Range::default(), new_text: "x".into() };
+        let eager = plugin_code_action("acme.x", action(vec![("/a".into(), vec![edit])], Some("ref")));
+        assert!(eager.edit.is_some() && eager.data.is_none());
+    }
+
    #[test]
    fn every_completion_kind_the_plugin_api_documents_is_understood() {
        let wit = include_str!("../../../../wit/providers.wit");
@@ -3,7 +3,7 @@ use crate::Host;
 use crate::Project;
 use crate::rpc::Dispatcher;
 use ide_core::{DocId, IdeResult, IpcPath, Location, Pos};
-use ide_index::{FileMatch, IndexStatus, SymbolFilter, SymbolMatch};
+use ide_index::{ExtensionCount, FileMatch, IndexStatus, SymbolFilter, SymbolMatch};
 use ide_language::{FileReference, WebReference};
 use ide_workspace::file_refs::{self, PathCompletion};
 use serde::{Deserialize, Serialize};
@@ -32,10 +32,19 @@ pub fn index_status(host: &Host, window: &str) -> IdeResult<IndexStatus> {
    Ok(host.project(window)?.index.status())
 }

+/// The project's file extensions, most common first.
+pub fn index_file_extensions(host: &Host, window: &str) -> IdeResult<Vec<ExtensionCount>> {
+    Ok(host.project(window)?.index.file_extensions())
+}
+
 pub fn find_files(host: &Host, window: &str, query: String, limit: u32) -> IdeResult<Vec<FileMatch>> {
    Ok(host.project(window)?.index.find_files(&query, limit as usize))
 }

+pub fn find_dirs(host: &Host, window: &str, query: String, limit: u32) -> IdeResult<Vec<FileMatch>> {
+    Ok(host.project(window)?.index.find_dirs(&query, limit as usize))
+}
+
 pub fn find_symbols(
    host: &Host,
    window: &str,
@@ -156,7 +165,9 @@ pub async fn web_unresolved_references(host: &Host, window: &str, doc: DocId) ->
 /// Commands of this module the remote server answers.
 pub(crate) fn register(d: &mut Dispatcher) {
    d.add("index_status", |c| async move { index_status(&c.host, &c.window) });
+    d.add("index_file_extensions", |c| async move { index_file_extensions(&c.host, &c.window) });
    d.add("find_files", |c| async move { find_files(&c.host, &c.window, c.arg("query")?, c.arg("limit")?) });
+    d.add("find_dirs", |c| async move { find_dirs(&c.host, &c.window, c.arg("query")?, c.arg("limit")?) });
    d.add("find_symbols", |c| async move {
        find_symbols(&c.host, &c.window, c.arg("query")?, c.arg("filter")?, c.arg("limit")?)
    });
@@ -17,6 +17,8 @@ pub struct ProjectInfo {
    pub settings: Settings,
    #[serde(default, skip_serializing_if = "Option::is_none")]
    pub workspace: Option<ide_workspace::workspace::Workspace>,
+    #[serde(default, skip_serializing_if = "Option::is_none")]
+    pub unity: Option<ide_workspace::unity::UnityProjectInfo>,
 }

 pub fn info(project: &Project) -> ProjectInfo {
@@ -33,6 +35,7 @@ pub fn info(project: &Project) -> ProjectInfo {
        settings,
        root: project.root.clone().into(),
        workspace: ide_workspace::workspace::Workspace::load(&project.root).ok().flatten(),
+        unity: ide_workspace::unity::detect(&project.root),
    }
 }

@@ -172,7 +175,12 @@ pub fn set_settings(
        host.apply_proxy();
    }
    // A new interpreter / toolchain / server executable restarts the language servers it affects.
-    let code_style = key == "editor" || key == "editor.codeStyle" || key.starts_with("editor.codeStyle.");
+    // So do inspections that are compiler options (`ide-sdk` `configure_java_compiler`).
+    let code_style = key == "editor"
+        || key == "editor.codeStyle"
+        || key.starts_with("editor.codeStyle.")
+        || key == "inspections"
+        || key.starts_with("inspections.");
    let toolchain = ["languages", "tools", "languageServers", "projectStructure"]
        .iter()
        .any(|k| key == *k || key.starts_with(&format!("{k}.")));
@@ -188,7 +196,9 @@ pub fn set_settings(
    }
    let roots_changed = key == "projectStructure"
        || key.starts_with("projectStructure.")
-        || "languages.java.maven.unlinkedProjects".starts_with(key);
+        || "languages.java.maven.unlinkedProjects".starts_with(key)
+        || "languages.java.maven.linkedProjects".starts_with(key)
+        || "languages.java.gradle.linkedProjects".starts_with(key);
    // Content roots and excludes (files.exclude, ignored names, excluded folders) reach the
    // index and the watchers without reopening the project (the rescan runs in the background).
    if roots_changed || key == "files" || key.starts_with("files.") {
@@ -20,7 +20,7 @@ const MAX_FILE_BYTES: u64 = 4 << 20;
 #[derive(Clone, Debug, Serialize, Deserialize, Type)]
 #[serde(rename_all = "camelCase")]
 pub struct RouteSource {
-    pub path: String,
+    pub path: ide_core::IpcPath,
    pub text: String,
 }

@@ -51,7 +51,7 @@ pub(crate) fn sources_in(root: &Path, excludes: &[String]) -> Vec<RouteSource> {
            return;
        }
        bytes.fetch_add(text.len(), Ordering::Relaxed);
-        found.push(RouteSource { path: path.to_string_lossy().into_owned(), text });
+        found.push(RouteSource { path: path.to_path_buf().into(), text });
    });
    let mut files = found.into_inner().unwrap_or_default();
    files.sort_by(|a, b| a.path.cmp(&b.path));
@@ -116,7 +116,7 @@ mod tests {
        std::fs::write(tmp.path().join("src/Notes.txt"), "@GetMapping(\"/a\")").unwrap();
        let files = sources_in(tmp.path(), &[]);
        assert_eq!(files.len(), 1, "{:?}", files.iter().map(|f| &f.path).collect::<Vec<_>>());
-        assert!(Path::new(&files[0].path).ends_with("src/Ctl.java"), "{}", files[0].path);
+        assert!(files[0].path.ends_with("src/Ctl.java"), "{:?}", files[0].path);
        assert!(files[0].text.contains("@GetMapping"));
    }

@@ -129,6 +129,6 @@ mod tests {
        std::fs::write(tmp.path().join("build/B.java"), "@RequestMapping(\"/b\")").unwrap();
        let files = sources_in(tmp.path(), &["build/**".to_owned()]);
        assert_eq!(files.len(), 1, "{:?}", files.iter().map(|f| &f.path).collect::<Vec<_>>());
-        assert!(Path::new(&files[0].path).ends_with("module/src/A.java"), "{}", files[0].path);
+        assert!(files[0].path.ends_with("module/src/A.java"), "{:?}", files[0].path);
    }
 }
@@ -41,7 +41,7 @@ pub fn configs(host: &Host, window: &str) -> IdeResult<Vec<RunConfig>> {
 }

 /// A project's detected configurations (minus removed ones and unlinked Maven projects), then
-/// its saved ones; toolchains from Languages & Frameworks applied. Gradle choices stay as saved:
+/// its saved ones; toolchains from Languages & Frameworks applied. Build-tool choices stay as saved:
 /// derived defaults must not be written back as explicit environment.
 fn detected_and_saved(
    root: &std::path::Path,
@@ -56,7 +56,7 @@ fn detected_and_saved(
            .filter(|d| !suppressed.contains(&d.id) && !saved.iter().any(|u| u.id == d.id))
            .collect();
    all.extend(saved.iter().cloned());
-    for config in all.iter_mut().filter(|c| c.kind != "gradle") {
+    for config in all.iter_mut().filter(|c| !matches!(c.kind.as_str(), "gradle" | "maven")) {
        ide_sdk::apply::apply_to_run_configs(std::slice::from_mut(config), root, settings);
    }
    all
@@ -75,13 +75,65 @@ pub fn save_configs(
    let configs: Vec<RunConfig> = configs
        .iter()
        .map(|c| match c.kind.as_str() {
-            "gradle" => c.clone(),
+            "gradle" | "maven" => c.clone(),
            _ => ide_sdk::apply::without_derived(c, &project.root, &settings),
        })
        .collect();
    ide_run::save_user_configs_with_removals(&project.root, &configs, removed_detected_ids)
 }

+/// The project `config` runs in (a workspace member, by its working directory) and its settings.
+fn settings_for(
+    host: &Host,
+    project: &crate::project::Project,
+    config: &RunConfig,
+) -> IdeResult<(std::path::PathBuf, ide_core::settings::Settings)> {
+    let member = ide_workspace::workspace::Workspace::load(&project.root)?.and_then(|workspace| {
+        let cwd = config.cwd.as_deref()?;
+        workspace.projects.into_iter().filter(|root| cwd.starts_with(root)).max_by_key(|root| root.components().count())
+    });
+    Ok(match member {
+        Some(root) => {
+            let settings = ide_workspace::SettingsStore::load(&host.config_dir, Some(&root)).effective();
+            (root, settings)
+        }
+        None => (project.root.clone(), project.settings.effective()),
+    })
+}
+
+/// Temporary configurations as they are kept between sessions: without what settings derived
+/// (toolchain commands, Maven options, `JAVA_HOME`…), so they follow later settings changes.
+pub fn without_derived(host: &Host, window: &str, configs: Vec<RunConfig>) -> IdeResult<Vec<RunConfig>> {
+    host.require_trust(window)?;
+    let project = host.project(window)?;
+    configs
+        .into_iter()
+        .map(|c| {
+            if c.kind == "gradle" {
+                return Ok(c);
+            }
+            let (root, settings) = settings_for(host, &project, &c)?;
+            Ok(ide_sdk::apply::without_derived(&c, &root, &settings))
+        })
+        .collect()
+}
+
+/// Kept temporary configurations with today's settings applied, as [`configs`] lists the others.
+pub fn apply_settings(host: &Host, window: &str, configs: Vec<RunConfig>) -> IdeResult<Vec<RunConfig>> {
+    host.require_trust(window)?;
+    let project = host.project(window)?;
+    configs
+        .into_iter()
+        .map(|mut c| {
+            if c.kind != "gradle" {
+                let (root, settings) = settings_for(host, &project, &c)?;
+                ide_sdk::apply::apply_to_run_configs(std::slice::from_mut(&mut c), &root, &settings);
+            }
+            Ok(c)
+        })
+        .collect()
+}
+
 pub async fn start(host: &Host, window: &str, config: RunConfig, on_output: Emit<OutputChunk>) -> IdeResult<RunInfo> {
    host.require_trust(window)?;
    let project = host.project(window)?;
@@ -100,18 +152,16 @@ pub async fn start(host: &Host, window: &str, config: RunConfig, on_output: Emit
            .run(&settings, &project.root, &config, project.sink.clone(), Box::new(move |c| out(c)))
            .await;
    }
-    let member = ide_workspace::workspace::Workspace::load(&project.root)?.and_then(|workspace| {
-        let cwd = config.cwd.as_deref()?;
-        workspace.projects.into_iter().filter(|root| cwd.starts_with(root)).max_by_key(|root| root.components().count())
-    });
-    let root = member.as_ref().unwrap_or(&project.root);
-    let settings = match &member {
-        Some(root) => ide_workspace::SettingsStore::load(&host.config_dir, Some(root)).effective(),
-        None => project.settings.effective(),
-    };
+    let (root, settings) = settings_for(host, &project, &config)?;
+    let root = &root;
    // Configurations made in the UI name bare tools (`godot`) that may live outside PATH.
+    // Maven re-applies too: a config listed before a settings change (daemon toggle,
+    // Maven home) keeps the launcher that was current then; re-resolving at launch is
+    // what makes the setting take effect without reopening the project.
    let mut config = config;
-    if matches!(config.kind.as_str(), "gradle" | "tomcat") {
+    if config.kind == "maven" {
+        ide_sdk::apply::prepare_maven_run(&mut config, root, &settings);
+    } else if matches!(config.kind.as_str(), "gradle" | "tomcat") {
        ide_sdk::apply::apply_to_run_configs(std::slice::from_mut(&mut config), root, &settings);
    } else {
        ide_sdk::apply::resolve_run_command(&mut config, root, &settings);
@@ -147,7 +197,8 @@ pub async fn start(host: &Host, window: &str, config: RunConfig, on_output: Emit
    let encoding = settings.console.encoding;
    let options = StartOptions {
        encoding: Some(encoding).filter(|e| !e.trim().is_empty()),
-        python_paths: if member.is_some() { vec![root.clone()] } else { super::python::paths(&project) },
+        python_paths: if *root != project.root { vec![root.clone()] } else { super::python::paths(&project) },
+        ruby_reporter: ruby_reporter_dir(host, &config),
    };
    project.require_trust()?;
    let mut sink = project.sink.clone();
@@ -164,6 +215,21 @@ pub async fn start(host: &Host, window: &str, config: RunConfig, on_output: Emit
    host.processes.start(&project.root, &config, &options, sink, Box::new(move |c| on_output(c)))
 }

+/// The Ruby test reporter's directory, installed on demand, for runs that take it.
+fn ruby_reporter_dir(host: &Host, config: &RunConfig) -> Option<std::path::PathBuf> {
+    if !ide_run::ruby_reporter::applies(config) {
+        return None;
+    }
+    let dir = host.local_data_dir.join("ruby-reporter");
+    match ide_run::ruby_reporter::install(&dir) {
+        Ok(()) => Some(dir),
+        Err(e) => {
+            tracing::warn!("cannot install the Ruby test reporter in {}: {e}", dir.display());
+            None
+        }
+    }
+}
+
 /// Stops a run (interrupt, then kill after Settings › Run's termination timeout).
 pub fn stop(host: &Host, window: &str, id: RunId) -> IdeResult<()> {
    let settings = match host.project(window) {
@@ -142,6 +142,21 @@ pub async fn run_gradle_jvm_args_script(_host: &Host, _window: &str, jvm_args: V
    .map_err(|e| IdeError::internal(e.to_string()))?
 }

+/// Writes one of the IDE's Gradle init scripts (`text`; the file is named `<name>-<hash>`) on
+/// the machine that runs the build, for `--init-script`, and returns its path.
+pub async fn run_gradle_init_script(_host: &Host, _window: &str, name: String, text: String) -> IdeResult<String> {
+    if name.is_empty() || !name.bytes().all(|b| b.is_ascii_alphanumeric() || b == b'-') {
+        return Err(IdeError::invalid(format!("invalid init script name {name:?}")));
+    }
+    tokio::task::spawn_blocking(move || {
+        ide_run::gradle_jvm::write_script(&ide_run::gradle_jvm::default_dir(), &name, &text)
+            .map(|p| p.to_string_lossy().into_owned())
+            .map_err(|e| IdeError::internal(format!("cannot write the Gradle init script: {e}")))
+    })
+    .await
+    .map_err(|e| IdeError::internal(e.to_string()))?
+}
+
 /// Results from the JUnit XML reports (Surefire, Failsafe, Gradle) of the module at
 /// `module` (relative to the project root) written since `since_ms` (Unix epoch, ms).
 pub async fn run_test_reports(
@@ -241,6 +256,35 @@ pub async fn run_tomcat_update(host: &Host, window: &str, config: RunConfig, mod
        .map_err(|e| IdeError::internal(e.to_string()))?
 }

+/// Updates a running Tomcat artifact deployment from the module's compiled output and web
+/// resources (`ide_run::tomcat::sync_outputs`). `false`: rebuild the WAR instead.
+pub async fn run_tomcat_sync(
+    host: &Host,
+    window: &str,
+    config: RunConfig,
+    module: std::path::PathBuf,
+    class_paths: Vec<String>,
+    resources_only: bool,
+) -> IdeResult<bool> {
+    host.require_trust(window)?;
+    let project = host.project(window)?;
+    if !host.processes.list().iter().any(|r| r.running && r.config_id == config.id) {
+        return Err(IdeError::invalid("Start this Tomcat configuration before updating it"));
+    }
+    if config.extras.params.get("deployment").is_some_and(|v| v != "artifact") {
+        return Ok(false);
+    }
+    tokio::task::spawn_blocking(move || {
+        let module = dunce::canonicalize(project.root.join(module))?;
+        let class_paths: Vec<_> =
+            class_paths.iter().filter_map(|p| dunce::canonicalize(project.root.join(p)).ok()).collect();
+        let base = ide_run::tomcat::base_dir(&project.cache_dir, &config.id);
+        ide_run::tomcat::sync_outputs(&base, &module, &class_paths, resources_only)
+    })
+    .await
+    .map_err(|e| IdeError::internal(e.to_string()))?
+}
+
 /// Commands of this module the remote server answers.
 pub(crate) fn register(d: &mut Dispatcher) {
    d.add("run_dotnet_resolve", |c| async move {
@@ -255,6 +299,17 @@ pub(crate) fn register(d: &mut Dispatcher) {
    d.add("run_tomcat_home", |c| async move { run_tomcat_home(&c.host, &c.window, c.arg("home")?).await });
    d.add("run_tomcat_artifacts", |c| async move { run_tomcat_artifacts(&c.host, &c.window).await });
    d.add("run_tomcat_build", |c| async move { run_tomcat_build(&c.host, &c.window, c.arg("config")?).await });
+    d.add("run_tomcat_sync", |c| async move {
+        run_tomcat_sync(
+            &c.host,
+            &c.window,
+            c.arg("config")?,
+            c.arg("module")?,
+            c.arg("classPaths")?,
+            c.arg("resourcesOnly")?,
+        )
+        .await
+    });
    d.add("run_tomcat_update", |c| async move {
        run_tomcat_update(&c.host, &c.window, c.arg("config")?, c.arg("mode")?).await
    });
@@ -268,6 +323,9 @@ pub(crate) fn register(d: &mut Dispatcher) {
    d.add("run_gradle_jvm_args_script", |c| async move {
        run_gradle_jvm_args_script(&c.host, &c.window, c.arg("jvmArgs")?).await
    });
+    d.add("run_gradle_init_script", |c| async move {
+        run_gradle_init_script(&c.host, &c.window, c.arg("name")?, c.arg("text")?).await
+    });
    d.add("run_test_reports", |c| async move {
        run_test_reports(&c.host, &c.window, c.arg("module")?, c.arg("sinceMs")?).await
    });
@@ -23,8 +23,26 @@ pub struct LocatedTools {
 /// Installed interpreters / toolchains of `kind`; project-local ones first.
 pub async fn sdk_detect(host: &Host, window: &str, kind: SdkKind) -> IdeResult<Vec<Sdk>> {
    host.require_trust(window)?;
-    let root = host.project(window).ok().map(|p| p.root.clone());
-    tokio::task::spawn_blocking(move || ide_sdk::detect(kind, root.as_deref())).await.map_err(join_err)
+    let project = host.project(window).ok();
+    let root = project.as_ref().map(|p| p.root.clone());
+    // The interpreter the project uses is a choice even where detection doesn't look (a
+    // virtualenv in a subfolder, one picked by path), so it shows by name and version.
+    let current = match (&project, kind) {
+        (Some(p), SdkKind::Python) => ide_sdk::apply::python_interpreter(&p.root, &p.settings.effective()),
+        _ => None,
+    };
+    tokio::task::spawn_blocking(move || {
+        let mut sdks = ide_sdk::detect(kind, root.as_deref());
+        if let Some(path) = current
+            && !sdks.iter().any(|s| *s.path == *path)
+            && let Some(sdk) = ide_sdk::python_interpreter_sdk(&path, root.as_deref())
+        {
+            sdks.push(sdk);
+        }
+        sdks
+    })
+    .await
+    .map_err(join_err)
 }

 /// The interpreter the project uses: the configured one, else its virtualenv.
@@ -34,6 +52,42 @@ pub fn sdk_python_effective(host: &Host, window: &str) -> IdeResult<Option<ide_c
    Ok(ide_sdk::apply::python_interpreter(&project.root, &project.settings.effective()).map(Into::into))
 }

+/// The PHP language level of the project `path` belongs to (a workspace member, by path, as
+/// the language server configuration picks it).
+#[derive(Clone, Debug, serde::Serialize, specta::Type)]
+#[serde(rename_all = "camelCase")]
+pub struct PhpLanguageLevels {
+    /// The one Intelephense checks against; `None`: its default.
+    pub effective: Option<ide_sdk::php::PhpLanguageLevel>,
+    /// The one Auto picks, from `composer.json`.
+    pub auto: Option<ide_sdk::php::PhpLanguageLevel>,
+    /// The workspace member `path` belongs to: its own settings choose the level, not the
+    /// workspace's. `None`: the opened project.
+    pub member: Option<ide_core::IpcPath>,
+}
+
+pub async fn sdk_php_language_level(host: &Host, window: &str, path: PathBuf) -> IdeResult<PhpLanguageLevels> {
+    let project = host.project(window)?;
+    let (project_root, project_settings) = (project.root.clone(), project.settings.effective());
+    let config_dir = host.config_dir.clone();
+    tokio::task::spawn_blocking(move || {
+        let member = ide_workspace::workspace::Workspace::load(&project_root).ok().flatten().and_then(|w| {
+            w.projects.into_iter().filter(|p| path.starts_with(p)).max_by_key(|p| p.components().count())
+        });
+        let (root, settings) = match &member {
+            Some(member) => (member, ide_workspace::SettingsStore::load(&config_dir, Some(member)).effective()),
+            None => (&project_root, project_settings),
+        };
+        PhpLanguageLevels {
+            effective: ide_sdk::php::language_level(root, &settings),
+            auto: ide_sdk::php::composer_level(root),
+            member: member.map(ide_core::IpcPath),
+        }
+    })
+    .await
+    .map_err(join_err)
+}
+
 /// SDK / library source folders shown under "External Libraries" in the Project view,
 /// with the Maven / Gradle dependency jars of the build model.
 pub async fn sdk_project_libraries(host: &Host, window: &str) -> IdeResult<Vec<ide_sdk::libraries::LibraryGroup>> {
@@ -144,6 +198,10 @@ pub async fn sdk_python_pip(
 pub(crate) fn register(d: &mut Dispatcher) {
    d.add("sdk_detect", |c| async move { sdk_detect(&c.host, &c.window, c.arg("kind")?).await });
    d.add("sdk_python_effective", |c| async move { sdk_python_effective(&c.host, &c.window) });
+    d.add(
+        "sdk_php_language_level",
+        |c| async move { sdk_php_language_level(&c.host, &c.window, c.arg("path")?).await },
+    );
    d.add("sdk_project_libraries", |c| async move { sdk_project_libraries(&c.host, &c.window).await });
    d.add("sdk_locate_tools", |c| async move {
        sdk_locate_tools(&c.host, &c.window, c.arg("names")?, c.arg("near")?).await
@@ -24,7 +24,11 @@ fn tools(host: &Host, window: &str) -> IdeResult<Tools> {
        .collect();
    // Godot is usually an app bundle / Flatpak outside the search path.
    let found = ide_sdk::godot::find(None).map(|p| (ide_sdk::godot::COMMAND.to_owned(), p));
-    Ok(Tools::new(&data).with_custom_paths(custom).with_found_paths(found.into_iter().collect()))
+    let work_dir = (!root.as_os_str().is_empty()).then_some(root);
+    Ok(Tools::new(&data)
+        .with_custom_paths(custom)
+        .with_found_paths(found.into_iter().collect())
+        .with_work_dir(work_dir))
 }

 /// The language definitions plus the servers defined in the window's settings.
@@ -12,6 +12,76 @@ use std::path::{Path, PathBuf};

 use crate::apply_git_executable;

+/// Read-only repository access also works in a standalone log window.
+struct LogAccess {
+    project: Option<std::sync::Arc<Project>>,
+    external: Option<std::sync::Arc<Repo>>,
+    cache: PathBuf,
+}
+
+/// Immutable Git objects exposed through the editor's ordinary read-only VFS.
+pub async fn revision_virtual_document(
+    host: &Host,
+    window: &str,
+    uri: &str,
+) -> IdeResult<ide_lsp::types::VirtualDocument> {
+    #[derive(Deserialize)]
+    struct Target {
+        repo: PathBuf,
+        revision: String,
+        path: PathBuf,
+    }
+    let encoded = uri
+        .strip_prefix("git-revision:")
+        .and_then(|s| s.split('/').next())
+        .ok_or_else(|| ide_core::IdeError::invalid("invalid Git revision URI"))?;
+    if encoded.len() > 32768 || encoded.len() % 2 != 0 || !encoded.bytes().all(|b| b.is_ascii_hexdigit()) {
+        return Err(ide_core::IdeError::invalid("invalid Git revision URI"));
+    }
+    let bytes = (0..encoded.len())
+        .step_by(2)
+        .map(|i| {
+            u8::from_str_radix(&encoded[i..i + 2], 16)
+                .map_err(|_| ide_core::IdeError::invalid("invalid Git revision URI"))
+        })
+        .collect::<IdeResult<Vec<_>>>()?;
+    let target: Target = serde_json::from_slice(&bytes).map_err(|e| ide_core::IdeError::invalid(e.to_string()))?;
+    let path = target.repo.join(&target.path);
+    let text = vcs_file_at(host, window, path, Some(target.revision.clone()))
+        .await?
+        .ok_or_else(|| ide_core::IdeError::not_found("file is absent at this revision"))?;
+    Ok(ide_lsp::types::VirtualDocument {
+        uri: uri.into(),
+        language_id: host.languages.detect(&target.path, text.lines().next()),
+        text,
+        title: target.path.file_name().unwrap_or_default().to_string_lossy().into_owned(),
+        description: Some(format!("{} · {}", target.repo.display(), target.revision)),
+        decompiled: false,
+    })
+}
+impl LogAccess {
+    fn new(host: &Host, window: &str, at: Option<&Path>) -> Self {
+        let project = host.project(window).ok();
+        let external = host
+            .external_logs
+            .read()
+            .get(host.owner_window(window))
+            .and_then(|rs| rs.iter().find(|r| Some(r.root()) == at).cloned())
+            .filter(|repo| project.as_ref().is_none_or(|p| p.repos().at_root(repo.root()).is_none()));
+        Self { project, external, cache: host.local_data_dir.join("cache/git-log") }
+    }
+    fn with_log_repo_at<T>(&self, at: Option<&Path>, f: impl FnOnce(&Repo) -> IdeResult<T>) -> IdeResult<T> {
+        if let Some(repo) = &self.external {
+            repo.enable_log_index(&self.cache);
+            return f(repo);
+        }
+        self.project
+            .as_ref()
+            .ok_or_else(|| ide_core::IdeError::unavailable("external Git log is not open"))?
+            .with_log_repo_at(at, f)
+    }
+}
+
 /// A repository of the project (IDEA's VCS root).
 #[derive(Serialize, Deserialize, Type)]
 #[serde(rename_all = "camelCase")]
@@ -182,8 +252,8 @@ pub fn vcs_roots(host: &Host, window: &str) -> IdeResult<Vec<VcsRoot>> {
 }

 pub async fn vcs_branch_info(host: &Host, window: &str, repo: Option<PathBuf>) -> IdeResult<BranchInfo> {
-    let project = host.project(window)?;
-    blocking(move || project.with_repo_at(repo.as_deref(), |r| r.branch_info())).await
+    let project = LogAccess::new(host, window, repo.as_deref());
+    blocking(move || project.with_log_repo_at(repo.as_deref(), |r| r.branch_info())).await
 }

 /// Gutter change markers for a file, computed against its current (unsaved) text.
@@ -197,9 +267,21 @@ pub async fn vcs_line_hunks(host: &Host, window: &str, path: PathBuf) -> IdeResu
 }

 pub async fn vcs_file_at(host: &Host, window: &str, path: PathBuf, rev: Option<String>) -> IdeResult<Option<String>> {
-    let project = host.project(window)?;
+    let project = host.project(window).ok();
+    let external = host.external_logs.read().get(host.owner_window(window)).and_then(|rs| {
+        rs.iter().filter(|r| path.starts_with(r.root())).max_by_key(|r| r.root().components().count()).cloned()
+    });
    blocking(move || {
-        project.with_repo_of(&path, |r| r.file_at(&path, rev.as_deref(), project.vcs_encoding(&path, rev.as_deref())?))
+        if let Some(project) = project {
+            return project.with_log_repo_of(&path, |r| {
+                r.file_at(&path, rev.as_deref(), project.vcs_encoding(&path, rev.as_deref())?)
+            });
+        }
+        external.ok_or_else(|| ide_core::IdeError::unavailable("external Git log is not open"))?.file_at(
+            &path,
+            rev.as_deref(),
+            encoding_rs::UTF_8,
+        )
    })
    .await
 }
@@ -222,9 +304,126 @@ pub async fn vcs_blame(
    .await
 }

-pub async fn vcs_log(host: &Host, window: &str, repo: Option<PathBuf>, query: LogQuery) -> IdeResult<Vec<Commit>> {
+/// History for Selection: the commits that changed `lines` (0-based, inclusive) of the
+/// editor's text of `path`. Cancellable.
+pub async fn vcs_block_history(
+    host: &Host,
+    window: &str,
+    request: RequestId,
+    path: PathBuf,
+    text: Option<String>,
+    lines: (u32, u32),
+) -> IdeResult<BlockHistory> {
    let project = host.project(window)?;
-    blocking(move || project.with_repo_at(repo.as_deref(), |r| r.log(&query))).await
+    let cancel = host.begin_request(request);
+    let result = blocking(move || {
+        let text = text.or_else(|| project.documents.text_of(&path));
+        project.with_repo_of(&path, |r| {
+            r.block_history(&path, text.as_deref(), lines, project.vcs_encoding(&path, None)?, &cancel)
+        })
+    })
+    .await;
+    host.end_request(request);
+    result
+}
+
+pub async fn vcs_log(host: &Host, window: &str, repo: Option<PathBuf>, query: LogQuery) -> IdeResult<Vec<Commit>> {
+    let project = LogAccess::new(host, window, repo.as_deref());
+    let request = query.request;
+    let cancel =
+        request.map_or_else(ide_core::CancellationToken::new, |id| host.begin_project_read_request(window, id));
+    let result = blocking(move || {
+        project.with_log_repo_at(repo.as_deref(), |r| {
+            r.enable_log_index(&project.cache);
+            r.log_cancellable(&query, &cancel)
+        })
+    })
+    .await;
+    if let Some(id) = request {
+        host.end_request(id);
+    }
+    result
+}
+
+pub async fn vcs_log_refs(
+    host: &Host,
+    window: &str,
+    repo: Option<PathBuf>,
+) -> IdeResult<std::collections::BTreeMap<String, String>> {
+    let project = LogAccess::new(host, window, repo.as_deref());
+    blocking(move || project.with_log_repo_at(repo.as_deref(), |r| r.log_refs())).await
+}
+
+pub async fn vcs_log_users(host: &Host, window: &str, repo: Option<PathBuf>) -> IdeResult<Vec<String>> {
+    let project = LogAccess::new(host, window, repo.as_deref());
+    blocking(move || project.with_log_repo_at(repo.as_deref(), |r| r.log_users())).await
+}
+
+pub async fn vcs_open_external_log(host: &Host, window: &str, path: PathBuf) -> IdeResult<ide_core::IpcPath> {
+    let path = dunce::canonicalize(path)?;
+    let repo = Repo::discover(&path)?.ok_or_else(|| ide_core::IdeError::unavailable("folder is not a Git worktree"))?;
+    let root = repo.root().to_path_buf();
+    repo.set_execution_allowed(false);
+    repo.enable_log_index(&host.local_data_dir.join("cache/git-log"));
+    if let Ok(project) = host.project(window) {
+        project.open_external_log(&root)?;
+    }
+    let mut logs = host.external_logs.write();
+    let roots = logs.entry(host.owner_window(window).to_string()).or_default();
+    if !roots.iter().any(|r| r.root() == root) {
+        roots.push(std::sync::Arc::new(repo));
+    }
+    Ok(root.into())
+}
+
+pub async fn vcs_log_details(
+    host: &Host,
+    window: &str,
+    repo: Option<PathBuf>,
+    revision: String,
+) -> IdeResult<LogDetails> {
+    let project = LogAccess::new(host, window, repo.as_deref());
+    blocking(move || project.with_log_repo_at(repo.as_deref(), |r| r.log_details(&revision))).await
+}
+
+pub async fn vcs_log_details_batch(
+    host: &Host,
+    window: &str,
+    repo: Option<PathBuf>,
+    revisions: Vec<String>,
+    request: RequestId,
+) -> IdeResult<Vec<LogDetails>> {
+    let project = LogAccess::new(host, window, repo.as_deref());
+    let cancel = host.begin_project_read_request(window, request);
+    let result = blocking(move || {
+        project.with_log_repo_at(repo.as_deref(), |r| {
+            revisions.iter().map(|id| r.log_details_cancellable(id, &cancel)).collect()
+        })
+    })
+    .await;
+    host.end_request(request);
+    result
+}
+
+pub async fn vcs_revision_children(
+    host: &Host,
+    window: &str,
+    repo: Option<PathBuf>,
+    revision: String,
+    directory: String,
+) -> IdeResult<Vec<String>> {
+    let project = LogAccess::new(host, window, repo.as_deref());
+    blocking(move || project.with_log_repo_at(repo.as_deref(), |r| r.revision_children(&revision, &directory))).await
+}
+
+pub async fn vcs_revision_files(
+    host: &Host,
+    window: &str,
+    repo: Option<PathBuf>,
+    revision: String,
+) -> IdeResult<Vec<String>> {
+    let project = LogAccess::new(host, window, repo.as_deref());
+    blocking(move || project.with_log_repo_at(repo.as_deref(), |r| r.revision_files(&revision))).await
 }

 pub async fn vcs_commit_files(
@@ -233,8 +432,8 @@ pub async fn vcs_commit_files(
    repo: Option<PathBuf>,
    commit: String,
 ) -> IdeResult<Vec<ChangedFile>> {
-    let project = host.project(window)?;
-    blocking(move || project.with_repo_at(repo.as_deref(), |r| r.commit_files(&commit))).await
+    let project = LogAccess::new(host, window, repo.as_deref());
+    blocking(move || project.with_log_repo_at(repo.as_deref(), |r| r.commit_files(&commit))).await
 }

 /// Combined changes of several commits, `commits` oldest first.
@@ -244,13 +443,13 @@ pub async fn vcs_commits_changes(
    repo: Option<PathBuf>,
    commits: Vec<String>,
 ) -> IdeResult<Vec<RevisionChange>> {
-    let project = host.project(window)?;
-    blocking(move || project.with_repo_at(repo.as_deref(), |r| r.commits_changes(&commits))).await
+    let project = LogAccess::new(host, window, repo.as_deref());
+    blocking(move || project.with_log_repo_at(repo.as_deref(), |r| r.commits_changes(&commits))).await
 }

 pub async fn vcs_branches(host: &Host, window: &str, repo: Option<PathBuf>) -> IdeResult<Vec<Branch>> {
-    let project = host.project(window)?;
-    blocking(move || project.with_repo_at(repo.as_deref(), |r| r.branches())).await
+    let project = LogAccess::new(host, window, repo.as_deref());
+    blocking(move || project.with_log_repo_at(repo.as_deref(), |r| r.branches())).await
 }

 pub async fn vcs_stashes(host: &Host, window: &str, repo: Option<PathBuf>) -> IdeResult<Vec<Stash>> {
@@ -271,7 +470,7 @@ pub async fn vcs_add_to_ignore(
    window: &str,
    paths: Vec<PathBuf>,
    destination: IgnoreDestination,
-) -> IdeResult<Vec<String>> {
+) -> IdeResult<Vec<ide_core::IpcPath>> {
    host.require_trust(window)?;
    let project = host.project(window)?;
    blocking(move || {
@@ -288,7 +487,7 @@ pub async fn vcs_add_to_ignore(
            watcher.reload_ignore_rules();
        }
        project.sink.emit(ide_core::IdeEvent::VcsChanged { root: project.root.clone().into() });
-        result.map(|files| files.into_iter().map(|p| p.to_string_lossy().into_owned()).collect())
+        result.map(|files| files.into_iter().map(Into::into).collect())
    })
    .await
 }
@@ -605,8 +804,8 @@ pub async fn vcs_config_get(
    repo: Option<PathBuf>,
    key: String,
 ) -> IdeResult<Option<String>> {
-    let project = host.project(window)?;
-    blocking(move || project.with_repo_at(repo.as_deref(), |r| r.config_get(&key))).await
+    let project = LogAccess::new(host, window, repo.as_deref());
+    blocking(move || project.with_log_repo_at(repo.as_deref(), |r| r.config_get(&key))).await
 }

 /// Local history operation that may take a while (hooks, large checkouts); git's
@@ -667,8 +866,8 @@ pub async fn vcs_create_tag(
 }

 pub async fn vcs_tags(host: &Host, window: &str, repo: Option<PathBuf>) -> IdeResult<Vec<String>> {
-    let project = host.project(window)?;
-    blocking(move || project.with_repo_at(repo.as_deref(), |r| r.tags())).await
+    let project = LogAccess::new(host, window, repo.as_deref());
+    blocking(move || project.with_log_repo_at(repo.as_deref(), |r| r.tags())).await
 }

 /// Merge dialog: merges `branches` into the current branch.
@@ -704,8 +903,8 @@ pub async fn vcs_rebase_with(
 }

 pub async fn vcs_remotes(host: &Host, window: &str, repo: Option<PathBuf>) -> IdeResult<Vec<Remote>> {
-    let project = host.project(window)?;
-    blocking(move || project.with_repo_at(repo.as_deref(), |r| r.remotes())).await
+    let project = LogAccess::new(host, window, repo.as_deref());
+    blocking(move || project.with_log_repo_at(repo.as_deref(), |r| r.remotes())).await
 }

 pub async fn vcs_edit_remote(host: &Host, window: &str, repo: Option<PathBuf>, edit: RemoteEdit) -> IdeResult<()> {
@@ -792,8 +991,8 @@ pub async fn vcs_diff_with_worktree(
    repo: Option<PathBuf>,
    rev: String,
 ) -> IdeResult<Vec<ChangedFile>> {
-    let project = host.project(window)?;
-    blocking(move || project.with_repo_at(repo.as_deref(), |r| r.diff_with_worktree(&rev))).await
+    let project = LogAccess::new(host, window, repo.as_deref());
+    blocking(move || project.with_log_repo_at(repo.as_deref(), |r| r.diff_with_worktree(&rev))).await
 }

 /// Files that differ between two revisions (the "N files updated" of Update Project).
@@ -804,8 +1003,8 @@ pub async fn vcs_diff_revisions(
    from: String,
    to: String,
 ) -> IdeResult<Vec<ChangedFile>> {
-    let project = host.project(window)?;
-    blocking(move || project.with_repo_at(repo.as_deref(), |r| r.diff_revisions(&from, &to))).await
+    let project = LogAccess::new(host, window, repo.as_deref());
+    blocking(move || project.with_log_repo_at(repo.as_deref(), |r| r.diff_revisions(&from, &to))).await
 }

 /// The best common ancestor of `a` and `b` (`git merge-base`), if any: the New Pull
@@ -987,7 +1186,26 @@ pub(crate) fn register(d: &mut Dispatcher) {
    d.add("vcs_blame", |c| async move {
        vcs_blame(&c.host, &c.window, c.arg("path")?, c.arg("text")?, c.arg("revision")?).await
    });
+    d.add("vcs_block_history", |c| async move {
+        let (request, path, text, lines) = (c.arg("request")?, c.arg("path")?, c.arg("text")?, c.arg("lines")?);
+        vcs_block_history(&c.host, &c.window, request, path, text, lines).await
+    });
    d.add("vcs_log", |c| async move { vcs_log(&c.host, &c.window, c.arg("repo")?, c.arg("query")?).await });
+    d.add("vcs_log_refs", |c| async move { vcs_log_refs(&c.host, &c.window, c.arg("repo")?).await });
+    d.add("vcs_log_users", |c| async move { vcs_log_users(&c.host, &c.window, c.arg("repo")?).await });
+    d.add("vcs_open_external_log", |c| async move { vcs_open_external_log(&c.host, &c.window, c.arg("path")?).await });
+    d.add("vcs_log_details", |c| async move {
+        vcs_log_details(&c.host, &c.window, c.arg("repo")?, c.arg("revision")?).await
+    });
+    d.add("vcs_log_details_batch", |c| async move {
+        vcs_log_details_batch(&c.host, &c.window, c.arg("repo")?, c.arg("revisions")?, c.arg("request")?).await
+    });
+    d.add("vcs_revision_children", |c| async move {
+        vcs_revision_children(&c.host, &c.window, c.arg("repo")?, c.arg("revision")?, c.arg("directory")?).await
+    });
+    d.add("vcs_revision_files", |c| async move {
+        vcs_revision_files(&c.host, &c.window, c.arg("repo")?, c.arg("revision")?).await
+    });
    d.add("vcs_commit_files", |c| async move {
        vcs_commit_files(&c.host, &c.window, c.arg("repo")?, c.arg("commit")?).await
    });
@@ -0,0 +1,850 @@
+//! Saved PHP files -> `vendor/bin/phpstan analyse` -> `phpstan` diagnostics.
+
+use ide_core::event::NotifyLevel;
+use ide_core::output_encoding::decode_tool_output;
+use ide_core::{CancellationToken, Diagnostic, IdeEvent, Pos, Range, Severity, SharedSink};
+use ide_workspace::SettingsStore;
+use ide_workspace::documents::DocumentObserver;
+use parking_lot::Mutex;
+use serde_json::Value;
+use std::collections::{BTreeMap, BTreeSet, HashSet};
+use std::path::{Path, PathBuf};
+use std::process::{Command, Output, Stdio};
+use std::sync::{
+    Arc,
+    atomic::{AtomicBool, Ordering},
+};
+use std::time::Duration;
+use tokio::sync::Notify;
+
+const DELAY: Duration = Duration::from_millis(750);
+const SOURCE: &str = "phpstan";
+
+/// Saved files waiting for a check. Each save cancels the wait or the check in progress.
+#[derive(Default)]
+struct Queue {
+    generation: u64,
+    cancel: CancellationToken,
+    files: BTreeSet<PathBuf>,
+}
+
+impl Queue {
+    fn push(&mut self, files: impl IntoIterator<Item = PathBuf>) {
+        self.files.extend(files);
+        self.cancel.cancel();
+        self.generation += 1;
+        self.cancel = CancellationToken::new();
+    }
+    fn current(&self, generation: u64) -> bool {
+        self.generation == generation && !self.cancel.is_cancelled()
+    }
+}
+
+pub(crate) struct Phpstan {
+    root: PathBuf,
+    config_dir: PathBuf,
+    settings: Arc<SettingsStore>,
+    sink: SharedSink,
+    trusted: Arc<AtomicBool>,
+    lifetime: CancellationToken,
+    queue: Mutex<Queue>,
+    changed: Notify,
+    /// Files with PHPStan diagnostics, the only ones a clean result or a removal clears.
+    shown: Mutex<HashSet<PathBuf>>,
+}
+
+impl Phpstan {
+    pub(crate) fn new(
+        root: PathBuf,
+        config_dir: PathBuf,
+        settings: Arc<SettingsStore>,
+        sink: SharedSink,
+        trusted: Arc<AtomicBool>,
+    ) -> Arc<Self> {
+        Arc::new(Self {
+            root,
+            config_dir,
+            settings,
+            sink,
+            trusted,
+            lifetime: CancellationToken::new(),
+            queue: Mutex::new(Queue::default()),
+            changed: Notify::new(),
+            shown: Mutex::new(HashSet::new()),
+        })
+    }
+
+    pub(crate) fn start(self: &Arc<Self>, runtime: &tokio::runtime::Handle) {
+        let checker = self.clone();
+        runtime.spawn(async move { checker.run().await });
+    }
+
+    pub(crate) fn stop(&self) {
+        self.lifetime.cancel();
+        self.queue.lock().cancel.cancel();
+    }
+
+    /// Stops the check in progress (trust changed); its files wait for the next one, which drops
+    /// them while the project is in Restricted Mode.
+    pub(crate) fn interrupt(&self) {
+        self.queue.lock().push([]);
+        self.changed.notify_one();
+    }
+
+    fn files_saved(&self, paths: impl IntoIterator<Item = PathBuf>) {
+        let mut files = paths.into_iter().filter(|p| p.extension().is_some_and(|e| e == "php")).peekable();
+        if self.lifetime.is_cancelled() || files.peek().is_none() {
+            return;
+        }
+        self.queue.lock().push(files);
+        self.changed.notify_one();
+    }
+
+    /// Deleted files and folders lose their diagnostics.
+    pub(crate) fn files_removed<'a>(&self, removed: impl Iterator<Item = &'a PathBuf>) {
+        let removed: Vec<&PathBuf> = removed.collect();
+        let gone: Vec<PathBuf> =
+            self.shown.lock().iter().filter(|p| removed.iter().any(|r| p.starts_with(r))).cloned().collect();
+        for path in gone {
+            self.publish(path, Vec::new());
+        }
+    }
+
+    fn publish(&self, path: PathBuf, items: Vec<Diagnostic>) {
+        let mut shown = self.shown.lock();
+        if items.is_empty() {
+            if !shown.remove(&path) {
+                return;
+            }
+        } else {
+            shown.insert(path.clone());
+        }
+        // Under the lock, so a removal and a result for one file reach the UI in the order decided here.
+        self.sink.emit(IdeEvent::Diagnostics { path: path.into(), source: SOURCE.into(), items });
+    }
+
+    async fn run(self: Arc<Self>) {
+        // The failure last reported per root: each is reported once, until a run succeeds.
+        let mut failures: BTreeMap<PathBuf, String> = BTreeMap::new();
+        loop {
+            tokio::select! {
+                _ = self.lifetime.cancelled() => return,
+                _ = self.changed.notified() => {},
+            }
+            let (generation, cancel) = {
+                let queue = self.queue.lock();
+                (queue.generation, queue.cancel.clone())
+            };
+            if !debounce(&cancel, &self.lifetime).await {
+                continue;
+            }
+            let files = {
+                let mut queue = self.queue.lock();
+                if !queue.current(generation) {
+                    continue;
+                }
+                std::mem::take(&mut queue.files)
+            };
+            if !self.trusted.load(Ordering::Acquire) {
+                continue;
+            }
+            let (root, config_dir, settings) = (self.root.clone(), self.config_dir.clone(), self.settings.clone());
+            let Ok((checks, unchecked)) =
+                tokio::task::spawn_blocking(move || plan(&root, &config_dir, &settings, files)).await
+            else {
+                continue;
+            };
+            for path in unchecked {
+                self.publish(path, Vec::new());
+            }
+            let mut checks = checks.into_iter();
+            while let Some(check) = checks.next() {
+                let started = std::time::Instant::now();
+                let program = check.command.get_program().to_string_lossy().into_owned();
+                let output = analyse(check.command, &cancel).await;
+                let Some(output) = output.filter(|_| self.queue.lock().current(generation)) else {
+                    // A newer save: these files are checked again with it.
+                    let mut queue = self.queue.lock();
+                    queue.files.extend(check.files);
+                    queue.files.extend(checks.by_ref().flat_map(|c| c.files));
+                    break;
+                };
+                tracing::debug!(
+                    "phpstan checked {} file(s) in {} ms",
+                    check.files.len(),
+                    started.elapsed().as_millis()
+                );
+                // Files deleted meanwhile make the result (or the failure) moot: check the rest again.
+                let (present, missing): (Vec<PathBuf>, Vec<PathBuf>) =
+                    check.files.iter().cloned().partition(|f| f.is_file());
+                if !missing.is_empty() {
+                    for path in missing {
+                        self.publish(path, Vec::new());
+                    }
+                    self.files_saved(present);
+                    continue;
+                }
+                let report = match output {
+                    Ok(output) => {
+                        let parsed = parse(&decode_tool_output(&output.stdout), &decode_tool_output(&output.stderr));
+                        parsed.map_err(|text| {
+                            if text.is_empty() {
+                                let status = output.status;
+                                format!("PHPStan ended with {status} and no report")
+                            } else {
+                                text
+                            }
+                        })
+                    }
+                    Err(error) => Err(format!("Cannot run {program}: {error}")),
+                };
+                let failure = match report {
+                    Ok(report) => {
+                        let files = check.files.clone();
+                        let results = tokio::task::spawn_blocking(move || diagnostics(&files, report.files))
+                            .await
+                            .unwrap_or_default();
+                        for (path, items) in results {
+                            // Severe errors (a syntax error) stop the analysis of the other files.
+                            if report.complete || !items.is_empty() {
+                                self.publish(path, items);
+                            }
+                        }
+                        report.errors.join("\n")
+                    }
+                    Err(text) => {
+                        // Without a report the earlier errors of these files may be stale.
+                        for path in check.files {
+                            self.publish(path, Vec::new());
+                        }
+                        text
+                    }
+                };
+                if failure.is_empty() {
+                    failures.remove(&check.root);
+                } else {
+                    self.failure(&check.root, failure, &mut failures);
+                }
+            }
+        }
+    }
+
+    fn failure(&self, root: &Path, text: String, failures: &mut BTreeMap<PathBuf, String>) {
+        if failures.get(root) == Some(&text) {
+            return;
+        }
+        self.sink.emit(IdeEvent::Notify {
+            level: NotifyLevel::Error,
+            title: "PHPStan check failed".into(),
+            body: Some(text.clone()),
+        });
+        failures.insert(root.to_path_buf(), text);
+    }
+}
+
+impl DocumentObserver for Phpstan {
+    fn saved(&self, _doc: ide_core::DocId, path: &Path, _text: &str) {
+        self.files_saved([path.to_path_buf()]);
+    }
+}
+
+async fn debounce(cancel: &CancellationToken, lifetime: &CancellationToken) -> bool {
+    tokio::select! {
+        _ = lifetime.cancelled() => false,
+        _ = cancel.cancelled() => false,
+        _ = tokio::time::sleep(DELAY) => true,
+    }
+}
+
+/// One `vendor/bin/phpstan` run: the saved files below one PHP project.
+struct Check {
+    root: PathBuf,
+    files: Vec<PathBuf>,
+    command: Command,
+}
+
+/// The runs that check `files`, and the files not checked, whose earlier diagnostics no longer
+/// apply. A file belongs to the innermost linked project (with its own settings) that contains it,
+/// else to the project; deleted files, files in `vendor` or in excluded folders, and files of a
+/// project without PHPStan are not checked.
+fn plan(
+    project: &Path,
+    config_dir: &Path,
+    settings: &SettingsStore,
+    files: BTreeSet<PathBuf>,
+) -> (Vec<Check>, Vec<PathBuf>) {
+    let members =
+        ide_workspace::workspace::Workspace::load(project).ok().flatten().map(|w| w.projects).unwrap_or_default();
+    let mut groups: BTreeMap<PathBuf, Vec<PathBuf>> = BTreeMap::new();
+    let mut unchecked = Vec::new();
+    for file in files {
+        let member = members.iter().filter(|m| file.starts_with(m)).max_by_key(|m| m.components().count());
+        let root = member.cloned().or_else(|| file.starts_with(project).then(|| project.to_path_buf()));
+        match root {
+            Some(root) if file.is_file() => groups.entry(root).or_default().push(file),
+            _ => unchecked.push(file),
+        }
+    }
+    let mut checks = Vec::new();
+    for (root, files) in groups {
+        let effective = if root == project {
+            settings.effective()
+        } else {
+            SettingsStore::load(config_dir, Some(&root)).effective()
+        };
+        let excludes = ide_vfs::ExcludeMatcher::new(&effective.exclude_globs());
+        let (files, skipped): (Vec<PathBuf>, Vec<PathBuf>) = files.into_iter().partition(|f| {
+            f.strip_prefix(&root).is_ok_and(|rel| !rel.starts_with("vendor") && !excludes.is_excluded(rel))
+        });
+        unchecked.extend(skipped);
+        match ide_sdk::php::phpstan_command(&root, &effective, &files).filter(|_| !files.is_empty()) {
+            Some(command) => checks.push(Check { root, files, command }),
+            None => unchecked.extend(files),
+        }
+    }
+    (checks, unchecked)
+}
+
+/// Runs `cmd` to its end; `None` when `cancel` fires first, which kills it.
+async fn analyse(mut cmd: Command, cancel: &CancellationToken) -> Option<std::io::Result<Output>> {
+    if cancel.is_cancelled() {
+        return None;
+    }
+    ide_core::process::prepare(&mut cmd);
+    ide_core::process::own_group(&mut cmd);
+    cmd.stdin(Stdio::null()).stdout(Stdio::piped()).stderr(Stdio::piped());
+    let mut cmd = tokio::process::Command::from(cmd);
+    cmd.kill_on_drop(true);
+    let child = match cmd.spawn() {
+        Ok(child) => child,
+        Err(error) => return Some(Err(error)),
+    };
+    let pid = child.id();
+    // PHPStan may start workers of its own.
+    let cancelled = async {
+        cancel.cancelled().await;
+        if let Some(pid) = pid {
+            let _ = tokio::task::spawn_blocking(move || ide_core::process::kill_tree_of(pid)).await;
+        }
+    };
+    tokio::select! {
+        output = child.wait_with_output() => Some(output),
+        () = cancelled => None,
+    }
+}
+
+/// A PHPStan message: 0-based line, text with its tip, identifier.
+#[derive(Debug, PartialEq)]
+struct Message {
+    line: u32,
+    text: String,
+    identifier: Option<String>,
+}
+
+/// A JSON report: messages per file as PHPStan names it, the errors of the run itself, and
+/// whether every file was analysed (severe errors such as a syntax error stop the others).
+#[derive(Debug, PartialEq)]
+struct Report {
+    files: BTreeMap<String, Vec<Message>>,
+    errors: Vec<String>,
+    complete: bool,
+}
+
+impl Default for Report {
+    fn default() -> Self {
+        Self { files: BTreeMap::new(), errors: Vec::new(), complete: true }
+    }
+}
+
+/// PHPStan's `--error-format=json` report, or the text to report when there is none (an
+/// invalid configuration, a crash). PHP warnings, or a byte order mark a bootstrap file prints,
+/// may precede the report on stdout.
+fn parse(stdout: &str, stderr: &str) -> Result<Report, String> {
+    let json = serde_json::from_str::<Value>(stdout.trim().trim_start_matches('\u{feff}')).ok().or_else(|| {
+        stdout.lines().rev().find_map(|l| l.find('{').and_then(|start| serde_json::from_str(&l[start..]).ok()))
+    });
+    let Some(Value::Object(json)) = json else {
+        // Every saved file is excluded by the configuration (`excludePaths`).
+        if stderr.contains("No files found to analyse") {
+            return Ok(Report::default());
+        }
+        return Err(failure_text(stdout, stderr));
+    };
+    let mut report = Report::default();
+    if let Some(Value::Object(files)) = json.get("files") {
+        for (file, result) in files {
+            let messages = result.get("messages").and_then(Value::as_array).into_iter().flatten();
+            report.files.insert(file.clone(), messages.filter_map(message).collect());
+        }
+    }
+    let errors = json.get("errors").and_then(Value::as_array).into_iter().flatten();
+    report.errors = errors.map(|e| e.as_str().map_or_else(|| e.to_string(), str::to_owned)).collect();
+    report.complete = !stderr.contains("Result is incomplete");
+    Ok(report)
+}
+
+fn message(m: &Value) -> Option<Message> {
+    let mut text = m.get("message")?.as_str()?.to_owned();
+    if let Some(tip) = m.get("tip").and_then(Value::as_str).filter(|t| !t.trim().is_empty()) {
+        text = format!("{text}\n{}", strip_console_tags(tip));
+    }
+    let line = m.get("line").and_then(Value::as_u64).unwrap_or(1).max(1) - 1;
+    Some(Message {
+        line: u32::try_from(line).unwrap_or(u32::MAX),
+        text,
+        identifier: m.get("identifier").and_then(Value::as_str).map(str::to_owned),
+    })
+}
+
+/// Tips may carry console styling (`<fg=cyan>…</>`).
+fn strip_console_tags(text: &str) -> String {
+    let mut out = String::with_capacity(text.len());
+    let mut rest = text;
+    while let Some(i) = rest.find('<') {
+        out.push_str(&rest[..i]);
+        rest = &rest[i..];
+        let tag = rest.find('>').map(|end| &rest[..=end]);
+        match tag {
+            Some(tag)
+                if tag == "</>"
+                    || tag.starts_with("<fg=")
+                    || tag.starts_with("<bg=")
+                    || tag.starts_with("<options=") =>
+            {
+                rest = &rest[tag.len()..];
+            }
+            _ => {
+                out.push('<');
+                rest = &rest[1..];
+            }
+        }
+    }
+    out.push_str(rest);
+    out
+}
+
+/// What PHPStan printed instead of a report, without its notes and blank lines.
+fn failure_text(stdout: &str, stderr: &str) -> String {
+    let lines: Vec<&str> = stderr
+        .lines()
+        .chain(stdout.lines())
+        .map(str::trim)
+        .filter(|l| !l.is_empty() && !l.starts_with("Note: Using configuration file"))
+        .collect();
+    lines.iter().take(20).copied().collect::<Vec<_>>().join("\n")
+}
+
+/// The diagnostics of each checked file (none for a clean one), matched to the report's files
+/// by their real paths. Errors PHPStan reports in a trait name the class using it
+/// (`Trait.php (in context of class Foo)`).
+fn diagnostics(files: &[PathBuf], reported: BTreeMap<String, Vec<Message>>) -> Vec<(PathBuf, Vec<Diagnostic>)> {
+    let real = |p: &Path| dunce::canonicalize(p).unwrap_or_else(|_| p.to_path_buf());
+    let mut messages: BTreeMap<PathBuf, Vec<Message>> = BTreeMap::new();
+    for (name, list) in reported {
+        let name = name.split(" (in context of ").next().unwrap_or(&name);
+        messages.entry(real(Path::new(name))).or_default().extend(list);
+    }
+    files
+        .iter()
+        .map(|file| {
+            let list = messages.remove(&real(file)).unwrap_or_default();
+            // Columns only: a file in another encoding than UTF-8 still gives the right lines.
+            let text = if list.is_empty() {
+                None
+            } else {
+                std::fs::read(file).ok().map(|bytes| String::from_utf8_lossy(&bytes).into_owned())
+            };
+            let items = list.into_iter().map(|m| diagnostic(m, text.as_deref())).collect();
+            (file.clone(), items)
+        })
+        .collect()
+}
+
+fn diagnostic(m: Message, text: Option<&str>) -> Diagnostic {
+    Diagnostic {
+        range: line_range(text, m.line),
+        severity: Severity::Warning,
+        message: m.text,
+        source: Some("PHPStan".into()),
+        server: Some(SOURCE.into()),
+        code: m.identifier,
+        unnecessary: false,
+        deprecated: false,
+    }
+}
+
+/// PHPStan reports lines only: the line from its first non-blank character to its end (UTF-16).
+fn line_range(text: Option<&str>, line: u32) -> Range {
+    let text = text.map(|t| t.strip_prefix('\u{feff}').unwrap_or(t));
+    let content = text.and_then(|t| t.split('\n').nth(line as usize)).unwrap_or("").trim_end();
+    let indent = content.len() - content.trim_start().len();
+    let col = |s: &str| u32::try_from(s.encode_utf16().count()).unwrap_or(u32::MAX);
+    Range { start: Pos { line, col: col(&content[..indent]) }, end: Pos { line, col: col(content) } }
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    const REPORT: &str = r#"{"totals":{"errors":0,"file_errors":3},"files":{
+        "/p/src/A.php":{"errors":2,"messages":[
+            {"message":"Constant UNKNOWN not found.","line":11,"ignorable":true,
+             "tip":"Learn more at https://phpstan.org/user-guide/discovering-symbols","identifier":"constant.notFound"},
+            {"message":"Access to an undefined property.","line":3,"ignorable":true,
+             "tip":"Learn more: <fg=cyan>https://phpstan.org/blog/solving</> for array<int, string>","identifier":"property.notFound"}]},
+        "/p/src/T.php (in context of class App\\A)":{"errors":1,"messages":[
+            {"message":"Syntax error","line":null,"ignorable":false,"identifier":"phpstan.parse"}]}},
+        "errors":[]}"#;
+
+    fn message(line: u32, text: &str, identifier: &str) -> Message {
+        Message { line, text: text.into(), identifier: Some(identifier.into()) }
+    }
+
+    #[test]
+    fn messages_keep_their_line_tip_and_identifier() {
+        let report = parse(REPORT, "Note: Using configuration file /p/phpstan.neon.").unwrap();
+        assert!(report.errors.is_empty());
+        assert_eq!(
+            report.files["/p/src/A.php"],
+            [
+                message(
+                    10,
+                    "Constant UNKNOWN not found.\nLearn more at https://phpstan.org/user-guide/discovering-symbols",
+                    "constant.notFound"
+                ),
+                message(
+                    2,
+                    "Access to an undefined property.\nLearn more: https://phpstan.org/blog/solving for array<int, string>",
+                    "property.notFound"
+                ),
+            ]
+        );
+        assert_eq!(
+            report.files["/p/src/T.php (in context of class App\\A)"],
+            [message(0, "Syntax error", "phpstan.parse")]
+        );
+    }
+
+    #[test]
+    fn errors_of_the_run_are_not_file_messages() {
+        let stdout =
+            r#"{"totals":{"errors":1,"file_errors":0},"files":[],"errors":["Invalid entries in excludePaths"]}"#;
+        let report = parse(stdout, "").unwrap();
+        assert!(report.files.is_empty());
+        assert_eq!(report.errors, ["Invalid entries in excludePaths"]);
+        // PHP warnings ahead of the report, or a byte order mark printed by a bootstrap file.
+        let warned = format!("Deprecated: something in /p/x.php on line 3\n{stdout}");
+        assert_eq!(parse(&warned, "").unwrap().errors, ["Invalid entries in excludePaths"]);
+        let marked = format!("\u{feff}{stdout}");
+        assert_eq!(parse(&marked, "").unwrap().errors, ["Invalid entries in excludePaths"]);
+        assert_eq!(parse(&format!("Notice: x{stdout}"), "").unwrap().errors, ["Invalid entries in excludePaths"]);
+        assert!(parse(stdout, "").unwrap().complete);
+        let severe = " Result is incomplete because of severe errors.";
+        assert!(!parse(stdout, severe).unwrap().complete);
+    }
+
+    #[test]
+    fn output_without_a_report_is_a_failure() {
+        let stderr = "Note: Using configuration file /p/phpstan.neon.\n\n  Invalid entry in excludePaths:\n  Path \"/p/nothere\" is neither a directory\n\n";
+        assert_eq!(
+            parse("", stderr),
+            Err("Invalid entry in excludePaths:\nPath \"/p/nothere\" is neither a directory".to_string())
+        );
+        assert_eq!(
+            parse("Fatal error: Allowed memory size exhausted", ""),
+            Err("Fatal error: Allowed memory size exhausted".into())
+        );
+        assert_eq!(parse("", ""), Err(String::new()));
+        // Excluded files are no failure: nothing to report.
+        assert_eq!(parse("", " [ERROR] No files found to analyse.\n"), Ok(Report::default()));
+    }
+
+    #[test]
+    fn checked_files_get_their_messages_and_clean_files_none() {
+        let dir = tempfile::tempdir().unwrap();
+        let root = dunce::canonicalize(dir.path()).unwrap();
+        let (a, t, clean) = (root.join("A.php"), root.join("T.php"), root.join("Clean.php"));
+        std::fs::write(&a, "<?php\n\n    echo $é;  \r\n").unwrap();
+        std::fs::write(&t, "<?php\n").unwrap();
+        std::fs::write(&clean, "<?php\n").unwrap();
+        let reported = BTreeMap::from([
+            (a.to_string_lossy().into_owned(), vec![message(2, "Undefined variable", "variable.undefined")]),
+            (format!("{} (in context of class A)", t.display()), vec![message(0, "In a trait", "trait.x")]),
+            ("/elsewhere/B.php".to_string(), vec![message(0, "Not checked", "x")]),
+        ]);
+        let out = diagnostics(&[a.clone(), t.clone(), clean.clone()], reported);
+        assert_eq!(
+            out.iter().map(|(p, items)| (p.clone(), items.len())).collect::<Vec<_>>(),
+            [(a, 1), (t, 1), (clean, 0)]
+        );
+        let d = &out[0].1[0];
+        // From the first non-blank character to the end of the line, in UTF-16 columns.
+        assert_eq!(d.range, Range { start: Pos { line: 2, col: 4 }, end: Pos { line: 2, col: 12 } });
+        assert_eq!(
+            (d.code.as_deref(), d.source.as_deref(), d.server.as_deref(), d.severity),
+            (Some("variable.undefined"), Some("PHPStan"), Some("phpstan"), Severity::Warning)
+        );
+        assert_eq!(line_range(None, 7), Range { start: Pos { line: 7, col: 0 }, end: Pos { line: 7, col: 0 } });
+    }
+
+    #[tokio::test(start_paused = true)]
+    async fn burst_saves_give_one_check_of_all_files() {
+        let mut queue = Queue::default();
+        queue.push([PathBuf::from("/p/A.php")]);
+        let token = queue.cancel.clone();
+        let lifetime = CancellationToken::new();
+        let pending_lifetime = lifetime.clone();
+        let waiting = tokio::spawn(async move { debounce(&token, &pending_lifetime).await });
+        tokio::task::yield_now().await;
+        tokio::time::advance(DELAY - Duration::from_millis(1)).await;
+        assert!(!waiting.is_finished());
+        for i in 0..20 {
+            queue.push([PathBuf::from(format!("/p/{}.php", i % 3))]);
+        }
+        assert!(!waiting.await.unwrap());
+        let current = queue.generation;
+        assert!(debounce(&queue.cancel, &lifetime).await);
+        assert!(queue.current(current));
+        assert_eq!(queue.files.len(), 4);
+        lifetime.cancel();
+        assert!(!debounce(&queue.cancel, &lifetime).await);
+    }
+
+    /// A project with PHPStan whose PHP logs each run, waits `pause` seconds, prints `stderr` and
+    /// reports `report`.
+    #[cfg(unix)]
+    struct Fixture {
+        _dir: tempfile::TempDir,
+        root: PathBuf,
+        events: Arc<Mutex<Vec<IdeEvent>>>,
+        trusted: Arc<AtomicBool>,
+        checker: Arc<Phpstan>,
+    }
+
+    #[cfg(unix)]
+    impl Fixture {
+        fn new() -> Self {
+            use std::os::unix::fs::PermissionsExt;
+            let dir = tempfile::tempdir().unwrap();
+            let base = dunce::canonicalize(dir.path()).unwrap();
+            let root = base.join("project");
+            std::fs::create_dir_all(root.join("vendor/bin")).unwrap();
+            std::fs::create_dir_all(root.join("src")).unwrap();
+            std::fs::write(root.join("vendor/bin/phpstan"), "<?php\n").unwrap();
+            // Named php8.5: the selected PHP runs vendor/bin/phpstan, whatever its name.
+            let php = base.join("php/php8.5");
+            std::fs::create_dir_all(php.parent().unwrap()).unwrap();
+            let script = "#!/bin/sh\nshift\necho \"$XDEBUG_MODE $*\" >> runs.log\n\
+                sleep \"$(cat pause 2>/dev/null || echo 0)\"\ncat stderr >&2 2>/dev/null\ncat report\n";
+            std::fs::write(&php, script).unwrap();
+            std::fs::set_permissions(&php, std::fs::Permissions::from_mode(0o755)).unwrap();
+            std::fs::create_dir_all(root.join(".openidea")).unwrap();
+            let settings = format!("[languages.php]\ninterpreter = {:?}\n", php.to_string_lossy());
+            std::fs::write(root.join(".openidea/settings.toml"), settings).unwrap();
+            let config = base.join("config");
+            let settings = Arc::new(SettingsStore::load(&config, Some(&root)));
+            let events = Arc::new(Mutex::new(Vec::new()));
+            let sink_events = events.clone();
+            let sink: SharedSink = Arc::new(move |e| sink_events.lock().push(e));
+            let trusted = Arc::new(AtomicBool::new(true));
+            let checker = Phpstan::new(root.clone(), config, settings, sink, trusted.clone());
+            checker.start(&tokio::runtime::Handle::current());
+            Self { _dir: dir, root, events, trusted, checker }
+        }
+
+        fn file(&self, name: &str) -> PathBuf {
+            let path = self.root.join("src").join(name);
+            std::fs::write(&path, "<?php\necho UNKNOWN;\n").unwrap();
+            path
+        }
+
+        fn report(&self, path: &Path, identifiers: &[&str]) {
+            let messages: Vec<Value> = identifiers
+                .iter()
+                .map(|id| serde_json::json!({"message": "Bad", "line": 2, "identifier": id, "ignorable": true}))
+                .collect();
+            let files = if messages.is_empty() {
+                serde_json::json!({})
+            } else {
+                serde_json::json!({ path.to_string_lossy(): {"errors": messages.len(), "messages": messages} })
+            };
+            std::fs::write(self.root.join("report"), serde_json::json!({"files": files, "errors": []}).to_string())
+                .unwrap();
+        }
+
+        fn runs(&self) -> Vec<String> {
+            std::fs::read_to_string(self.root.join("runs.log")).unwrap_or_default().lines().map(str::to_owned).collect()
+        }
+
+        async fn until(&self, what: &str, done: impl Fn(&Self) -> bool) {
+            for _ in 0..200 {
+                if done(self) {
+                    return;
+                }
+                tokio::time::sleep(Duration::from_millis(25)).await;
+            }
+            panic!("timed out waiting for {what}: runs {:?}, events {:?}", self.runs(), self.events.lock());
+        }
+
+        fn diagnostics(&self) -> Vec<(PathBuf, Vec<Option<String>>)> {
+            self.events
+                .lock()
+                .iter()
+                .filter_map(|e| match e {
+                    IdeEvent::Diagnostics { path, source, items } if source == SOURCE => {
+                        Some((path.to_path_buf(), items.iter().map(|d| d.code.clone()).collect()))
+                    }
+                    _ => None,
+                })
+                .collect()
+        }
+
+        fn notifications(&self) -> Vec<String> {
+            let events = self.events.lock();
+            events.iter().filter(|e| matches!(e, IdeEvent::Notify { .. })).map(|e| format!("{e:?}")).collect()
+        }
+    }
+
+    #[cfg(unix)]
+    #[tokio::test(flavor = "multi_thread", worker_threads = 2)]
+    async fn saves_are_checked_together_and_a_newer_save_cancels_the_check() {
+        let f = Fixture::new();
+        let a = f.file("A.php");
+        f.report(&a, &["constant.notFound"]);
+        for _ in 0..5 {
+            f.checker.files_saved([a.clone(), f.root.join("src/readme.txt")]);
+        }
+        f.until("one check", |f| f.diagnostics().len() == 1).await;
+        assert_eq!(f.runs(), [format!("off analyse --error-format=json --no-progress {}", a.display())]);
+        assert_eq!(f.diagnostics(), [(a.clone(), vec![Some("constant.notFound".to_string())])]);
+
+        // A save during a check kills it; the next check covers both files.
+        std::fs::write(f.root.join("pause"), "30").unwrap();
+        f.checker.files_saved([a.clone()]);
+        f.until("the slow check", |f| f.runs().len() == 2).await;
+        std::fs::write(f.root.join("pause"), "0").unwrap();
+        let b = f.file("B.php");
+        f.report(&a, &[]);
+        f.checker.files_saved([b.clone()]);
+        f.until("the check of both", |f| f.runs().len() == 3 && f.diagnostics().len() == 2).await;
+        assert!(f.runs()[2].ends_with(&format!("{} {}", a.display(), b.display())), "{:?}", f.runs());
+        // A clean result clears A; B never had diagnostics, so nothing is sent for it.
+        assert_eq!(f.diagnostics()[1], (a, vec![]));
+        f.checker.stop();
+    }
+
+    #[cfg(unix)]
+    #[tokio::test(flavor = "multi_thread", worker_threads = 2)]
+    async fn a_failing_run_is_reported_once_and_projects_without_phpstan_stay_quiet() {
+        let f = Fixture::new();
+        let a = f.file("A.php");
+        f.report(&a, &["constant.notFound"]);
+        f.checker.files_saved([a.clone()]);
+        f.until("the first check", |f| f.diagnostics().len() == 1).await;
+
+        std::fs::write(f.root.join("report"), "").unwrap();
+        for run in 2..=3 {
+            f.checker.files_saved([a.clone()]);
+            f.until("the failing check", |f| f.runs().len() == run).await;
+        }
+        tokio::time::sleep(Duration::from_millis(200)).await;
+        let notes = f.notifications();
+        assert_eq!(notes.len(), 1, "{notes:?}");
+        assert!(notes[0].contains("PHPStan check failed") && notes[0].contains("no report"), "{notes:?}");
+        // The failed check leaves no stale errors.
+        assert_eq!(f.diagnostics(), [(a.clone(), vec![Some("constant.notFound".to_string())]), (a.clone(), vec![])]);
+
+        std::fs::remove_file(f.root.join("vendor/bin/phpstan")).unwrap();
+        let events = f.events.lock().len();
+        f.checker.files_saved([a.clone()]);
+        tokio::time::sleep(DELAY * 2).await;
+        assert_eq!(f.events.lock().len(), events);
+        f.checker.stop();
+    }
+
+    #[cfg(unix)]
+    #[tokio::test(flavor = "multi_thread", worker_threads = 2)]
+    async fn files_a_severe_error_left_unchecked_keep_their_diagnostics() {
+        let f = Fixture::new();
+        let (a, b) = (f.file("A.php"), f.file("B.php"));
+        f.report(&a, &["constant.notFound"]);
+        f.checker.files_saved([a.clone()]);
+        f.until("the check of A", |f| f.diagnostics().len() == 1).await;
+        // A syntax error in B: PHPStan reports B only and says the result is incomplete.
+        f.report(&b, &["phpstan.parse"]);
+        std::fs::write(f.root.join("stderr"), "Result is incomplete because of severe errors.").unwrap();
+        f.checker.files_saved([a.clone(), b.clone()]);
+        f.until("the check of both", |f| f.diagnostics().len() == 2).await;
+        tokio::time::sleep(Duration::from_millis(200)).await;
+        assert_eq!(f.diagnostics()[1], (b, vec![Some("phpstan.parse".to_string())]));
+        assert_eq!(f.diagnostics().len(), 2, "A is not cleared");
+        f.checker.stop();
+    }
+
+    #[cfg(unix)]
+    #[tokio::test(flavor = "multi_thread", worker_threads = 2)]
+    async fn a_file_deleted_during_its_check_gets_no_result_and_no_failure() {
+        let f = Fixture::new();
+        let (a, b) = (f.file("A.php"), f.file("B.php"));
+        f.report(&a, &["constant.notFound"]);
+        std::fs::write(f.root.join("pause"), "1").unwrap();
+        f.checker.files_saved([a.clone(), b.clone()]);
+        f.until("the check", |f| f.runs().len() == 1).await;
+        std::fs::remove_file(&a).unwrap();
+        // B is checked again on its own.
+        f.until("the check of B", |f| f.runs().len() == 2).await;
+        assert!(f.runs()[1].ends_with(&format!("--no-progress {}", b.display())), "{:?}", f.runs());
+        tokio::time::sleep(Duration::from_millis(300)).await;
+        assert!(f.events.lock().is_empty(), "{:?}", f.events.lock());
+        f.checker.stop();
+    }
+
+    #[cfg(unix)]
+    #[tokio::test(flavor = "multi_thread", worker_threads = 2)]
+    async fn restricted_mode_stops_the_check_in_progress() {
+        let f = Fixture::new();
+        let a = f.file("A.php");
+        f.report(&a, &["constant.notFound"]);
+        std::fs::write(f.root.join("pause"), "30").unwrap();
+        f.checker.files_saved([a.clone()]);
+        f.until("the check", |f| f.runs().len() == 1).await;
+        f.trusted.store(false, Ordering::Release);
+        f.checker.interrupt();
+        tokio::time::sleep(DELAY * 2).await;
+        assert_eq!(f.runs().len(), 1);
+        assert!(f.events.lock().is_empty());
+        f.checker.stop();
+    }
+
+    #[cfg(unix)]
+    #[tokio::test(flavor = "multi_thread", worker_threads = 2)]
+    async fn files_no_longer_checked_lose_their_diagnostics() {
+        let f = Fixture::new();
+        let a = f.file("A.php");
+        f.report(&a, &["constant.notFound"]);
+        f.checker.files_saved([a.clone()]);
+        f.until("the check", |f| f.diagnostics().len() == 1).await;
+        // PHPStan removed from the project: saving A no longer checks it and drops its errors.
+        std::fs::remove_file(f.root.join("vendor/bin/phpstan")).unwrap();
+        f.checker.files_saved([a.clone()]);
+        f.until("the clear", |f| f.diagnostics().len() == 2).await;
+        assert_eq!(f.diagnostics()[1], (a, vec![]));
+        assert_eq!(f.runs().len(), 1);
+        f.checker.stop();
+    }
+
+    #[cfg(unix)]
+    #[tokio::test(flavor = "multi_thread", worker_threads = 2)]
+    async fn removed_files_lose_their_diagnostics() {
+        let f = Fixture::new();
+        let a = f.file("A.php");
+        f.report(&a, &["constant.notFound"]);
+        f.checker.files_saved([a.clone()]);
+        f.until("the check", |f| f.diagnostics().len() == 1).await;
+        f.checker.files_removed([f.root.join("src/other")].iter());
+        assert_eq!(f.diagnostics().len(), 1);
+        f.checker.files_removed([f.root.join("src")].iter());
+        assert_eq!(f.diagnostics()[1], (a, vec![]));
+        f.checker.stop();
+    }
+}
@@ -2,6 +2,7 @@
 //! Capabilities were checked by the runtime before any of this runs.

 use super::{PluginEvent, PluginEventSink};
+use ide_core::ipc_path::to_ipc;
 use ide_core::{CancellationToken, TextEdit};
 use ide_extension::Package;
 use ide_language::ProgramPin;
@@ -324,6 +325,18 @@ impl HostApi for PluginApi {
            .emit(client, PluginEvent::Notification { plugin_id: self.id().to_owned(), level, title, body });
    }

+    fn copy_to_clipboard(&self, client: Option<&str>, text: String) -> Result<(), HostError> {
+        let client = from_window(client, "copy to the clipboard")?;
+        self.shared.sink.emit(Some(client), PluginEvent::CopyToClipboard { plugin_id: self.id().to_owned(), text });
+        Ok(())
+    }
+
+    fn open_url(&self, client: Option<&str>, url: String) -> Result<(), HostError> {
+        let client = from_window(client, "open a URL")?;
+        self.shared.sink.emit(Some(client), PluginEvent::OpenUrl { plugin_id: self.id().to_owned(), url });
+        Ok(())
+    }
+
    fn status_item(&self, id: &str, item: Option<StatusItem>) {
        let key = (self.id().to_owned(), id.to_owned());
        {
@@ -407,7 +420,7 @@ impl HostApi for PluginApi {
        let info = repo.branch_info().map_err(failed)?;
        let changed = repo.status().map_err(failed)?.len();
        Ok(Some(RepositoryStatus {
-            root: repo.root().to_string_lossy().into_owned(),
+            root: to_ipc(repo.root()),
            branch: info.head,
            commit: info.head_commit,
            upstream: info.upstream,
@@ -418,6 +431,12 @@ impl HostApi for PluginApi {
        }))
    }

+    fn vcs_remotes(&self, root: &Path) -> Result<Vec<(String, String)>, HostError> {
+        let Some(repo) = ide_vcs::Repo::discover(root).map_err(failed)? else { return Ok(Vec::new()) };
+        let remotes = repo.remotes().map_err(failed)?;
+        Ok(remotes.into_iter().map(|r| (r.name, without_credentials(&r.url))).collect())
+    }
+
    fn vcs_fetch(&self, root: &Path, cancel: &CancellationToken) -> Result<(), HostError> {
        let workspace = self.shared.workspace();
        if !workspace.is_some_and(|w| w.trusted(root)) {
@@ -449,7 +468,7 @@ impl HostApi for PluginApi {
            }
            let Ok(rel) = entry.path().strip_prefix(root) else { continue };
            if matcher.is_match(rel) {
-                out.push(entry.path().to_string_lossy().into_owned());
+                out.push(to_ipc(entry.path()));
            }
        }
        out.sort();
@@ -667,6 +686,17 @@ impl HostApi for PluginApi {
        Ok(())
    }

+    fn open_location(&self, client: Option<&str>, path: &Path, line: u32, column: u32) -> Result<(), HostError> {
+        let event = PluginEvent::OpenLocation {
+            plugin_id: self.id().to_owned(),
+            path: path.to_path_buf().into(),
+            line,
+            column,
+        };
+        self.shared.sink.emit(client, event);
+        Ok(())
+    }
+
    fn setting(&self, root: Option<&Path>, key: &str) -> Option<String> {
        let schema: Vec<super::ui_points::SettingSchema> = self
            .shared
@@ -777,6 +807,19 @@ mod tests {
        PluginApi { pkg: Package::new(manifest, dir.to_path_buf()), shared }
    }

+    #[test]
+    fn repository_and_search_paths_match_ipc_events() {
+        let tmp = tempfile::tempdir().unwrap();
+        assert!(std::process::Command::new("git").args(["init", "-q"]).arg(tmp.path()).status().unwrap().success());
+        let root = tmp.path().canonicalize().unwrap();
+        std::fs::create_dir(root.join("src")).unwrap();
+        let file = root.join("src/Example.java");
+        std::fs::write(&file, "class Example {}\n").unwrap();
+        let api = api(&root, Arc::default());
+        assert_eq!(api.find_files(&root, "**/*.java", 8).unwrap(), [to_ipc(&file)]);
+        assert_eq!(api.vcs_status(&root).unwrap().unwrap().root, to_ipc(&root));
+    }
+
    #[test]
    fn programs_run_only_as_approved() {
        let tmp = tempfile::tempdir().unwrap();
@@ -801,3 +844,42 @@ mod tests {
        );
    }
 }
+
+/// The window a user action invoked the plugin from: browser tabs and clipboard writes
+/// follow what the user did, never background work (which would reach every window).
+fn from_window<'a>(client: Option<&'a str>, what: &str) -> Result<&'a str, HostError> {
+    client.ok_or_else(|| HostError::Invalid(format!("can only {what} from a command the user invoked")))
+}
+
+/// `url` without the `user:password@` a remote may carry (`https://user:token@host/…`):
+/// `vcs.read` must not hand out credentials. scp-style `git@host:path` has no password.
+fn without_credentials(url: &str) -> String {
+    let Some((scheme, rest)) = url.split_once("://") else { return url.to_owned() };
+    let authority_end = rest.find('/').unwrap_or(rest.len());
+    match rest[..authority_end].rfind('@') {
+        Some(at) => format!("{scheme}://{}", &rest[at + 1..]),
+        None => url.to_owned(),
+    }
+}
+
+#[cfg(test)]
+mod credential_tests {
+    use super::*;
+
+    #[test]
+    fn remote_urls_lose_their_credentials() {
+        for (url, expected) in [
+            ("https://user:[email protected]/o/r.git", "https://github.com/o/r.git"),
+            ("https://[email protected]/o/r", "https://gitlab.com/o/r"),
+            ("ssh://git@host:2222/o/r.git", "ssh://host:2222/o/r.git"),
+            ("https://github.com/o/r.git", "https://github.com/o/r.git"),
+            ("https://github.com/o/r@v1", "https://github.com/o/r@v1"),
+            ("[email protected]:o/r.git", "[email protected]:o/r.git"),
+            ("/srv/git/r.git", "/srv/git/r.git"),
+        ] {
+            assert_eq!(without_credentials(url), expected, "{url}");
+        }
+        assert!(matches!(from_window(None, "open a URL"), Err(HostError::Invalid(_))));
+        assert_eq!(from_window(Some("main"), "open a URL").unwrap(), "main");
+    }
+}
@@ -0,0 +1,207 @@
+use super::icon_patterns::validate_pattern;
+use ide_extension::validate_item_id;
+use serde::{Deserialize, Serialize};
+use std::collections::{BTreeMap, BTreeSet};
+use std::path::PathBuf;
+
+const MAX_GROUPS: usize = 64;
+const MAX_CHOICES: usize = 16;
+const MAX_CHOICE_OPTIONS: usize = 16;
+const MAX_NAME_LEN: usize = 255;
+pub(super) const DARK_SUFFIX: &str = "_dark";
+
+#[derive(Deserialize)]
+#[serde(untagged)]
+pub(super) enum IconDefinition {
+    Path(PathBuf),
+    Variants(IconVariants),
+}
+
+#[derive(Deserialize)]
+#[serde(deny_unknown_fields)]
+pub(super) struct IconVariants {
+    light: PathBuf,
+    #[serde(default)]
+    dark: Option<PathBuf>,
+}
+
+impl IconDefinition {
+    pub(super) fn light(&self) -> &PathBuf {
+        match self {
+            IconDefinition::Path(p) => p,
+            IconDefinition::Variants(v) => &v.light,
+        }
+    }
+
+    pub(super) fn dark(&self) -> Option<&PathBuf> {
+        match self {
+            IconDefinition::Path(_) => None,
+            IconDefinition::Variants(v) => v.dark.as_ref(),
+        }
+    }
+}
+
+#[derive(Clone, Copy, Default, PartialEq, Eq, Deserialize, Serialize)]
+#[serde(rename_all = "camelCase")]
+pub(super) enum Target {
+    #[default]
+    File,
+    Folder,
+}
+
+#[derive(Deserialize, Serialize)]
+#[serde(rename_all = "camelCase", deny_unknown_fields)]
+pub(super) struct Pattern {
+    pattern: String,
+    icon: String,
+    #[serde(default)]
+    target: Target,
+    #[serde(default)]
+    path: bool,
+    #[serde(default)]
+    ignore_case: bool,
+    #[serde(default)]
+    group: Option<String>,
+    #[serde(default)]
+    open_icon: Option<String>,
+}
+
+fn enabled_by_default() -> bool {
+    true
+}
+
+#[derive(Deserialize, Serialize)]
+#[serde(deny_unknown_fields)]
+pub(super) struct Group {
+    pub(super) id: String,
+    name: String,
+    #[serde(default = "enabled_by_default")]
+    enabled: bool,
+}
+
+#[derive(Deserialize, Serialize)]
+#[serde(deny_unknown_fields)]
+pub(super) struct ChoiceOption {
+    pub(super) id: String,
+    pub(super) name: String,
+    #[serde(default)]
+    overrides: BTreeMap<String, String>,
+}
+
+#[derive(Deserialize, Serialize)]
+#[serde(deny_unknown_fields)]
+pub(super) struct Choice {
+    pub(super) id: String,
+    pub(super) name: String,
+    pub(super) default: String,
+    pub(super) options: Vec<ChoiceOption>,
+}
+
+#[derive(Default, Deserialize, Serialize)]
+#[serde(rename_all = "camelCase")]
+pub(super) struct Extensions {
+    #[serde(default)]
+    pub(super) patterns: Vec<Pattern>,
+    #[serde(default)]
+    pub(super) overrides: BTreeMap<String, String>,
+    #[serde(default)]
+    pub(super) groups: Vec<Group>,
+    #[serde(default)]
+    pub(super) choices: Vec<Choice>,
+    #[serde(default)]
+    pub(super) accent: bool,
+}
+
+pub(super) fn check_icon_id(id: &str) -> Result<(), String> {
+    validate_item_id(id, "icon id")?;
+    if id.ends_with(DARK_SUFFIX) {
+        return Err(format!("icon id {id:?}: the {DARK_SUFFIX:?} suffix is reserved for dark variants"));
+    }
+    Ok(())
+}
+
+fn check_named(id: &str, name: &str, what: &str) -> Result<(), String> {
+    validate_item_id(id, what)?;
+    if name.trim().is_empty() || name.len() > MAX_NAME_LEN {
+        return Err(format!("{what} {id:?}: name must have 1 to {MAX_NAME_LEN} characters"));
+    }
+    Ok(())
+}
+
+fn check_unique<'a>(ids: impl Iterator<Item = &'a String>, what: &str) -> Result<(), String> {
+    let mut seen = BTreeSet::new();
+    match ids.into_iter().find(|id| !seen.insert(*id)) {
+        Some(id) => Err(format!("duplicate {what} {id:?}")),
+        None => Ok(()),
+    }
+}
+
+impl Extensions {
+    pub(super) fn mappings(&self) -> usize {
+        let chosen: usize = self.choices.iter().flat_map(|c| &c.options).map(|o| o.overrides.len()).sum();
+        self.patterns.len() + self.overrides.len() + chosen
+    }
+
+    pub(super) fn validate(&self, check_ref: &dyn Fn(&str, &str) -> Result<(), String>) -> Result<(), String> {
+        self.validate_groups()?;
+        for p in &self.patterns {
+            validate_pattern(&p.pattern)?;
+            check_ref(&p.icon, "patterns")?;
+            if let Some(group) = &p.group
+                && !self.groups.iter().any(|g| &g.id == group)
+            {
+                return Err(format!("pattern {:?}: unknown group {group:?}", p.pattern));
+            }
+            if let Some(open) = &p.open_icon {
+                if p.target != Target::Folder {
+                    return Err(format!("pattern {:?}: openIcon is only for folder patterns", p.pattern));
+                }
+                check_ref(open, "patterns")?;
+            }
+        }
+        check_overrides(&self.overrides, check_ref, "overrides")?;
+        for choice in &self.choices {
+            for option in &choice.options {
+                check_overrides(&option.overrides, check_ref, "choices")?;
+            }
+        }
+        Ok(())
+    }
+
+    fn validate_groups(&self) -> Result<(), String> {
+        if self.groups.len() > MAX_GROUPS || self.choices.len() > MAX_CHOICES {
+            return Err(format!("too many groups or choices (max {MAX_GROUPS} and {MAX_CHOICES})"));
+        }
+        for g in &self.groups {
+            check_named(&g.id, &g.name, "group")?;
+        }
+        check_unique(self.groups.iter().map(|g| &g.id), "group")?;
+        check_unique(self.choices.iter().map(|c| &c.id), "choice")?;
+        for choice in &self.choices {
+            check_named(&choice.id, &choice.name, "choice")?;
+            if choice.options.is_empty() || choice.options.len() > MAX_CHOICE_OPTIONS {
+                return Err(format!("choice {:?}: expected 1 to {MAX_CHOICE_OPTIONS} options", choice.id));
+            }
+            for option in &choice.options {
+                check_named(&option.id, &option.name, "choice option")?;
+            }
+            check_unique(choice.options.iter().map(|o| &o.id), "choice option")?;
+            if !choice.options.iter().any(|o| o.id == choice.default) {
+                return Err(format!("choice {:?}: default {:?} is not one of its options", choice.id, choice.default));
+            }
+        }
+        Ok(())
+    }
+}
+
+fn check_overrides(
+    overrides: &BTreeMap<String, String>,
+    check_ref: &dyn Fn(&str, &str) -> Result<(), String>,
+    what: &str,
+) -> Result<(), String> {
+    for (name, icon) in overrides {
+        validate_item_id(name, "overridden icon name")?;
+        check_ref(icon, what)?;
+    }
+    Ok(())
+}
@@ -0,0 +1,105 @@
+use regex_syntax::hir::{Hir, HirKind};
+
+pub(crate) const MAX_PATTERN_LEN: usize = 512;
+const NAME_LEN: u64 = 256;
+const MAX_COST: u64 = 4 * NAME_LEN * NAME_LEN;
+
+const UNSUPPORTED: &[(&str, &str)] = &[
+    ("\\A", "\\A"),
+    ("\\z", "\\z"),
+    ("\\Z", "\\Z"),
+    ("\\p", "\\p"),
+    ("\\P", "\\P"),
+    ("[[:", "a POSIX class"),
+    ("&&", "class intersection"),
+    ("~~", "class symmetric difference"),
+];
+
+pub(crate) fn validate_pattern(pattern: &str) -> Result<(), String> {
+    if pattern.len() > MAX_PATTERN_LEN {
+        return Err(format!("pattern {pattern:?} is too long (max {MAX_PATTERN_LEN})"));
+    }
+    if let Some(construct) = unsupported_construct(pattern) {
+        return Err(format!("pattern {pattern:?}: {construct} is not supported"));
+    }
+    let hir = regex_syntax::Parser::new().parse(pattern).map_err(|e| format!("invalid pattern {pattern:?}: {e}"))?;
+    match cost(&hir) {
+        Err(why) => Err(format!("pattern {pattern:?}: {why} is not supported")),
+        Ok(c) if c > MAX_COST => Err(format!("pattern {pattern:?} is too complex: too many ways to match one name")),
+        Ok(_) => Ok(()),
+    }
+}
+
+fn unsupported_construct(pattern: &str) -> Option<&'static str> {
+    if pattern.match_indices("(?").any(|(at, _)| !pattern[at + 2..].starts_with(':')) {
+        return Some("an inline flag, lookaround or named group");
+    }
+    UNSUPPORTED.iter().find(|(needle, _)| pattern.contains(needle)).map(|(_, what)| *what)
+}
+
+fn cost(hir: &Hir) -> Result<u64, &'static str> {
+    match hir.kind() {
+        HirKind::Empty | HirKind::Literal(_) | HirKind::Class(_) | HirKind::Look(_) => Ok(1),
+        HirKind::Capture(c) => cost(&c.sub),
+        HirKind::Concat(items) => items.iter().try_fold(1u64, |acc, h| Ok(acc.saturating_mul(cost(h)?))),
+        HirKind::Alternation(items) => items.iter().try_fold(0u64, |acc, h| Ok(acc.saturating_add(cost(h)?))),
+        HirKind::Repetition(r) => match r.max {
+            None if matches!(r.sub.kind(), HirKind::Literal(_) | HirKind::Class(_)) => Ok(NAME_LEN),
+            None => Err("a repeated group (`(…)*`, `(…)+`)"),
+            Some(max) => Ok(cost(&r.sub)?.saturating_add(1).saturating_pow(max)),
+        },
+    }
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    fn err(pattern: &str) -> String {
+        validate_pattern(pattern).unwrap_err()
+    }
+
+    #[test]
+    fn accepts_typical_file_name_patterns() {
+        for pattern in [
+            r"^(architecture|ARCHITECTURE)(\.(md|rst|txt))?$",
+            r"(main|workflow|ci|release|build|config)\.ya?ml$",
+            r"^[a-z]+\.d\.ts$",
+            r"^\.?eslintrc(\.(js|cjs|json|ya?ml))?$",
+            r"^.*\.config\.[cm]?[jt]s$",
+            r"^.*-(test|spec)\..*$",
+            r"^[0-9]{4}-[0-9]{2}\.log$",
+        ] {
+            assert!(validate_pattern(pattern).is_ok(), "{pattern}: {:?}", validate_pattern(pattern));
+        }
+    }
+
+    #[test]
+    fn rejects_patterns_that_backtrack_catastrophically() {
+        assert!(err(r"(a+)+$").contains("repeated group"));
+        assert!(err(r"(?:a*)*").contains("repeated group"));
+        assert!(err(r"^(\w|\w\w)*!$").contains("repeated group"));
+        assert!(err(r"^(a|aa)+$").contains("repeated group"));
+        assert!(err(r"^.*.*.*x$").contains("too complex"));
+        assert!(err(r"^(a?){30}a{30}$").contains("too complex"));
+        assert!(err(&format!("^{}b$", "(a|aa)".repeat(20))).contains("too complex"));
+        assert!(err(r"x{0,40}").contains("too complex"));
+    }
+
+    #[test]
+    fn rejects_constructs_javascript_reads_differently() {
+        assert!(err(r"(?i)readme").contains("not supported"));
+        assert!(err(r"(?P<n>a)").contains("not supported"));
+        assert!(err(r"\Areadme").contains("not supported"));
+        assert!(err(r"readme\z").contains("not supported"));
+        assert!(err(r"\p{L}").contains("not supported"));
+        assert!(err(r"[[:alpha:]]").contains("not supported"));
+        assert!(err(r"[a-z&&[^x]]").contains("not supported"));
+    }
+
+    #[test]
+    fn rejects_invalid_and_oversized_patterns() {
+        assert!(err("(").contains("invalid pattern"));
+        assert!(err(&"a".repeat(MAX_PATTERN_LEN + 1)).contains("too long"));
+    }
+}
@@ -0,0 +1,185 @@
+use super::icon_extensions::Extensions;
+use serde::{Deserialize, Serialize};
+
+const MAX_SECTIONS: usize = 16;
+const MAX_ITEMS: usize = 32;
+const MAX_TEXT_LEN: usize = 255;
+const MAX_HINT_LEN: usize = 512;
+const MAX_COLUMNS: u8 = 4;
+
+#[derive(Clone, Copy, PartialEq, Eq, Deserialize, Serialize)]
+#[serde(rename_all = "camelCase")]
+pub(super) enum SettingOption {
+    HideFiles,
+    HideFolders,
+    HideUiIcons,
+    HidePsiIcons,
+    HollowFolders,
+    Groups,
+    Choice,
+    Accent,
+    Monochrome,
+    Saturation,
+    Opacity,
+    IconSize,
+    RowHeight,
+}
+
+#[derive(Deserialize, Serialize)]
+#[serde(untagged)]
+pub(super) enum SettingDefault {
+    Number(u8),
+    Color(String),
+}
+
+#[derive(Deserialize, Serialize)]
+#[serde(rename_all = "camelCase", deny_unknown_fields)]
+pub(super) struct SettingItem {
+    option: SettingOption,
+    #[serde(default)]
+    label: Option<String>,
+    #[serde(default)]
+    hint: Option<String>,
+    #[serde(default)]
+    invert: bool,
+    #[serde(default)]
+    choice: Option<String>,
+    #[serde(default)]
+    columns: Option<u8>,
+    #[serde(default)]
+    default: Option<SettingDefault>,
+}
+
+#[derive(Deserialize, Serialize)]
+#[serde(deny_unknown_fields)]
+pub(super) struct SettingsSection {
+    title: String,
+    items: Vec<SettingItem>,
+}
+
+#[derive(Serialize)]
+struct ChoiceSummary<'a> {
+    id: &'a str,
+    name: &'a str,
+    default: &'a str,
+    options: Vec<OptionSummary<'a>>,
+}
+
+#[derive(Serialize)]
+struct OptionSummary<'a> {
+    id: &'a str,
+    name: &'a str,
+}
+
+fn check_text(text: &str, max: usize, what: &str) -> Result<(), String> {
+    if text.trim().is_empty() || text.len() > max {
+        return Err(format!("settings: {what} must have 1 to {max} characters"));
+    }
+    Ok(())
+}
+
+fn range(option: SettingOption) -> Option<(u8, u8)> {
+    match option {
+        SettingOption::Saturation => Some((0, 20)),
+        SettingOption::Opacity => Some((10, 100)),
+        SettingOption::IconSize => Some((12, 32)),
+        SettingOption::RowHeight => Some((16, 48)),
+        _ => None,
+    }
+}
+
+fn is_color(text: &str) -> bool {
+    text.len() == 7 && text.starts_with('#') && text[1..].chars().all(|c| c.is_ascii_hexdigit())
+}
+
+fn is_flag(option: SettingOption) -> bool {
+    matches!(
+        option,
+        SettingOption::HideFiles
+            | SettingOption::HideFolders
+            | SettingOption::HideUiIcons
+            | SettingOption::HidePsiIcons
+            | SettingOption::HollowFolders
+    )
+}
+
+impl SettingItem {
+    fn validate(&self, ext: &Extensions) -> Result<(), String> {
+        let named = !matches!(self.option, SettingOption::Groups | SettingOption::Choice);
+        match &self.label {
+            Some(label) => check_text(label, MAX_TEXT_LEN, "label")?,
+            None if named => return Err("settings: label is required".into()),
+            None => {}
+        }
+        if let Some(hint) = &self.hint {
+            check_text(hint, MAX_HINT_LEN, "hint")?;
+        }
+        if self.invert && !is_flag(self.option) {
+            return Err("settings: invert is only for on/off options".into());
+        }
+        if self.columns.is_some_and(|c| c == 0 || c > MAX_COLUMNS)
+            || (self.columns.is_some() && self.option != SettingOption::Groups)
+        {
+            return Err(format!("settings: columns are 1 to {MAX_COLUMNS}, for groups only"));
+        }
+        match (self.option, &self.choice) {
+            (SettingOption::Choice, Some(id)) if !ext.choices.iter().any(|c| &c.id == id) => {
+                return Err(format!("settings: unknown choice {id:?}"));
+            }
+            (SettingOption::Choice, None) => return Err("settings: choice items name their choice".into()),
+            (SettingOption::Choice, Some(_)) | (_, None) => {}
+            (_, Some(_)) => return Err("settings: only choice items name a choice".into()),
+        }
+        if self.option == SettingOption::Accent && !ext.accent {
+            return Err("settings: the accent option needs \"accent\": true".into());
+        }
+        self.validate_default()
+    }
+
+    fn validate_default(&self) -> Result<(), String> {
+        let colored = matches!(self.option, SettingOption::Accent | SettingOption::Monochrome);
+        match (range(self.option), &self.default) {
+            (Some((min, max)), Some(SettingDefault::Number(n))) if (min..=max).contains(n) => Ok(()),
+            (Some((min, max)), _) => Err(format!("settings: a default from {min} to {max} is required")),
+            (None, Some(SettingDefault::Color(c))) if colored && is_color(c) => Ok(()),
+            (None, _) if colored => Err("settings: a #rrggbb default is required".into()),
+            (None, None) => Ok(()),
+            (None, Some(_)) => Err("settings: this option takes no default".into()),
+        }
+    }
+}
+
+pub(super) fn validate(sections: &[SettingsSection], ext: &Extensions) -> Result<(), String> {
+    if sections.len() > MAX_SECTIONS {
+        return Err(format!("settings: more than {MAX_SECTIONS} sections"));
+    }
+    for section in sections {
+        check_text(&section.title, MAX_TEXT_LEN, "title")?;
+        if section.items.len() > MAX_ITEMS {
+            return Err(format!("settings: more than {MAX_ITEMS} items in {:?}", section.title));
+        }
+        for item in &section.items {
+            item.validate(ext)?;
+        }
+    }
+    Ok(())
+}
+
+pub(super) fn summary(sections: &[SettingsSection], ext: &Extensions) -> serde_json::Value {
+    let choices: Vec<ChoiceSummary> = ext
+        .choices
+        .iter()
+        .map(|c| ChoiceSummary {
+            id: &c.id,
+            name: &c.name,
+            default: &c.default,
+            options: c.options.iter().map(|o| OptionSummary { id: &o.id, name: &o.name }).collect(),
+        })
+        .collect();
+    serde_json::json!({
+        "groups": ext.groups,
+        "choices": choices,
+        "accent": ext.accent,
+        "settings": sections,
+    })
+}
@@ -24,6 +24,8 @@
 //! asset; the client fetches the mapping and the icons only when the theme is
 //! selected, so installed icon themes cost nothing at start-up.

+use super::icon_extensions::{Choice, DARK_SUFFIX, Extensions, Group, IconDefinition, Pattern, check_icon_id};
+use super::icon_settings::{self, SettingsSection};
 use ide_extension::{Package, UiDecl, check_relative, decode, validate_item_id};
 use serde::Deserialize;
 use std::collections::{BTreeMap, BTreeSet};
@@ -45,7 +47,7 @@ struct Decl {
 #[derive(Deserialize)]
 #[serde(rename_all = "camelCase", deny_unknown_fields)]
 struct ThemeFile {
-    icon_definitions: BTreeMap<String, PathBuf>,
+    icon_definitions: BTreeMap<String, IconDefinition>,
    #[serde(default)]
    file: Option<String>,
    #[serde(default)]
@@ -53,11 +55,25 @@ struct ThemeFile {
    #[serde(default)]
    folder_expanded: Option<String>,
    #[serde(default)]
+    folder_open: Option<String>,
+    #[serde(default)]
    file_extensions: BTreeMap<String, String>,
    #[serde(default)]
    file_names: BTreeMap<String, String>,
    #[serde(default)]
    folder_names: BTreeMap<String, String>,
+    #[serde(default)]
+    patterns: Vec<Pattern>,
+    #[serde(default)]
+    overrides: BTreeMap<String, String>,
+    #[serde(default)]
+    groups: Vec<Group>,
+    #[serde(default)]
+    choices: Vec<Choice>,
+    #[serde(default)]
+    accent: bool,
+    #[serde(default)]
+    settings: Vec<SettingsSection>,
 }

 /// Asset id of a theme's mapping (JSON).
@@ -65,6 +81,10 @@ pub fn map_asset(theme: &str) -> String {
    format!("iconTheme/{theme}/map")
 }

+pub fn settings_asset(theme: &str) -> String {
+    format!("iconTheme/{theme}/settings")
+}
+
 /// Asset id prefix of a theme's SVGs (`…/svg/<icon id>`).
 pub fn svg_prefix(theme: &str) -> String {
    format!("iconTheme/{theme}/svg/")
@@ -87,12 +107,20 @@ pub(super) fn icon_theme(pkg: &Package, decl: toml::Value) -> Result<UiDecl, Str
        return Err(format!("icon theme {:?} has an empty label", d.id));
    }
    let src = pkg.read_text(&d.path)?;
-    let theme: ThemeFile = serde_json::from_str(&src).map_err(|e| format!("{}: {e}", d.path.display()))?;
+    let mut theme: ThemeFile = serde_json::from_str(&src).map_err(|e| format!("{}: {e}", d.path.display()))?;
+    let extensions = Extensions {
+        patterns: std::mem::take(&mut theme.patterns),
+        overrides: std::mem::take(&mut theme.overrides),
+        groups: std::mem::take(&mut theme.groups),
+        choices: std::mem::take(&mut theme.choices),
+        accent: theme.accent,
+    };
    let at = |what: &str| format!("{} ({what})", d.path.display());
    if theme.icon_definitions.len() > MAX_ICONS {
        return Err(format!("{}: more than {MAX_ICONS} icons", d.path.display()));
    }
-    let mappings = theme.file_extensions.len() + theme.file_names.len() + theme.folder_names.len();
+    let mappings =
+        theme.file_extensions.len() + theme.file_names.len() + theme.folder_names.len() + extensions.mappings();
    if mappings > MAX_MAPPINGS {
        return Err(format!("{}: more than {MAX_MAPPINGS} mappings", d.path.display()));
    }
@@ -100,7 +128,17 @@ pub(super) fn icon_theme(pkg: &Package, decl: toml::Value) -> Result<UiDecl, Str
    let check_ref = |icon: &str, what: &str| -> Result<(), String> {
        if defined.contains(icon) { Ok(()) } else { Err(format!("{}: unknown icon {icon:?}", at(what))) }
    };
-    for (what, icon) in [("file", &theme.file), ("folder", &theme.folder), ("folderExpanded", &theme.folder_expanded)] {
+    for icon in theme.icon_definitions.keys() {
+        check_icon_id(icon)?;
+    }
+    extensions.validate(&check_ref)?;
+    icon_settings::validate(&theme.settings, &extensions).map_err(|e| format!("{}: {e}", d.path.display()))?;
+    for (what, icon) in [
+        ("file", &theme.file),
+        ("folder", &theme.folder),
+        ("folderExpanded", &theme.folder_expanded),
+        ("folderOpen", &theme.folder_open),
+    ] {
        if let Some(icon) = icon {
            check_ref(icon, what)?;
        }
@@ -125,20 +163,31 @@ pub(super) fn icon_theme(pkg: &Package, decl: toml::Value) -> Result<UiDecl, Str

    let mut assets = Vec::with_capacity(theme.icon_definitions.len() + 1);
    let mut files = vec![d.path.clone()];
-    for (icon, path) in &theme.icon_definitions {
-        validate_item_id(icon, "icon id")?;
-        let clean = read_icon(pkg, path)?;
-        assets.push((format!("{}{icon}", svg_prefix(&d.id)), clean));
-        files.push(path.clone());
+    for (icon, def) in &theme.icon_definitions {
+        let dark = def.dark().map(|path| (path, DARK_SUFFIX));
+        for (path, suffix) in std::iter::once((def.light(), "")).chain(dark) {
+            let clean = read_icon(pkg, path)?;
+            assets.push((format!("{}{icon}{suffix}", svg_prefix(&d.id)), clean));
+            files.push(path.clone());
+        }
    }
    let map = serde_json::json!({
        "file": theme.file,
        "folder": theme.folder,
        "folderExpanded": theme.folder_expanded,
+        "folderOpen": theme.folder_open,
        "fileExtensions": file_extensions,
        "fileNames": file_names,
        "folderNames": folder_names,
+        "patterns": extensions.patterns,
+        "overrides": extensions.overrides,
+        "groups": extensions.groups,
+        "choices": extensions.choices,
+        "accent": extensions.accent,
    });
+    if !theme.settings.is_empty() {
+        assets.push((settings_asset(&d.id), icon_settings::summary(&theme.settings, &extensions).to_string()));
+    }
    assets.push((map_asset(&d.id), map.to_string()));
    let json = serde_json::json!({ "id": d.id, "label": d.label, "icons": theme.icon_definitions.len() });
    let mut out = UiDecl::new(d.id.clone(), d.label, json);
@@ -612,4 +661,184 @@ mod tests {
        assert!(icon_theme(&pkg, decl("evil.json")).unwrap_err().contains("evil.svg"));
        assert!(icon_theme(&pkg, decl("../x.json")).is_err());
    }
+
+    const SVG: &str = r#"<svg viewBox="0 0 16 16"><path d="M0 0h16v16z"/></svg>"#;
+
+    fn theme_package(theme: &str) -> (tempfile::TempDir, Package) {
+        let tmp = tempfile::tempdir().unwrap();
+        let dir = tmp.path();
+        std::fs::create_dir_all(dir.join("icons")).unwrap();
+        for icon in ["file", "folder", "folder-src", "folder-src-open", "rust", "rust-dark", "tests", "arrow"] {
+            std::fs::write(dir.join(format!("icons/{icon}.svg")), SVG).unwrap();
+        }
+        std::fs::write(dir.join("theme.json"), theme).unwrap();
+        let manifest = ide_extension::Manifest::parse(
+            "id = \"p\"\nname = \"P\"\nversion = \"1.0.0\"\nengines.openidea = \"^1.0\"",
+        )
+        .unwrap();
+        let pkg = Package::new(manifest, dir.to_path_buf());
+        (tmp, pkg)
+    }
+
+    fn load(theme: &str) -> Result<UiDecl, String> {
+        let (_tmp, pkg) = theme_package(theme);
+        let mut t = toml::Table::new();
+        t.insert("id".into(), "m".into());
+        t.insert("label".into(), "M".into());
+        t.insert("path".into(), "theme.json".into());
+        icon_theme(&pkg, toml::Value::Table(t))
+    }
+
+    fn with(extra: &str) -> String {
+        format!(
+            r#"{{"iconDefinitions":{{"file":"icons/file.svg","folder":"icons/folder.svg",
+                "folder-src":"icons/folder-src.svg","folder-src-open":"icons/folder-src-open.svg",
+                "rust":{{"light":"icons/rust.svg","dark":"icons/rust-dark.svg"}},
+                "tests":"icons/tests.svg","arrow":"icons/arrow.svg"}},
+                "file":"file","folder":"folder"{extra}}}"#
+        )
+    }
+
+    const EXTENSIONS: &str = r#","patterns":[
+        {"pattern":"^.*\\.rs$","icon":"rust","ignoreCase":true},
+        {"pattern":"/tests?/","icon":"tests","path":true,"group":"tests"},
+        {"pattern":"^src$","icon":"folder-src","target":"folder","openIcon":"folder-src-open"}],
+        "overrides":{"chevron-right":"arrow","symbol-class":"rust"},
+        "groups":[{"id":"tests","name":"Tests","enabled":false}],
+        "choices":[{"id":"arrows","name":"Arrows","default":"plain","options":[
+            {"id":"plain","name":"Default"},{"id":"material","name":"Material","overrides":{"chevron-down":"arrow"}}]}],
+        "accent":true,"folderOpen":"folder-src-open""#;
+
+    fn map_of(d: &UiDecl) -> serde_json::Value {
+        serde_json::from_str(&d.assets.iter().find(|(k, _)| *k == map_asset("m")).unwrap().1).unwrap()
+    }
+
+    #[test]
+    fn theme_extensions_reach_the_mapping() {
+        let d = load(&with(EXTENSIONS)).unwrap();
+        let map = map_of(&d);
+        assert_eq!(
+            map["patterns"],
+            serde_json::json!([
+                {"pattern":"^.*\\.rs$","icon":"rust","target":"file","path":false,"ignoreCase":true,"group":null,"openIcon":null},
+                {"pattern":"/tests?/","icon":"tests","target":"file","path":true,"ignoreCase":false,"group":"tests","openIcon":null},
+                {"pattern":"^src$","icon":"folder-src","target":"folder","path":false,"ignoreCase":false,"group":null,"openIcon":"folder-src-open"}
+            ])
+        );
+        assert_eq!(map["overrides"], serde_json::json!({"chevron-right":"arrow","symbol-class":"rust"}));
+        assert_eq!(map["groups"], serde_json::json!([{"id":"tests","name":"Tests","enabled":false}]));
+        assert_eq!(map["choices"][0]["default"], "plain");
+        assert_eq!(map["choices"][0]["options"][1]["overrides"], serde_json::json!({"chevron-down":"arrow"}));
+        assert_eq!(map["choices"][0]["options"][0]["overrides"], serde_json::json!({}));
+        assert_eq!(map["accent"], true);
+        assert_eq!(map["folderOpen"], "folder-src-open");
+        assert_eq!(d.json["icons"], 7);
+        assert!(d.assets.iter().any(|(k, _)| *k == format!("{}rust", svg_prefix("m"))));
+        assert!(d.assets.iter().any(|(k, _)| *k == format!("{}rust_dark", svg_prefix("m"))));
+        assert!(d.files.iter().any(|f| f.ends_with("icons/rust-dark.svg")));
+    }
+
+    #[test]
+    fn themes_without_extensions_keep_their_mapping() {
+        let map = map_of(&load(&with("")).unwrap());
+        assert_eq!(map["patterns"], serde_json::json!([]));
+        assert_eq!(map["overrides"], serde_json::json!({}));
+        assert_eq!(map["groups"], serde_json::json!([]));
+        assert_eq!(map["choices"], serde_json::json!([]));
+        assert_eq!(map["accent"], false);
+    }
+
+    #[test]
+    fn theme_extensions_are_validated() {
+        let cases = [
+            (r#","patterns":[{"pattern":"x","icon":"nope"}]"#, "unknown icon"),
+            (r#","patterns":[{"pattern":"(a+)+$","icon":"rust"}]"#, "repeated group"),
+            (r#","patterns":[{"pattern":"(","icon":"rust"}]"#, "invalid pattern"),
+            (r#","patterns":[{"pattern":"x","icon":"rust","group":"nope"}]"#, "unknown group"),
+            (r#","patterns":[{"pattern":"x","icon":"rust","openIcon":"tests"}]"#, "openIcon"),
+            (r#","patterns":[{"pattern":"x","icon":"folder","target":"folder","openIcon":"nope"}]"#, "unknown icon"),
+            (r#","patterns":[{"pattern":"x","icon":"rust","priority":1}]"#, "unknown field"),
+            (r#","overrides":{"chevron-right":"nope"}"#, "unknown icon"),
+            (r#","folderOpen":"nope""#, "unknown icon"),
+            (r#","overrides":{"Chevron":"rust"}"#, "invalid overridden icon"),
+            (r#","groups":[{"id":"a","name":" "}]"#, "name"),
+            (r#","groups":[{"id":"a","name":"A"},{"id":"a","name":"B"}]"#, "duplicate"),
+            (r#","choices":[{"id":"c","name":"C","default":"x","options":[{"id":"y","name":"Y"}]}]"#, "default"),
+            (r#","choices":[{"id":"c","name":"C","default":"y","options":[]}]"#, "options"),
+            (
+                r#","choices":[{"id":"c","name":"C","default":"y","options":[{"id":"y","name":"Y","overrides":{"a":"nope"}}]}]"#,
+                "unknown icon",
+            ),
+        ];
+        for (extra, needle) in cases {
+            let err = load(&with(extra)).err().unwrap_or_else(|| panic!("accepted: {extra}"));
+            assert!(err.contains(needle), "{extra}: {err}");
+        }
+        let dark_id = r#"{"iconDefinitions":{"x_dark":"icons/rust.svg"}}"#;
+        assert!(load(dark_id).unwrap_err().contains("_dark"));
+    }
+
+    const SETTINGS: &str = r##","settings":[
+        {"title":"Toggle","items":[
+            {"option":"hideFiles","label":"Enable file icons","hint":"Files","invert":true},
+            {"option":"hollowFolders","label":"Hollow"}]},
+        {"title":"Packs","items":[{"option":"groups","columns":2}]},
+        {"title":"Other","items":[
+            {"option":"choice","choice":"arrows"},
+            {"option":"accent","label":"Accent","default":"#009688"},
+            {"option":"saturation","label":"Saturation","default":10}]}]"##;
+
+    fn settings_of(d: &UiDecl) -> Option<serde_json::Value> {
+        d.assets.iter().find(|(k, _)| *k == settings_asset("m")).map(|(_, v)| serde_json::from_str(v).unwrap())
+    }
+
+    #[test]
+    fn theme_settings_get_their_own_asset() {
+        let d = load(&with(&format!("{EXTENSIONS}{SETTINGS}"))).unwrap();
+        let s = settings_of(&d).unwrap();
+        assert_eq!(s["accent"], true);
+        assert_eq!(s["groups"], serde_json::json!([{"id":"tests","name":"Tests","enabled":false}]));
+        assert_eq!(
+            s["choices"],
+            serde_json::json!([{"id":"arrows","name":"Arrows","default":"plain","options":[
+                {"id":"plain","name":"Default"},{"id":"material","name":"Material"}]}])
+        );
+        assert_eq!(s["settings"][0]["title"], "Toggle");
+        assert_eq!(
+            s["settings"][0]["items"][0],
+            serde_json::json!({"option":"hideFiles","label":"Enable file icons","hint":"Files","invert":true,
+                "choice":null,"columns":null,"default":null})
+        );
+        assert_eq!(s["settings"][2]["items"][1]["default"], "#009688");
+        assert_eq!(s["settings"][2]["items"][2]["default"], 10);
+        assert!(settings_of(&load(&with(EXTENSIONS)).unwrap()).is_none());
+    }
+
+    #[test]
+    fn theme_settings_are_validated() {
+        let section = |items: &str| with(&format!(r#"{EXTENSIONS},"settings":[{{"title":"T","items":[{items}]}}]"#));
+        let cases = [
+            (section(r#"{"option":"nope","label":"X"}"#), "unknown variant"),
+            (section(r#"{"option":"hideFiles"}"#), "label"),
+            (section(r#"{"option":"hideFiles","label":" "}"#), "label"),
+            (section(r#"{"option":"choice","choice":"nope"}"#), "unknown choice"),
+            (section(r#"{"option":"choice"}"#), "choice"),
+            (section(r#"{"option":"groups","columns":9}"#), "columns"),
+            (section(r#"{"option":"saturation","label":"S"}"#), "default"),
+            (section(r#"{"option":"saturation","label":"S","default":50}"#), "default"),
+            (section(r##"{"option":"opacity","label":"O","default":"#000000"}"##), "default"),
+            (section(r#"{"option":"monochrome","label":"M","default":"red"}"#), "default"),
+            (section(r#"{"option":"saturation","label":"S","default":5,"invert":true}"#), "invert"),
+            (section(r#"{"option":"hideFiles","label":"F","extra":1}"#), "unknown field"),
+            (with(&format!(r#"{EXTENSIONS},"settings":[{{"title":"","items":[]}}]"#)), "title"),
+            (
+                with(r##","settings":[{"title":"T","items":[{"option":"accent","label":"A","default":"#000000"}]}]"##),
+                "accent",
+            ),
+        ];
+        for (theme, needle) in cases {
+            let err = load(&theme).err().unwrap_or_else(|| panic!("accepted: {theme}"));
+            assert!(err.contains(needle), "{theme}: {err}");
+        }
+    }
 }
@@ -0,0 +1,884 @@
+//! IntelliJ theme plugins, read for import as OpenIDEA theme plugins: a
+//! Marketplace download (a `.jar`, or a `.zip` holding the plugin's
+//! `lib/*.jar`), an installed plugin's folder or a loose `.theme.json`; and the
+//! theme plugins of the JetBrains IDEs on this machine, with the theme each IDE
+//! is set to (`options/laf.xml`).
+//!
+//! Nothing is converted here: the UI maps IntelliJ keys onto design tokens
+//! (`src/features/plugins/intellijTheme.ts`, shared with `pnpm
+//! theme:import-intellij`) and [`super::PluginHost::stage_package`] writes the
+//! result for the install page, which validates it like any package.
+
+use ide_core::{IdeError, IdeResult, IpcPath};
+use quick_xml::{Reader, XmlVersion, events::Event};
+use serde::{Deserialize, Serialize};
+use specta::Type;
+use std::ffi::OsString;
+use std::io::{Cursor, Read, Seek};
+use std::path::{Path, PathBuf};
+
+/// A descriptor, theme or editor scheme larger than this is not one.
+const MAX_FILE: u64 = 4 << 20;
+/// A plugin jar read into memory from a Marketplace zip.
+const MAX_JAR: u64 = 64 << 20;
+/// Jars of one plugin looked into.
+const MAX_JARS: usize = 64;
+/// All the jars read into memory from one Marketplace zip.
+const MAX_NESTED: u64 = 256 << 20;
+/// Descriptors read for one plugin: `plugin.xml` and those it includes.
+const MAX_DESCRIPTORS: usize = 64;
+const PLUGIN_XML: &str = "META-INF/plugin.xml";
+
+/// A theme plugin's themes, as read from its files.
+#[derive(Clone, Debug, PartialEq, Serialize, Deserialize, Type)]
+#[serde(rename_all = "camelCase")]
+pub struct IntellijThemeSource {
+    /// The plugin's `<name>`, or the theme's for a loose file.
+    pub name: String,
+    pub plugin_id: Option<String>,
+    pub version: Option<String>,
+    pub vendor: Option<String>,
+    pub themes: Vec<IntellijThemeFile>,
+}
+
+#[derive(Clone, Debug, PartialEq, Serialize, Deserialize, Type)]
+#[serde(rename_all = "camelCase")]
+pub struct IntellijThemeFile {
+    /// The `themeProvider` id (what `laf.xml` names), or the file name without `.theme.json`.
+    pub id: String,
+    /// The `.theme.json`, comments removed.
+    pub theme: String,
+    /// The editor scheme (`.icls` XML) its `editorScheme` names, when the plugin has it.
+    pub editor_scheme: Option<String>,
+}
+
+/// A theme of a plugin installed in a JetBrains IDE.
+#[derive(Clone, Debug, PartialEq, Serialize, Deserialize, Type)]
+#[serde(rename_all = "camelCase")]
+pub struct InstalledIntellijTheme {
+    /// The IDE and its version: `IntelliJ IDEA 2025.2`.
+    pub ide: String,
+    /// The plugin's name.
+    pub plugin: String,
+    /// What to import: the plugin's folder or jar.
+    pub path: IpcPath,
+    pub theme_id: String,
+    pub theme_name: String,
+    pub dark: bool,
+    /// The IDE is set to this theme.
+    pub active: bool,
+}
+
+/// Reads the themes of an IntelliJ theme plugin (a `.jar`, a Marketplace
+/// `.zip`, an installed plugin's folder) or of a `.theme.json`.
+pub fn read_source(path: &Path) -> IdeResult<IntellijThemeSource> {
+    read(path).map_err(IdeError::invalid)
+}
+
+/// The theme plugins of the JetBrains IDEs (and Android Studio) of this user,
+/// the themes their IDEs are set to first.
+pub fn installed_themes() -> Vec<InstalledIntellijTheme> {
+    let Some(home) = dirs::home_dir() else { return Vec::new() };
+    let layout = if cfg!(target_os = "macos") {
+        Layout::Mac
+    } else if cfg!(windows) {
+        Layout::Windows
+    } else {
+        Layout::Xdg
+    };
+    find_installed(&ide_dirs(layout, &home, |key| std::env::var_os(key)))
+}
+
+fn read(path: &Path) -> Result<IntellijThemeSource, String> {
+    if path.extension().is_some_and(|e| e.eq_ignore_ascii_case("json")) {
+        return loose_theme(path);
+    }
+    let mut jars = plugin_jars(path)?;
+    let plugin = descriptor(&mut jars)?;
+    let shown = || path.file_name().map(|n| n.to_string_lossy().into_owned()).unwrap_or_default();
+    if plugin.themes.is_empty() {
+        return Err(format!("{} is not a theme plugin: its plugin.xml declares no themeProvider", shown()));
+    }
+    let mut themes = Vec::new();
+    let mut problem = None;
+    for (id, theme_path) in &plugin.themes {
+        match plugin_theme(&mut jars, id, theme_path) {
+            Ok(theme) => themes.push(theme),
+            Err(e) => problem = problem.or(Some(e)),
+        }
+    }
+    if themes.is_empty() {
+        return Err(problem.unwrap_or_else(|| format!("{} has no readable theme", shown())));
+    }
+    Ok(IntellijThemeSource {
+        name: plugin.name.unwrap_or_else(shown),
+        plugin_id: plugin.id,
+        version: plugin.version,
+        vendor: plugin.vendor,
+        themes,
+    })
+}
+
+fn plugin_theme(jars: &mut [Jar], id: &str, path: &str) -> Result<IntellijThemeFile, String> {
+    let bytes = find(jars, entry_name(path), MAX_FILE)?.ok_or_else(|| format!("{path} is missing from the plugin"))?;
+    let (theme, fields) = theme_json(&bytes).map_err(|e| format!("{path}: {e}"))?;
+    let editor_scheme = match string_field(&fields, "editorScheme") {
+        Some(scheme) => find(jars, entry_name(scheme), MAX_FILE)?.map(|b| text(&b)),
+        None => None,
+    };
+    Ok(IntellijThemeFile { id: id.to_owned(), theme, editor_scheme })
+}
+
+/// A `.theme.json` with the editor scheme beside it (its `editorScheme` names a path in the plugin's jar).
+fn loose_theme(path: &Path) -> Result<IntellijThemeSource, String> {
+    let (theme, fields) = theme_json(&read_file(path)?).map_err(|e| format!("{}: {e}", path.display()))?;
+    // Any JSON object parses: an IntelliJ theme has UI colours or an editor scheme.
+    let scheme_ref = string_field(&fields, "editorScheme");
+    if !fields.get("ui").is_some_and(serde_json::Value::is_object) && scheme_ref.is_none() {
+        return Err(format!("{} is not an IntelliJ theme: it has no \"ui\" or \"editorScheme\"", path.display()));
+    }
+    let editor_scheme = scheme_ref
+        .and_then(|p| Path::new(p).file_name().map(|n| path.with_file_name(n)))
+        .filter(|p| p.is_file())
+        .map(|p| read_file(&p).map(|b| text(&b)))
+        .transpose()?;
+    let file = path.file_name().map(|n| n.to_string_lossy().into_owned()).unwrap_or_default();
+    let id = file.strip_suffix(".theme.json").or_else(|| file.strip_suffix(".json")).unwrap_or(&file).to_owned();
+    Ok(IntellijThemeSource {
+        name: string_field(&fields, "name").map_or_else(|| id.clone(), str::to_owned),
+        plugin_id: None,
+        version: None,
+        vendor: string_field(&fields, "author").map(str::to_owned),
+        themes: vec![IntellijThemeFile { id, theme, editor_scheme }],
+    })
+}
+
+type JsonObject = serde_json::Map<String, serde_json::Value>;
+
+/// The theme JSON, comments removed, and its fields, if it is an object.
+fn theme_json(bytes: &[u8]) -> Result<(String, JsonObject), String> {
+    let json = super::theme::strip_json_comments(&text(bytes));
+    match serde_json::from_str::<serde_json::Value>(&json) {
+        Ok(serde_json::Value::Object(fields)) => Ok((json, fields)),
+        Ok(_) => Err("not a theme: expected a JSON object".into()),
+        Err(e) => Err(format!("invalid theme JSON: {e}")),
+    }
+}
+
+fn string_field<'a>(fields: &'a JsonObject, key: &str) -> Option<&'a str> {
+    fields.get(key)?.as_str().filter(|s| !s.trim().is_empty())
+}
+
+/// `/themes/x.theme.json` → `themes/x.theme.json`.
+fn entry_name(path: &str) -> &str {
+    path.trim().trim_start_matches('/')
+}
+
+fn text(bytes: &[u8]) -> String {
+    let bytes = bytes.strip_prefix(b"\xEF\xBB\xBF").unwrap_or(bytes);
+    String::from_utf8_lossy(bytes).into_owned()
+}
+
+fn read_file(path: &Path) -> Result<Vec<u8>, String> {
+    let shown = |e: std::io::Error| format!("{}: {e}", path.display());
+    let file = std::fs::File::open(path).map_err(shown)?;
+    let mut buf = Vec::new();
+    file.take(MAX_FILE + 1).read_to_end(&mut buf).map_err(shown)?;
+    if buf.len() as u64 > MAX_FILE {
+        return Err(format!("{} is too large for a theme", path.display()));
+    }
+    Ok(buf)
+}
+
+trait ReadSeek: Read + Seek {}
+impl<T: Read + Seek> ReadSeek for T {}
+type Jar = zip::ZipArchive<Box<dyn ReadSeek>>;
+
+fn open_jar(path: &Path) -> Result<Jar, String> {
+    let file = std::fs::File::open(path).map_err(|e| format!("{}: {e}", path.display()))?;
+    let reader: Box<dyn ReadSeek> = Box::new(std::io::BufReader::new(file));
+    zip::ZipArchive::new(reader).map_err(|e| format!("{} is not a jar or zip file ({e})", path.display()))
+}
+
+/// The jars of the plugin at `path`: a jar, a Marketplace zip (`<plugin>/lib/*.jar`)
+/// or an installed plugin's folder (`lib/*.jar`).
+fn plugin_jars(path: &Path) -> Result<Vec<Jar>, String> {
+    let not_plugin = || format!("{} is not an IntelliJ plugin: no {PLUGIN_XML} and no lib/*.jar", path.display());
+    if path.is_dir() {
+        let mut found: Vec<PathBuf> = [path.join("lib"), path.join("lib").join("modules")]
+            .iter()
+            .flat_map(|dir| std::fs::read_dir(dir).into_iter().flatten().flatten())
+            .map(|e| e.path())
+            .filter(|p| p.is_file() && is_jar(p))
+            .collect();
+        found.sort();
+        let jars: Vec<Jar> = found.iter().take(MAX_JARS).filter_map(|p| open_jar(p).ok()).collect();
+        return if jars.is_empty() { Err(not_plugin()) } else { Ok(jars) };
+    }
+    let mut archive = open_jar(path)?;
+    if archive.index_for_name(PLUGIN_XML).is_some() {
+        return Ok(vec![archive]);
+    }
+    let jars = nested_jars(&mut archive, MAX_JAR, MAX_NESTED);
+    if jars.is_empty() { Err(not_plugin()) } else { Ok(jars) }
+}
+
+/// The `lib` jars of a Marketplace zip, smallest first (a theme's own jar is small)
+/// while they fit `max_total`; library jars too large or not jars at all are skipped.
+fn nested_jars(archive: &mut Jar, max_jar: u64, max_total: u64) -> Vec<Jar> {
+    let mut nested: Vec<(u64, String)> = entry_names(archive)
+        .into_iter()
+        .filter(|n| is_lib_jar(n))
+        .filter_map(|n| Some((archive.by_name(&n).ok()?.size(), n)))
+        .filter(|(size, _)| *size <= max_jar)
+        .collect();
+    nested.sort();
+    let (mut jars, mut loaded) = (Vec::new(), 0u64);
+    for (size, name) in nested.into_iter().take(MAX_JARS) {
+        if loaded.saturating_add(size) > max_total {
+            break;
+        }
+        let Ok(Some(bytes)) = read_entry(archive, &name, max_jar) else { continue };
+        loaded += size;
+        let reader: Box<dyn ReadSeek> = Box::new(Cursor::new(bytes));
+        if let Ok(jar) = zip::ZipArchive::new(reader) {
+            jars.push(jar);
+        }
+    }
+    jars
+}
+
+fn entry_names(jar: &Jar) -> Vec<String> {
+    jar.file_names().filter_map(Result::ok).map(|n| n.into_owned()).collect()
+}
+
+fn is_jar(path: &Path) -> bool {
+    path.extension().is_some_and(|e| e.eq_ignore_ascii_case("jar"))
+}
+
+/// `lib/x.jar`, `<plugin>/lib/x.jar` or `<plugin>/lib/modules/x.jar` in a Marketplace zip.
+fn is_lib_jar(name: &str) -> bool {
+    let parts: Vec<&str> = name.split('/').collect();
+    let n = parts.len();
+    name.to_ascii_lowercase().ends_with(".jar")
+        && (2..=4).contains(&n)
+        && (parts[n - 2] == "lib" || (n >= 3 && parts[n - 2] == "modules" && parts[n - 3] == "lib"))
+}
+
+fn read_entry(jar: &mut Jar, name: &str, max: u64) -> Result<Option<Vec<u8>>, String> {
+    let Ok(file) = jar.by_name(name) else { return Ok(None) };
+    if file.is_dir() {
+        return Ok(None);
+    }
+    if file.size() > max {
+        return Err(format!("{name} is too large"));
+    }
+    let mut buf = Vec::with_capacity(file.size() as usize);
+    file.take(max.saturating_add(1)).read_to_end(&mut buf).map_err(|e| format!("{name}: {e}"))?;
+    if buf.len() as u64 > max {
+        return Err(format!("{name} is too large"));
+    }
+    Ok(Some(buf))
+}
+
+fn find(jars: &mut [Jar], name: &str, max: u64) -> Result<Option<Vec<u8>>, String> {
+    for jar in jars.iter_mut() {
+        if let Some(bytes) = read_entry(jar, name, max)? {
+            return Ok(Some(bytes));
+        }
+    }
+    Ok(None)
+}
+
+/// What the plugin's descriptors say: `<idea-plugin>`'s `id`, `name`, `version`,
+/// `vendor`, and its `themeProvider`s (id, path in the jar).
+#[derive(Debug, Default, PartialEq)]
+struct Descriptor {
+    id: Option<String>,
+    name: Option<String>,
+    version: Option<String>,
+    vendor: Option<String>,
+    themes: Vec<(String, String)>,
+}
+
+/// Reads `META-INF/plugin.xml` and the descriptors it includes (`<xi:include href>`), in any jar.
+fn descriptor(jars: &mut [Jar]) -> Result<Descriptor, String> {
+    let main = find(jars, PLUGIN_XML, MAX_FILE)
+        .ok()
+        .flatten()
+        .ok_or_else(|| format!("not an IntelliJ plugin: no {PLUGIN_XML}"))?;
+    let mut out = Descriptor::default();
+    let mut includes = Vec::new();
+    parse_descriptor(&text(&main), true, &mut out, &mut includes).map_err(|e| format!("{PLUGIN_XML}: {e}"))?;
+    let mut read = std::collections::HashSet::from([PLUGIN_XML.to_owned()]);
+    while let Some(href) = includes.pop() {
+        let name = include_entry(&href);
+        if read.len() >= MAX_DESCRIPTORS || !read.insert(name.clone()) {
+            continue;
+        }
+        let Ok(Some(bytes)) = find(jars, &name, MAX_FILE) else { continue };
+        let _ = parse_descriptor(&text(&bytes), false, &mut out, &mut includes);
+    }
+    let mut seen = std::collections::HashSet::new();
+    out.themes.retain(|(id, _)| seen.insert(id.clone()));
+    Ok(out)
+}
+
+/// An `<xi:include href>` as a jar entry: `/META-INF/x.xml` from the jar's root, `x.xml` beside plugin.xml.
+fn include_entry(href: &str) -> String {
+    let href = href.trim();
+    href.strip_prefix('/').map_or_else(|| format!("META-INF/{href}"), str::to_owned)
+}
+
+fn parse_descriptor(xml: &str, main: bool, out: &mut Descriptor, includes: &mut Vec<String>) -> Result<(), String> {
+    let mut reader = Reader::from_str(xml);
+    let mut stack: Vec<String> = Vec::new();
+    let mut text = String::new();
+    loop {
+        let event = reader.read_event().map_err(|e| e.to_string())?;
+        match event {
+            Event::Start(ref tag) | Event::Empty(ref tag) => {
+                let name = tag.local_name().as_ref().to_owned();
+                if name == "include" {
+                    let href = tag.attributes().flatten().find(|a| a.key.local_name().as_ref() == "href");
+                    if let Some(href) = href.and_then(|a| a.normalized_value(XmlVersion::Implicit1_0).ok()) {
+                        includes.push(href.into_owned());
+                    }
+                }
+                if name == "themeProvider" {
+                    let (mut id, mut path) = (None, None);
+                    for a in tag.attributes() {
+                        let a = a.map_err(|e| e.to_string())?;
+                        let value = a.normalized_value(XmlVersion::Implicit1_0).map_err(|e| e.to_string())?;
+                        match a.key.local_name().as_ref() {
+                            "id" => id = Some(value.trim().to_owned()),
+                            "path" => path = Some(value.trim().to_owned()),
+                            _ => {}
+                        }
+                    }
+                    if let (Some(id), Some(path)) = (id, path)
+                        && !id.is_empty()
+                        && !path.is_empty()
+                    {
+                        out.themes.push((id, path));
+                    }
+                }
+                if matches!(event, Event::Start(_)) {
+                    stack.push(name);
+                    text.clear();
+                }
+            }
+            Event::Text(t) => text.push_str(&t.xml_content(XmlVersion::Implicit1_0)),
+            Event::CData(t) => text.push_str(t.as_ref()),
+            Event::GeneralRef(r) => {
+                let name = r.as_ref();
+                let escaped = format!("&{name};");
+                text.push_str(&quick_xml::escape::unescape(&escaped).map_err(|e| e.to_string())?);
+            }
+            Event::End(_) => {
+                let name = stack.pop().ok_or("unbalanced element")?;
+                // Direct children of <idea-plugin>.
+                if main && stack.len() == 1 && stack[0] == "idea-plugin" {
+                    let value = text.trim();
+                    let slot = match name.as_str() {
+                        "id" => Some(&mut out.id),
+                        "name" => Some(&mut out.name),
+                        "version" => Some(&mut out.version),
+                        "vendor" => Some(&mut out.vendor),
+                        _ => None,
+                    };
+                    if let Some(slot) = slot
+                        && slot.is_none()
+                        && !value.is_empty()
+                    {
+                        *slot = Some(value.to_owned());
+                    }
+                }
+                text.clear();
+            }
+            Event::Eof => return if stack.is_empty() { Ok(()) } else { Err("unclosed element".into()) },
+            _ => {}
+        }
+    }
+}
+
+/// Where an OS keeps the IDEs' settings and plugins.
+#[derive(Clone, Copy, Debug)]
+enum Layout {
+    /// `~/Library/Application Support/<vendor>/<IDE>`, plugins in its `plugins/`.
+    Mac,
+    /// `%APPDATA%\<vendor>\<IDE>`, plugins in its `plugins\`.
+    Windows,
+    /// `$XDG_CONFIG_HOME/<vendor>/<IDE>`, plugins in `$XDG_DATA_HOME/<vendor>/<IDE>`.
+    Xdg,
+}
+
+#[derive(Debug, PartialEq)]
+struct IdeDir {
+    label: String,
+    product: String,
+    version: (u32, u32),
+    config: PathBuf,
+    plugins: PathBuf,
+}
+
+/// The settings folders of JetBrains IDEs and Android Studio (2020.1 and later), newest first, one
+/// per product: its newest version's (an upgrade leaves the older ones behind).
+fn ide_dirs(layout: Layout, home: &Path, env: impl Fn(&str) -> Option<OsString>) -> Vec<IdeDir> {
+    let var = |key: &str| env(key).filter(|v| !v.is_empty()).map(PathBuf::from);
+    let (config_root, data_root) = match layout {
+        Layout::Mac => {
+            let root = home.join("Library").join("Application Support");
+            (root.clone(), root)
+        }
+        Layout::Windows => {
+            let root = var("APPDATA").unwrap_or_else(|| home.join("AppData").join("Roaming"));
+            (root.clone(), root)
+        }
+        Layout::Xdg => (
+            var("XDG_CONFIG_HOME").unwrap_or_else(|| home.join(".config")),
+            var("XDG_DATA_HOME").unwrap_or_else(|| home.join(".local").join("share")),
+        ),
+    };
+    let mut out = Vec::new();
+    for vendor in ["JetBrains", "Google"] {
+        for entry in std::fs::read_dir(config_root.join(vendor)).into_iter().flatten().flatten() {
+            let name = entry.file_name().to_string_lossy().into_owned();
+            let Some((product, version, shown)) = product_dir(&name) else { continue };
+            let config = entry.path();
+            if !config.is_dir() {
+                continue;
+            }
+            let plugins = match layout {
+                Layout::Xdg => data_root.join(vendor).join(&name),
+                Layout::Mac | Layout::Windows => config.join("plugins"),
+            };
+            out.push(IdeDir {
+                label: format!("{} {shown}", product_label(product)),
+                product: product.to_owned(),
+                version,
+                config,
+                plugins,
+            });
+        }
+    }
+    out.sort_by(|a, b| b.version.cmp(&a.version).then_with(|| a.label.cmp(&b.label)));
+    let mut products = std::collections::HashSet::new();
+    out.retain(|ide| products.insert(ide.product.clone()));
+    out
+}
+
+/// `IntelliJIdea2025.2` → (`IntelliJIdea`, (2025, 2), `2025.2`).
+fn product_dir(name: &str) -> Option<(&str, (u32, u32), &str)> {
+    let at = name.find(|c: char| c.is_ascii_digit())?;
+    let (product, version) = name.split_at(at);
+    if product.is_empty() || !product.chars().all(|c| c.is_ascii_alphabetic()) {
+        return None;
+    }
+    let (year, minor) = version.split_once('.')?;
+    let ok = |s: &str| !s.is_empty() && s.len() <= 4 && s.chars().all(|c| c.is_ascii_digit());
+    if year.len() != 4 || !ok(year) || !ok(minor) {
+        return None;
+    }
+    Some((product, (year.parse().ok()?, minor.parse().ok()?), version))
+}
+
+fn product_label(product: &str) -> &str {
+    match product {
+        "IntelliJIdea" => "IntelliJ IDEA",
+        "IdeaIC" => "IntelliJ IDEA Community Edition",
+        "PyCharmCE" => "PyCharm Community Edition",
+        "AndroidStudio" => "Android Studio",
+        "AndroidStudioPreview" => "Android Studio Preview",
+        other => other,
+    }
+}
+
+/// The theme ids `options/laf.xml` selects: the current one, and with "Sync with OS" the preferred light and dark.
+fn active_theme_ids(config: &Path) -> Vec<String> {
+    let Ok(bytes) = read_file(&config.join("options").join("laf.xml")) else { return Vec::new() };
+    let xml = text(&bytes);
+    let mut reader = Reader::from_str(&xml);
+    let (mut ids, mut preferred, mut autodetect) = (Vec::new(), Vec::new(), false);
+    loop {
+        match reader.read_event() {
+            Ok(Event::Start(tag) | Event::Empty(tag)) => {
+                let attr = |key: &str| {
+                    tag.attributes()
+                        .flatten()
+                        .find(|a| a.key.as_ref() == key)
+                        .and_then(|a| a.normalized_value(XmlVersion::Implicit1_0).ok().map(|v| v.trim().to_owned()))
+                };
+                match tag.local_name().as_ref() {
+                    "component" if attr("name").as_deref() == Some("LafManager") => {
+                        autodetect = attr("autodetect").as_deref() == Some("true");
+                    }
+                    "laf" => ids.extend(attr("themeId")),
+                    "preferred-light-laf" | "preferred-dark-laf" => preferred.extend(attr("themeId")),
+                    _ => {}
+                }
+            }
+            Ok(Event::Eof) | Err(_) => break,
+            _ => {}
+        }
+    }
+    if autodetect {
+        ids.extend(preferred);
+    }
+    ids.retain(|id| !id.is_empty());
+    ids
+}
+
+fn find_installed(ides: &[IdeDir]) -> Vec<InstalledIntellijTheme> {
+    let mut out = Vec::new();
+    for ide in ides {
+        let active = active_theme_ids(&ide.config);
+        let mut plugins: Vec<PathBuf> = std::fs::read_dir(&ide.plugins)
+            .into_iter()
+            .flatten()
+            .flatten()
+            .map(|e| e.path())
+            .filter(|p| p.is_dir() || (p.is_file() && is_jar(p)))
+            .collect();
+        plugins.sort();
+        for plugin in plugins {
+            let Ok(mut jars) = plugin_jars(&plugin) else { continue };
+            let Ok(found) = descriptor(&mut jars) else { continue };
+            for (id, path) in &found.themes {
+                let Ok(Some(bytes)) = find(&mut jars, entry_name(path), MAX_FILE) else { continue };
+                let Ok((_, fields)) = theme_json(&bytes) else { continue };
+                let file = || plugin.file_name().map(|n| n.to_string_lossy().into_owned()).unwrap_or_default();
+                out.push(InstalledIntellijTheme {
+                    ide: ide.label.clone(),
+                    plugin: found.name.clone().unwrap_or_else(file),
+                    path: plugin.clone().into(),
+                    theme_id: id.clone(),
+                    theme_name: string_field(&fields, "name").unwrap_or(id).to_owned(),
+                    dark: fields.get("dark").and_then(serde_json::Value::as_bool).unwrap_or(true),
+                    active: active.contains(id),
+                });
+            }
+        }
+    }
+    // Stable: the IDEs' order (newest first) within each group.
+    out.sort_by_key(|t| !t.active);
+    out
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+    use std::io::Write;
+
+    const PLUGIN: &str = r#"<idea-plugin>
+  <id>com.example.deepsea</id>
+  <name>Deep Sea &amp; Friends</name>
+  <version>2.3</version>
+  <vendor email="[email protected]">Someone</vendor>
+  <description><![CDATA[<b>Dark</b> themes]]></description>
+  <depends>com.intellij.modules.platform</depends>
+  <extensions defaultExtensionNs="com.intellij">
+    <themeProvider id="deep-sea-id" path="/themes/DeepSea.theme.json"/>
+    <themeProvider id="shallow-id" path="themes/Shallow.theme.json" />
+  </extensions>
+</idea-plugin>"#;
+
+    const DEEP: &str = r##"{
+  // comment
+  "name": "Deep Sea",
+  "dark": true,
+  "editorScheme": "/themes/DeepSea.xml",
+  "ui": { "*": { "background": "#101820" } }
+}"##;
+    const SHALLOW: &str = r#"{ "name": "Shallow", "dark": false, "ui": {} }"#;
+    const SCHEME: &str = r#"<scheme name="Deep Sea" version="142" parent_scheme="Darcula"/>"#;
+
+    fn jar_bytes(entries: &[(&str, &[u8])]) -> Vec<u8> {
+        let mut zip = zip::ZipWriter::new(Cursor::new(Vec::new()));
+        for (name, data) in entries {
+            zip.start_file(*name, zip::write::SimpleFileOptions::default()).unwrap();
+            zip.write_all(data).unwrap();
+        }
+        zip.finish().unwrap().into_inner()
+    }
+
+    fn theme_jar() -> Vec<u8> {
+        jar_bytes(&[
+            ("META-INF/MANIFEST.MF", b"Manifest-Version: 1.0\n"),
+            (PLUGIN_XML, PLUGIN.as_bytes()),
+            ("themes/DeepSea.theme.json", DEEP.as_bytes()),
+            ("themes/DeepSea.xml", SCHEME.as_bytes()),
+            ("themes/Shallow.theme.json", SHALLOW.as_bytes()),
+        ])
+    }
+
+    fn write(path: &Path, bytes: &[u8]) {
+        std::fs::create_dir_all(path.parent().unwrap()).unwrap();
+        std::fs::write(path, bytes).unwrap();
+    }
+
+    fn expected_source() -> IntellijThemeSource {
+        IntellijThemeSource {
+            name: "Deep Sea & Friends".into(),
+            plugin_id: Some("com.example.deepsea".into()),
+            version: Some("2.3".into()),
+            vendor: Some("Someone".into()),
+            themes: vec![
+                IntellijThemeFile {
+                    id: "deep-sea-id".into(),
+                    theme: super::super::theme::strip_json_comments(DEEP),
+                    editor_scheme: Some(SCHEME.into()),
+                },
+                IntellijThemeFile { id: "shallow-id".into(), theme: SHALLOW.into(), editor_scheme: None },
+            ],
+        }
+    }
+
+    #[test]
+    fn reads_a_theme_jar_with_its_editor_scheme() {
+        let tmp = tempfile::tempdir().unwrap();
+        let jar = tmp.path().join("deep-sea.jar");
+        write(&jar, &theme_jar());
+        let source = read_source(&jar).unwrap();
+        assert_eq!(source, expected_source());
+        assert!(!source.themes[0].theme.contains("comment"));
+    }
+
+    #[test]
+    fn reads_a_marketplace_zip_and_an_installed_folder() {
+        let tmp = tempfile::tempdir().unwrap();
+        let other = jar_bytes(&[("META-INF/MANIFEST.MF", b"x"), ("a/B.class", b"\xCA\xFE")]);
+        let zip = tmp.path().join("DeepSea-2.3.zip");
+        write(&zip, &jar_bytes(&[("DeepSea/lib/a-util.jar", &other), ("DeepSea/lib/deep-sea.jar", &theme_jar())]));
+        assert_eq!(read_source(&zip).unwrap(), expected_source());
+
+        let dir = tmp.path().join("plugins").join("DeepSea");
+        write(&dir.join("lib").join("deep-sea.jar"), &theme_jar());
+        write(&dir.join("lib").join("a-util.jar"), &other);
+        assert_eq!(read_source(&dir).unwrap(), expected_source());
+    }
+
+    #[test]
+    fn skips_library_jars_it_cannot_or_need_not_read() {
+        let tmp = tempfile::tempdir().unwrap();
+        // Stored, not deflated: as large in the zip as its content.
+        let mut big = zip::ZipWriter::new(Cursor::new(Vec::new()));
+        let stored = zip::write::SimpleFileOptions::default().compression_method(zip::CompressionMethod::Stored);
+        big.start_file("lib/Data.class", stored).unwrap();
+        big.write_all(&[b'x'; 8192]).unwrap();
+        let big = big.finish().unwrap().into_inner();
+        let zip = tmp.path().join("DeepSea.zip");
+        write(
+            &zip,
+            &jar_bytes(&[
+                ("DeepSea/lib/a-broken.jar", b"not a jar"),
+                ("DeepSea/lib/b-big.jar", &big),
+                ("DeepSea/lib/deep-sea.jar", &theme_jar()),
+            ]),
+        );
+        assert_eq!(read_source(&zip).unwrap(), expected_source());
+
+        // The broken jar is skipped; a jar over the size limit, or past the total
+        // (smallest first), is not read, while the theme's small jar still is.
+        let mut archive = open_jar(&zip).unwrap();
+        let theme_len = theme_jar().len() as u64;
+        assert_eq!(nested_jars(&mut archive, u64::MAX, u64::MAX).len(), 2);
+        let one = nested_jars(&mut archive, theme_len + 64, u64::MAX);
+        assert_eq!(one.len(), 1);
+        assert!(one[0].index_for_name(PLUGIN_XML).is_some());
+        assert_eq!(nested_jars(&mut archive, u64::MAX, theme_len + 64).len(), 1);
+        assert!(nested_jars(&mut archive, 8, u64::MAX).is_empty());
+    }
+
+    #[test]
+    fn reads_a_loose_theme_json_with_the_scheme_beside_it() {
+        let tmp = tempfile::tempdir().unwrap();
+        let theme = tmp.path().join("DeepSea.theme.json");
+        write(&theme, DEEP.as_bytes());
+        write(&tmp.path().join("DeepSea.xml"), SCHEME.as_bytes());
+        let source = read_source(&theme).unwrap();
+        assert_eq!(source.name, "Deep Sea");
+        assert_eq!(source.themes.len(), 1);
+        assert_eq!(source.themes[0].id, "DeepSea");
+        assert_eq!(source.themes[0].editor_scheme.as_deref(), Some(SCHEME));
+
+        std::fs::remove_file(tmp.path().join("DeepSea.xml")).unwrap();
+        assert_eq!(read_source(&theme).unwrap().themes[0].editor_scheme, None);
+    }
+
+    #[test]
+    fn says_what_is_wrong_with_other_files() {
+        let tmp = tempfile::tempdir().unwrap();
+        let not_zip = tmp.path().join("notes.jar");
+        write(&not_zip, b"hello");
+        assert!(read_source(&not_zip).unwrap_err().message.contains("not a jar or zip"));
+
+        let other_plugin = tmp.path().join("tools.jar");
+        let xml = "<idea-plugin><name>Tools</name><actions/></idea-plugin>";
+        write(&other_plugin, &jar_bytes(&[(PLUGIN_XML, xml.as_bytes())]));
+        assert!(read_source(&other_plugin).unwrap_err().message.contains("not a theme plugin"));
+
+        let package = tmp.path().join("package.zip");
+        write(&package, &jar_bytes(&[("plugin.toml", b"id = \"x\"")]));
+        assert!(read_source(&package).unwrap_err().message.contains("not an IntelliJ plugin"));
+
+        let other = tmp.path().join("package.json");
+        write(&other, br#"{ "name": "app", "version": "1.0.0" }"#);
+        assert!(read_source(&other).unwrap_err().message.contains("is not an IntelliJ theme"));
+
+        let broken = tmp.path().join("broken.theme.json");
+        write(&broken, b"{ \"name\": ");
+        assert!(read_source(&broken).unwrap_err().message.contains("invalid theme JSON"));
+
+        let missing = tmp.path().join("missing.jar");
+        let xml = r#"<idea-plugin><name>M</name><themeProvider id="m" path="/m.theme.json"/></idea-plugin>"#;
+        write(&missing, &jar_bytes(&[(PLUGIN_XML, xml.as_bytes())]));
+        assert!(read_source(&missing).unwrap_err().message.contains("/m.theme.json is missing"));
+    }
+
+    #[test]
+    fn finds_theme_providers_in_included_descriptors() {
+        let tmp = tempfile::tempdir().unwrap();
+        let jar = tmp.path().join("split.jar");
+        let main = r#"<idea-plugin xmlns:xi="http://www.w3.org/2001/XInclude"><name>Split</name>
+            <xi:include href="/META-INF/themes.xml"/></idea-plugin>"#;
+        let part = r#"<idea-plugin xmlns:xi="http://www.w3.org/2001/XInclude"><extensions defaultExtensionNs="com.intellij">
+            <themeProvider id="s" path="/s.theme.json"/></extensions><name>Not this</name>
+            <xi:include href="more.xml"/><xi:include href="/META-INF/themes.xml"/></idea-plugin>"#;
+        let more = r#"<idea-plugin><themeProvider id="m" path="/m.theme.json"/></idea-plugin>"#;
+        let unrelated = r#"<idea-plugin><themeProvider id="x" path="/x.theme.json"/></idea-plugin>"#;
+        write(
+            &jar,
+            &jar_bytes(&[
+                ("META-INF/themes.xml", part.as_bytes()),
+                ("META-INF/more.xml", more.as_bytes()),
+                ("META-INF/unrelated.xml", unrelated.as_bytes()),
+                (PLUGIN_XML, main.as_bytes()),
+                ("s.theme.json", br#"{"name":"S"}"#),
+                ("m.theme.json", br#"{"name":"M"}"#),
+                ("x.theme.json", br#"{"name":"X"}"#),
+            ]),
+        );
+        let source = read_source(&jar).unwrap();
+        assert_eq!(source.name, "Split");
+        // Only what plugin.xml includes (relative or from the root, once each) counts.
+        assert_eq!(source.themes.iter().map(|t| t.id.as_str()).collect::<Vec<_>>(), ["s", "m"]);
+    }
+
+    #[test]
+    fn parses_ide_folder_names() {
+        assert_eq!(product_dir("IntelliJIdea2025.2"), Some(("IntelliJIdea", (2025, 2), "2025.2")));
+        assert_eq!(product_dir("PyCharmCE2023.10"), Some(("PyCharmCE", (2023, 10), "2023.10")));
+        assert_eq!(product_dir("AndroidStudio2024.3"), Some(("AndroidStudio", (2024, 3), "2024.3")));
+        for name in
+            ["Toolbox", "consentOptions", "IntelliJIdea2025", "Idea-2025.1", "2025.1", "Rider25.1", "Go Land2025.1"]
+        {
+            assert_eq!(product_dir(name), None, "{name}");
+        }
+    }
+
+    #[test]
+    fn locates_the_settings_and_plugins_of_each_os() {
+        let tmp = tempfile::tempdir().unwrap();
+        let home = tmp.path();
+        let mk = |p: PathBuf| {
+            std::fs::create_dir_all(&p).unwrap();
+            p
+        };
+        let mac = mk(home.join("Library/Application Support/JetBrains/IntelliJIdea2025.2"));
+        mk(home.join("Library/Application Support/JetBrains/Toolbox"));
+        // An upgrade leaves the older version's folder behind: only the newest of a product counts.
+        mk(home.join("Library/Application Support/JetBrains/IntelliJIdea2024.3"));
+        mk(home.join("Library/Application Support/JetBrains/IntelliJIdea2025.10"));
+        let dirs = ide_dirs(Layout::Mac, home, |_| None);
+        assert_eq!(dirs.len(), 1);
+        assert_eq!(dirs[0].label, "IntelliJ IDEA 2025.10");
+        std::fs::remove_dir(home.join("Library/Application Support/JetBrains/IntelliJIdea2025.10")).unwrap();
+        let dirs = ide_dirs(Layout::Mac, home, |_| None);
+        assert_eq!(dirs.len(), 1);
+        assert_eq!(dirs[0].label, "IntelliJ IDEA 2025.2");
+        assert_eq!((dirs[0].config.clone(), dirs[0].plugins.clone()), (mac.clone(), mac.join("plugins")));
+
+        let appdata = mk(home.join("Roaming"));
+        let win = mk(appdata.join("JetBrains/PyCharm2024.3"));
+        let studio = mk(appdata.join("Google/AndroidStudio2025.1"));
+        let env = |k: &str| (k == "APPDATA").then(|| appdata.clone().into_os_string());
+        let dirs = ide_dirs(Layout::Windows, home, env);
+        assert_eq!(
+            dirs.iter().map(|d| d.label.as_str()).collect::<Vec<_>>(),
+            ["Android Studio 2025.1", "PyCharm 2024.3"]
+        );
+        assert_eq!(dirs[1].plugins, win.join("plugins"));
+        assert_eq!(dirs[0].config, studio);
+
+        let config = mk(home.join(".config/JetBrains/IdeaIC2024.1"));
+        mk(home.join(".config/JetBrains/GoLand2025.2"));
+        let dirs = ide_dirs(Layout::Xdg, home, |_| None);
+        assert_eq!(dirs.iter().map(|d| d.product.as_str()).collect::<Vec<_>>(), ["GoLand", "IdeaIC"]);
+        assert_eq!(dirs[1].label, "IntelliJ IDEA Community Edition 2024.1");
+        assert_eq!(dirs[1].config, config);
+        assert_eq!(dirs[1].plugins, home.join(".local/share/JetBrains/IdeaIC2024.1"));
+
+        let xdg_data = home.join("data");
+        let env = |k: &str| (k == "XDG_DATA_HOME").then(|| xdg_data.clone().into_os_string());
+        assert_eq!(ide_dirs(Layout::Xdg, home, env)[1].plugins, xdg_data.join("JetBrains/IdeaIC2024.1"));
+    }
+
+    #[test]
+    fn reads_the_selected_theme_from_laf_xml() {
+        let tmp = tempfile::tempdir().unwrap();
+        let laf = tmp.path().join("options/laf.xml");
+        write(
+            &laf,
+            br#"<application>
+  <component name="LafManager">
+    <laf class-name="com.intellij.ide.ui.laf.UIThemeBasedLookAndFeelInfo" themeId="deep-sea-id" />
+    <preferred-light-laf themeId="shallow-id" />
+  </component>
+</application>"#,
+        );
+        assert_eq!(active_theme_ids(tmp.path()), ["deep-sea-id"]);
+        let synced = std::fs::read_to_string(&laf)
+            .unwrap()
+            .replace(r#"name="LafManager""#, r#"name="LafManager" autodetect="true""#);
+        write(&laf, synced.as_bytes());
+        assert_eq!(active_theme_ids(tmp.path()), ["deep-sea-id", "shallow-id"]);
+        assert!(active_theme_ids(&tmp.path().join("missing")).is_empty());
+    }
+
+    #[test]
+    fn lists_installed_theme_plugins_the_ides_current_first() {
+        let tmp = tempfile::tempdir().unwrap();
+        let config = tmp.path().join("IntelliJIdea2025.2");
+        let plugins = config.join("plugins");
+        write(&plugins.join("DeepSea/lib/deep-sea.jar"), &theme_jar());
+        write(
+            &plugins.join("Tools/lib/tools.jar"),
+            &jar_bytes(&[(PLUGIN_XML, b"<idea-plugin><name>T</name></idea-plugin>")]),
+        );
+        write(&plugins.join("broken.jar"), b"not a jar");
+        write(
+            &config.join("options/laf.xml"),
+            br#"<application><component name="LafManager"><laf themeId="shallow-id"/></component></application>"#,
+        );
+        let ide = IdeDir {
+            label: "IntelliJ IDEA 2025.2".into(),
+            product: "IntelliJIdea".into(),
+            version: (2025, 2),
+            config: config.clone(),
+            plugins: plugins.clone(),
+        };
+        let found = find_installed(&[ide]);
+        let theme = |id: &str, name: &str, dark: bool, active: bool| InstalledIntellijTheme {
+            ide: "IntelliJ IDEA 2025.2".into(),
+            plugin: "Deep Sea & Friends".into(),
+            path: plugins.join("DeepSea").into(),
+            theme_id: id.into(),
+            theme_name: name.into(),
+            dark,
+            active,
+        };
+        assert_eq!(found, [theme("shallow-id", "Shallow", false, true), theme("deep-sea-id", "Deep Sea", true, false)]);
+        assert!(find_installed(&[]).is_empty());
+    }
+}
@@ -3,11 +3,14 @@
 //! plugins, and revocations. The host keeps the last index it read
 //! (`market-index.json`), checks signatures against it, and disables what it
 //! revokes — at start-up and on every refresh (the desktop refreshes daily).
+//! Release builds pin the official publisher to the keys they were built
+//! with, so no index can sign `openidea.*` plugins with another key.

-use super::{PluginHost, PluginSource, PluginStatus};
+use super::{PackageFile, PluginEvent, PluginHost, PluginSource, PluginStatus, PluginUpdate, install};
 use ide_core::{IdeError, IdeResult};
-use ide_extension::Manifest;
 use ide_extension::package::{self, Index, IndexEntry, PackageSignature, SIGNATURE_FILE};
+use ide_extension::{MANIFEST_FILE, Manifest};
+use semver::Version;
 use serde::{Deserialize, Serialize};
 use std::path::{Path, PathBuf};

@@ -15,11 +18,18 @@ use std::path::{Path, PathBuf};
 /// the app, next to the signed packages of the official plugins.
 pub const OFFICIAL_INDEX: &str = "https://github.com/l0ng-ai/openidea/releases/latest/download/plugins-index.json";

+/// The publisher of the official plugins.
+pub const OFFICIAL_PUBLISHER: &str = "openidea";
+
 /// The last index read, in the plugins directory.
 pub const INDEX_FILE: &str = "market-index.json";
 const DOWNLOADS: &str = ".downloads";
 const MAX_INDEX: usize = 16 << 20;
 const MAX_PACKAGE: usize = 256 << 20;
+const MAX_STAGED_FILES: usize = 256;
+const MAX_STAGED_BYTES: usize = 16 << 20;
+/// `moved` links followed before giving up (a loop, or a misconfiguration).
+const MAX_MOVES: usize = 3;

 /// A marketplace entry with what is installed.
 #[derive(Clone, Debug, Serialize, Deserialize, specta::Type)]
@@ -29,6 +39,32 @@ pub struct MarketPlugin {
    pub entry: IndexEntry,
    /// Installed version, if any.
    pub installed: Option<String>,
+    /// Whether this IDE can load `entry` (the newest version it can, else the newest).
+    pub compatible: bool,
+}
+
+impl MarketPlugin {
+    /// A version this IDE can load, newer than the one installed.
+    pub fn is_update(&self) -> bool {
+        let newer = |installed: &String| match (Version::parse(&self.entry.version), Version::parse(installed)) {
+            (Ok(offered), Ok(installed)) => offered > installed,
+            _ => false,
+        };
+        self.compatible && self.installed.as_ref().is_some_and(newer)
+    }
+}
+
+/// The official publisher's keys this IDE was built with
+/// (`OPENIDEA_OFFICIAL_PLUGIN_KEYS`: base64, comma-separated). Development
+/// builds have none: the index decides.
+pub(super) fn built_in_official_keys() -> Vec<String> {
+    let keys = option_env!("OPENIDEA_OFFICIAL_PLUGIN_KEYS").unwrap_or_default();
+    keys.split(',').map(str::trim).filter(|k| !k.is_empty()).map(str::to_owned).collect()
+}
+
+fn pinned(mut index: Index, official_keys: &[String]) -> Index {
+    index.pin_publisher(OFFICIAL_PUBLISHER, "OpenIDEA", official_keys);
+    index
 }

 /// Reads `url`: `http(s)://…`, `file://…` or a local path.
@@ -56,6 +92,33 @@ pub fn read_url(url: &str, max: usize) -> Result<Vec<u8>, String> {
    Ok(bytes)
 }

+/// The index at `url`, following `moved`, with downloads made absolute against
+/// where it was read from.
+fn read_index(url: &str) -> IdeResult<Index> {
+    let mut url = url.to_owned();
+    for _ in 0..=MAX_MOVES {
+        let bytes = read_url(&url, MAX_INDEX).map_err(IdeError::unavailable)?;
+        let text = String::from_utf8(bytes).map_err(|_| IdeError::invalid("the index is not UTF-8"))?;
+        let mut index = Index::parse(&text).map_err(IdeError::invalid)?;
+        match index.moved.take().filter(|m| !m.trim().is_empty()) {
+            Some(next) => {
+                let next = resolve(&url, &next);
+                if url.starts_with("https://") && !next.starts_with("https://") {
+                    return Err(IdeError::invalid(format!("the marketplace moved to {next}, which isn't https")));
+                }
+                url = next;
+            }
+            None => {
+                for e in &mut index.plugins {
+                    e.download = resolve(&url, &e.download);
+                }
+                return Ok(index);
+            }
+        }
+    }
+    Err(IdeError::unavailable(format!("the marketplace index moved more than {MAX_MOVES} times")))
+}
+
 /// `href` relative to the index at `base`: a URL, or a local path (with the
 /// platform's separators, e.g. `C:\\market\\index.json`).
 pub fn resolve(base: &str, href: &str) -> String {
@@ -75,9 +138,16 @@ pub fn resolve(base: &str, href: &str) -> String {
 }

 impl PluginHost {
-    pub(super) fn load_market_index(dir: &Path) -> Option<Index> {
+    pub(super) fn load_market_index(dir: &Path, official_keys: &[String]) -> Option<Index> {
        let text = std::fs::read_to_string(dir.join(INDEX_FILE)).ok()?;
-        Index::parse(&text).map_err(|e| tracing::warn!("{INDEX_FILE}: {e}")).ok()
+        let index = Index::parse(&text).map_err(|e| tracing::warn!("{INDEX_FILE}: {e}")).ok()?;
+        Some(pinned(index, official_keys))
+    }
+
+    /// Pins the official publisher to `keys` (base64) instead of the built-in
+    /// ones, from the next index read.
+    pub fn set_official_keys(&self, keys: Vec<String>) {
+        *self.official_keys.write() = keys;
    }

    /// The marketplace index URL: the user's, else the default (none: no marketplace).
@@ -95,14 +165,26 @@ impl PluginHost {
        self.save_state();
    }

-    /// Reads the index again, keeps it, and applies its revocations.
+    /// The marketplace's plugins: read again when `refresh`, else the last index
+    /// read. Reads it when none has been read yet (first run, nothing cached).
+    pub fn market_listing(&self, refresh: bool) -> IdeResult<Vec<MarketPlugin>> {
+        if refresh || (self.market.read().is_none() && self.market_url().is_some()) {
+            self.refresh_market()
+        } else {
+            Ok(self.market_plugins())
+        }
+    }
+
+    /// Reads the index again, keeps it, and applies its revocations. Announces
+    /// updates of installed plugins it hasn't announced yet.
    pub fn refresh_market(&self) -> IdeResult<Vec<MarketPlugin>> {
        let url = self.market_url().ok_or_else(|| IdeError::unavailable("no plugin marketplace is configured"))?;
-        let bytes = read_url(&url, MAX_INDEX).map_err(IdeError::unavailable)?;
-        let text = String::from_utf8(bytes).map_err(|_| IdeError::invalid("the index is not UTF-8"))?;
-        let index = Index::parse(&text).map_err(IdeError::invalid)?;
-        let _ = std::fs::write(self.plugins_dir.join(INDEX_FILE), &text);
-        *self.market.write() = Some(index);
+        let index = read_index(&url)?;
+        if let Ok(json) = serde_json::to_string(&index) {
+            let _ = std::fs::write(self.plugins_dir.join(INDEX_FILE), json);
+        }
+        let newer = index.is_newer().then_some(index.format);
+        *self.market.write() = Some(pinned(index, &self.official_keys.read()));
        // Trust may have changed: who signed what, what is revoked.
        let installed: Vec<_> =
            self.plugins.read().values().filter(|p| p.source == PluginSource::Installed).cloned().collect();
@@ -111,7 +193,41 @@ impl PluginHost {
            plugin.meta.lock().publisher = publisher;
        }
        self.apply_revocations();
-        Ok(self.market_plugins())
+        if let Some(format) = newer {
+            return Err(IdeError::unavailable(format!(
+                "the marketplace needs a newer OpenIDEA (index format {format}); its revocations still apply"
+            )));
+        }
+        let plugins = self.market_plugins();
+        self.announce_updates(&plugins);
+        Ok(plugins)
+    }
+
+    /// Tells the windows about updates once per set of versions: a later
+    /// refresh offering the same ones says nothing.
+    fn announce_updates(&self, plugins: &[MarketPlugin]) {
+        let updates: Vec<PluginUpdate> = plugins
+            .iter()
+            .filter(|p| p.is_update())
+            .map(|p| PluginUpdate {
+                id: p.entry.id.clone(),
+                name: p.entry.name.clone(),
+                version: p.entry.version.clone(),
+            })
+            .collect();
+        let key: Vec<String> = updates.iter().map(|u| format!("{}@{}", u.id, u.version)).collect();
+        if std::mem::replace(&mut *self.announced_updates.lock(), key.clone()) != key && !updates.is_empty() {
+            self.emit(None, PluginEvent::UpdatesAvailable { updates });
+        }
+    }
+
+    /// Whether the package in `src` would replace the installed `id`'s copy
+    /// with one signed by another key than that copy, without that key's
+    /// endorsement: the user confirms the change of signer.
+    pub(super) fn signer_changed(&self, id: &str, src: &Path) -> bool {
+        let Some(current) = install::active_dir(&self.plugins_dir.join(id)) else { return false };
+        let market = self.market.read();
+        !package::signer_continues(market.as_ref(), read_signature(&current).as_ref(), read_signature(src).as_ref())
    }

    /// The plugins of the last index read.
@@ -119,16 +235,14 @@ impl PluginHost {
        let Some(index) = self.market.read().clone() else { return Vec::new() };
        let plugins = self.plugins.read();
        index
-            .plugins
-            .iter()
-            .filter(|e| index.revocation(&e.id, &e.version).is_none())
-            .cloned()
-            .map(|entry| {
+            .offered()
+            .into_iter()
+            .map(|(entry, compatible)| {
                let installed = plugins
                    .get(&entry.id)
                    .filter(|p| p.source == PluginSource::Installed)
                    .map(|p| p.manifest().version.clone());
-                MarketPlugin { entry, installed }
+                MarketPlugin { entry: entry.clone(), installed, compatible }
            })
            .collect()
    }
@@ -139,12 +253,18 @@ impl PluginHost {
    pub fn download_market_plugin(&self, id: &str) -> IdeResult<PathBuf> {
        let url = self.market_url().ok_or_else(|| IdeError::unavailable("no plugin marketplace is configured"))?;
        let index = self.market.read().clone().ok_or_else(|| IdeError::unavailable("refresh the marketplace first"))?;
-        let entry = index
-            .plugins
-            .iter()
-            .find(|e| e.id == id)
-            .cloned()
+        let (entry, compatible) = index
+            .offered()
+            .into_iter()
+            .find(|(e, _)| e.id == id)
+            .map(|(e, ok)| (e.clone(), ok))
            .ok_or_else(|| IdeError::not_found(format!("{id} is not in the marketplace")))?;
+        if !compatible {
+            return Err(IdeError::unavailable(format!(
+                "{} {} needs plugin API {}: update OpenIDEA",
+                entry.name, entry.version, entry.engine
+            )));
+        }
        let bytes = read_url(&resolve(&url, &entry.download), MAX_PACKAGE).map_err(IdeError::unavailable)?;
        let downloads = self.plugins_dir.join(DOWNLOADS);
        std::fs::create_dir_all(&downloads)?;
@@ -182,6 +302,45 @@ impl PluginHost {
        Ok(dir)
    }

+    /// Writes a package the UI generated (an imported IntelliJ theme) into a
+    /// folder next to the downloads, named after `name` (its plugin id); returns the folder.
+    /// The install page validates it like any other package.
+    pub fn stage_package(&self, name: &str, files: &[PackageFile]) -> IdeResult<PathBuf> {
+        ide_extension::validate_item_id(name, "package name").map_err(IdeError::invalid)?;
+        if !files.iter().any(|f| f.path == MANIFEST_FILE) {
+            return Err(IdeError::invalid(format!("a package needs a {MANIFEST_FILE}")));
+        }
+        let total: usize = files.iter().map(|f| f.text.len()).sum();
+        if files.len() > MAX_STAGED_FILES || total > MAX_STAGED_BYTES {
+            return Err(IdeError::invalid("the package is too large"));
+        }
+        let mut seen = std::collections::HashSet::new();
+        for f in files {
+            let valid = !f.path.is_empty()
+                && f.path.len() <= 255
+                && f.path.split('/').all(|part| {
+                    !matches!(part, "" | "." | "..") && !part.contains(['\\', ':', '\0']) && !part.starts_with('.')
+                });
+            if !valid {
+                return Err(IdeError::invalid(format!("invalid package path {:?}", f.path)));
+            }
+            if !seen.insert(f.path.to_ascii_lowercase()) {
+                return Err(IdeError::invalid(format!("{} is in the package twice", f.path)));
+            }
+        }
+        // One folder per package, replaced by the next import of it: they don't pile up.
+        let dir = self.plugins_dir.join(DOWNLOADS).join(format!("{name}-generated"));
+        let _ = std::fs::remove_dir_all(&dir);
+        for f in files {
+            let path = dir.join(&f.path);
+            if let Some(parent) = path.parent() {
+                std::fs::create_dir_all(parent)?;
+            }
+            std::fs::write(&path, &f.text)?;
+        }
+        Ok(dir)
+    }
+
    /// Files of the package in `dir` (what its declarations reference, and
    /// the component): what a package file holds besides the manifest.
    pub fn package_files_of(&self, dir: &Path) -> IdeResult<Vec<PathBuf>> {
@@ -16,8 +16,12 @@
 //! projects) and folders linked with `openidea-plugin link` (`links.json`).

 mod api;
+mod icon_extensions;
+mod icon_patterns;
+mod icon_settings;
 mod icons;
 mod install;
+pub mod intellij;
 mod market;
 mod points;
 mod providers;
@@ -32,7 +36,10 @@ pub mod web;

 pub use api::{FileSecretStore, HostWorkspace, PluginWorkspace, SecretStore};
 pub use icons::{map_asset as icon_theme_map_asset, sanitize_svg, svg_prefix as icon_theme_svg_prefix};
-pub use market::{INDEX_FILE as MARKET_INDEX_FILE, MarketPlugin, OFFICIAL_INDEX as OFFICIAL_MARKET_INDEX};
+pub use market::{
+    INDEX_FILE as MARKET_INDEX_FILE, MarketPlugin, OFFICIAL_INDEX as OFFICIAL_MARKET_INDEX, OFFICIAL_PUBLISHER,
+    read_url as read_market_url, resolve as resolve_market_href,
+};
 pub use points::{COMMANDS, CommandDecl, register_builtin_points};
 pub(crate) use providers::editor_providers as editor_providers_for;
 pub use providers::{ProviderKind, set_editor_providers};
@@ -238,12 +245,16 @@ pub struct Consent {
    /// Optional capabilities the user accepted (`net:crates.io`, …). Required
    /// ones are implied by consenting at all.
    pub optional: Vec<String>,
+    /// The user accepted a package signed by another key than the installed
+    /// copy ([`InstallPreview::signer_changed`]).
+    #[serde(default)]
+    pub signer_change: bool,
 }

 impl Consent {
    /// Accept everything the plugin asks for (tests, trusted official plugins).
    pub fn all() -> Self {
-        Self { optional: vec!["*".into()] }
+        Self { optional: vec!["*".into()], signer_change: true }
    }

    fn accepts(&self, cap: &Capability) -> bool {
@@ -270,6 +281,14 @@ pub struct InstallPreview {
    pub unsigned: bool,
    /// The verified publisher.
    pub publisher: Option<String>,
+    /// Replaces an installed copy signed with another key, which didn't
+    /// endorse this package's (or this one is unsigned): the user confirms it
+    /// ([`Consent::signer_change`]).
+    pub signer_changed: bool,
+    /// Something to confirm: a first install, an unsigned package, another
+    /// signer, or capabilities the installed version wasn't granted or
+    /// refused. Without, an update installs with the grants it has.
+    pub needs_consent: bool,
 }

 type ProjectPolicy = Arc<dyn Fn(&Path) -> bool + Send + Sync>;
@@ -316,6 +335,10 @@ pub struct PluginHost {
    pins: Arc<RwLock<HashMap<(String, String), ProgramPin>>>,
    /// The last marketplace index read: trust root for signatures, revocations.
    market: RwLock<Option<ide_extension::package::Index>>,
+    /// The official publisher's keys the index is pinned to (none: as listed).
+    official_keys: RwLock<Vec<String>>,
+    /// `id@version` of the updates last announced.
+    announced_updates: Mutex<Vec<String>>,
    /// The marketplace used while the user has set none (the app's official one).
    default_market_url: RwLock<Option<String>>,
    /// Updates not confirmed yet (the new version hasn't started once): what
@@ -354,9 +377,12 @@ impl PluginHost {
            policy_pins.read().get(&(plugin.to_owned(), cap.to_string())).cloned()
        }));
        let shared = api::Shared::new(sink.clone(), plugins_dir.join(".data"), pins.clone(), ui.clone());
-        let market = RwLock::new(Self::load_market_index(&plugins_dir));
+        let official_keys = market::built_in_official_keys();
+        let market = RwLock::new(Self::load_market_index(&plugins_dir, &official_keys));
        let host = Self {
            market,
+            official_keys: RwLock::new(official_keys),
+            announced_updates: Mutex::default(),
            default_market_url: RwLock::new(None),
            updates: Mutex::default(),
            project_policy: RwLock::new(Arc::new(|_| false)),
@@ -699,14 +725,27 @@ impl PluginHost {
        }
        let publisher = self.verified_publisher(src);
        let m = &pkg.manifest;
+        let replaces = self.plugins.read().get(&m.id).map(|p| p.manifest().version.clone());
+        // An update shows what the installed version was granted.
+        let grant = replaces
+            .as_ref()
+            .and_then(|_| self.ledger.lock().get(&Subject::Installed(m.id.clone())).cloned())
+            .filter(|g| g.confirmed);
+        let granted = |c: &Capability| grant.as_ref().is_some_and(|g| g.has(c));
        let mut capabilities: Vec<CapabilityInfo> =
-            m.capabilities.all().map(|c| CapabilityInfo::new(c, m.capabilities.is_optional(c), false)).collect();
+            m.capabilities.all().map(|c| CapabilityInfo::new(c, m.capabilities.is_optional(c), granted(c))).collect();
        for extra in &set.capabilities {
            if !m.declares(extra) {
-                capabilities.push(CapabilityInfo::new(extra, true, false));
+                capabilities.push(CapabilityInfo::new(extra, true, granted(extra)));
            }
        }
        capabilities.sort_by(|a, b| b.risk.cmp(&a.risk).then(a.id.cmp(&b.id)));
+        let signer_changed = self.signer_changed(&m.id, src);
+        let answered = |c: &CapabilityInfo| {
+            c.granted || (c.optional && grant.as_ref().is_some_and(|g| g.declined.contains(&c.id)))
+        };
+        let needs_consent =
+            grant.is_none() || publisher.is_none() || signer_changed || !capabilities.iter().all(answered);
        Ok(InstallPreview {
            id: m.id.clone(),
            name: m.name.clone(),
@@ -717,9 +756,11 @@ impl PluginHost {
            capabilities,
            contributions: counts(m),
            warnings: set.warnings.clone(),
-            replaces: self.plugins.read().get(&m.id).map(|p| p.manifest().version.clone()),
+            replaces,
            unsigned: publisher.is_none(),
            publisher,
+            signer_changed,
+            needs_consent,
        })
    }

@@ -742,6 +783,11 @@ impl PluginHost {
        if let Some(problem) = self.signature_problem(src) {
            return Err(IdeError::invalid(format!("refusing {id}: {problem}")));
        }
+        if !consent.signer_change && self.signer_changed(&id, src) {
+            return Err(IdeError::invalid(format!(
+                "refusing {id}: it is signed by another key than the installed version; confirm the change of signer"
+            )));
+        }
        let version = pkg.manifest.version.clone();
        if let Some(r) = self.market.read().as_ref().and_then(|i| i.revocation(&id, &version)) {
            return Err(IdeError::invalid(format!("{id} {version} was revoked: {}", r.reason)));
@@ -2207,6 +2253,7 @@ fn placeholder_manifest(dir: &Path) -> Manifest {
        homepage: None,
        license: None,
        change_notes: None,
+        declared_categories: Vec::new(),
        engine: ide_extension::ENGINE_VERSION.into(),
        legacy: false,
        wasm: None,
@@ -292,6 +292,21 @@ impl PluginHost {
        .collect()
    }

+    /// The edits of an action `plugin_id` returned with `data`, now that the
+    /// user picked it: a call with the command budget, not the edit path's.
+    pub fn resolve_code_action(
+        &self,
+        plugin_id: &str,
+        doc: &ProviderDocument,
+        action: CodeAction,
+    ) -> ide_core::IdeResult<CodeAction> {
+        let d = Arc::new(doc.clone());
+        let timeout = self.limits.timeout;
+        self.code_call(plugin_id, ide_plugin::Invocation::default(), "resolving the code action", move |rt, _| {
+            rt.resolve_code_action(&d, &action, timeout)
+        })
+    }
+
    pub fn provide_definition(&self, doc: &ProviderDocument, at: ide_core::Pos) -> Vec<Location> {
        let d = Arc::new(doc.clone());
        self.edit_calls(ProviderKind::Definition, &doc.language, move |rt, timeout| {
@@ -114,6 +114,9 @@ pub fn forwarded(event: &PluginEvent) -> bool {
            | PluginEvent::ViewChanged { .. }
            | PluginEvent::ViewMessage { .. }
            | PluginEvent::OpenTerminal { .. }
+            | PluginEvent::OpenLocation { .. }
+            | PluginEvent::CopyToClipboard { .. }
+            | PluginEvent::OpenUrl { .. }
    )
 }

@@ -272,7 +275,8 @@ impl RemotePlugins {
                report.failed.push(format!("{}: invalid plugin id", pkg.id));
                continue;
            }
-            let consent = Consent { optional: pkg.granted.clone() };
+            // The desktop asked the user, change of signer included.
+            let consent = Consent { optional: pkg.granted.clone(), signer_change: true };
            if self.current_digest(&pkg.id).as_deref() == Some(pkg.digest.as_str()) {
                if let Err(e) = self.follow_grants(&pkg, &consent) {
                    report.failed.push(format!("{}: {e}", pkg.id));
@@ -134,7 +134,7 @@ impl ExtensionPoint for ThemesPoint {

 /// Blanks out `//` and `/* */` comments outside strings, keeping newlines so
 /// parse errors still point at the right line.
-fn strip_json_comments(src: &str) -> String {
+pub(super) fn strip_json_comments(src: &str) -> String {
    let mut out = String::with_capacity(src.len());
    let mut chars = src.chars().peekable();
    let (mut in_str, mut escaped) = (false, false);
@@ -138,12 +138,24 @@ pub struct PluginsSnapshot {
    pub ui: Vec<UiContribution>,
 }

+/// A newer version of an installed plugin in the marketplace.
+#[derive(Clone, Debug, PartialEq, Eq, Serialize, Deserialize, Type)]
+#[serde(rename_all = "camelCase")]
+pub struct PluginUpdate {
+    pub id: String,
+    pub name: String,
+    pub version: String,
+}
+
 /// Backend → UI notifications (Tauri event `ide://plugin`).
 #[derive(Clone, Debug, PartialEq, Serialize, Deserialize, Type)]
 #[serde(tag = "type", rename_all = "camelCase")]
 pub enum PluginEvent {
    /// Plugins, their status or their contributions changed: re-fetch `plugin_list`.
    CommandsChanged,
+    /// The marketplace offers newer versions of installed plugins (announced
+    /// once per set of versions).
+    UpdatesAvailable { updates: Vec<PluginUpdate> },
    #[serde(rename_all = "camelCase")]
    Notification { plugin_id: String, level: NotificationLevel, title: String, body: String },
    /// A plugin's status bar item was set (`item`) or removed.
@@ -180,9 +192,17 @@ pub enum PluginEvent {
        args: Vec<String>,
        cwd: ide_core::IpcPath,
    },
+    #[serde(rename_all = "camelCase")]
+    OpenLocation { plugin_id: String, path: ide_core::IpcPath, line: u32, column: u32 },
    /// Plugin languages, or the servers they may start, changed: re-fetch
    /// `languages` (the host re-detects open documents: [`crate::Host::plugin_languages_changed`]).
    LanguagesChanged,
+    /// Copy `text` to the system clipboard.
+    #[serde(rename_all = "camelCase")]
+    CopyToClipboard { plugin_id: String, text: String },
+    /// Open `url` (`http(s)://`) in the system browser.
+    #[serde(rename_all = "camelCase")]
+    OpenUrl { plugin_id: String, url: String },
 }

 /// Delivers events to the UI. `client` is the window that invoked the plugin
@@ -212,6 +232,14 @@ impl PluginEditor {
    }
 }

+/// A text file of a package the UI generated, at its `/`-separated path in the package.
+#[derive(Clone, Debug, Serialize, Deserialize, Type)]
+#[serde(rename_all = "camelCase")]
+pub struct PackageFile {
+    pub path: String,
+    pub text: String,
+}
+
 /// A plugin's status bar item.
 #[derive(Clone, Debug, Serialize, Deserialize, Type)]
 #[serde(rename_all = "camelCase")]